Skip to content

feat: run metadata through the OVN agent - #217

Merged
gboutry merged 2 commits into
canonical:mainfrom
gboutry:feat/migrate-to-ovn-agent
Sep 4, 2026
Merged

gboutry merged 2 commits into
canonical:mainfrom
gboutry:feat/migrate-to-ovn-agent

Conversation

@gboutry

@gboutry gboutry commented Sep 2, 2026

Copy link
Copy Markdown
Collaborator

Consume MicroOVN Northbound and Southbound connections through the ovn-env content plug. Configure neutron-ovn-agent with the metadata extension and fail closed when connection data is unavailable or invalid.

Use the regular configure hook to reconcile the agent after charm-managed snap settings change. Keep local OVS schema readiness checks before launch.

QA steps

Deployed a full sunbeam gazpacho, and replaced the existing hypervisor with the charm and the snap changed.

The agent is responding correctly:

2026-09-01T20:47:22Z privsep-helper[1508387]: 2026-09-01 20:47:22.617 1508387 INFO oslo_service.backend [-] Loading backend: threading
2026-09-01T20:47:22Z privsep-helper[1508387]: 2026-09-01 20:47:22.695 1508387 INFO oslo_service.backend [-] Backend 'threading' successfully loaded and cached.
2026-09-01T20:47:22Z privsep-helper[1508405]: 2026-09-01 20:47:22.705 1508405 INFO oslo.privsep.daemon [-] privsep daemon starting
2026-09-01T20:47:22Z privsep-helper[1508405]: 2026-09-01 20:47:22.714 1508405 INFO oslo.privsep.daemon [-] privsep process running with uid/gid: 0/0
2026-09-01T20:47:22Z privsep-helper[1508405]: 2026-09-01 20:47:22.715 1508405 INFO oslo.privsep.daemon [-] privsep process running with capabilities (eff/prm/inh): CAP_NET_ADMIN|CAP_SYS_ADMIN/CAP_NET_ADMIN|CAP_SYS_ADMIN/none
2026-09-01T20:47:22Z privsep-helper[1508405]: 2026-09-01 20:47:22.716 1508405 INFO oslo.privsep.daemon [-] privsep daemon running as pid 1508405
2026-09-01T20:47:22Z neutron-ovn-agent[1508320]: 2026-09-01 20:47:22.874 1508320 INFO oslo.privsep.daemon [-] Spawned new privsep daemon via rootwrap
2026-09-01T20:47:22Z neutron-ovn-agent[1508320]: 2026-09-01 20:47:22.705 1508405 INFO oslo.privsep.daemon [-] privsep daemon starting
2026-09-01T20:47:22Z neutron-ovn-agent[1508320]: 2026-09-01 20:47:22.714 1508405 INFO oslo.privsep.daemon [-] privsep process running with uid/gid: 0/0
2026-09-01T20:47:22Z neutron-ovn-agent[1508320]: 2026-09-01 20:47:22.715 1508405 INFO oslo.privsep.daemon [-] privsep process running with capabilities (eff/prm/inh): CAP_NET_ADMIN|CAP_SYS_ADMIN/CAP_NET_ADMIN|CAP_SYS_ADMIN/none
2026-09-01T20:47:22Z neutron-ovn-agent[1508320]: 2026-09-01 20:47:22.716 1508405 INFO oslo.privsep.daemon [-] privsep daemon running as pid 1508405
2026-09-01T20:47:26Z neutron-ovn-agent[1508320]: 2026-09-01 20:47:26.343 1508320 INFO oslo.privsep.daemon [-] Running privsep helper: ['sudo', 'privsep-helper', '--config-file', '/var/snap/openstack-hypervisor/common/etc/neutron/neutron.conf', '--config-file', '/var/snap/openstack-hypervisor/common/etc/neutron/neutron_ovn_agent.ini', '--config-dir', '/var/snap/openstack-hypervisor/common/etc/neutron/neutron.conf.d', '--privsep_context', 'neutron.privileged.namespace_cmd', '--privsep_sock_path', '/tmp/tmpzlmc0fzc/privsep.sock']
2026-09-01T20:47:27Z privsep-helper[1508460]: 2026-09-01 20:47:27.359 1508460 INFO oslo_service.backend [-] Loading backend: threading
2026-09-01T20:47:27Z privsep-helper[1508460]: 2026-09-01 20:47:27.429 1508460 INFO oslo_service.backend [-] Backend 'threading' successfully loaded and cached.
2026-09-01T20:47:27Z privsep-helper[1508483]: 2026-09-01 20:47:27.436 1508483 INFO oslo.privsep.daemon [-] privsep daemon starting
2026-09-01T20:47:27Z privsep-helper[1508483]: 2026-09-01 20:47:27.448 1508483 INFO oslo.privsep.daemon [-] privsep process running with uid/gid: 0/0
2026-09-01T20:47:27Z privsep-helper[1508483]: 2026-09-01 20:47:27.450 1508483 INFO oslo.privsep.daemon [-] privsep process running with capabilities (eff/prm/inh): CAP_SYS_ADMIN/CAP_SYS_ADMIN/none
2026-09-01T20:47:27Z privsep-helper[1508483]: 2026-09-01 20:47:27.450 1508483 INFO oslo.privsep.daemon [-] privsep daemon running as pid 1508483
2026-09-01T20:47:27Z neutron-ovn-agent[1508320]: 2026-09-01 20:47:27.551 1508320 INFO oslo.privsep.daemon [-] Spawned new privsep daemon via rootwrap
2026-09-01T20:47:27Z neutron-ovn-agent[1508320]: 2026-09-01 20:47:27.436 1508483 INFO oslo.privsep.daemon [-] privsep daemon starting
2026-09-01T20:47:27Z neutron-ovn-agent[1508320]: 2026-09-01 20:47:27.448 1508483 INFO oslo.privsep.daemon [-] privsep process running with uid/gid: 0/0
2026-09-01T20:47:27Z neutron-ovn-agent[1508320]: 2026-09-01 20:47:27.450 1508483 INFO oslo.privsep.daemon [-] privsep process running with capabilities (eff/prm/inh): CAP_SYS_ADMIN/CAP_SYS_ADMIN/none
2026-09-01T20:47:27Z neutron-ovn-agent[1508320]: 2026-09-01 20:47:27.450 1508483 INFO oslo.privsep.daemon [-] privsep daemon running as pid 1508483
2026-09-01T20:47:30Z neutron-ovn-agent[1508320]: 2026-09-01 20:47:30.666 1508320 INFO neutron.agent.ovn.extensions.extension_manager [-] Extension manager: Metadata OVN agent extension started
2026-09-01T20:47:30Z neutron-ovn-agent[1508320]: 2026-09-01 20:47:30.685 1508320 INFO neutron.agent.ovn.agent.ovn_neutron_agent [-] OVN Neutron Agent started
2026-09-01T20:50:37Z neutron-ovn-agent[1508320]: 2026-09-01 20:50:37.538 1508320 INFO neutron.agent.ovn.metadata.agent [-] Port a4c9e4be-3287-46e5-88ca-3494b69b9ef4 in datapath 1fea1226-6602-4c17-b368-f603f99a2342 unbound from our chassis
2026-09-01T20:50:37Z neutron-ovn-agent[1508320]: 2026-09-01 20:50:37.543 1508320 INFO neutron.agent.ovn.metadata.agent [-] Cleaning up ovnmeta-1fea1226-6602-4c17-b368-f603f99a2342 namespace which is not needed anymore
2026-09-01T20:51:22Z neutron-ovn-agent[1508320]: 2026-09-01 20:51:22.812 1508320 INFO neutron.agent.ovn.metadata.agent [-] Port a4442c3c-0aae-435d-ad9c-94b23c9f926d in datapath 1fea1226-6602-4c17-b368-f603f99a2342 bound to our chassis
2026-09-01T20:51:22Z neutron-ovn-agent[1508320]: 2026-09-01 20:51:22.815 1508320 INFO neutron.agent.ovn.metadata.agent [-] Provisioning metadata for network 1fea1226-6602-4c17-b368-f603f99a2342
2026-09-01T20:51:44Z haproxy-metadata-proxy-1fea1226-6602-4c17-b368-f603f99a2342[1524207]: 192.168.122.103:54032 [01/Sep/2026:20:51:40.851] listener listener/metadata 0/0/0/3748/3748 200 284 - - ---- 1/1/0/0/0 0/0 "GET /openstack HTTP/1.1"
2026-09-01T20:51:47Z haproxy-metadata-proxy-1fea1226-6602-4c17-b368-f603f99a2342[1524207]: 192.168.122.103:41138 [01/Sep/2026:20:51:44.602] listener listener/metadata 0/0/0/3318/3318 200 284 - - ---- 1/1/0/0/0 0/0 "GET /openstack HTTP/1.1"
2026-09-01T20:51:51Z haproxy-metadata-proxy-1fea1226-6602-4c17-b368-f603f99a2342[1524207]: 192.168.122.103:41154 [01/Sep/2026:20:51:47.925] listener listener/metadata 0/0/0/3351/3351 200 1054 - - ---- 1/1/0/0/0 0/0 "GET /openstack/2018-08-27/meta_data.json HTTP/1.1"
2026-09-01T20:51:54Z haproxy-metadata-proxy-1fea1226-6602-4c17-b368-f603f99a2342[1524207]: 192.168.122.103:41162 [01/Sep/2026:20:51:51.279] listener listener/metadata 0/0/0/3496/3496 404 309 - - ---- 1/1/0/0/0 0/0 "GET /openstack/2018-08-27/user_data HTTP/1.1"
2026-09-01T20:51:57Z haproxy-metadata-proxy-1fea1226-6602-4c17-b368-f603f99a2342[1524207]: 192.168.122.103:35970 [01/Sep/2026:20:51:54.782] listener listener/metadata 0/0/0/3122/3122 200 140 - - ---- 2/2/0/0/0 0/0 "GET /openstack/2018-08-27/vendor_data.json HTTP/1.1"
2026-09-01T20:52:01Z haproxy-metadata-proxy-1fea1226-6602-4c17-b368-f603f99a2342[1524207]: 192.168.122.103:35978 [01/Sep/2026:20:51:57.907] listener listener/metadata 0/0/0/3513/3513 200 153 - - ---- 2/2/0/0/0 0/0 "GET /openstack/2018-08-27/vendor_data2.json HTTP/1.1"

Consume MicroOVN Northbound and Southbound connections through the
ovn-env content plug. Configure neutron-ovn-agent with the metadata
extension and fail closed when connection data is unavailable
or invalid.

Use the regular configure hook to reconcile the agent after charm-managed
snap settings change. Keep local OVS schema readiness checks
before launch.

Assisted-By: Codex (gpt-5-6-sol)
Signed-off-by: Guillaume Boutry <guillaume.boutry@canonical.com>
Cotyledon creates POSIX semaphores for its multiprocessing managers.
Grant the Ceilometer compute and OVN agents private shared-memory
access so the managers can start under strict confinement.

Assisted-By: Codex (gpt-5-6-sol)
Signed-off-by: Guillaume Boutry <guillaume.boutry@canonical.com>
@gboutry
gboutry requested review from ahmad-can and hemanthnakkina and removed request for ahmad-can September 2, 2026 12:11
@hemanthnakkina

Copy link
Copy Markdown
Collaborator

@gboutry Is ovn-agent required by nodes running network role?

@gboutry

gboutry commented Sep 3, 2026

Copy link
Copy Markdown
Collaborator Author

@hemanthnakkina It is not, ovn-agent, in our current use case, fills the exact same purpose as ovn-neutron-metadata-agent.

(meaning, it's creating the network namespace for the VM to be able to talk to nova metadata api, giving access to cloud init and other info)

@hemanthnakkina hemanthnakkina left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

One minor note: if microovn does not come up, ovn-agent will fail to start and gets self-healed retrying to start the service.

@gboutry

gboutry commented Sep 4, 2026

Copy link
Copy Markdown
Collaborator Author

I believe it's fine to have ovn-agent trying to restart until microovn is back. Because the snap has no other mechanism to know if the other snap is back and healthy.

@gboutry
gboutry merged commit 5637555 into canonical:main Sep 4, 2026
5 of 6 checks passed
@gboutry
gboutry deleted the feat/migrate-to-ovn-agent branch September 7, 2026 14:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants