Maximilian Stinsky
4f5dda8737
Implement neutron-ovn-vpn-agent
This patch implements vpnaas for OVN environments. It deploys
a standalone neutron-ovn-vpn-agent on neutron nodes.
The container no longer requires 'privileged: true'. Running
as the 'neutron' user with specific kernel capabilities ensures
the agent can manage network namespaces and interfaces without
full privileges.
Added capabilities:
- NET_ADMIN # manage interfaces, IPs, routing, firewall
- SYS_ADMIN # create/manage network namespaces
- SYS_PTRACE # allow 'ip netns exec' attach to processes
- DAC_OVERRIDE # bypass file read/write restrictions
- DAC_READ_SEARCH # allow directory traversal and file read
- SETPCAP # retain capabilities for privileged ops
Added security options:
- apparmor=unconfined # disable AppArmor confinement
- seccomp=unconfined # disable seccomp filtering
- label=disable # disable SELinux/labeling
Depends-On: https://review.opendev.org/c/openstack/kolla/+/924302
Closes-Bug: #2048392
Change-Id: I961b1407ae1402d146f0c09924df8e007e331af5
Signed-off-by: Joachim de Groot <joachim.de.groot@menzel-it.net>
Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2026-04-17 09:07:00 +00:00
..
2025-07-21 12:31:40 +00:00
2026-01-23 16:33:19 +00:00
2023-04-28 16:16:55 +02:00
2025-07-21 12:31:40 +00:00
2017-02-15 16:34:51 +08:00
2025-10-06 08:44:53 +00:00
2026-04-17 09:07:00 +00:00
2023-04-28 16:16:55 +02:00
2023-04-28 16:16:55 +02:00
2023-04-28 16:16:55 +02:00
2017-02-15 16:34:51 +08:00
2016-03-08 09:27:26 -05:00
2025-07-21 12:31:40 +00:00
2021-06-30 15:16:12 +01:00
2021-08-17 14:29:33 +02:00
2026-03-19 13:17:03 +01:00
2021-08-17 14:29:33 +02:00
2023-04-28 16:16:55 +02:00
2020-04-04 17:00:17 +02:00
2018-07-21 00:43:50 +00:00
2021-06-30 15:16:12 +01:00