b693730102
As described in Idcfdaf3b163ba852c9a2c45d5e0c6c35e643c7f5, the libvirt driver provides port filtering capability. At present, setting the 'allow_same_net_traffic' config option to True allows for same network traffic when using these port filters. This is the default case and is the only case currently tested. While there may be reasons to prevent same net traffic, it is a minority use case that can be achieved in other ways, such as through use of neutron's native port filtering [1] or security groups. Remove this functionality, referring users to the alternatives. This simplifies the relevant code and ensures 'allow_same_net_traffic' is once again a nova-network only option and therefore deprecable. [1] https://blueprints.launchpad.net/neutron/+spec/ml2-ovs-portsecurity Change-Id: I67556f1fc0b62b3db64af6fc09c945af313d8ddb Implements: blueprint centralize-config-options-pike
27 lines
1.1 KiB
YAML
27 lines
1.1 KiB
YAML
---
|
|
upgrade:
|
|
- |
|
|
The libvirt driver provides port filtering capability. This capability is
|
|
enabled when the following is true:
|
|
|
|
- The `nova.virt.libvirt.firewall.IptablesFirewallDriver` firewall driver
|
|
is enabled
|
|
- Security groups are disabled
|
|
- Neutron port filtering is disabled
|
|
- An IPTables-compatible interface is used, e.g. hybrid mode, where the
|
|
VIF is a tap device
|
|
|
|
When enabled, libvirt applies IPTables rules that provide MAC, IP, and
|
|
ARP spoofing protection.
|
|
|
|
Previously, setting the `allow_same_net_traffic` config option to `True`
|
|
allowed for same network traffic when using these port filters. This was
|
|
the default case and was the only case tested. Setting this to `False`
|
|
disabled same network traffic *when using the libvirt driver port filtering
|
|
functionality only*, however, this was neither tested nor documented.
|
|
|
|
Given that there are other better documented and better tested ways to
|
|
approach this, such as through use of neutron's native port filtering or
|
|
security groups, this functionality has been removed. Users should instead
|
|
rely on one of these alternatives.
|