Repository navigation
F #-: VRouter: Management NIC in separate MGMT VRF - #419
Open
netaviator wants to merge 5 commits into
Open
netaviator wants to merge 5 commits into
netaviator wants to merge 5 commits into
Conversation
The NIC that OpenNebula marks as VROUTER_MANAGEMENT moves into a VRF, so its default route no longer collides with the one in the main table. Opt out with ONEAPP_VNF_MGMT_VRF_ENABLED=NO. Signed-off-by: Jan Gilla <jgilla@level66.network>
Moving a NIC into a VRF flushes its IPv6 addresses and routes. Put the static address, the ULA and the default route back, inside the VRF table. Signed-off-by: Jan Gilla <jgilla@level66.network>
The appliance talks to OneGate from the default VRF, which cannot reach hosts behind the management NIC once it is enslaved. Add a policy rule that sends the traffic for the OneGate address (IP literals only) to the VRF table, and remove it again at cleanup. Signed-off-by: Jan Gilla <jgilla@level66.network>
one-context adds the default route of every NIC with 'ip route add', so the gateway of the first NIC (the management one) wins and the others are never installed. With the management gateway in the VRF table, apply the gateways (IPv4 with ETHx_METRIC, IPv6) of the NICs that are not marked as management in the main table. Signed-off-by: Jan Gilla <jgilla@level66.network>
Describe the ONEAPP_VNF_MGMT_VRF_ENABLED attribute (on by default), what the module configures and in which order, the accepted values and what it does not cover. Signed-off-by: Jan Gilla <jgilla@level66.network>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
OpenNebula marks one NIC of a Virtual Router as the management NIC. In OpenNebula it is set with VROUTER_MANAGEMENT = "YES" on the NIC of the Virtual Router template, and arrives in the VM context as ETH_VROUTER_MANAGEMENT=YES. one-context adds the default route of every NIC with ip route add, so the gateway of the first NIC wins and the default route of the management NIC collides with the one of the NIC that carries the traffic.
Move the management NIC into its own VRF (mgmt, routing table 1000), so its default route lives in a separate table and the main table stays free for the routed NICs. It is on by default. Opt out with ONEAPP_VNF_MGMT_VRF_ENABLED=NO. Without a NIC marked as management the module does nothing.
Values that end up in a shell command (gateways, metrics, IPv6 addresses) are checked; an invalid one is logged and skipped.