Change in vdsm[master]: hooks: Security groups support for OVS

mkolesni at redhat.com mkolesni at redhat.com
Tue Dec 31 06:35:56 UTC 2013


Mike Kolesnik has posted comments on this change.

Change subject: hooks: Security groups support for OVS
......................................................................


Patch Set 1:

(7 comments)

In reply to Itamar: the feature page is at http://www.ovirt.org/Features/Detailed_OSN_Integration#Security_groups

....................................................
File lib/vdsm/constants.py.in
Line 101: 
Line 102: EXT_IFDOWN = '@IFDOWN_PATH@'
Line 103: EXT_IFUP = '@IFUP_PATH@'
Line 104: EXT_IONICE = '@IONICE_PATH@'
Line 105: EXT_IP = '@IP_PATH@'
I don't mind using it, but is it distro agnostic?
Line 106: EXT_ISCSIADM = '@ISCSIADM_PATH@'
Line 107: EXT_TC = '@TC_PATH@'
Line 108: 
Line 109: EXT_KILL = '@KILL_PATH@'


....................................................
File vdsm_hooks/openstacknet/after_device_destroy.py
Line 30: from vdsm.constants import EXT_IP
Line 31: from vdsm.constants import EXT_OVS_VSCTL
Line 32: 
Line 33: 
Line 34: def disconnectVnic(portId):
Thanks!
Line 35:     brName = devName("qbr", portId)
Line 36:     vethBr = devName("qvb", portId)
Line 37:     vethOvs = devName("qvo", portId)
Line 38: 


....................................................
File vdsm_hooks/openstacknet/before_device_create.py
Line 14: default integration bridge, named "br_int".
Line 15: 
Line 16: Syntax:
Line 17:     { 'provider_type': 'OPENSTACK_NETWORK', 'vnic_id': 'port_id',
Line 18:       'plugin_type': 'plugin_type_value' }
Done
Line 19: Where:
Line 20:     port_id should be replaced with the port id of the virtual NIC to be
Line 21:     connected to OpenStack Network.
Line 22:     plugin_type_value should be replaced with with OPEN_VSWITCH for OVS plugin


Line 86: 
Line 87: def addOvsHybridVnic(domxml, iface, portId):
Line 88:     brName = devName("qbr", portId)
Line 89: 
Line 90:     if not checkDeviceExists(brName):
Basically that's how the nova VIF driver does it, I believe they already have some experience that made them use this safety mechanism.. For example, the bug you opened seems fitting for this case.

As I see it we can have two alternative choices (if we want to change this):
1. Not check, thus having the hook fail if bridge already exists (indicating garbage).
2. Remove the bridge prior to creating it (which also requires checking if the veth pair exists and removing it).

If we decide to change it, I prefer option #1.
Line 91:         executeOrExit([EXT_BRCTL, 'addbr', brName])
Line 92:         executeOrExit([EXT_BRCTL, 'setfd', brName, '0'])
Line 93:         executeOrExit([EXT_BRCTL, 'stp', brName, 'off'])
Line 94: 


Line 154:         hooking.write_domxml(domxml)
Line 155: 
Line 156: 
Line 157: def mockExecuteOrExit(command, expectSuccess=True):
Line 158:     print "Mocking successful execution of: %s" % " ".join(map(str, command))
Done
Line 159:     return (0, '', '')
Line 160: 
Line 161: 
Line 162: def mockDeviceExists(dev):


....................................................
File vdsm_hooks/openstacknet/openstacknet_utils.py
Line 34: def devName(prefix, name):
Line 35:     return (prefix + str(name))[:DEV_MAX_LENGTH]
Line 36: 
Line 37: 
Line 38: def checkDeviceExists(dev):
Done
Line 39:     command = [EXT_IP, 'link', 'show', 'dev', dev]
Line 40:     retcode, out, err = hooking.execCmd(command, sudo=True, raw=True)


Line 36: 
Line 37: 
Line 38: def checkDeviceExists(dev):
Line 39:     command = [EXT_IP, 'link', 'show', 'dev', dev]
Line 40:     retcode, out, err = hooking.execCmd(command, sudo=True, raw=True)
Done


-- 
To view, visit http://gerrit.ovirt.org/22585
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: I77e219cce9c572ebef6a8584847f517abbda224d
Gerrit-PatchSet: 1
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Mike Kolesnik <mkolesni at redhat.com>
Gerrit-Reviewer: Antoni Segura Puimedon <asegurap at redhat.com>
Gerrit-Reviewer: Assaf Muller <amuller at redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken at redhat.com>
Gerrit-Reviewer: Itamar Heim <iheim at redhat.com>
Gerrit-Reviewer: Mike Kolesnik <mkolesni at redhat.com>
Gerrit-Reviewer: oVirt Jenkins CI Server
Gerrit-HasComments: Yes


More information about the vdsm-patches mailing list