ebtables is racing with itself when nova and libvirt attempt to create
rules at the same time in the nat table. ebtables now has an explicit
--concurrent flag, that all tools must opt into to prevent ebtables
from inherently being unsafe to run.
libvirt gained this support in 1.2.11, which is too new for our ubuntu
primary testing environment. Nova still hasn't added this support,
though even if it did, we'd run into the issue with libvirt.
We can do the most ghetto thing possible and create a wrapper for
ebtables that does explicit locking on it's own. It's pretty terrible,
but it should work. And it is the kind of work around that people
unable to upgrade libvirt will probably need to do.
This is an opt in value which we should set in the gate to True.
Related-Bug: #1501558
Change-Id: Ic6fa847eba34c21593b9df86a1c2c179534d0ba5
(cherry picked from commit 7860f2ba31)
(cherry picked from commit aca08dedc7)
733d85c5c9