Friday, 2026-09-11

opendevreviewKyuyeong Lee proposed openstack/neutron stable/2026.1: [OVN] Fix shared admin_context in OVSDB monitor event handlers  https://review.opendev.org/c/openstack/neutron/+/100517805:02
opendevreviewKyuyeong Lee proposed openstack/neutron stable/2025.2: [OVN] Fix shared admin_context in OVSDB monitor event handlers  https://review.opendev.org/c/openstack/neutron/+/100517905:03
opendevreviewKyuyeong Lee proposed openstack/neutron stable/2026.1: [OVN] Fix shared admin_context in OVSDB monitor event handlers  https://review.opendev.org/c/openstack/neutron/+/100517806:00
opendevreviewKyuyeong Lee proposed openstack/neutron stable/2025.2: [OVN] Fix shared admin_context in OVSDB monitor event handlers  https://review.opendev.org/c/openstack/neutron/+/100517906:26
opendevreviewMerged openstack/neutron master: evpn: Use branch-26.03 OVN branch for the experimental job  https://review.opendev.org/c/openstack/neutron/+/100508207:38
opendevreviewRodolfo Alonso proposed openstack/neutron-tempest-plugin master: vpnaas: Run VPNaaS tempest jobs with concurrency 1  https://review.opendev.org/c/openstack/neutron-tempest-plugin/+/100518807:42
opendevreviewRodolfo Alonso proposed openstack/neutron-tempest-plugin master: DNM == Test ``neutron-tempest-plugin-vpnaas`` scenario classes  https://review.opendev.org/c/openstack/neutron-tempest-plugin/+/100443907:44
opendevreviewRodolfo Alonso proposed openstack/neutron-vpnaas master: vpnaas: Add swanctl (VICI protocol) support for strongSwan  https://review.opendev.org/c/openstack/neutron-vpnaas/+/100380107:51
opendevreviewRodolfo Alonso proposed openstack/neutron-vpnaas master: conf: Move VPNaaS configuration options to neutron_vpnaas/conf  https://review.opendev.org/c/openstack/neutron-vpnaas/+/100457107:51
opendevreviewRodolfo Alonso proposed openstack/neutron-vpnaas master: zuul: add OVN VPNaaS tempest job with swanctl legacy mode  https://review.opendev.org/c/openstack/neutron-vpnaas/+/100382007:52
opendevreviewRodolfo Alonso proposed openstack/neutron-vpnaas master: DNM == Test ``neutron-tempest-plugin-vpnaas-ovn-sswan-swanctl`` 20 times  https://review.opendev.org/c/openstack/neutron-vpnaas/+/100443207:52
opendevreviewAdam Harwell proposed openstack/os-ken master: ofctl: Use the features reply ID before datapath initialization  https://review.opendev.org/c/openstack/os-ken/+/100519108:11
opendevreviewRodolfo Alonso proposed openstack/neutron master: ai: Add release cycle transition skill  https://review.opendev.org/c/openstack/neutron/+/100499208:21
opendevreviewRodolfo Alonso proposed openstack/neutron master: ovn: Remove standalone OVN Metadata agent  https://review.opendev.org/c/openstack/neutron/+/99878708:21
opendevreviewRodolfo Alonso proposed openstack/neutron-tempest-plugin master: vpnaas: Run VPNaaS tempest jobs with concurrency 1  https://review.opendev.org/c/openstack/neutron-tempest-plugin/+/100518808:28
opendevreviewRodolfo Alonso proposed openstack/neutron-tempest-plugin master: DNM == Test ``neutron-tempest-plugin-vpnaas`` scenario classes  https://review.opendev.org/c/openstack/neutron-tempest-plugin/+/100443908:28
opendevreviewSlawek Kaplonski proposed openstack/neutron stable/2025.2: Use RBAC API policy to create default security group  https://review.opendev.org/c/openstack/neutron/+/100249909:16
opendevreviewSlawek Kaplonski proposed openstack/neutron stable/2025.1: Use RBAC API policy to create default security group  https://review.opendev.org/c/openstack/neutron/+/100250209:23
opendevreviewEduardo Olivares proposed openstack/neutron-tempest-plugin master: bgp: Enable Neutron BGP multinode job in experimental queue  https://review.opendev.org/c/openstack/neutron-tempest-plugin/+/100493509:37
opendevreviewRodolfo Alonso proposed openstack/ovsdbapp master: ovn-sb: Set default ``hostname`` in ``chassis_add``  https://review.opendev.org/c/openstack/ovsdbapp/+/100520710:34
LarsErikPAny news on new neutron versions in gazpacho UCA? =)11:02
ralonsohLarsErikP, you can check that in the releases patches11:03
ralonsohhttps://review.opendev.org/c/openstack/releases/+/100492911:03
LarsErikPralonsoh: thanks. I'm especially interested in the plans for releasing this into gazpacho-updates in the UCA. Do you know anything about that? =)11:07
opendevreviewMerged openstack/neutron master: ovn: Filter ``bind_port()`` segments by subnet ``segment_id``  https://review.opendev.org/c/openstack/neutron/+/100438511:07
ralonsohLarsErikP, no idea about Canonical roadmap11:07
LarsErikPmaybe haleyb knows? I've asked him before, and he mentioned he knew someone working on that in Canonical..11:08
LarsErikPWould love to see the release there, as there is some showstopping bugs for us in 28.0.0, which is fixed in >=28.0.1 =)11:09
ralonsohhaleyb, hi! Please review https://review.opendev.org/c/openstack/releases/+/1005112. This has been a very productive cycle and we have more new features to add11:14
*** iurygregory_ is now known as iurygregory12:17
slaweqralonsoh: wow, this is really long list of significant new features added this cycle12:37
ralonsohyeah!12:37
haleybralonsoh: will take a look, don't know how i missed all that12:53
haleybLarsErikP: once https://review.opendev.org/c/openstack/releases/+/1004929 someone else here (I work at Canonical too) will be working on the downstream packaging part12:56
haleybmerges12:56
haleyb#startmeeting neutron_drivers13:00
opendevmeetMeeting started Fri Sep 11 13:00:55 2026 UTC and is due to finish in 60 minutes.  The chair is haleyb. Information about MeetBot at http://wiki.debian.org/MeetBot.13:00
opendevmeetUseful Commands: #action #agreed #help #info #idea #link #topic #startvote.13:00
opendevmeetThe meeting name has been set to 'neutron_drivers'13:00
haleybPing list: ykarel, mlavalle, mtomaska, slaweq, tobias-urdin, lajoskatona, haleyb, ralonsoh, cardoe13:00
ralonsohhello13:01
slaweqo/13:01
haleybwill wait for quorom but i counted 4 items in the list13:01
mlavalle\o13:02
ichenhello13:02
cyyoon__hello13:02
haleybok we can get started13:03
haleybfirst one is13:03
haleyb#link https://bugs.launchpad.net/neutron/+bug/216530613:03
haleyb[RFE][OVN] Add an ACL flow-sampling output type to Network Log13:03
opendevreviewSlawek Kaplonski proposed openstack/neutron-tempest-plugin master: [FWaaS] Add basic scenario test for FW attached to L2 ports  https://review.opendev.org/c/openstack/neutron-tempest-plugin/+/99569513:03
cardoeo/13:03
haleybi think this was from cyyoon__ who just joined - can you give a high-level description of it?13:04
cyyoon__  I'm Chanyeol from KT Cloud, the author of this RFE. Happy to answer questions.13:04
cyyoon__  Yes, that's mine. We'd like to add an optional flow_sample output to Network Log using OVN's native ACL sampling. Existing logs would keep the current packet logging behavior by default.13:05
cyyoon__The main gap is keeping sampling state⠁in sync when logs or⠈SG rules change, ACLs are⠁replaced, or Neutron runs DB sync. Neutron would manage that lifecycle, while the exporter, collector and   ⠐   aggregation stay operator-managed.⠠    13:05
* haleyb is still reading rfe13:07
ralonsohone question, this RFE proposes to update the current API, adding `[packet_log, flow_sample]`, right?13:08
ralonsohonly for ML2/OVN13:08
cyyoon__Yes, adding an output_type field, with packet_log as the default13:09
cyyoon__Yes, flow_sample would initially be supported only by ML2/OVN.13:09
ralonsohand the log plugin will be in charge of handling these ACLs 13:09
cyyoon__Yes, the OVN logging driver would manage sampling state on the selected ACLs13:10
ralonsohno more questions here, thanks13:10
slaweqIIUC if the output_type will be "flow_sample" logs will be in different format than they are today, but where they will be stored and who will consume them? Will this be outside of the neutron configuration, like e.g. some extra collector which will know where to look for them?13:10
cyyoon__Yes, operators would configure OVS to export samples via IPFIX to an external collector. Collection, aggregation and storage would be outside Neutron13:11
slaweqok, thx13:13
haleyband the main goal is to track new and established connections?13:13
cyyoon__Yes, to observe new and established traffic through sampling13:14
haleybi didn't have any other questions13:16
mlavalleI don't have other questions13:17
slaweqme neighter, this seems like reasonable request13:18
slaweqand RFE is written in the way that it can be just copy-paste to be spec :)13:18
mlavallestraightforward13:18
ralonsohFor me is a +1 (with the corresponding spec)13:18
haleybok, we can vote - there were a lot of questions at the end13:18
mlavalle+113:19
haleybyes, +1 from me with a spec13:19
slaweq+113:19
haleybok, great i'll mark approved13:19
haleybcyyoon__: thanks for the RFE and attending, please go ahead and propose a spec, there should be a 2027.1 folder there now13:20
cyyoon__Thanks everyone for the feedback. I'll prepare the spec for 2027.113:20
haleybgreat, thanks!13:21
haleybthe next one is from ichen 13:21
haleyb#link https://bugs.launchpad.net/neutron/+bug/216602513:21
haleyb[RFE] Extend BGP EVPN Type-5 to use distributed routing13:21
ichenI created the RFE, to extend Neutron to also support EVPN Type-5 using distributed routing.  Neutron current supports EVPN Type-5 using what I call centralized routing, where the VTEP is on a network node.  This RFE changes that to place VTEP on all compute nodes.13:23
cardoeThis is most similar to how I'm doing this with bare metal and switches. 13:25
ichenThe spec is still in development, but a draft is linked to Launchpad #2166025, and jlibosv already commented.  :)13:25
ralonsoh(I have no questions but Helen gave us yesterday, internally, a quick update on this feature)13:25
haleyband what about the comment cyyoon__ added - is there any work required in OVN for this?13:26
ichenThe spec documents a working solution, supported as of OVN 26.03 August 31, 2026.  However, jlibosva has scalability concerns in the spec.13:27
ichenIt is likely that OVN work will be needed to fully address the scalability concern.13:28
haleybwould that then change the design as well?13:28
cardoeI'm curious if you don't have a chassis per router... what's your VRF boundary?13:30
cardoeCause you're already doing route leaking in the original spec13:31
ichenThe draft spec proposes an OVN logical topology that includes a chassis router on each compute node for every VNI, i.e., per VNI, Neutron creates a chassis router on each compute node.  If there are 1000 VNIs and 1000 compute nodes, then there will be 1M chassis routers in total created.  This is where the scalability concern is, and reducing this number would be helpful.  If this isn’t scalable on current, typical 13:31
ichenhardware, then I expect the OVN logical topology to be different.  The13:31
ichenThere’s been brainstorming about a VRF-aware logical router.  So, one logical router to provide all the VRF isolation.  This will require changes in OVN.13:33
cardoehaleyb: I don't see needing to change the API that Helen proposes but it'll certainly change the plumbing internally.13:33
ichenYes, what cardoe said above.13:33
cardoeichen: okay that would make sense. But that's really some sensitive piece to get right otherwise you're leaking traffic between tenants.13:33
cardoeOverall from me +1 on doing this.13:35
cardoeLike I said, this mirrors real hardware implementations13:35
cardoeThat's why I asked for https://review.opendev.org/c/openstack/neutron/+/100048513:36
cardoeThe only other gap between what we have to do on real hardware then would be customizing ASNs13:36
cardoeI guess the question is the comfort level of the Neutron team around the fact that the internal implementation might change for different OVN versions.13:37
haleybok, so there could be a scalability concern as noted in the spec, but this could be addressed by future OVN work, which neutron could then take advantage of13:37
haleybcardoe: right, and is just a maintenance task type update?13:38
ichenI would think that the finalized spec will need to wait for OVN.13:38
cardoehaleyb: I dunno. It depends on how they implement the VRF aware logical router and what that migration would look like.13:38
cardoea VRF aware logical router would definitely make OVN feel more like hardware13:39
cardoeIt'd bring us to wanting to have an API for the router policy table however13:40
haleybso this is the only thing i'm stuck on then, and not sure how quickly the OVN team will work on it13:41
haleybwhat do others think?13:42
ichenIf following OVN’s release schedule, then the earliest would be OVN 27.03 in March 2027.  OVN will be releasing OVN 26.09 this month.13:42
haleybwe do have more on agenda13:42
slaweqdo I understand correctly that we will need to wait for ovn 27.03 at least to be able to deliver that RFE?13:43
ichenNot necessarily, but OVN is still investigating the performance of the current design13:44
slaweqahh, ok13:44
ichenThe current design requires, per VNI, a chassis router on each compute node.13:45
slaweqso we can use what is currenly there with some known limitations on scale13:45
slaweqand that may improve in future 13:45
mlavalleand migration implications down the road, IIUC13:45
cardoeJust quickly reading (my first time seeing this) I agree with Helen that she could deliver it with how OVN works today. But they're probably right there's a performance consideration there. And if OVN 27.03 brings a new way of doing it there's a migration and how impacting that migration will be is unknown until OVN folks create the implementation. But more than likely it would be down time since you would be tearing down 13:45
cardoea chassis and building a new router object and moving flows and configs.13:45
ichenThat is one approach.  The other approach is to wait, either wait to approve RFE or wait to approve spec.13:46
cardoeI don't think Helen's API would change either way.13:46
ralonsohwe can approve the RFE, waiting for the needed OVN release and releasing the neutron code at this point13:47
ichenMigration would really mean upgrading OVN, right?13:47
cardoeupgrade OVN and have neutron rebuild state13:47
ralonsohif there are OF rules upgrades, that could imply traffic disconnections13:47
cardoe^ yeah13:47
ralonsohbut everything can be documented, I see no problem with the Neutron part13:48
slaweqI agree with ralonsoh 13:48
mlavalleas long as potential deployers understand the migration implications down the road13:49
haleybso if i'm understanding above, we can approve the RFE, but the spec and implementation would need to wait for OVN work13:50
haleybi think in general it's a good feature13:51
ralonsoh+1 with the already WIP spec13:51
ichenIf we don’t want to migrate, then spec and implementation would need to wait for OVN work.13:51
mlavalleyes, that's really the decision we need to make13:52
ralonsohThat could be discussed in the spec13:52
cardoeichen: my only feedback would be to let different router flavors signal if they support centralized vs distributed or both.13:52
ralonsohas different alternatives proposed13:53
cardoeichen: e.g. my telco plugin would only support distributed for example13:53
haleybok, now i understand ralonsoh's comment - implement as-is today, when OVN support is updated, we change, documenting the data plane disruption13:53
ichencardoe: ACK13:53
ralonsohexactly13:53
mlavallegood point. approve rfe now and hash out the migration question in the spec13:53
opendevreviewRodolfo Alonso proposed openstack/neutron-tempest-plugin master: vpnaas: Log dataplane state on pre-VPN isolation failure  https://review.opendev.org/c/openstack/neutron-tempest-plugin/+/100524113:54
opendevreviewMerged openstack/neutron-vpnaas stable/2026.1: Fix automatic rescheduling from dead VPN agents  https://review.opendev.org/c/openstack/neutron-vpnaas/+/100477013:55
haleybok, so let's vote on that - approve the RFE and start working on spec13:55
ralonsoh+113:55
mlavalle+113:55
haleyb+113:56
haleybok, so please add any comments to spec13:56
slaweq+113:56
haleyb4/5 so approved13:57
ichenThanks!13:57
mlavalleis the fifth in 4/5 Lajos?13:57
haleyband i don't think we have time for the others, will have to defer until next week, i'll update the wiki13:57
cardoeI know time is almost up but since there's a lot of folks around... I'd ask for some feedback on https://bugs.launchpad.net/neutron/+bug/2167105 my proposed fix has implications for tbachman (I might have messed up his IRC nick), for hjensas (networking-baremetal) and for myself.13:58
haleybmlavalle: yes, Lajos13:58
ralonsohcardoe, we can talk about this after the meeting13:58
cardoeWe also hit an OVN maintenance worker issue yesterday where it ATE a bunch of OVN routers. I'm still trying to troubleshoot it.13:58
ralonsohafter this meeting13:59
haleybthanks for attending, i'll end the meeting13:59
haleyb#endmeeting13:59
opendevmeetMeeting ended Fri Sep 11 13:59:17 2026 UTC.  Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4)13:59
opendevmeetMinutes:        https://meetings.opendev.org/meetings/neutron_drivers/2026/neutron_drivers.2026-09-11-13.00.html13:59
opendevmeetMinutes (text): https://meetings.opendev.org/meetings/neutron_drivers/2026/neutron_drivers.2026-09-11-13.00.txt13:59
opendevmeetLog:            https://meetings.opendev.org/meetings/neutron_drivers/2026/neutron_drivers.2026-09-11-13.00.log.html13:59
ralonsohcardoe, I'll check the trunk issue13:59
ralonsohwhat happened with the maintenance worker?13:59
ralonsohdo you have a launchpad bug?13:59
cardoeI'm also happy sometime to do a walk through / demo / whatever folks would like to see how the bare metal drivers and neutron interact.13:59
slaweqhaleyb: next friday I will probably not be available so my topic can be moved to Sept 2513:59
cardoeralonsoh: I haven't made a launchpad bug yet for the maintenance worker.14:00
cardoeralonsoh: so due to a screw up in configs from my team we didn't have the maintenance worker running in that env and so they fixed that yesterday.14:00
ralonsohbut is this something related to the code?14:00
cardoeit started up and it was set to 2 pods in k8s so 2 copies fired up at the same time.14:00
haleybslaweq: ack, i will not be there then but the other 4/5 will i hope :)14:01
ralonsohthere is no problem of concurrency for the maintenance worker, it is supposed to request the OVN DB lock14:01
cardoeone of them decided that 8 OVN routers were missing their LRP and so it triggered the generic update_port() instead of the router aware path. So it recreated the port without type=router14:02
ralonsohin other words, if more than 1 maintenance process is running, only the first one will execute the tasks14:02
cardoeokay well more digging.14:02
ralonsohcardoe, please, fill a LP bug with any possible information14:02
cardoeI've thrown all the logs at Claude right now and I'm letting it jump to conclusions to be honest as a starting point.14:03
ralonsohalso because you use baremetal ports, that is relevant for the report14:03
cardoeI figured I'd make a LP bug once I have some concrete info14:03
ralonsohperfect14:03
ralonsohI'll check the trunks one14:03
cardoehttps://github.com/rackerlabs/understack/issues/2330 is where Claude is rambling away at.14:03
opendevreviewMiro Tomaska proposed openstack/neutron-tempest-plugin master: Test that only one subnet with `advertise-host` is allowed per network  https://review.opendev.org/c/openstack/neutron-tempest-plugin/+/100097314:04
cardoeralonsoh: as an aside... for ichen's distributed EVPN.. she'll need https://review.opendev.org/c/openstack/neutron/+/1000485 because the physnet for the VNI will be the same across the deployment "evpn-ovn" let's say but then the VLAN side physnet will need to be the compute node14:05
ralonsohI still don't know how the implementation refactor will be, but it should replicate the current evpn code, so I'm not sure about this14:06
cardoeBecause on compute node-1 FRR will use let's say VLAN 1000 but on compute node-2 FRR will use 2000 potentially for the same connection and node-2 could use VLAN 1000 for a completely different VNI.14:06
cardoeOtherwise you cannot scale past 4094 EVPN links per Neutron instance.14:07
ralonsohI'm aware but I'm not sure if that was an issue during the evpn initial design14:07
cardoeIt wasn't cause they were just focused on the centralized implementation while I've been only doing the distributed version.14:08
opendevreviewMerged openstack/neutron master: [bgp] Bump cirros version to 0.6.3  https://review.opendev.org/c/openstack/neutron/+/100206514:11
opendevreviewRodolfo Alonso proposed openstack/neutron-tempest-plugin master: vpnaas: Log dataplane state on pre-VPN isolation failure  https://review.opendev.org/c/openstack/neutron-tempest-plugin/+/100524114:11
opendevreviewRodolfo Alonso proposed openstack/neutron-tempest-plugin master: vpnaas: Log dataplane state on pre-VPN isolation failure  https://review.opendev.org/c/openstack/neutron-tempest-plugin/+/100524114:13
opendevreviewRodolfo Alonso proposed openstack/neutron-tempest-plugin master: DNM == Test ``neutron-tempest-plugin-vpnaas`` scenario classes  https://review.opendev.org/c/openstack/neutron-tempest-plugin/+/100443914:13
opendevreviewMerged openstack/neutron stable/2026.1: [OVN] Fix shared admin_context in OVSDB monitor event handlers  https://review.opendev.org/c/openstack/neutron/+/100517818:15
opendevreviewMerged openstack/neutron stable/2025.2: [OVN] Fix shared admin_context in OVSDB monitor event handlers  https://review.opendev.org/c/openstack/neutron/+/100517918:15
opendevreviewMerged openstack/neutron stable/2025.2: Use RBAC API policy to create default security group  https://review.opendev.org/c/openstack/neutron/+/100249918:15
opendevreviewMerged openstack/neutron master: ovn: Add BGP password to EVPN FRR fallback templates  https://review.opendev.org/c/openstack/neutron/+/100137521:03

Generated by irclog2html.py 4.1.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!