Page MenuHomePhabricator

neutron: introduce a mechanism for setting arbitrary sysctl on netns creating
Closed, ResolvedPublic


Neutron implements virtual routers using linux network namespaces.

The failover can be improved by setting some nf_conntrack sysctl parameters, specifically:

  • nf_conntrack_tcp_loose (understand already established connections) (this is activated by default)
  • nf_conntrack_tcp_be_liberal (disable most TCP checks and improve chances that conntrack understand an already established connection as valid)

I ran some experiments and this directly affects the recovery of failovered NATed TCP connections in the other neutron router.

However, given the neutron virtual router runs in a netns, the sysctl configuration isn't shared with the host system. We need a way to ensure these sysctl parameters are always set up correctly in the auto-generated neutron netns.

My plan to introduce a small python daemon that watches netns creation events and sets proper sysctl parameters, hopefully before traffic starts flowing.

Event Timeline

Change 666616 had a related patch set uploaded (by Arturo Borrero Gonzalez; owner: Arturo Borrero Gonzalez):
[operations/puppet@production] openstack: neutron: add daemon

Change 666616 merged by Arturo Borrero Gonzalez:
[operations/puppet@production] openstack: neutron: add daemon

Mentioned in SAL (#wikimedia-cloud) [2021-02-25T14:56:28Z] <arturo> deployed wmcs-netns-events daemon to all cloudnet servers (T275483)

aborrero triaged this task as Medium priority.
aborrero moved this task from Inbox to Doing on the cloud-services-team (Kanban) board.