Kevin Benton
19dbbe6f00
The iptables apply logic performs diffs between the rules in the system and the desired rule state. If the format generated in Neutron does not match the format of iptables-save, Neutron will generate unnecessary deletions and adds for rules that it thinks are different when they are actually the same. A simple way to detect mismatches is to run the _apply function twice each time and generate an error if the second one results in changes since that implies that the rules the first one applied did not match the format of iptables-save. However, this comes at a performance cost and doesn't offer benefits to operators. This patch adds a config option to debug_iptables_rules that is set to False by default. When set to True it will perform the secondary check described above. This enables it for all of the jobs that call the gate_hook.sh script. This is only meant to assist catching development errors of iptables, it SHOULD NOT be turned on by operators. Change-Id: I6bee1d51155488e91857ee8bc45470d6a224fa37
5 lines
77 B
Plaintext
5 lines
77 B
Plaintext
[[post-config|/etc/neutron/neutron.conf]]
|
|
|
|
[AGENT]
|
|
debug_iptables_rules=True
|