From 61f6af415cefdc8c15ca79a6a2758398efb2e640 Mon Sep 17 00:00:00 2001 From: Michal Arbet Date: Tue, 7 Jul 2026 09:34:42 +0200 Subject: [PATCH 1/5] Refactor Neutron config file loading Centralize the list of Neutron configuration files and ensure service-specific configs are loaded only where required. Closes-Bug: #2160066 Change-Id: I2852da13b5085ce1f78fbae90843f07e4292604a Signed-off-by: Michal Arbet --- ansible/roles/neutron/defaults/main.yml | 12 ++++++++++++ ansible/roles/neutron/tasks/config.yml | 11 +++++++++++ .../templates/neutron-ovn-maintenance-worker.json.j2 | 8 +++++++- .../templates/neutron-periodic-worker.json.j2 | 8 +++++++- .../neutron/templates/neutron-rpc-server.json.j2 | 8 +++++++- 5 files changed, 44 insertions(+), 3 deletions(-) diff --git a/ansible/roles/neutron/defaults/main.yml b/ansible/roles/neutron/defaults/main.yml index a9c0b59477..4d32d2dff6 100644 --- a/ansible/roles/neutron/defaults/main.yml +++ b/ansible/roles/neutron/defaults/main.yml @@ -255,6 +255,18 @@ neutron_config_validation: - generator: "/neutron/etc/oslo-config-generator/dhcp_agent.ini" config: "/etc/neutron/dhcp_agent.ini" +neutron_config_files: + - name: "neutron.conf" + enabled: true + - name: "plugins/ml2/ml2_conf.ini" + enabled: true + - name: "neutron_vpnaas.conf" + enabled: "{{ enable_neutron_vpnaas | bool }}" + - name: "fwaas_driver.ini" + enabled: "{{ enable_neutron_fwaas | bool }}" + - name: "neutron_taas.conf" + enabled: "{{ enable_neutron_taas | bool }}" + #################### # Database #################### diff --git a/ansible/roles/neutron/tasks/config.yml b/ansible/roles/neutron/tasks/config.yml index 1e9fe3314a..379750a665 100644 --- a/ansible/roles/neutron/tasks/config.yml +++ b/ansible/roles/neutron/tasks/config.yml @@ -255,6 +255,9 @@ services_need_fwaas_driver_ini: - "neutron-server" - "neutron-l3-agent" + - "neutron-ovn-maintenance-worker" + - "neutron-periodic-worker" + - "neutron-rpc-server" merge_configs: sources: - "{{ role_path }}/templates/fwaas_driver.ini.j2" @@ -424,5 +427,13 @@ service_uwsgi_config_tls_key: "/etc/neutron/certs/neutron-key.pem" service_uwsgi_config_uid: "neutron" service_uwsgi_config_workers: "{{ neutron_api_workers }}" + service_uwsgi_config_env: + OS_NEUTRON_CONFIG_FILES: >- + {{ + neutron_config_files + | selectattr('enabled', 'equalto', true) + | map(attribute='name') + | join(';') + }} when: - service | service_enabled_and_mapped_to_host diff --git a/ansible/roles/neutron/templates/neutron-ovn-maintenance-worker.json.j2 b/ansible/roles/neutron/templates/neutron-ovn-maintenance-worker.json.j2 index 3360babe47..0791c80912 100644 --- a/ansible/roles/neutron/templates/neutron-ovn-maintenance-worker.json.j2 +++ b/ansible/roles/neutron/templates/neutron-ovn-maintenance-worker.json.j2 @@ -1,5 +1,5 @@ { - "command": "neutron-ovn-maintenance-worker", + "command": "neutron-ovn-maintenance-worker --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini{% if enable_neutron_vpnaas | bool %} --config-file /etc/neutron/neutron_vpnaas.conf{% endif %}{% if enable_neutron_fwaas | bool %} --config-file /etc/neutron/fwaas_driver.ini{% endif %}", "config_files": [ { "source": "{{ container_config_directory }}/neutron.conf", @@ -18,6 +18,12 @@ "dest": "/etc/neutron/neutron_vpnaas.conf", "owner": "neutron", "perm": "0600" + }{% endif %}{% if enable_neutron_fwaas | bool %}, + { + "source": "{{ container_config_directory }}/fwaas_driver.ini", + "dest": "/etc/neutron/fwaas_driver.ini", + "owner": "neutron", + "perm": "0600" }{% endif %}{% if kolla_copy_ca_into_containers | bool %}, { "source": "{{ container_config_directory }}/ca-certificates", diff --git a/ansible/roles/neutron/templates/neutron-periodic-worker.json.j2 b/ansible/roles/neutron/templates/neutron-periodic-worker.json.j2 index 612b027fe3..b8f230075d 100644 --- a/ansible/roles/neutron/templates/neutron-periodic-worker.json.j2 +++ b/ansible/roles/neutron/templates/neutron-periodic-worker.json.j2 @@ -1,5 +1,5 @@ { - "command": "neutron-periodic-workers", + "command": "neutron-periodic-workers --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini{% if enable_neutron_vpnaas | bool %} --config-file /etc/neutron/neutron_vpnaas.conf{% endif %}{% if enable_neutron_fwaas | bool %} --config-file /etc/neutron/fwaas_driver.ini{% endif %}", "config_files": [ { "source": "{{ container_config_directory }}/neutron.conf", @@ -18,6 +18,12 @@ "dest": "/etc/neutron/neutron_vpnaas.conf", "owner": "neutron", "perm": "0600" + }{% endif %}{% if enable_neutron_fwaas | bool %}, + { + "source": "{{ container_config_directory }}/fwaas_driver.ini", + "dest": "/etc/neutron/fwaas_driver.ini", + "owner": "neutron", + "perm": "0600" }{% endif %}{% if kolla_copy_ca_into_containers | bool %}, { "source": "{{ container_config_directory }}/ca-certificates", diff --git a/ansible/roles/neutron/templates/neutron-rpc-server.json.j2 b/ansible/roles/neutron/templates/neutron-rpc-server.json.j2 index fa6032add2..171c3c345a 100644 --- a/ansible/roles/neutron/templates/neutron-rpc-server.json.j2 +++ b/ansible/roles/neutron/templates/neutron-rpc-server.json.j2 @@ -1,5 +1,5 @@ { - "command": "neutron-rpc-server", + "command": "neutron-rpc-server --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini{% if enable_neutron_vpnaas | bool %} --config-file /etc/neutron/neutron_vpnaas.conf{% endif %}{% if enable_neutron_fwaas | bool %} --config-file /etc/neutron/fwaas_driver.ini{% endif %}", "config_files": [ { "source": "{{ container_config_directory }}/neutron.conf", @@ -18,6 +18,12 @@ "dest": "/etc/neutron/neutron_vpnaas.conf", "owner": "neutron", "perm": "0600" + }{% endif %}{% if enable_neutron_fwaas | bool %}, + { + "source": "{{ container_config_directory }}/fwaas_driver.ini", + "dest": "/etc/neutron/fwaas_driver.ini", + "owner": "neutron", + "perm": "0600" }{% endif %}{% if kolla_copy_ca_into_containers | bool %}, { "source": "{{ container_config_directory }}/ca-certificates", From f2392c6537b2a726a25441bfafbf26b0b257f23d Mon Sep 17 00:00:00 2001 From: Michal Arbet Date: Thu, 9 Jul 2026 16:16:50 +0200 Subject: [PATCH 2/5] Fix FWaaS while using OVN This patch fixes FWaaS when using OVN by Configure the OVN FWaaS service provider when OVN is used as the ML2 backend. Previously, the default agent-based provider was always configured, preventing the OVN FWaaS driver from being loaded. Closes-Bug: #2160232 Change-Id: Ic199094588c6415a5312fa97d9c44ad26d42cc6f Signed-off-by: Michal Arbet --- ansible/roles/neutron/templates/fwaas_driver.ini.j2 | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ansible/roles/neutron/templates/fwaas_driver.ini.j2 b/ansible/roles/neutron/templates/fwaas_driver.ini.j2 index 652f2fe0bf..1d4fdea9bd 100644 --- a/ansible/roles/neutron/templates/fwaas_driver.ini.j2 +++ b/ansible/roles/neutron/templates/fwaas_driver.ini.j2 @@ -3,4 +3,8 @@ enabled = true driver = iptables_v2 [service_providers] +{% if neutron_plugin_agent == 'openvswitch' %} service_provider = FIREWALL_V2:fwaas_db:neutron_fwaas.services.firewall.service_drivers.agents.agents.FirewallAgentDriver:default +{% elif neutron_plugin_agent == 'ovn' %} +service_provider = FIREWALL_V2:fwaas_db:neutron_fwaas.services.firewall.service_drivers.ovn.firewall_l3_driver.OVNFwaasDriver:default +{% endif %} From 37a995615577b8c5ac7f5a5bfcca3c5050a661eb Mon Sep 17 00:00:00 2001 From: Michal Arbet Date: Thu, 9 Jul 2026 13:03:42 +0200 Subject: [PATCH 3/5] Remove sysctl override from OVN VPN agent The OVN VPN driver enables net.ipv4.ip_forward inside VPN network namespaces by invoking sysctl. Replacing /usr/sbin/sysctl with /bin/true prevents this configuration, causing VPN traffic to fail. Closes-Bug: #2160208 Signed-off-by: Michal Arbet Change-Id: I4fee14032275007965912b8438107ea60086da50 --- ansible/roles/neutron/defaults/main.yml | 1 - releasenotes/notes/bug-2160208-1298f91f49d93e34.yaml | 5 +++++ 2 files changed, 5 insertions(+), 1 deletion(-) create mode 100644 releasenotes/notes/bug-2160208-1298f91f49d93e34.yaml diff --git a/ansible/roles/neutron/defaults/main.yml b/ansible/roles/neutron/defaults/main.yml index 4d32d2dff6..93ec573215 100644 --- a/ansible/roles/neutron/defaults/main.yml +++ b/ansible/roles/neutron/defaults/main.yml @@ -672,7 +672,6 @@ neutron_ovn_vpn_agent_default_volumes: - "/run/netns:/run/netns:shared" - "kolla_logs:/var/log/kolla/" - "{{ '/dev/shm:/dev/shm' }}" - - "/bin/true:/usr/sbin/sysctl:ro" neutron_extra_volumes: "{{ default_extra_volumes }}" neutron_dhcp_agent_extra_volumes: "{{ neutron_extra_volumes }}" diff --git a/releasenotes/notes/bug-2160208-1298f91f49d93e34.yaml b/releasenotes/notes/bug-2160208-1298f91f49d93e34.yaml new file mode 100644 index 0000000000..fd757a4a96 --- /dev/null +++ b/releasenotes/notes/bug-2160208-1298f91f49d93e34.yaml @@ -0,0 +1,5 @@ +--- +fixes: + - | + Fixed VPN traffic forwarding in OVN VPNaaS deployments. + `LP#2160208 `__ From 541a26c7d4dd1988eda64327c6b08aa831ee3162 Mon Sep 17 00:00:00 2001 From: Owen Jones Date: Mon, 10 Aug 2026 11:44:47 +0100 Subject: [PATCH 4/5] fix: Delegate fernet key distribution to correct host The key used to group hosts was previously changed[0] but the group not updated in the task used to distribute fernet keys. When migrating hosts this could lead to the task being delegated to a host without keys, resulting in all hosts losing their keys. 0: Change I1db88e28a828ebf073f018b2bae1d9556ec22807 Closes-Bug: #2163158 Change-Id: Ia76f3e6cb41a30b88ac885832755ebe5264ad9fc Signed-off-by: Owen Jones --- ansible/roles/keystone/tasks/distribute_fernet.yml | 6 ++---- .../notes/fix-fernet-distribution-96a52af5a5641871.yaml | 6 ++++++ 2 files changed, 8 insertions(+), 4 deletions(-) create mode 100644 releasenotes/notes/fix-fernet-distribution-96a52af5a5641871.yaml diff --git a/ansible/roles/keystone/tasks/distribute_fernet.yml b/ansible/roles/keystone/tasks/distribute_fernet.yml index a780cf8dad..2bb346da91 100644 --- a/ansible/roles/keystone/tasks/distribute_fernet.yml +++ b/ansible/roles/keystone/tasks/distribute_fernet.yml @@ -9,11 +9,9 @@ retries: 10 delay: 5 -- name: Run key distribution +- name: Run fernet key distribution become: true changed_when: true ansible.builtin.command: "{{ kolla_container_engine }} exec -t {{ keystone_services['keystone-fernet']['container_name'] }} /usr/bin/fernet-push.sh" run_once: true - delegate_to: >- - {% if groups['keystone_fernet_running'] is defined -%} - {{ groups['keystone_fernet_running'][0] }}{%- else -%}{{ groups['keystone'][0] }}{%- endif %} + delegate_to: "{{ (groups['keystone_fernet_running_True'] | default(groups['keystone']))[0] }}" diff --git a/releasenotes/notes/fix-fernet-distribution-96a52af5a5641871.yaml b/releasenotes/notes/fix-fernet-distribution-96a52af5a5641871.yaml new file mode 100644 index 0000000000..c7cf4d7a48 --- /dev/null +++ b/releasenotes/notes/fix-fernet-distribution-96a52af5a5641871.yaml @@ -0,0 +1,6 @@ +--- +fixes: + - | + Fernet key distribution is now delegated to a host in the correct + group when run on existing deployments. + `LP#2163158 `__ From c7c124eeac370a062a2dab635389f42b581ea16d Mon Sep 17 00:00:00 2001 From: OpenStack Proposal Bot Date: Thu, 13 Aug 2026 02:22:07 +0000 Subject: [PATCH 5/5] Updated ansible-lint j2lint in lint-requirements.txt Change-Id: Ic338b450821ee408de84a06530ce4ac71630fc16 Signed-off-by: OpenStack Proposal Bot Generated-By: openstack/project-config:playbooks/proposal/propose_update.sh --- lint-requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lint-requirements.txt b/lint-requirements.txt index e295c7af33..a960de98a7 100644 --- a/lint-requirements.txt +++ b/lint-requirements.txt @@ -1,5 +1,5 @@ ansible>=12,<14 # GPLv3 -ansible-lint===26.6.0 # MIT +ansible-lint===26.8.0 # MIT bandit>=1.1.0 # Apache-2.0 bashate>=0.5.1 # Apache-2.0 codespell<3 # GPLv2