Always update Remote SG Member Container#150
Draft
sven-rosenzweig wants to merge 1 commit intostable/yoga-m3from
Draft
Always update Remote SG Member Container#150sven-rosenzweig wants to merge 1 commit intostable/yoga-m3from
sven-rosenzweig wants to merge 1 commit intostable/yoga-m3from
Conversation
With this simple change, we always update the remote SG member container if either the users updates a OpenStack security group or the sync loop picks up the SG. With this commit, we do not depend the update process on the presence of the remote int the NSX-T agent metadata. In the past, we observed NSX-T SG member container out of sync (missing port IP addresses) as the security_group_member_update was not successfully at first place. Simply enforcing the remote group sync results in more group update calls towards NSX-T API. Updating the security group or port on OpenStack side, results in a RPC call for security_groups_member_updated and security_groups_rule_updated. Additionally, a port update calls port_update, itself calling putting calls for sg_memgers_updated and sg_rules_updated onto the job queue. All updating for security group rules enforces updating of remote security groups membership container now.
sven-rosenzweig
force-pushed
the
fix_sync_membership
branch
from
624577a to
9037a46
Compare
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
With this simple change, we always update the remote SG if we update a OpenStack security group and do not rely whether the group is already present in the in the Metadata.
In the past, we observed NSX-T SG member container out of sync (missing port IP addresses) as the security_group_member_update was not successfully at first place.
Simply enforcing the remote group sync results in more group update calls towards NSX-T API. Updating the security group or port on OpenStack side, results in a RPC call for security_groups_member_updated and security_groups_rule_updated. Additionally, a port update calls port_update, itself calling putting calls for sg_memgers_updated and sg_rules_updated onto the job queue.
All updating for security group rules enforces updating of remote security groups membership container now.