Synchronise master with upstream

ansible/roles/keystone/tasks/distribute_fernet.yml

@@ -9,11 +9,9 @@
   retries: 10
   delay: 5
 
-- name: Run key distribution
+- name: Run fernet key distribution
   become: true
   changed_when: true
   ansible.builtin.command: "{{ kolla_container_engine }} exec -t {{ keystone_services['keystone-fernet']['container_name'] }} /usr/bin/fernet-push.sh"
   run_once: true
-  delegate_to: >-
-    {% if groups['keystone_fernet_running'] is defined -%}
-    {{ groups['keystone_fernet_running'][0] }}{%- else -%}{{ groups['keystone'][0] }}{%- endif %}
+  delegate_to: "{{ (groups['keystone_fernet_running_True'] | default(groups['keystone']))[0] }}"

ansible/roles/neutron/defaults/main.yml

@@ -255,6 +255,18 @@ neutron_config_validation:
   - generator: "/neutron/etc/oslo-config-generator/dhcp_agent.ini"
     config: "/etc/neutron/dhcp_agent.ini"
 
+neutron_config_files:
+  - name: "neutron.conf"
+    enabled: true
+  - name: "plugins/ml2/ml2_conf.ini"
+    enabled: true
+  - name: "neutron_vpnaas.conf"
+    enabled: "{{ enable_neutron_vpnaas | bool }}"
+  - name: "fwaas_driver.ini"
+    enabled: "{{ enable_neutron_fwaas | bool }}"
+  - name: "neutron_taas.conf"
+    enabled: "{{ enable_neutron_taas | bool }}"
+
 ####################
 # Database
 ####################
@@ -660,7 +672,6 @@ neutron_ovn_vpn_agent_default_volumes:
   - "/run/netns:/run/netns:shared"
   - "kolla_logs:/var/log/kolla/"
   - "{{ '/dev/shm:/dev/shm' }}"
-  - "/bin/true:/usr/sbin/sysctl:ro"
 
 neutron_extra_volumes: "{{ default_extra_volumes }}"
 neutron_dhcp_agent_extra_volumes: "{{ neutron_extra_volumes }}"

ansible/roles/neutron/tasks/config.yml

@@ -255,6 +255,9 @@
     services_need_fwaas_driver_ini:
       - "neutron-server"
       - "neutron-l3-agent"
+      - "neutron-ovn-maintenance-worker"
+      - "neutron-periodic-worker"
+      - "neutron-rpc-server"
   merge_configs:
     sources:
       - "{{ role_path }}/templates/fwaas_driver.ini.j2"
@@ -424,5 +427,13 @@
     service_uwsgi_config_tls_key: "/etc/neutron/certs/neutron-key.pem"
     service_uwsgi_config_uid: "neutron"
     service_uwsgi_config_workers: "{{ neutron_api_workers }}"
+    service_uwsgi_config_env:
+      OS_NEUTRON_CONFIG_FILES: >-
+        {{
+          neutron_config_files
+          | selectattr('enabled', 'equalto', true)
+          | map(attribute='name')
+          | join(';')
+        }}
   when:
     - service | service_enabled_and_mapped_to_host

ansible/roles/neutron/templates/fwaas_driver.ini.j2

@@ -3,4 +3,8 @@ enabled = true
 driver = iptables_v2
 
 [service_providers]
+{% if neutron_plugin_agent == 'openvswitch' %}
 service_provider = FIREWALL_V2:fwaas_db:neutron_fwaas.services.firewall.service_drivers.agents.agents.FirewallAgentDriver:default
+{% elif neutron_plugin_agent == 'ovn' %}
+service_provider = FIREWALL_V2:fwaas_db:neutron_fwaas.services.firewall.service_drivers.ovn.firewall_l3_driver.OVNFwaasDriver:default
+{% endif %}

ansible/roles/neutron/templates/neutron-ovn-maintenance-worker.json.j2

@@ -1,5 +1,5 @@
 {
-    "command": "neutron-ovn-maintenance-worker",
+    "command": "neutron-ovn-maintenance-worker --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini{% if enable_neutron_vpnaas | bool %} --config-file /etc/neutron/neutron_vpnaas.conf{% endif %}{% if enable_neutron_fwaas | bool %} --config-file /etc/neutron/fwaas_driver.ini{% endif %}",
     "config_files": [
         {
             "source": "{{ container_config_directory }}/neutron.conf",
@@ -18,6 +18,12 @@
             "dest": "/etc/neutron/neutron_vpnaas.conf",
             "owner": "neutron",
             "perm": "0600"
+        }{% endif %}{% if enable_neutron_fwaas | bool %},
+        {
+            "source": "{{ container_config_directory }}/fwaas_driver.ini",
+            "dest": "/etc/neutron/fwaas_driver.ini",
+            "owner": "neutron",
+            "perm": "0600"
         }{% endif %}{% if kolla_copy_ca_into_containers | bool %},
         {
             "source": "{{ container_config_directory }}/ca-certificates",

ansible/roles/neutron/templates/neutron-periodic-worker.json.j2

@@ -1,5 +1,5 @@
 {
-    "command": "neutron-periodic-workers",
+    "command": "neutron-periodic-workers --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini{% if enable_neutron_vpnaas | bool %} --config-file /etc/neutron/neutron_vpnaas.conf{% endif %}{% if enable_neutron_fwaas | bool %} --config-file /etc/neutron/fwaas_driver.ini{% endif %}",
     "config_files": [
         {
             "source": "{{ container_config_directory }}/neutron.conf",
@@ -18,6 +18,12 @@
             "dest": "/etc/neutron/neutron_vpnaas.conf",
             "owner": "neutron",
             "perm": "0600"
+        }{% endif %}{% if enable_neutron_fwaas | bool %},
+        {
+            "source": "{{ container_config_directory }}/fwaas_driver.ini",
+            "dest": "/etc/neutron/fwaas_driver.ini",
+            "owner": "neutron",
+            "perm": "0600"
         }{% endif %}{% if kolla_copy_ca_into_containers | bool %},
         {
             "source": "{{ container_config_directory }}/ca-certificates",

ansible/roles/neutron/templates/neutron-rpc-server.json.j2

@@ -1,5 +1,5 @@
 {
-    "command": "neutron-rpc-server",
+    "command": "neutron-rpc-server --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini{% if enable_neutron_vpnaas | bool %} --config-file /etc/neutron/neutron_vpnaas.conf{% endif %}{% if enable_neutron_fwaas | bool %} --config-file /etc/neutron/fwaas_driver.ini{% endif %}",
     "config_files": [
         {
             "source": "{{ container_config_directory }}/neutron.conf",
@@ -18,6 +18,12 @@
             "dest": "/etc/neutron/neutron_vpnaas.conf",
             "owner": "neutron",
             "perm": "0600"
+        }{% endif %}{% if enable_neutron_fwaas | bool %},
+        {
+            "source": "{{ container_config_directory }}/fwaas_driver.ini",
+            "dest": "/etc/neutron/fwaas_driver.ini",
+            "owner": "neutron",
+            "perm": "0600"
         }{% endif %}{% if kolla_copy_ca_into_containers | bool %},
         {
             "source": "{{ container_config_directory }}/ca-certificates",

lint-requirements.txt

@@ -1,5 +1,5 @@
 ansible>=12,<14 # GPLv3
-ansible-lint===26.6.0 # MIT
+ansible-lint===26.8.0 # MIT
 bandit>=1.1.0 # Apache-2.0
 bashate>=0.5.1 # Apache-2.0
 codespell<3 # GPLv2

releasenotes/notes/bug-2160208-1298f91f49d93e34.yaml

@@ -0,0 +1,5 @@
+---
+fixes:
+  - |
+    Fixed VPN traffic forwarding in OVN VPNaaS deployments.
+    `LP#2160208 <https://bugs.launchpad.net/kolla-ansible/+bug/2160208>`__

releasenotes/notes/fix-fernet-distribution-96a52af5a5641871.yaml

@@ -0,0 +1,6 @@
+---
+fixes:
+  - |
+    Fernet key distribution is now delegated to a host in the correct
+    group when run on existing deployments.
+    `LP#2163158 <https://launchpad.net/bugs/2163158>`__