)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"1b706ca7e37b77ceb2bb0691434daae4ffd8b95c","unresolved":true,"context_lines":[{"line_number":7,"context_line":"Implement neutron-ovn-vpn-agent"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This patch implements vpnaas for ovn environements."},{"line_number":10,"context_line":"It deploys the new standalone neutron-ovn-vpn-agent on network nodes."},{"line_number":11,"context_line":"For this patch a new container image is required [1]."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"[1] https://review.opendev.org/c/openstack/kolla/+/924302"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"12e2dd51_fff348fc","line":10,"range":{"start_line":10,"start_character":55,"end_line":10,"end_character":62},"updated":"2024-07-29 14:17:12.000000000","message":"nit: it actually now deploys on neutron nodes :)","commit_id":"f840f54e96458878be324b4c445bdf5874e23f33"},{"author":{"_account_id":34380,"name":"Maximilian Stinsky","email":"maximilian@stinsky.com","username":"mstinsky"},"change_message_id":"bc8ec00cda55d4296ebeb54c954eaa431607b668","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Implement neutron-ovn-vpn-agent"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This patch implements vpnaas for ovn environements."},{"line_number":10,"context_line":"It deploys the new standalone neutron-ovn-vpn-agent on network nodes."},{"line_number":11,"context_line":"For this patch a new container image is required [1]."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"[1] https://review.opendev.org/c/openstack/kolla/+/924302"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"72e17427_c827dc73","line":10,"range":{"start_line":10,"start_character":55,"end_line":10,"end_character":62},"in_reply_to":"12e2dd51_fff348fc","updated":"2024-07-30 10:04:48.000000000","message":"Done","commit_id":"f840f54e96458878be324b4c445bdf5874e23f33"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"c01c6cc6182f437bc17356b13daf8eeeca80c1a4","unresolved":true,"context_lines":[{"line_number":10,"context_line":"It deploys the new standalone neutron-ovn-vpn-agent on network nodes."},{"line_number":11,"context_line":"For this patch a new container image is required [1]."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"[1] https://review.opendev.org/c/openstack/kolla/+/924302"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Closes-Bug: #2048392"},{"line_number":16,"context_line":"Change-Id: I961b1407ae1402d146f0c09924df8e007e331af5"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"50306c20_04cfd863","line":13,"range":{"start_line":13,"start_character":0,"end_line":13,"end_character":2},"updated":"2024-07-29 10:22:01.000000000","message":"write this as: `Depends-On: https://review.opendev.org/c/openstack/kolla/+/924302`\n\nso gerrit can recognize the dependency.\n\nsee the docs for more information: https://docs.opendev.org/opendev/infra-manual/latest/developers.html#cross-repository-dependencies","commit_id":"f840f54e96458878be324b4c445bdf5874e23f33"},{"author":{"_account_id":34380,"name":"Maximilian Stinsky","email":"maximilian@stinsky.com","username":"mstinsky"},"change_message_id":"bc8ec00cda55d4296ebeb54c954eaa431607b668","unresolved":false,"context_lines":[{"line_number":10,"context_line":"It deploys the new standalone neutron-ovn-vpn-agent on network nodes."},{"line_number":11,"context_line":"For this patch a new container image is required [1]."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"[1] https://review.opendev.org/c/openstack/kolla/+/924302"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Closes-Bug: #2048392"},{"line_number":16,"context_line":"Change-Id: I961b1407ae1402d146f0c09924df8e007e331af5"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"39f87aa1_68706905","line":13,"range":{"start_line":13,"start_character":0,"end_line":13,"end_character":2},"in_reply_to":"50306c20_04cfd863","updated":"2024-07-30 10:04:48.000000000","message":"Done","commit_id":"f840f54e96458878be324b4c445bdf5874e23f33"},{"author":{"_account_id":23084,"name":"Bartosz Bezak","email":"bartosz@stackhpc.com","username":"b.bezak"},"change_message_id":"cda301ac9317f64a8b1b34f1c257c08a36c0b7fd","unresolved":true,"context_lines":[{"line_number":10,"context_line":"a standalone neutron-ovn-vpn-agent on neutron nodes."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"The container no longer requires \u0027privileged: true\u0027. Running"},{"line_number":13,"context_line":"as root with specific kernel capabilities ensures the agent"},{"line_number":14,"context_line":"can manage network namespaces and interfaces without full"},{"line_number":15,"context_line":"privileges."},{"line_number":16,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":106,"id":"3a032c8c_51507b04","line":13,"updated":"2026-04-16 09:33:44.000000000","message":"NIT: container runs as neutron user - https://opendev.org/openstack/kolla/src/commit/050abd26cc639e4c6b001eb21fe23708866e4f27/docker/neutron/neutron-ovn-vpn-agent/Dockerfile.j2#L31","commit_id":"579cdc6f20145eb0b5ce4a82ba6bf13877af7216"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"287495c1c922a7ab374fd333ce3ca85039d41087","unresolved":false,"context_lines":[{"line_number":10,"context_line":"a standalone neutron-ovn-vpn-agent on neutron nodes."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"The container no longer requires \u0027privileged: true\u0027. Running"},{"line_number":13,"context_line":"as root with specific kernel capabilities ensures the agent"},{"line_number":14,"context_line":"can manage network namespaces and interfaces without full"},{"line_number":15,"context_line":"privileges."},{"line_number":16,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":106,"id":"0a1153ea_e5ec6c5a","line":13,"in_reply_to":"3a032c8c_51507b04","updated":"2026-04-16 13:31:02.000000000","message":"Acknowledged","commit_id":"579cdc6f20145eb0b5ce4a82ba6bf13877af7216"},{"author":{"_account_id":23084,"name":"Bartosz Bezak","email":"bartosz@stackhpc.com","username":"b.bezak"},"change_message_id":"cda301ac9317f64a8b1b34f1c257c08a36c0b7fd","unresolved":true,"context_lines":[{"line_number":26,"context_line":"  - apparmor\u003dunconfined  # disable AppArmor confinement"},{"line_number":27,"context_line":"  - seccomp\u003dunconfined   # disable seccomp filtering"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"Also adds support for \u0027user\u0027 parameter in kolla_container"},{"line_number":30,"context_line":"module, enabling explicit container user configuration."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Depends-On: https://review.opendev.org/c/openstack/kolla/+/924302"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":106,"id":"a72ab764_9e928549","line":29,"updated":"2026-04-16 09:33:44.000000000","message":"this is not case in current version of the patch","commit_id":"579cdc6f20145eb0b5ce4a82ba6bf13877af7216"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"287495c1c922a7ab374fd333ce3ca85039d41087","unresolved":false,"context_lines":[{"line_number":26,"context_line":"  - apparmor\u003dunconfined  # disable AppArmor confinement"},{"line_number":27,"context_line":"  - seccomp\u003dunconfined   # disable seccomp filtering"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"Also adds support for \u0027user\u0027 parameter in kolla_container"},{"line_number":30,"context_line":"module, enabling explicit container user configuration."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Depends-On: https://review.opendev.org/c/openstack/kolla/+/924302"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":106,"id":"66f8c2d8_919a33d0","line":29,"in_reply_to":"a72ab764_9e928549","updated":"2026-04-16 13:31:02.000000000","message":"Done","commit_id":"579cdc6f20145eb0b5ce4a82ba6bf13877af7216"}],"/PATCHSET_LEVEL":[{"author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"change_message_id":"54460dc5746a6b4a85185b2720769b3a90cb5245","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"c9cbd1f4_df871f24","updated":"2024-07-23 12:04:36.000000000","message":"seems you also need to add the new group to tests/templates/inventory.j2","commit_id":"f1a3a6e3ddbce4c2b553f91e951d990636c38696"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"1b706ca7e37b77ceb2bb0691434daae4ffd8b95c","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":4,"id":"4aaaff6c_20ef6d14","updated":"2024-07-29 14:17:12.000000000","message":"I guess this needs some at least some minimal docs on how to actually use it.","commit_id":"f840f54e96458878be324b4c445bdf5874e23f33"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"1b706ca7e37b77ceb2bb0691434daae4ffd8b95c","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"6327f87a_da27a596","updated":"2024-07-29 14:17:12.000000000","message":"I guess this needs some at least some minimal docs on how to actually use it.","commit_id":"f840f54e96458878be324b4c445bdf5874e23f33"},{"author":{"_account_id":34380,"name":"Maximilian Stinsky","email":"maximilian@stinsky.com","username":"mstinsky"},"change_message_id":"bc8ec00cda55d4296ebeb54c954eaa431607b668","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"6f4cbf4d_3bdd4749","in_reply_to":"4aaaff6c_20ef6d14","updated":"2024-07-30 10:04:48.000000000","message":"I had a look into the existing vpnaas documentation. The overall config flag stays the same but the documentation was quite outdated with a vpn agent that does not exist anymore. Changed the minimal doc slightly to reflect the current state.\n\nThe documentation also points to a test script `tools/init-vpn` which also looked very outdated so I refactored it a bit to use up to date openstack commands.","commit_id":"f840f54e96458878be324b4c445bdf5874e23f33"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"eda672fc99a7f5b64fef5f16e0e6ede155969cf7","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"547cda1f_1bc354cd","updated":"2024-07-30 14:59:24.000000000","message":"Thanks for providing this @maximilian@stinsky.com ! Especially the updated docs are appreciated!\n\nThat being said I miss some precise justification why this container needs to run privileged, see my comment for details.\n\nMost of this really LGTM though, thanks!","commit_id":"a0fd273021babbee5bb4f7c897667134db401abb"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"537a966c061531d2a9aa56bb53c0d8fb63c23c8b","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":8,"id":"cff3d40c_9c657e21","updated":"2024-08-06 15:35:54.000000000","message":"a tentative +1 from me, as I\u0027m not sure if we want/need more tests for this (might get complicated).","commit_id":"db4f74a65462c69b9176a735a2118b0bff81bd4a"},{"author":{"_account_id":36250,"name":"Przemysław Kuczyński","display_name":"przemekk","email":"przemyslaw.kuczynski@ochk.pl","username":"przemekk"},"change_message_id":"4e44dcdb2b3e5f6fea2229e3211370f7785da3a0","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":9,"id":"f90fb9e6_9d003098","updated":"2024-10-24 09:57:18.000000000","message":"Where is task neutron-db-manage --subproject neutron-vpnaas upgrade head\nhttps://docs.openstack.org/neutron-vpnaas/latest/contributor/vpnaas-for-ovn.html","commit_id":"0831e5cd86e75444974bfa59fc4b8ae2ca22f1a5"},{"author":{"_account_id":27339,"name":"Michal Arbet","email":"michal.arbet@ultimum.io","username":"michalarbet"},"change_message_id":"b7ac0818fc748531db884777d786baf8f5c2a005","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":9,"id":"2a5439ab_ae9d3ca7","updated":"2024-10-23 18:27:56.000000000","message":"recheck Ubuntu reconfigure","commit_id":"0831e5cd86e75444974bfa59fc4b8ae2ca22f1a5"},{"author":{"_account_id":36250,"name":"Przemysław Kuczyński","display_name":"przemekk","email":"przemyslaw.kuczynski@ochk.pl","username":"przemekk"},"change_message_id":"001de7e0deed87b01b2d2a3c46713953f2c4b7ac","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":9,"id":"61981a3e_8c3d3542","in_reply_to":"c98ad7dc_abefdcee","updated":"2026-02-23 12:41:18.000000000","message":"Thanks","commit_id":"0831e5cd86e75444974bfa59fc4b8ae2ca22f1a5"},{"author":{"_account_id":34380,"name":"Maximilian Stinsky","email":"maximilian@stinsky.com","username":"mstinsky"},"change_message_id":"b2b1504d255a11f49c66fa5882a26b3fce1b53d7","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":9,"id":"c98ad7dc_abefdcee","in_reply_to":"f90fb9e6_9d003098","updated":"2024-10-24 10:08:25.000000000","message":"Its built in the neutron-server container:\nhttps://github.com/openstack/kolla/blob/71d7edd61512cdd56f1cd2c04beec83c5ab72e23/docker/neutron/neutron-server/extend_start.sh#L7-L11\n\nAnd passed into the bootstrap container when `enable_neutron_vpnaas` is set to true: https://github.com/openstack/kolla-ansible/blob/cffaa8983105cdeff5ec75954c4a50a587601b0d/ansible/roles/neutron/tasks/bootstrap_service.yml#L13","commit_id":"0831e5cd86e75444974bfa59fc4b8ae2ca22f1a5"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"844171c754e96da5a2d7d8b683322250f4728811","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":13,"id":"30a8976c_0b910fac","updated":"2025-01-28 15:58:34.000000000","message":"Can we get some CI scenario deploying that?","commit_id":"64cad0134eba606dd29b45fe21c7db289b2c0928"},{"author":{"_account_id":37355,"name":"Pablo Colson","display_name":"Pablo Colson","email":"colson.pablo@gmail.com","username":"pabloclsn"},"change_message_id":"4f26eb9f6866b3cc870689bcc8f4c1f5ec856562","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":13,"id":"6cbadadf_4aca9235","in_reply_to":"12a4cc95_60d0c177","updated":"2025-01-28 18:11:02.000000000","message":"Oh my bad","commit_id":"64cad0134eba606dd29b45fe21c7db289b2c0928"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"223cac7c3e9e07d47e997e9aa16d72747f6cd950","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":13,"id":"0774bdb3_64a28f98","in_reply_to":"145e3281_cd372106","updated":"2026-01-28 14:22:07.000000000","message":"Acknowledged","commit_id":"64cad0134eba606dd29b45fe21c7db289b2c0928"},{"author":{"_account_id":37355,"name":"Pablo Colson","display_name":"Pablo Colson","email":"colson.pablo@gmail.com","username":"pabloclsn"},"change_message_id":"85f06408fc9d4dfd96bc2ec13a32e3fb86ed21fa","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":13,"id":"dac19dae_330a06c3","in_reply_to":"2d39375c_0c5d8822","updated":"2025-02-13 15:46:43.000000000","message":"@maximilian@stinsky.com ?","commit_id":"64cad0134eba606dd29b45fe21c7db289b2c0928"},{"author":{"_account_id":36250,"name":"Przemysław Kuczyński","display_name":"przemekk","email":"przemyslaw.kuczynski@ochk.pl","username":"przemekk"},"change_message_id":"001de7e0deed87b01b2d2a3c46713953f2c4b7ac","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":13,"id":"659ffd81_cae9a252","in_reply_to":"2d39375c_0c5d8822","updated":"2026-02-23 12:41:18.000000000","message":"I think all tests are in /init-vpn file  . Just create vpn site to site using gui and CLI . We have old solution yet. So i cant verify if this approach works","commit_id":"64cad0134eba606dd29b45fe21c7db289b2c0928"},{"author":{"_account_id":37355,"name":"Pablo Colson","display_name":"Pablo Colson","email":"colson.pablo@gmail.com","username":"pabloclsn"},"change_message_id":"974ec09f93c245088367edda5bcec0cc72f35f01","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":13,"id":"72e182f2_163b044e","in_reply_to":"30a8976c_0b910fac","updated":"2025-01-28 17:26:28.000000000","message":"It seems that a physnet is required, do you know if it\u0027s possible to create a vlan provider type network in CI ?","commit_id":"64cad0134eba606dd29b45fe21c7db289b2c0928"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"b849b2d297aac03c0f938557162150f28727c1c6","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":13,"id":"6d57e098_bf5a702e","in_reply_to":"659ffd81_cae9a252","updated":"2026-04-09 13:04:57.000000000","message":"Acknowledged","commit_id":"64cad0134eba606dd29b45fe21c7db289b2c0928"},{"author":{"_account_id":37355,"name":"Pablo Colson","display_name":"Pablo Colson","email":"colson.pablo@gmail.com","username":"pabloclsn"},"change_message_id":"3ca32acb223d6a135d5fca7d973ceab0036b3e42","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":13,"id":"2d39375c_0c5d8822","in_reply_to":"6cbadadf_4aca9235","updated":"2025-01-29 19:01:35.000000000","message":"I was looking at the doc for vpnaas (https://docs.openstack.org/neutron/latest/admin/vpnaas-scenario.html) last time I tried vpnaas on my openstack with OVN the only time you have a problem is during this command (openstack vpn ipsec site connection create conn) before that everything is working. My question is what kind of test do we need te do ? A good test would be to to pass this last command. I really don\u0027t know if it\u0027s possible looking as the current tests with my comprehension","commit_id":"64cad0134eba606dd29b45fe21c7db289b2c0928"},{"author":{"_account_id":37355,"name":"Pablo Colson","display_name":"Pablo Colson","email":"colson.pablo@gmail.com","username":"pabloclsn"},"change_message_id":"707e6d3727d81aec5738c19bcfadb6938b60fb16","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":13,"id":"7ee73de6_c9cc0d9f","in_reply_to":"72e182f2_163b044e","updated":"2025-01-28 17:26:37.000000000","message":"https://docs.openstack.org/ovn-bgp-agent/latest/examples/nb_evpn_vrf.html#configure-provider-networks","commit_id":"64cad0134eba606dd29b45fe21c7db289b2c0928"},{"author":{"_account_id":34380,"name":"Maximilian Stinsky","email":"maximilian@stinsky.com","username":"mstinsky"},"change_message_id":"19de9d7c782d22a163cb2740df79c2ec7eb2c794","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":13,"id":"12a4cc95_60d0c177","in_reply_to":"7ee73de6_c9cc0d9f","updated":"2025-01-28 18:08:36.000000000","message":"ovn-bgp-agent !\u003d ovn-vpn-agent\nThose are 2 different things @colson.pablo@gmail.com\n\nThis patch implements vpnaas with the ovn-vpn-agent and nothing more.","commit_id":"64cad0134eba606dd29b45fe21c7db289b2c0928"},{"author":{"_account_id":37725,"name":"Joachim de Groot","email":"jdegroot@web.de","username":"jaydg"},"change_message_id":"d90dc0c07a11d9678af36c502ede7f0b84e76d34","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":13,"id":"145e3281_cd372106","in_reply_to":"dac19dae_330a06c3","updated":"2025-08-01 14:30:13.000000000","message":"I added some CI, is this sufficient?","commit_id":"64cad0134eba606dd29b45fe21c7db289b2c0928"},{"author":{"_account_id":34380,"name":"Maximilian Stinsky","email":"maximilian@stinsky.com","username":"mstinsky"},"change_message_id":"1fba4c1b2e08334ab3cf5aa92f32bfd8218921d6","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":18,"id":"d914bbed_70d5737d","updated":"2025-08-20 15:07:13.000000000","message":"@jdegroot@web.de with the latest rebase patch you uploaded, I suspect you need to enable the new neutron-rpc-server when vpnaas is enabled. At the moment the rpc server is only startet in ovs and linuxbridge setups but the ovn vpnagent is using rpc to talk with the api.","commit_id":"965557db02245dea4804c13727de62ed82cfee24"},{"author":{"_account_id":37725,"name":"Joachim de Groot","email":"jdegroot@web.de","username":"jaydg"},"change_message_id":"516003a117881dc1078367bff8060aaf0327e064","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":18,"id":"30d2d933_71ac21e1","in_reply_to":"d914bbed_70d5737d","updated":"2025-11-10 07:00:01.000000000","message":"Definitely resolved with I66dae0f64e0a80e5f35ff6176956a44341411200","commit_id":"965557db02245dea4804c13727de62ed82cfee24"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"223cac7c3e9e07d47e997e9aa16d72747f6cd950","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":18,"id":"db0d3b83_459a6230","in_reply_to":"d914bbed_70d5737d","updated":"2026-01-28 14:22:07.000000000","message":"It\u0027s been reworked in a separate change","commit_id":"965557db02245dea4804c13727de62ed82cfee24"},{"author":{"_account_id":38777,"name":"Martin Fleischer","display_name":"butjar.mit","email":"martin.fleischer@menzel-it.net","username":"butjar.mit"},"change_message_id":"b5bcbf4254a65ff539b109451dac745c31c93606","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":54,"id":"de08e59e_ca6911a1","updated":"2026-03-04 15:35:27.000000000","message":"Added comment about removed privileged mode and added capabilities.","commit_id":"f5b6abc7209ebfa0a96f9671661aee945a7d4dbc"},{"author":{"_account_id":38853,"name":"Murat Mehmet Berksoy","display_name":"mberksoy","email":"mberksoy@vmind.com.tr","username":"calpazhan"},"change_message_id":"f448a90e789171fe0f7eba84e01813114bb5de1c","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":54,"id":"df511e76_9e80d7cc","updated":"2026-02-23 11:07:42.000000000","message":"Hi Maximilian and Kolla team. We are currently testing OVN-based deployments and this agent is a critical missing piece for us. Is there any help needed to get this through the finish line for the next release?","commit_id":"f5b6abc7209ebfa0a96f9671661aee945a7d4dbc"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"43b032486882095958a9b2151e7dbeb3debd1e4e","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":54,"id":"1f3f7da7_1e6a71e5","updated":"2026-02-23 11:37:44.000000000","message":"Recheck - ci probkems","commit_id":"f5b6abc7209ebfa0a96f9671661aee945a7d4dbc"},{"author":{"_account_id":34380,"name":"Maximilian Stinsky","email":"maximilian@stinsky.com","username":"mstinsky"},"change_message_id":"6c1fda82fba930068441cdfd4280f0c0f82a17a4","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":54,"id":"fa9696ad_40e3b5b4","in_reply_to":"3e8ea45c_2cc30c48","updated":"2026-02-23 12:04:21.000000000","message":"Forgot to add, the ovn vpnaas code had other small issues which meant ipsec configs were not updated and services not stopped correctly.\nMost of our patches were already merged but they are only available in vpnaas master branch and one patch is still missing:\nhttps://review.opendev.org/c/openstack/neutron-vpnaas/+/963490\nhttps://review.opendev.org/c/openstack/neutron-vpnaas/+/963493\nhttps://review.opendev.org/c/openstack/neutron-vpnaas/+/963487","commit_id":"f5b6abc7209ebfa0a96f9671661aee945a7d4dbc"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"5067ed57159c6ace79ee95125e6b22cebbdca837","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":54,"id":"eca27b48_9c9b31ce","in_reply_to":"df511e76_9e80d7cc","updated":"2026-02-23 11:33:22.000000000","message":"Hi! I really wanted to get this finished, but lately we\u0027ve been facing a lot of issues with OVN and CI. As soon as the CI tests start running correctly, I will finish it. Just so you know, I\u0027ve been using this code in production since the 2024.2 release and it works fine, so you might consider merging it as is.\n\nPatchset 51 - test VPN green","commit_id":"f5b6abc7209ebfa0a96f9671661aee945a7d4dbc"},{"author":{"_account_id":34380,"name":"Maximilian Stinsky","email":"maximilian@stinsky.com","username":"mstinsky"},"change_message_id":"579dfc1f60de8b441e2aa2b563183dc23d7e0efb","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":54,"id":"3e8ea45c_2cc30c48","in_reply_to":"eca27b48_9c9b31ce","updated":"2026-02-23 11:59:42.000000000","message":"Just to add we are also running a similar patch since over a year in our production env, its working fine. Feel free to backport and use it :)\n\nOne important side note when using in production (unrelated to kolla). Automatic failover of vpn agents is broken in neutron. Related patches are: https://review.opendev.org/c/openstack/neutron/+/939817 https://review.opendev.org/c/openstack/neutron-vpnaas/+/939978\n\nMake sure you build neutron containers with those patches otherwise vpn services will stay offline when a hosting node goes down.","commit_id":"f5b6abc7209ebfa0a96f9671661aee945a7d4dbc"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"1917c880e4d29fcf2dae8bab286f7c066d6f52b2","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":55,"id":"fb598d86_5b9973de","updated":"2026-03-10 07:28:54.000000000","message":"Recheck - CI horizon problems fix","commit_id":"a32d7bf8e873a59d906421f8c9789e8252f3eb9c"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"9a99336a2d97d734d7b9dadbafe07fe6dbe0cf3c","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":57,"id":"dacd2fe4_437e12d1","updated":"2026-03-13 07:09:34.000000000","message":"recheck - CI fixed (Horizon, etc.)","commit_id":"5be10e614511b175abaa7a6f8f81357cbb8ff8ff"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"ca9b7693a3ff36d30570a0c773a385e33141afc7","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":57,"id":"4053f90a_436623bd","updated":"2026-03-17 19:38:27.000000000","message":"recheck - horizon is working again","commit_id":"5be10e614511b175abaa7a6f8f81357cbb8ff8ff"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"00700d9b54b253e986a2206fb2e4d2ec47458ccb","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":57,"id":"149df162_872ac736","updated":"2026-03-13 09:51:00.000000000","message":"recheck releases.openstack.org  down - connection refused","commit_id":"5be10e614511b175abaa7a6f8f81357cbb8ff8ff"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"ba5fbe71b7ad17478c227de965797117dc44cd4e","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":99,"id":"053fa45a_0cf9f720","updated":"2026-04-09 12:40:48.000000000","message":"recheck - debian","commit_id":"589b73d85f71db3a7ba09d9960dcf1db0f00259b"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"30d5709c03ea0ee14eaf3a8f119c7484e7a9513e","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":100,"id":"10c50a61_1ca36c25","updated":"2026-04-09 15:42:04.000000000","message":"recheck","commit_id":"4b94aff80324b7d7ae86e602ca56e889d00bfc6f"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"3060ae7d2d56f0c62443771987973a41f277b233","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":106,"id":"2e18b5f1_2e352c1f","updated":"2026-04-14 12:41:20.000000000","message":"recheck - fail mariadb-upgrade","commit_id":"579cdc6f20145eb0b5ce4a82ba6bf13877af7216"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"fab5cbc361e513e5bcc5cd200fd3afc772793748","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":108,"id":"8bfedf20_c380f3a8","updated":"2026-04-16 13:29:18.000000000","message":"recheck - debian TIMED_OUT","commit_id":"4c486bccdef0c506d881f3d4aac201e19710ed16"},{"author":{"_account_id":23084,"name":"Bartosz Bezak","email":"bartosz@stackhpc.com","username":"b.bezak"},"change_message_id":"46da98aba1827d9ae5023b90c66fe678a3695828","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":108,"id":"09f95e39_0f3ed76a","updated":"2026-04-17 08:58:31.000000000","message":"we\u0027re almost there, those two bits were probably not added because of this feature was introduced before those global changes","commit_id":"4c486bccdef0c506d881f3d4aac201e19710ed16"}],"ansible/inventory/multinode":[{"author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"change_message_id":"358c3b88e510ddfa646099af4b80f8468dcb3f43","unresolved":true,"context_lines":[{"line_number":281,"context_line":"network"},{"line_number":282,"context_line":""},{"line_number":283,"context_line":"[neutron-ovn-vpn-agent:children]"},{"line_number":284,"context_line":"network"},{"line_number":285,"context_line":""},{"line_number":286,"context_line":"# Cinder"},{"line_number":287,"context_line":"[cinder-api:children]"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"3afb9798_5df7de6b","line":284,"range":{"start_line":284,"start_character":0,"end_line":284,"end_character":7},"updated":"2024-07-22 16:19:53.000000000","message":"I think `neutron` would be better here","commit_id":"75609413bd20c83b403a253aa75c6e350eee7176"},{"author":{"_account_id":34380,"name":"Maximilian Stinsky","email":"maximilian@stinsky.com","username":"mstinsky"},"change_message_id":"8bd70af1333a53127385ca7376951bd2511d582f","unresolved":true,"context_lines":[{"line_number":281,"context_line":"network"},{"line_number":282,"context_line":""},{"line_number":283,"context_line":"[neutron-ovn-vpn-agent:children]"},{"line_number":284,"context_line":"network"},{"line_number":285,"context_line":""},{"line_number":286,"context_line":"# Cinder"},{"line_number":287,"context_line":"[cinder-api:children]"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"c744e7c0_0703070b","line":284,"range":{"start_line":284,"start_character":0,"end_line":284,"end_character":7},"in_reply_to":"3afb9798_5df7de6b","updated":"2024-07-22 18:08:59.000000000","message":"Out of curiosity what is the reasoning behind using `neutron` over `network`?\n\nI\u0027ll push a second patch tomorrow to change both your comments.","commit_id":"75609413bd20c83b403a253aa75c6e350eee7176"},{"author":{"_account_id":34380,"name":"Maximilian Stinsky","email":"maximilian@stinsky.com","username":"mstinsky"},"change_message_id":"8e1137d4a68f83d7597f93f3e16860c49adc5fe0","unresolved":false,"context_lines":[{"line_number":281,"context_line":"network"},{"line_number":282,"context_line":""},{"line_number":283,"context_line":"[neutron-ovn-vpn-agent:children]"},{"line_number":284,"context_line":"network"},{"line_number":285,"context_line":""},{"line_number":286,"context_line":"# Cinder"},{"line_number":287,"context_line":"[cinder-api:children]"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"f60804c7_8616a1b7","line":284,"range":{"start_line":284,"start_character":0,"end_line":284,"end_character":7},"in_reply_to":"a6021445_4b55e59f","updated":"2024-07-23 06:49:47.000000000","message":"Okay, thanks for the explanation.\nChanged.","commit_id":"75609413bd20c83b403a253aa75c6e350eee7176"},{"author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"change_message_id":"dff4c8da714fe687151b932ea95a06b56da17a38","unresolved":true,"context_lines":[{"line_number":281,"context_line":"network"},{"line_number":282,"context_line":""},{"line_number":283,"context_line":"[neutron-ovn-vpn-agent:children]"},{"line_number":284,"context_line":"network"},{"line_number":285,"context_line":""},{"line_number":286,"context_line":"# Cinder"},{"line_number":287,"context_line":"[cinder-api:children]"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"a6021445_4b55e59f","line":284,"range":{"start_line":284,"start_character":0,"end_line":284,"end_character":7},"in_reply_to":"c744e7c0_0703070b","updated":"2024-07-23 06:32:46.000000000","message":"This is mainly for consistency with what the other agents are using. In the default setup it doesn\u0027t matter much, as the groups are defined identically, but the idea is that the network group can also comprise other services like octavia and the neutron group would then be a more specific subset of hosts.","commit_id":"75609413bd20c83b403a253aa75c6e350eee7176"}],"ansible/roles/neutron/defaults/main.yml":[{"author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"change_message_id":"358c3b88e510ddfa646099af4b80f8468dcb3f43","unresolved":true,"context_lines":[{"line_number":209,"context_line":"    dimensions: \"{{ neutron_ovn_agent_dimensions }}\""},{"line_number":210,"context_line":"    healthcheck: \"{{ neutron_ovn_agent_healthcheck }}\""},{"line_number":211,"context_line":"  neutron-ovn-vpn-agent:"},{"line_number":212,"context_line":"    container_name: \"neutron_ovn_vpn_agent\""},{"line_number":213,"context_line":"    image: \"{{ neutron_ovn_vpn_agent_image_full }}\""},{"line_number":214,"context_line":"    enabled: \"{{ enable_neutron_vpnaas | bool and neutron_plugin_agent \u003d\u003d \u0027ovn\u0027 }}\""},{"line_number":215,"context_line":"    privileged: True"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"8f796fd8_d0edb012","line":212,"updated":"2024-07-22 16:19:53.000000000","message":"missing `group:` entry\n\nalso keeping the ordering of the keys the same as for the previous agent would be helpful","commit_id":"75609413bd20c83b403a253aa75c6e350eee7176"},{"author":{"_account_id":34380,"name":"Maximilian Stinsky","email":"maximilian@stinsky.com","username":"mstinsky"},"change_message_id":"3b97798f2e1b976733f1b67dfaea27a825dba812","unresolved":false,"context_lines":[{"line_number":209,"context_line":"    dimensions: \"{{ neutron_ovn_agent_dimensions }}\""},{"line_number":210,"context_line":"    healthcheck: \"{{ neutron_ovn_agent_healthcheck }}\""},{"line_number":211,"context_line":"  neutron-ovn-vpn-agent:"},{"line_number":212,"context_line":"    container_name: \"neutron_ovn_vpn_agent\""},{"line_number":213,"context_line":"    image: \"{{ neutron_ovn_vpn_agent_image_full }}\""},{"line_number":214,"context_line":"    enabled: \"{{ enable_neutron_vpnaas | bool and neutron_plugin_agent \u003d\u003d \u0027ovn\u0027 }}\""},{"line_number":215,"context_line":"    privileged: True"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"178ccc01_dd3c9d2a","line":212,"in_reply_to":"8f796fd8_d0edb012","updated":"2024-07-23 06:33:14.000000000","message":"Done","commit_id":"75609413bd20c83b403a253aa75c6e350eee7176"},{"author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"change_message_id":"8508c1c5c7f605ade56916a3205ced890b067a40","unresolved":true,"context_lines":[{"line_number":213,"context_line":"    image: \"{{ neutron_ovn_vpn_agent_image_full }}\""},{"line_number":214,"context_line":"    privileged: True"},{"line_number":215,"context_line":"    enabled: \"{{ enable_neutron_vpnaas | bool and neutron_plugin_agent \u003d\u003d \u0027ovn\u0027 }}\""},{"line_number":216,"context_line":"    group: neuron-ovn-vpn-agent"},{"line_number":217,"context_line":"    host_in_groups: \"{{ inventory_hostname in groups[\u0027neutron-ovn-vpn-agent\u0027] }}\""},{"line_number":218,"context_line":"    volumes: \"{{ neutron_ovn_vpn_agent_default_volumes + neutron_ovn_vpn_agent_extra_volumes }}\""},{"line_number":219,"context_line":"    dimensions: \"{{ neutron_ovn_vpn_agent_dimensions }}\""}],"source_content_type":"text/x-yaml","patch_set":2,"id":"43dfa668_cd729205","line":216,"range":{"start_line":216,"start_character":11,"end_line":216,"end_character":17},"updated":"2024-07-23 07:01:09.000000000","message":"neutron","commit_id":"228499535d6f8b8a5d4f66ded982783e0d536429"},{"author":{"_account_id":34380,"name":"Maximilian Stinsky","email":"maximilian@stinsky.com","username":"mstinsky"},"change_message_id":"09493eaa141aa152284953a126dc67f8c97950dc","unresolved":false,"context_lines":[{"line_number":213,"context_line":"    image: \"{{ neutron_ovn_vpn_agent_image_full }}\""},{"line_number":214,"context_line":"    privileged: True"},{"line_number":215,"context_line":"    enabled: \"{{ enable_neutron_vpnaas | bool and neutron_plugin_agent \u003d\u003d \u0027ovn\u0027 }}\""},{"line_number":216,"context_line":"    group: neuron-ovn-vpn-agent"},{"line_number":217,"context_line":"    host_in_groups: \"{{ inventory_hostname in groups[\u0027neutron-ovn-vpn-agent\u0027] }}\""},{"line_number":218,"context_line":"    volumes: \"{{ neutron_ovn_vpn_agent_default_volumes + neutron_ovn_vpn_agent_extra_volumes }}\""},{"line_number":219,"context_line":"    dimensions: \"{{ neutron_ovn_vpn_agent_dimensions }}\""}],"source_content_type":"text/x-yaml","patch_set":2,"id":"0a69dc7e_c74a3de7","line":216,"range":{"start_line":216,"start_character":11,"end_line":216,"end_character":17},"in_reply_to":"43dfa668_cd729205","updated":"2024-07-23 07:59:51.000000000","message":"Done","commit_id":"228499535d6f8b8a5d4f66ded982783e0d536429"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"eda672fc99a7f5b64fef5f16e0e6ede155969cf7","unresolved":true,"context_lines":[{"line_number":211,"context_line":"  neutron-ovn-vpn-agent:"},{"line_number":212,"context_line":"    container_name: \"neutron_ovn_vpn_agent\""},{"line_number":213,"context_line":"    image: \"{{ neutron_ovn_vpn_agent_image_full }}\""},{"line_number":214,"context_line":"    privileged: True"},{"line_number":215,"context_line":"    enabled: \"{{ enable_neutron_vpnaas | bool and neutron_plugin_agent \u003d\u003d \u0027ovn\u0027 }}\""},{"line_number":216,"context_line":"    group: neutron-ovn-vpn-agent"},{"line_number":217,"context_line":"    host_in_groups: \"{{ inventory_hostname in groups[\u0027neutron-ovn-vpn-agent\u0027] }}\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"5f29e442_6c59086d","line":214,"range":{"start_line":214,"start_character":0,"end_line":214,"end_character":2},"updated":"2024-07-30 14:59:24.000000000","message":"I don\u0027t see anything documented anywhere why and what access requirements this container has.\n\nI can imagine that a container that provides VPN connectivity might need e.g. `cap_net_admin`, or possibly even full root access.\n\nIn either case, please document somewhere, or at least link to maybe preexisting documentation, what kind of privilege escalation is necessary.\n\nWe should not provide full root access to software without any written down justification.\n\nAnd of course, the container should only use as little privileges as possible, so please check if full blown root access is really needed or if something like network admin caps are sufficient.\n\nIn my , albeit short, search I wasn\u0027t able to find information on which caps are needed for the ovn vpn agent. Maybe I looked at the wrong place for that kind of information.","commit_id":"a0fd273021babbee5bb4f7c897667134db401abb"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"d3538467c96da3055b6ba68e4a1c37521e519890","unresolved":true,"context_lines":[{"line_number":211,"context_line":"  neutron-ovn-vpn-agent:"},{"line_number":212,"context_line":"    container_name: \"neutron_ovn_vpn_agent\""},{"line_number":213,"context_line":"    image: \"{{ neutron_ovn_vpn_agent_image_full }}\""},{"line_number":214,"context_line":"    privileged: True"},{"line_number":215,"context_line":"    enabled: \"{{ enable_neutron_vpnaas | bool and neutron_plugin_agent \u003d\u003d \u0027ovn\u0027 }}\""},{"line_number":216,"context_line":"    group: neutron-ovn-vpn-agent"},{"line_number":217,"context_line":"    host_in_groups: \"{{ inventory_hostname in groups[\u0027neutron-ovn-vpn-agent\u0027] }}\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"e2a1057b_aa7fe4b1","line":214,"range":{"start_line":214,"start_character":0,"end_line":214,"end_character":2},"in_reply_to":"0433d612_d27e249a","updated":"2024-08-05 15:42:24.000000000","message":"regarding putting your name there: If you search the codebase, you can see it\u0027s done sometimes. I don\u0027t think it\u0027s a strict requirement, as author information can be traced via git history as well.\n\nThank you!","commit_id":"a0fd273021babbee5bb4f7c897667134db401abb"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"b3a3b0bdaea2ee5575a5f267a9e3ae89ec7ce6e0","unresolved":true,"context_lines":[{"line_number":211,"context_line":"  neutron-ovn-vpn-agent:"},{"line_number":212,"context_line":"    container_name: \"neutron_ovn_vpn_agent\""},{"line_number":213,"context_line":"    image: \"{{ neutron_ovn_vpn_agent_image_full }}\""},{"line_number":214,"context_line":"    privileged: True"},{"line_number":215,"context_line":"    enabled: \"{{ enable_neutron_vpnaas | bool and neutron_plugin_agent \u003d\u003d \u0027ovn\u0027 }}\""},{"line_number":216,"context_line":"    group: neutron-ovn-vpn-agent"},{"line_number":217,"context_line":"    host_in_groups: \"{{ inventory_hostname in groups[\u0027neutron-ovn-vpn-agent\u0027] }}\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"744d4b28_103960a2","line":214,"range":{"start_line":214,"start_character":0,"end_line":214,"end_character":2},"in_reply_to":"291d77eb_9ccda635","updated":"2024-07-31 12:38:58.000000000","message":"for now it might be sufficient to just document this in the comments of the patchset.\n\nPersonally I like to have a comment in the sourcecode, e.g.:\n\n```suggestion\n    # (SvenKieske): Security: elevated privileges needed for oslo_privsep daemon\n    privileged: True\n```\n\nThis indicates why such high privileges are needed and has several advantages imho:\n\n- if people copy this code for new services they hopefully see the comment and check if it\u0027s really applying to them, so they don\u0027t end up copying too much privileges around when they don\u0027t need them\n- if in a future iteration oslo_privsep is maybe removed from neutron it\u0027s easily greppable in the codebase and it\u0027s easier to refactor this, e.g. if newer solutions don\u0027t need this many permissions, so we can remove them.\n\nDoes that make sense?\n\nThank you.","commit_id":"a0fd273021babbee5bb4f7c897667134db401abb"},{"author":{"_account_id":34380,"name":"Maximilian Stinsky","email":"maximilian@stinsky.com","username":"mstinsky"},"change_message_id":"dec35eb0f02c941464668754339623e68ef739a8","unresolved":true,"context_lines":[{"line_number":211,"context_line":"  neutron-ovn-vpn-agent:"},{"line_number":212,"context_line":"    container_name: \"neutron_ovn_vpn_agent\""},{"line_number":213,"context_line":"    image: \"{{ neutron_ovn_vpn_agent_image_full }}\""},{"line_number":214,"context_line":"    privileged: True"},{"line_number":215,"context_line":"    enabled: \"{{ enable_neutron_vpnaas | bool and neutron_plugin_agent \u003d\u003d \u0027ovn\u0027 }}\""},{"line_number":216,"context_line":"    group: neutron-ovn-vpn-agent"},{"line_number":217,"context_line":"    host_in_groups: \"{{ inventory_hostname in groups[\u0027neutron-ovn-vpn-agent\u0027] }}\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"c4521520_9ab15085","line":214,"range":{"start_line":214,"start_character":0,"end_line":214,"end_character":2},"in_reply_to":"5f29e442_6c59086d","updated":"2024-07-30 18:44:03.000000000","message":"Even though I share your sentiment this is not what is done in kolla-ansible for any other neutron agent? More or less every neutron agent is running in privileged mode and I was just copying the definition of agents that are doing similar things as the neutron-ovn-vpn-agent which is creating a netns and spawning a process in it.\n\nIf you want me to drop privileged I need to test if `cap_net_admin` is enough.","commit_id":"a0fd273021babbee5bb4f7c897667134db401abb"},{"author":{"_account_id":34380,"name":"Maximilian Stinsky","email":"maximilian@stinsky.com","username":"mstinsky"},"change_message_id":"5fa5ce76f28d30e3f961c8127630a6faa1b85451","unresolved":true,"context_lines":[{"line_number":211,"context_line":"  neutron-ovn-vpn-agent:"},{"line_number":212,"context_line":"    container_name: \"neutron_ovn_vpn_agent\""},{"line_number":213,"context_line":"    image: \"{{ neutron_ovn_vpn_agent_image_full }}\""},{"line_number":214,"context_line":"    privileged: True"},{"line_number":215,"context_line":"    enabled: \"{{ enable_neutron_vpnaas | bool and neutron_plugin_agent \u003d\u003d \u0027ovn\u0027 }}\""},{"line_number":216,"context_line":"    group: neutron-ovn-vpn-agent"},{"line_number":217,"context_line":"    host_in_groups: \"{{ inventory_hostname in groups[\u0027neutron-ovn-vpn-agent\u0027] }}\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"0433d612_d27e249a","line":214,"range":{"start_line":214,"start_character":0,"end_line":214,"end_character":2},"in_reply_to":"744d4b28_103960a2","updated":"2024-07-31 13:21:30.000000000","message":"Sure I can add such a comment.\nIs the name somehow a requirement for comments? I personally dont think a name adds any value to the comment as the person could not be active in the project anymore.","commit_id":"a0fd273021babbee5bb4f7c897667134db401abb"},{"author":{"_account_id":34380,"name":"Maximilian Stinsky","email":"maximilian@stinsky.com","username":"mstinsky"},"change_message_id":"5bb893a77bd2c301268265c229167435ad45ab75","unresolved":true,"context_lines":[{"line_number":211,"context_line":"  neutron-ovn-vpn-agent:"},{"line_number":212,"context_line":"    container_name: \"neutron_ovn_vpn_agent\""},{"line_number":213,"context_line":"    image: \"{{ neutron_ovn_vpn_agent_image_full }}\""},{"line_number":214,"context_line":"    privileged: True"},{"line_number":215,"context_line":"    enabled: \"{{ enable_neutron_vpnaas | bool and neutron_plugin_agent \u003d\u003d \u0027ovn\u0027 }}\""},{"line_number":216,"context_line":"    group: neutron-ovn-vpn-agent"},{"line_number":217,"context_line":"    host_in_groups: \"{{ inventory_hostname in groups[\u0027neutron-ovn-vpn-agent\u0027] }}\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"291d77eb_9ccda635","line":214,"range":{"start_line":214,"start_character":0,"end_line":214,"end_character":2},"in_reply_to":"aaca3087_25836230","updated":"2024-07-31 09:37:03.000000000","message":"The neutron-ovn-vpn-agent is starting the privsep daemon as many other neutron agents. I think that is why privileged access is required.\nWithout the privsep daemon fails to drop its capabilities:\n```\n2024-07-31 09:25:51.661 27 ERROR oslo.privsep.daemon [-] [Errno 1] Operation not permitted\nTraceback (most recent call last):\n  File \"/var/lib/kolla/venv/lib/python3.10/site-packages/oslo_privsep/daemon.py\", line 589, in helper_main\n    Daemon(channel, context).run()\n  File \"/var/lib/kolla/venv/lib/python3.10/site-packages/oslo_privsep/daemon.py\", line 394, in run\n    self._drop_privs()\n  File \"/var/lib/kolla/venv/lib/python3.10/site-packages/oslo_privsep/daemon.py\", line 428, in _drop_privs\n    capabilities.drop_all_caps_except(self.caps, self.caps, [])\n  File \"/var/lib/kolla/venv/lib/python3.10/site-packages/oslo_privsep/capabilities.py\", line 159, in drop_all_caps_except\n    raise OSError(errno, os.strerror(errno))\nPermissionError: [Errno 1] Operation not permitted\n```\nYou mentioned you want to have it documented why privileged is required. Where would this documentation belong? Where do other agents have this documented?","commit_id":"a0fd273021babbee5bb4f7c897667134db401abb"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"147672a2096bdd89532616ffb302b30672d8bc59","unresolved":true,"context_lines":[{"line_number":211,"context_line":"  neutron-ovn-vpn-agent:"},{"line_number":212,"context_line":"    container_name: \"neutron_ovn_vpn_agent\""},{"line_number":213,"context_line":"    image: \"{{ neutron_ovn_vpn_agent_image_full }}\""},{"line_number":214,"context_line":"    privileged: True"},{"line_number":215,"context_line":"    enabled: \"{{ enable_neutron_vpnaas | bool and neutron_plugin_agent \u003d\u003d \u0027ovn\u0027 }}\""},{"line_number":216,"context_line":"    group: neutron-ovn-vpn-agent"},{"line_number":217,"context_line":"    host_in_groups: \"{{ inventory_hostname in groups[\u0027neutron-ovn-vpn-agent\u0027] }}\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"aaca3087_25836230","line":214,"range":{"start_line":214,"start_character":0,"end_line":214,"end_character":2},"in_reply_to":"c4521520_9ab15085","updated":"2024-07-31 07:53:20.000000000","message":"well while the above is certainly true e.g. ironic-neutron-agent is not running privileged by default. In any case I personally would expect for all code contributions that only necessary privileges are used and I would assume that the same research was done in the past.\n\nIt would be great if you can investigate this, thanks.","commit_id":"a0fd273021babbee5bb4f7c897667134db401abb"},{"author":{"_account_id":34380,"name":"Maximilian Stinsky","email":"maximilian@stinsky.com","username":"mstinsky"},"change_message_id":"b68e7ebe185245084be176614792b5dc592dcda6","unresolved":false,"context_lines":[{"line_number":211,"context_line":"  neutron-ovn-vpn-agent:"},{"line_number":212,"context_line":"    container_name: \"neutron_ovn_vpn_agent\""},{"line_number":213,"context_line":"    image: \"{{ neutron_ovn_vpn_agent_image_full }}\""},{"line_number":214,"context_line":"    privileged: True"},{"line_number":215,"context_line":"    enabled: \"{{ enable_neutron_vpnaas | bool and neutron_plugin_agent \u003d\u003d \u0027ovn\u0027 }}\""},{"line_number":216,"context_line":"    group: neutron-ovn-vpn-agent"},{"line_number":217,"context_line":"    host_in_groups: \"{{ inventory_hostname in groups[\u0027neutron-ovn-vpn-agent\u0027] }}\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"8e59e3fc_d33ca9f3","line":214,"range":{"start_line":214,"start_character":0,"end_line":214,"end_character":2},"in_reply_to":"e2a1057b_aa7fe4b1","updated":"2024-08-06 08:24:50.000000000","message":"Added comment.","commit_id":"a0fd273021babbee5bb4f7c897667134db401abb"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"72b32f15aa95e83f76f8db4def1da9db3a4dae4e","unresolved":true,"context_lines":[{"line_number":211,"context_line":"  neutron-ovn-vpn-agent:"},{"line_number":212,"context_line":"    container_name: \"neutron_ovn_vpn_agent\""},{"line_number":213,"context_line":"    image: \"{{ neutron_ovn_vpn_agent_image_full }}\""},{"line_number":214,"context_line":"    # Security: elevated privileges needed for oslo_privsep daemon"},{"line_number":215,"context_line":"    privileged: True"},{"line_number":216,"context_line":"    enabled: \"{{ enable_neutron_vpnaas | bool and neutron_plugin_agent \u003d\u003d \u0027ovn\u0027 }}\""},{"line_number":217,"context_line":"    group: neutron-ovn-vpn-agent"}],"source_content_type":"text/x-yaml","patch_set":10,"id":"3e88f8f8_30871583","line":214,"updated":"2024-11-06 07:43:26.000000000","message":"comments usually are # NOTE: \u003ccontent\u003e\nWhich oslo_privsep actions require the container to be privileged?","commit_id":"45d4f9b1fee44d1382cb34f3417c7e14c225086e"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"0b2ce7f63bb1ace00d361eb85d516597b366cfeb","unresolved":true,"context_lines":[{"line_number":211,"context_line":"  neutron-ovn-vpn-agent:"},{"line_number":212,"context_line":"    container_name: \"neutron_ovn_vpn_agent\""},{"line_number":213,"context_line":"    image: \"{{ neutron_ovn_vpn_agent_image_full }}\""},{"line_number":214,"context_line":"    # Security: elevated privileges needed for oslo_privsep daemon"},{"line_number":215,"context_line":"    privileged: True"},{"line_number":216,"context_line":"    enabled: \"{{ enable_neutron_vpnaas | bool and neutron_plugin_agent \u003d\u003d \u0027ovn\u0027 }}\""},{"line_number":217,"context_line":"    group: neutron-ovn-vpn-agent"}],"source_content_type":"text/x-yaml","patch_set":10,"id":"6b776e86_e5e71363","line":214,"in_reply_to":"234eb42c_bf718375","updated":"2025-08-28 07:38:04.000000000","message":"Seems by default Neutron should be using sudo to run rootwrap-daemon - https://opendev.org/openstack/neutron/src/commit/20adc20274ef0c34ee40b720c193e00a261062f1/neutron/conf/agent/common.py#L79","commit_id":"45d4f9b1fee44d1382cb34f3417c7e14c225086e"},{"author":{"_account_id":34476,"name":"Marc Vorwerk","email":"marc+ubuntu@marc-vorwerk.de","username":"marc-vorwerk"},"change_message_id":"ab0b3254cb0026ce8f1a0dd785397164942a8717","unresolved":true,"context_lines":[{"line_number":211,"context_line":"  neutron-ovn-vpn-agent:"},{"line_number":212,"context_line":"    container_name: \"neutron_ovn_vpn_agent\""},{"line_number":213,"context_line":"    image: \"{{ neutron_ovn_vpn_agent_image_full }}\""},{"line_number":214,"context_line":"    # Security: elevated privileges needed for oslo_privsep daemon"},{"line_number":215,"context_line":"    privileged: True"},{"line_number":216,"context_line":"    enabled: \"{{ enable_neutron_vpnaas | bool and neutron_plugin_agent \u003d\u003d \u0027ovn\u0027 }}\""},{"line_number":217,"context_line":"    group: neutron-ovn-vpn-agent"}],"source_content_type":"text/x-yaml","patch_set":10,"id":"b5b57754_00f838ad","line":214,"in_reply_to":"3e88f8f8_30871583","updated":"2024-11-06 11:56:15.000000000","message":"\u003e comments usually are # NOTE: \u003ccontent\u003e\n\nFixed.\n\n\n\u003e Which oslo_privsep actions require the container to be privileged?\n\nI dont know which action exactly needs it. But as Maximilian already explained, the agent will not start without.","commit_id":"45d4f9b1fee44d1382cb34f3417c7e14c225086e"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"1ca197cd98cababd930d67a0eeb71dd77bb1c8d4","unresolved":true,"context_lines":[{"line_number":211,"context_line":"  neutron-ovn-vpn-agent:"},{"line_number":212,"context_line":"    container_name: \"neutron_ovn_vpn_agent\""},{"line_number":213,"context_line":"    image: \"{{ neutron_ovn_vpn_agent_image_full }}\""},{"line_number":214,"context_line":"    # Security: elevated privileges needed for oslo_privsep daemon"},{"line_number":215,"context_line":"    privileged: True"},{"line_number":216,"context_line":"    enabled: \"{{ enable_neutron_vpnaas | bool and neutron_plugin_agent \u003d\u003d \u0027ovn\u0027 }}\""},{"line_number":217,"context_line":"    group: neutron-ovn-vpn-agent"}],"source_content_type":"text/x-yaml","patch_set":10,"id":"b3c24555_d53d8472","line":214,"in_reply_to":"3e88f8f8_30871583","updated":"2024-11-06 11:48:45.000000000","message":"From what I see - that could be limited to some contexts: https://docs.openstack.org/oslo.privsep/latest/user/index.html","commit_id":"45d4f9b1fee44d1382cb34f3417c7e14c225086e"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"43143d36f4e3fb25529ca880d8eef15cc71d9618","unresolved":false,"context_lines":[{"line_number":211,"context_line":"  neutron-ovn-vpn-agent:"},{"line_number":212,"context_line":"    container_name: \"neutron_ovn_vpn_agent\""},{"line_number":213,"context_line":"    image: \"{{ neutron_ovn_vpn_agent_image_full }}\""},{"line_number":214,"context_line":"    # Security: elevated privileges needed for oslo_privsep daemon"},{"line_number":215,"context_line":"    privileged: True"},{"line_number":216,"context_line":"    enabled: \"{{ enable_neutron_vpnaas | bool and neutron_plugin_agent \u003d\u003d \u0027ovn\u0027 }}\""},{"line_number":217,"context_line":"    group: neutron-ovn-vpn-agent"}],"source_content_type":"text/x-yaml","patch_set":10,"id":"4edd4c06_b25da5a4","line":214,"in_reply_to":"6b776e86_e5e71363","updated":"2026-04-09 12:57:41.000000000","message":"Acknowledged","commit_id":"45d4f9b1fee44d1382cb34f3417c7e14c225086e"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"8bd1bb188de332c512d87a87f412e68cc8d8720a","unresolved":true,"context_lines":[{"line_number":211,"context_line":"  neutron-ovn-vpn-agent:"},{"line_number":212,"context_line":"    container_name: \"neutron_ovn_vpn_agent\""},{"line_number":213,"context_line":"    image: \"{{ neutron_ovn_vpn_agent_image_full }}\""},{"line_number":214,"context_line":"    # Security: elevated privileges needed for oslo_privsep daemon"},{"line_number":215,"context_line":"    privileged: True"},{"line_number":216,"context_line":"    enabled: \"{{ enable_neutron_vpnaas | bool and neutron_plugin_agent \u003d\u003d \u0027ovn\u0027 }}\""},{"line_number":217,"context_line":"    group: neutron-ovn-vpn-agent"}],"source_content_type":"text/x-yaml","patch_set":10,"id":"234eb42c_bf718375","line":214,"in_reply_to":"8441cc11_cdad29ae","updated":"2025-08-28 07:30:15.000000000","message":"I don\u0027t like introducing new things and saying let\u0027s have it as broken as the old things. Reality is - if this gets merged - nobody will come back and figure out which caps are required and make a follow up.","commit_id":"45d4f9b1fee44d1382cb34f3417c7e14c225086e"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"f6e9e1b0bdf04bc04fe57fe08d422ef8b65f2891","unresolved":true,"context_lines":[{"line_number":211,"context_line":"  neutron-ovn-vpn-agent:"},{"line_number":212,"context_line":"    container_name: \"neutron_ovn_vpn_agent\""},{"line_number":213,"context_line":"    image: \"{{ neutron_ovn_vpn_agent_image_full }}\""},{"line_number":214,"context_line":"    # Security: elevated privileges needed for oslo_privsep daemon"},{"line_number":215,"context_line":"    privileged: True"},{"line_number":216,"context_line":"    enabled: \"{{ enable_neutron_vpnaas | bool and neutron_plugin_agent \u003d\u003d \u0027ovn\u0027 }}\""},{"line_number":217,"context_line":"    group: neutron-ovn-vpn-agent"}],"source_content_type":"text/x-yaml","patch_set":10,"id":"b752f01e_75d39b76","line":214,"in_reply_to":"b5b57754_00f838ad","updated":"2024-11-06 12:01:27.000000000","message":"And that is the reason of lowering security? We need to be better than that.","commit_id":"45d4f9b1fee44d1382cb34f3417c7e14c225086e"},{"author":{"_account_id":34380,"name":"Maximilian Stinsky","email":"maximilian@stinsky.com","username":"mstinsky"},"change_message_id":"ce9c0b0e15e35316ddf064d27be391ced8b59d73","unresolved":true,"context_lines":[{"line_number":211,"context_line":"  neutron-ovn-vpn-agent:"},{"line_number":212,"context_line":"    container_name: \"neutron_ovn_vpn_agent\""},{"line_number":213,"context_line":"    image: \"{{ neutron_ovn_vpn_agent_image_full }}\""},{"line_number":214,"context_line":"    # Security: elevated privileges needed for oslo_privsep daemon"},{"line_number":215,"context_line":"    privileged: True"},{"line_number":216,"context_line":"    enabled: \"{{ enable_neutron_vpnaas | bool and neutron_plugin_agent \u003d\u003d \u0027ovn\u0027 }}\""},{"line_number":217,"context_line":"    group: neutron-ovn-vpn-agent"}],"source_content_type":"text/x-yaml","patch_set":10,"id":"8441cc11_cdad29ae","line":214,"in_reply_to":"b752f01e_75d39b76","updated":"2024-11-06 14:00:06.000000000","message":"I would argue that the new vpn agent should stay as a privileged container for this MR. My reasoning is that it is the de facto standard for how oslo_privsep is handled in kolla for now.\nIf we do this differently we have a gap between the agents for years to come.\nDepending on how crucial the security concerns are I would say their should be an effort to change all neutron agents at once to handle specific sys caps instead of privileged access.\n\nBut in the end I am not a kolla-ansible user and if you as the maintainer think its in the best interest for the project to have it this way now for the vpn agent we will figure out which caps are required and make a new patch for it.\n\nWhat do you think @mnasiadka@gmail.com ?","commit_id":"45d4f9b1fee44d1382cb34f3417c7e14c225086e"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"844171c754e96da5a2d7d8b683322250f4728811","unresolved":true,"context_lines":[{"line_number":216,"context_line":"    container_name: \"neutron_ovn_vpn_agent\""},{"line_number":217,"context_line":"    image: \"{{ neutron_ovn_vpn_agent_image_full }}\""},{"line_number":218,"context_line":"    # NOTE: Security: elevated privileges needed for oslo_privsep daemon"},{"line_number":219,"context_line":"    privileged: True"},{"line_number":220,"context_line":"    enabled: \"{{ enable_neutron_vpnaas | bool and neutron_plugin_agent \u003d\u003d \u0027ovn\u0027 }}\""},{"line_number":221,"context_line":"    group: neutron-ovn-vpn-agent"},{"line_number":222,"context_line":"    host_in_groups: \"{{ inventory_hostname in groups[\u0027neutron-ovn-vpn-agent\u0027] }}\""}],"source_content_type":"text/x-yaml","patch_set":13,"id":"082890a5_0424b1d5","line":219,"updated":"2025-01-28 15:58:34.000000000","message":"well, oslo_privsep just need sudo rights - privileged container is something else - so we need more meat to the bone here.","commit_id":"64cad0134eba606dd29b45fe21c7db289b2c0928"},{"author":{"_account_id":38777,"name":"Martin Fleischer","display_name":"butjar.mit","email":"martin.fleischer@menzel-it.net","username":"butjar.mit"},"change_message_id":"b5bcbf4254a65ff539b109451dac745c31c93606","unresolved":true,"context_lines":[{"line_number":216,"context_line":"    container_name: \"neutron_ovn_vpn_agent\""},{"line_number":217,"context_line":"    image: \"{{ neutron_ovn_vpn_agent_image_full }}\""},{"line_number":218,"context_line":"    # NOTE: Security: elevated privileges needed for oslo_privsep daemon"},{"line_number":219,"context_line":"    privileged: True"},{"line_number":220,"context_line":"    enabled: \"{{ enable_neutron_vpnaas | bool and neutron_plugin_agent \u003d\u003d \u0027ovn\u0027 }}\""},{"line_number":221,"context_line":"    group: neutron-ovn-vpn-agent"},{"line_number":222,"context_line":"    host_in_groups: \"{{ inventory_hostname in groups[\u0027neutron-ovn-vpn-agent\u0027] }}\""}],"source_content_type":"text/x-yaml","patch_set":13,"id":"459a6cc1_760d5582","line":219,"in_reply_to":"082890a5_0424b1d5","updated":"2026-03-04 15:35:27.000000000","message":"@mnasiadka@gmail.com: Privileged has been removed in Patchset 32 (https://review.opendev.org/c/openstack/kolla-ansible/+/924575/31..32/ansible/roles/neutron/defaults/main.yml). The added capabilities have been refined in Patchset 37 (https://review.opendev.org/c/openstack/kolla-ansible/+/924575/36..37/ansible/roles/neutron/defaults/main.yml) and Patchset 45 (https://review.opendev.org/c/openstack/kolla-ansible/+/924575/44..45/ansible/roles/neutron/defaults/main.yml).\n\nIs this sufficient? I don\u0027t know about privsep, can you point me anywhere?","commit_id":"64cad0134eba606dd29b45fe21c7db289b2c0928"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"bb2d60668048e58070b500d59d970961ead7f6aa","unresolved":true,"context_lines":[{"line_number":216,"context_line":"    container_name: \"neutron_ovn_vpn_agent\""},{"line_number":217,"context_line":"    image: \"{{ neutron_ovn_vpn_agent_image_full }}\""},{"line_number":218,"context_line":"    # NOTE: Security: elevated privileges needed for oslo_privsep daemon"},{"line_number":219,"context_line":"    privileged: True"},{"line_number":220,"context_line":"    enabled: \"{{ enable_neutron_vpnaas | bool and neutron_plugin_agent \u003d\u003d \u0027ovn\u0027 }}\""},{"line_number":221,"context_line":"    group: neutron-ovn-vpn-agent"},{"line_number":222,"context_line":"    host_in_groups: \"{{ inventory_hostname in groups[\u0027neutron-ovn-vpn-agent\u0027] }}\""}],"source_content_type":"text/x-yaml","patch_set":13,"id":"f24a25b9_cf75edf9","line":219,"in_reply_to":"459a6cc1_760d5582","updated":"2026-03-31 12:40:53.000000000","message":"Acknowledged","commit_id":"64cad0134eba606dd29b45fe21c7db289b2c0928"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"43143d36f4e3fb25529ca880d8eef15cc71d9618","unresolved":false,"context_lines":[{"line_number":216,"context_line":"    container_name: \"neutron_ovn_vpn_agent\""},{"line_number":217,"context_line":"    image: \"{{ neutron_ovn_vpn_agent_image_full }}\""},{"line_number":218,"context_line":"    # NOTE: Security: elevated privileges needed for oslo_privsep daemon"},{"line_number":219,"context_line":"    privileged: True"},{"line_number":220,"context_line":"    enabled: \"{{ enable_neutron_vpnaas | bool and neutron_plugin_agent \u003d\u003d \u0027ovn\u0027 }}\""},{"line_number":221,"context_line":"    group: neutron-ovn-vpn-agent"},{"line_number":222,"context_line":"    host_in_groups: \"{{ inventory_hostname in groups[\u0027neutron-ovn-vpn-agent\u0027] }}\""}],"source_content_type":"text/x-yaml","patch_set":13,"id":"36c1a309_3772e89a","line":219,"in_reply_to":"f24a25b9_cf75edf9","updated":"2026-04-09 12:57:41.000000000","message":"Acknowledged","commit_id":"64cad0134eba606dd29b45fe21c7db289b2c0928"},{"author":{"_account_id":23084,"name":"Bartosz Bezak","email":"bartosz@stackhpc.com","username":"b.bezak"},"change_message_id":"cda301ac9317f64a8b1b34f1c257c08a36c0b7fd","unresolved":true,"context_lines":[{"line_number":227,"context_line":"      - CAP_DAC_READ_SEARCH"},{"line_number":228,"context_line":"      - CAP_SETPCAP"},{"line_number":229,"context_line":"    security_opt:"},{"line_number":230,"context_line":"      - \"apparmor:unconfined\""},{"line_number":231,"context_line":"      - \"seccomp:unconfined\""},{"line_number":232,"context_line":"      - \"label\u003ddisable\""},{"line_number":233,"context_line":"    enabled: \"{{ enable_neutron_vpnaas | bool and neutron_plugin_agent \u003d\u003d \u0027ovn\u0027 }}\""}],"source_content_type":"text/x-yaml","patch_set":106,"id":"08a17fac_95e2c7a9","line":230,"updated":"2026-04-16 09:33:44.000000000","message":"why discrepancy between : and \u003d ?\nfurthermore looks like podman wants \"\u003d\" syntax here - https://docs.podman.io/en/latest/markdown/podman-run.1.html#security-opt-option\n\nthe same as was written in commit message, btw commit message don\u0027t have label\u003ddisable","commit_id":"579cdc6f20145eb0b5ce4a82ba6bf13877af7216"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"287495c1c922a7ab374fd333ce3ca85039d41087","unresolved":false,"context_lines":[{"line_number":227,"context_line":"      - CAP_DAC_READ_SEARCH"},{"line_number":228,"context_line":"      - CAP_SETPCAP"},{"line_number":229,"context_line":"    security_opt:"},{"line_number":230,"context_line":"      - \"apparmor:unconfined\""},{"line_number":231,"context_line":"      - \"seccomp:unconfined\""},{"line_number":232,"context_line":"      - \"label\u003ddisable\""},{"line_number":233,"context_line":"    enabled: \"{{ enable_neutron_vpnaas | bool and neutron_plugin_agent \u003d\u003d \u0027ovn\u0027 }}\""}],"source_content_type":"text/x-yaml","patch_set":106,"id":"e924995b_eff8ec49","line":230,"in_reply_to":"08a17fac_95e2c7a9","updated":"2026-04-16 13:31:02.000000000","message":"Done","commit_id":"579cdc6f20145eb0b5ce4a82ba6bf13877af7216"},{"author":{"_account_id":23084,"name":"Bartosz Bezak","email":"bartosz@stackhpc.com","username":"b.bezak"},"change_message_id":"46da98aba1827d9ae5023b90c66fe678a3695828","unresolved":true,"context_lines":[{"line_number":362,"context_line":"neutron_ovn_agent_tag: \"{{ neutron_tag }}\""},{"line_number":363,"context_line":"neutron_ovn_agent_image_full: \"{{ neutron_ovn_agent_image }}:{{ neutron_ovn_agent_tag }}\""},{"line_number":364,"context_line":""},{"line_number":365,"context_line":"neutron_ovn_vpn_agent_image: \"{{ docker_registry ~ \u0027/\u0027 if docker_registry else \u0027\u0027 }}{{ docker_namespace }}/neutron-ovn-vpn-agent\""},{"line_number":366,"context_line":"neutron_ovn_vpn_agent_tag: \"{{ neutron_tag }}\""},{"line_number":367,"context_line":"neutron_ovn_vpn_agent_image_full: \"{{ neutron_ovn_vpn_agent_image }}:{{ neutron_ovn_vpn_agent_tag }}\""},{"line_number":368,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":108,"id":"845a2880_88ac20f0","line":365,"updated":"2026-04-17 08:58:31.000000000","message":"```suggestion\nneutron_ovn_vpn_agent_image: \"{{ docker_image_url }}neutron-ovn-vpn-agent\"\n```","commit_id":"4c486bccdef0c506d881f3d4aac201e19710ed16"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"c548fd6171bac6ca56dc247357e2b13b66ff26b9","unresolved":false,"context_lines":[{"line_number":362,"context_line":"neutron_ovn_agent_tag: \"{{ neutron_tag }}\""},{"line_number":363,"context_line":"neutron_ovn_agent_image_full: \"{{ neutron_ovn_agent_image }}:{{ neutron_ovn_agent_tag }}\""},{"line_number":364,"context_line":""},{"line_number":365,"context_line":"neutron_ovn_vpn_agent_image: \"{{ docker_registry ~ \u0027/\u0027 if docker_registry else \u0027\u0027 }}{{ docker_namespace }}/neutron-ovn-vpn-agent\""},{"line_number":366,"context_line":"neutron_ovn_vpn_agent_tag: \"{{ neutron_tag }}\""},{"line_number":367,"context_line":"neutron_ovn_vpn_agent_image_full: \"{{ neutron_ovn_vpn_agent_image }}:{{ neutron_ovn_vpn_agent_tag }}\""},{"line_number":368,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":108,"id":"9ccf8306_8350b02c","line":365,"in_reply_to":"845a2880_88ac20f0","updated":"2026-04-17 09:07:09.000000000","message":"Fix applied.","commit_id":"4c486bccdef0c506d881f3d4aac201e19710ed16"}],"ansible/roles/neutron/handlers/main.yml":[{"author":{"_account_id":23084,"name":"Bartosz Bezak","email":"bartosz@stackhpc.com","username":"b.bezak"},"change_message_id":"cda301ac9317f64a8b1b34f1c257c08a36c0b7fd","unresolved":true,"context_lines":[{"line_number":334,"context_line":"    service_name: \"neutron-ovn-vpn-agent\""},{"line_number":335,"context_line":"    service: \"{{ neutron_services[service_name] }}\""},{"line_number":336,"context_line":"  become: true"},{"line_number":337,"context_line":"  kolla_container:"},{"line_number":338,"context_line":"    action: \"recreate_or_restart_container\""},{"line_number":339,"context_line":"    common_options: \"{{ docker_common_options }}\""},{"line_number":340,"context_line":"    environment: \"{{ service.environment | default(omit) }}\""}],"source_content_type":"text/x-yaml","patch_set":106,"id":"82e97a37_2cff3fdc","line":337,"updated":"2026-04-16 09:33:44.000000000","message":"it looks like we lost `cgroupns_mode: private` here, so restart will drop it\n\ncgroupns_mode: \"{{ service.cgroupns_mode | default(omit) }}\"","commit_id":"579cdc6f20145eb0b5ce4a82ba6bf13877af7216"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"287495c1c922a7ab374fd333ce3ca85039d41087","unresolved":false,"context_lines":[{"line_number":334,"context_line":"    service_name: \"neutron-ovn-vpn-agent\""},{"line_number":335,"context_line":"    service: \"{{ neutron_services[service_name] }}\""},{"line_number":336,"context_line":"  become: true"},{"line_number":337,"context_line":"  kolla_container:"},{"line_number":338,"context_line":"    action: \"recreate_or_restart_container\""},{"line_number":339,"context_line":"    common_options: \"{{ docker_common_options }}\""},{"line_number":340,"context_line":"    environment: \"{{ service.environment | default(omit) }}\""}],"source_content_type":"text/x-yaml","patch_set":106,"id":"6f763e51_9d0e2363","line":337,"in_reply_to":"82e97a37_2cff3fdc","updated":"2026-04-16 13:31:02.000000000","message":"Acknowledged","commit_id":"579cdc6f20145eb0b5ce4a82ba6bf13877af7216"}],"ansible/roles/neutron/tasks/config-host.yml":[{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"6b70df4a2a8d454a57612ebc02858a7058245e5a","unresolved":true,"context_lines":[{"line_number":39,"context_line":"  vars:"},{"line_number":40,"context_line":"    vpn_service: \"{{ neutron_services[\u0027neutron-ovn-vpn-agent\u0027] }}\""},{"line_number":41,"context_line":"    settings:"},{"line_number":42,"context_line":"      - { name: \"net.ipv4.conf.all.promote_secondaries\", value: \"{{ neutron_vpn_host_ipv4_promote_secondaries }}\" }"},{"line_number":43,"context_line":"      - { name: \"net.ipv4.conf.default.promote_secondaries\", value: \"{{ neutron_vpn_host_ipv4_promote_secondaries }}\" }"},{"line_number":44,"context_line":"  when:"},{"line_number":45,"context_line":"    - set_sysctl | bool"}],"source_content_type":"text/x-yaml","patch_set":81,"id":"8893d71d_99efd91b","line":42,"updated":"2026-03-30 19:20:56.000000000","message":"why do we need all as well? Default should be enough","commit_id":"d0c69a2bcdab1793d5e91357d1b121d941f4c3fa"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"b849b2d297aac03c0f938557162150f28727c1c6","unresolved":false,"context_lines":[{"line_number":39,"context_line":"  vars:"},{"line_number":40,"context_line":"    vpn_service: \"{{ neutron_services[\u0027neutron-ovn-vpn-agent\u0027] }}\""},{"line_number":41,"context_line":"    settings:"},{"line_number":42,"context_line":"      - { name: \"net.ipv4.conf.all.promote_secondaries\", value: \"{{ neutron_vpn_host_ipv4_promote_secondaries }}\" }"},{"line_number":43,"context_line":"      - { name: \"net.ipv4.conf.default.promote_secondaries\", value: \"{{ neutron_vpn_host_ipv4_promote_secondaries }}\" }"},{"line_number":44,"context_line":"  when:"},{"line_number":45,"context_line":"    - set_sysctl | bool"}],"source_content_type":"text/x-yaml","patch_set":81,"id":"9eb753ff_f3d250f1","line":42,"in_reply_to":"8893d71d_99efd91b","updated":"2026-04-09 13:04:57.000000000","message":"These were also tests for Rocky Linux. Without them, we were seeing strange errors where it couldn\u0027t assign an IP address.","commit_id":"d0c69a2bcdab1793d5e91357d1b121d941f4c3fa"}],"ansible/roles/neutron/tasks/config.yml":[{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"844171c754e96da5a2d7d8b683322250f4728811","unresolved":true,"context_lines":[{"line_number":322,"context_line":"    dest: \"{{ node_config_directory }}/{{ service_name }}/neutron_ovn_vpn_agent.ini\""},{"line_number":323,"context_line":"    mode: \"0660\""},{"line_number":324,"context_line":"  when:"},{"line_number":325,"context_line":"    - neutron_ovn_vpn_agent.enabled | bool"},{"line_number":326,"context_line":"    - neutron_ovn_vpn_agent.host_in_groups | bool"},{"line_number":327,"context_line":"  notify:"},{"line_number":328,"context_line":"    - \"Restart {{ service_name }} container\""}],"source_content_type":"text/x-yaml","patch_set":13,"id":"10851657_023295bc","line":325,"updated":"2025-01-28 15:58:34.000000000","message":"rework it so it uses service | service_enabled_and_mapped_to_host","commit_id":"64cad0134eba606dd29b45fe21c7db289b2c0928"},{"author":{"_account_id":37725,"name":"Joachim de Groot","email":"jdegroot@web.de","username":"jaydg"},"change_message_id":"d90dc0c07a11d9678af36c502ede7f0b84e76d34","unresolved":false,"context_lines":[{"line_number":322,"context_line":"    dest: \"{{ node_config_directory }}/{{ service_name }}/neutron_ovn_vpn_agent.ini\""},{"line_number":323,"context_line":"    mode: \"0660\""},{"line_number":324,"context_line":"  when:"},{"line_number":325,"context_line":"    - neutron_ovn_vpn_agent.enabled | bool"},{"line_number":326,"context_line":"    - neutron_ovn_vpn_agent.host_in_groups | bool"},{"line_number":327,"context_line":"  notify:"},{"line_number":328,"context_line":"    - \"Restart {{ service_name }} container\""}],"source_content_type":"text/x-yaml","patch_set":13,"id":"de94c1b0_a52c9c42","line":325,"in_reply_to":"10851657_023295bc","updated":"2025-08-01 14:30:13.000000000","message":"Done","commit_id":"64cad0134eba606dd29b45fe21c7db289b2c0928"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"6b70df4a2a8d454a57612ebc02858a7058245e5a","unresolved":true,"context_lines":[{"line_number":99,"context_line":"  vars:"},{"line_number":100,"context_line":"    service_name: \"{{ item.key }}\""},{"line_number":101,"context_line":"    services_need_neutron_vpnaas_conf:"},{"line_number":102,"context_line":"      - \"neutron-l3-agent\""},{"line_number":103,"context_line":"      - \"neutron-ovn-maintenance-worker\""},{"line_number":104,"context_line":"      - \"neutron-periodic-worker\""},{"line_number":105,"context_line":"      - \"neutron-rpc-server\""}],"source_content_type":"text/x-yaml","patch_set":81,"id":"43a8b114_21c0badd","side":"PARENT","line":102,"updated":"2026-03-30 19:20:56.000000000","message":"Why reshuffle and not sorted?","commit_id":"2c70177a933c4e3edf380f7b384c81ea85971ceb"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"bb2d60668048e58070b500d59d970961ead7f6aa","unresolved":false,"context_lines":[{"line_number":99,"context_line":"  vars:"},{"line_number":100,"context_line":"    service_name: \"{{ item.key }}\""},{"line_number":101,"context_line":"    services_need_neutron_vpnaas_conf:"},{"line_number":102,"context_line":"      - \"neutron-l3-agent\""},{"line_number":103,"context_line":"      - \"neutron-ovn-maintenance-worker\""},{"line_number":104,"context_line":"      - \"neutron-periodic-worker\""},{"line_number":105,"context_line":"      - \"neutron-rpc-server\""}],"source_content_type":"text/x-yaml","patch_set":81,"id":"adcd877d_45c5cbe4","side":"PARENT","line":102,"in_reply_to":"43a8b114_21c0badd","updated":"2026-03-31 12:40:53.000000000","message":"Acknowledged","commit_id":"2c70177a933c4e3edf380f7b384c81ea85971ceb"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"6b70df4a2a8d454a57612ebc02858a7058245e5a","unresolved":true,"context_lines":[{"line_number":295,"context_line":"  when: service | service_enabled_and_mapped_to_host"},{"line_number":296,"context_line":""},{"line_number":297,"context_line":"# TODO(Vurmil): Remove after G/2026.1 release"},{"line_number":298,"context_line":"# NOTE(Vurmil): After tightening permissions, this file might be owned by root,"},{"line_number":299,"context_line":"#                  which will prevent the container from starting correctly."},{"line_number":300,"context_line":"#                  Ensure it is removed before restart to allow proper recreation."},{"line_number":301,"context_line":"- name: Check ownership of oslo_messaging shm file"}],"source_content_type":"text/x-yaml","patch_set":81,"id":"8bb5b1a2_28d18932","line":298,"updated":"2026-03-30 19:20:56.000000000","message":"What is this tightening permissions?","commit_id":"d0c69a2bcdab1793d5e91357d1b121d941f4c3fa"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"43143d36f4e3fb25529ca880d8eef15cc71d9618","unresolved":true,"context_lines":[{"line_number":295,"context_line":"  when: service | service_enabled_and_mapped_to_host"},{"line_number":296,"context_line":""},{"line_number":297,"context_line":"# TODO(Vurmil): Remove after G/2026.1 release"},{"line_number":298,"context_line":"# NOTE(Vurmil): After tightening permissions, this file might be owned by root,"},{"line_number":299,"context_line":"#                  which will prevent the container from starting correctly."},{"line_number":300,"context_line":"#                  Ensure it is removed before restart to allow proper recreation."},{"line_number":301,"context_line":"- name: Check ownership of oslo_messaging shm file"}],"source_content_type":"text/x-yaml","patch_set":81,"id":"95e6cb60_a5bde21c","line":298,"in_reply_to":"8bb5b1a2_28d18932","updated":"2026-04-09 12:57:41.000000000","message":"We can delete it, but it\u0027s going to be a problem for anyone who has already used this patch (myself included). It will leave behind files owned by root in /dev/shm/, which will cause permission errors and break the deployment during the next run.","commit_id":"d0c69a2bcdab1793d5e91357d1b121d941f4c3fa"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"def76bf57cf412c781539b5024d516fbe714eaea","unresolved":true,"context_lines":[{"line_number":295,"context_line":"  when: service | service_enabled_and_mapped_to_host"},{"line_number":296,"context_line":""},{"line_number":297,"context_line":"# TODO(Vurmil): Remove after G/2026.1 release"},{"line_number":298,"context_line":"# NOTE(Vurmil): After tightening permissions, this file might be owned by root,"},{"line_number":299,"context_line":"#                  which will prevent the container from starting correctly."},{"line_number":300,"context_line":"#                  Ensure it is removed before restart to allow proper recreation."},{"line_number":301,"context_line":"- name: Check ownership of oslo_messaging shm file"}],"source_content_type":"text/x-yaml","patch_set":81,"id":"f3a11f27_a505b745","line":298,"in_reply_to":"95e6cb60_a5bde21c","updated":"2026-04-14 10:05:33.000000000","message":"We can\u0027t cover ALL corner cases, especially the ones that are caused by using unmerged versions of the patches - please remove it.","commit_id":"d0c69a2bcdab1793d5e91357d1b121d941f4c3fa"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"4ea84523217207c214429dcaae781ea5f2281db3","unresolved":false,"context_lines":[{"line_number":295,"context_line":"  when: service | service_enabled_and_mapped_to_host"},{"line_number":296,"context_line":""},{"line_number":297,"context_line":"# TODO(Vurmil): Remove after G/2026.1 release"},{"line_number":298,"context_line":"# NOTE(Vurmil): After tightening permissions, this file might be owned by root,"},{"line_number":299,"context_line":"#                  which will prevent the container from starting correctly."},{"line_number":300,"context_line":"#                  Ensure it is removed before restart to allow proper recreation."},{"line_number":301,"context_line":"- name: Check ownership of oslo_messaging shm file"}],"source_content_type":"text/x-yaml","patch_set":81,"id":"97f15390_43184be7","line":298,"in_reply_to":"f3a11f27_a505b745","updated":"2026-04-14 10:13:17.000000000","message":"Acknowledged","commit_id":"d0c69a2bcdab1793d5e91357d1b121d941f4c3fa"}],"ansible/roles/neutron/templates/neutron-ovn-maintenance-worker.json.j2":[{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"6b70df4a2a8d454a57612ebc02858a7058245e5a","unresolved":true,"context_lines":[{"line_number":15,"context_line":"            \"perm\": \"0600\""},{"line_number":16,"context_line":"        },"},{"line_number":17,"context_line":"{% endif %}"},{"line_number":18,"context_line":"        {"},{"line_number":19,"context_line":"            \"source\": \"{{ container_config_directory }}/ml2_conf.ini\","},{"line_number":20,"context_line":"            \"dest\": \"/etc/neutron/plugins/ml2/ml2_conf.ini\","},{"line_number":21,"context_line":"            \"owner\": \"neutron\","}],"source_content_type":"text/x-jinja2","patch_set":81,"id":"a5d6145e_0d65ea3f","line":18,"updated":"2026-03-30 19:20:56.000000000","message":"Why it needs to be moved?","commit_id":"d0c69a2bcdab1793d5e91357d1b121d941f4c3fa"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"bb2d60668048e58070b500d59d970961ead7f6aa","unresolved":false,"context_lines":[{"line_number":15,"context_line":"            \"perm\": \"0600\""},{"line_number":16,"context_line":"        },"},{"line_number":17,"context_line":"{% endif %}"},{"line_number":18,"context_line":"        {"},{"line_number":19,"context_line":"            \"source\": \"{{ container_config_directory }}/ml2_conf.ini\","},{"line_number":20,"context_line":"            \"dest\": \"/etc/neutron/plugins/ml2/ml2_conf.ini\","},{"line_number":21,"context_line":"            \"owner\": \"neutron\","}],"source_content_type":"text/x-jinja2","patch_set":81,"id":"4ad93453_ff06bd12","line":18,"in_reply_to":"a5d6145e_0d65ea3f","updated":"2026-03-31 12:40:53.000000000","message":"Acknowledged","commit_id":"d0c69a2bcdab1793d5e91357d1b121d941f4c3fa"}],"ansible/roles/neutron/templates/neutron-ovn-vpn-agent.json.j2":[{"author":{"_account_id":23084,"name":"Bartosz Bezak","email":"bartosz@stackhpc.com","username":"b.bezak"},"change_message_id":"46da98aba1827d9ae5023b90c66fe678a3695828","unresolved":true,"context_lines":[{"line_number":17,"context_line":"            \"source\": \"{{ container_config_directory }}/{{ neutron_policy_file }}\","},{"line_number":18,"context_line":"            \"dest\": \"/etc/neutron/{{ neutron_policy_file }}\","},{"line_number":19,"context_line":"            \"owner\": \"neutron\","},{"line_number":20,"context_line":"            \"perm\": \"0600\""},{"line_number":21,"context_line":"        }{% endif %}"},{"line_number":22,"context_line":"    ],"},{"line_number":23,"context_line":"    \"permissions\": ["}],"source_content_type":"text/x-jinja2","patch_set":108,"id":"1befd307_52903eb7","line":20,"updated":"2026-04-17 08:58:31.000000000","message":"```suggestion\n            \"perm\": \"0600\"\n        }{% endif %}{% if kolla_copy_ca_into_containers | bool %},\n        {\n            \"source\": \"{{ container_config_directory }}/ca-certificates\",\n            \"dest\": \"/var/lib/kolla/share/ca-certificates\",\n            \"owner\": \"root\",\n            \"perm\": \"0600\"\n```","commit_id":"4c486bccdef0c506d881f3d4aac201e19710ed16"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"c548fd6171bac6ca56dc247357e2b13b66ff26b9","unresolved":false,"context_lines":[{"line_number":17,"context_line":"            \"source\": \"{{ container_config_directory }}/{{ neutron_policy_file }}\","},{"line_number":18,"context_line":"            \"dest\": \"/etc/neutron/{{ neutron_policy_file }}\","},{"line_number":19,"context_line":"            \"owner\": \"neutron\","},{"line_number":20,"context_line":"            \"perm\": \"0600\""},{"line_number":21,"context_line":"        }{% endif %}"},{"line_number":22,"context_line":"    ],"},{"line_number":23,"context_line":"    \"permissions\": ["}],"source_content_type":"text/x-jinja2","patch_set":108,"id":"48fed6d6_7b610ea7","line":20,"in_reply_to":"1befd307_52903eb7","updated":"2026-04-17 09:07:09.000000000","message":"Fix applied.","commit_id":"4c486bccdef0c506d881f3d4aac201e19710ed16"}],"ansible/roles/neutron/templates/neutron-periodic-worker.json.j2":[{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"6b70df4a2a8d454a57612ebc02858a7058245e5a","unresolved":true,"context_lines":[{"line_number":15,"context_line":"            \"perm\": \"0600\""},{"line_number":16,"context_line":"        },"},{"line_number":17,"context_line":"{% endif %}"},{"line_number":18,"context_line":"        {"},{"line_number":19,"context_line":"            \"source\": \"{{ container_config_directory }}/ml2_conf.ini\","},{"line_number":20,"context_line":"            \"dest\": \"/etc/neutron/plugins/ml2/ml2_conf.ini\","},{"line_number":21,"context_line":"            \"owner\": \"neutron\","}],"source_content_type":"text/x-jinja2","patch_set":81,"id":"8a26a1c6_97097103","line":18,"updated":"2026-03-30 19:20:56.000000000","message":"ditto","commit_id":"d0c69a2bcdab1793d5e91357d1b121d941f4c3fa"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"bb2d60668048e58070b500d59d970961ead7f6aa","unresolved":false,"context_lines":[{"line_number":15,"context_line":"            \"perm\": \"0600\""},{"line_number":16,"context_line":"        },"},{"line_number":17,"context_line":"{% endif %}"},{"line_number":18,"context_line":"        {"},{"line_number":19,"context_line":"            \"source\": \"{{ container_config_directory }}/ml2_conf.ini\","},{"line_number":20,"context_line":"            \"dest\": \"/etc/neutron/plugins/ml2/ml2_conf.ini\","},{"line_number":21,"context_line":"            \"owner\": \"neutron\","}],"source_content_type":"text/x-jinja2","patch_set":81,"id":"77a0d339_254fccb1","line":18,"in_reply_to":"8a26a1c6_97097103","updated":"2026-03-31 12:40:53.000000000","message":"Acknowledged","commit_id":"d0c69a2bcdab1793d5e91357d1b121d941f4c3fa"}],"ansible/roles/neutron/templates/neutron-rpc-server.json.j2":[{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"6b70df4a2a8d454a57612ebc02858a7058245e5a","unresolved":true,"context_lines":[{"line_number":16,"context_line":"        },"},{"line_number":17,"context_line":"{% endif %}"},{"line_number":18,"context_line":"        {"},{"line_number":19,"context_line":"            \"source\": \"{{ container_config_directory }}/ml2_conf.ini\","},{"line_number":20,"context_line":"            \"dest\": \"/etc/neutron/plugins/ml2/ml2_conf.ini\","},{"line_number":21,"context_line":"            \"owner\": \"neutron\","},{"line_number":22,"context_line":"            \"perm\": \"0600\""}],"source_content_type":"text/x-jinja2","patch_set":81,"id":"5ad18c0e_820a62e1","line":19,"updated":"2026-03-30 19:20:56.000000000","message":"ditto","commit_id":"d0c69a2bcdab1793d5e91357d1b121d941f4c3fa"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"bb2d60668048e58070b500d59d970961ead7f6aa","unresolved":false,"context_lines":[{"line_number":16,"context_line":"        },"},{"line_number":17,"context_line":"{% endif %}"},{"line_number":18,"context_line":"        {"},{"line_number":19,"context_line":"            \"source\": \"{{ container_config_directory }}/ml2_conf.ini\","},{"line_number":20,"context_line":"            \"dest\": \"/etc/neutron/plugins/ml2/ml2_conf.ini\","},{"line_number":21,"context_line":"            \"owner\": \"neutron\","},{"line_number":22,"context_line":"            \"perm\": \"0600\""}],"source_content_type":"text/x-jinja2","patch_set":81,"id":"c804882f_d27c9837","line":19,"in_reply_to":"5ad18c0e_820a62e1","updated":"2026-03-31 12:40:53.000000000","message":"Acknowledged","commit_id":"d0c69a2bcdab1793d5e91357d1b121d941f4c3fa"}],"ansible/roles/neutron/templates/neutron.conf.j2":[{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"6b70df4a2a8d454a57612ebc02858a7058245e5a","unresolved":true,"context_lines":[{"line_number":73,"context_line":"lock_path \u003d /var/lib/neutron/tmp"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"[agent]"},{"line_number":76,"context_line":"root_helper \u003d sudo /var/lib/kolla/venv/bin/neutron-rootwrap /etc/neutron/rootwrap.conf"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"[database]"},{"line_number":79,"context_line":"connection \u003d mysql+pymysql://{{ neutron_database_user }}:{{ neutron_database_password }}@{{ neutron_database_address }}/{{ neutron_database_name }}{{ \u0027?ssl_ca\u003d\u0027 ~ openstack_cacert if neutron_database_enable_tls_internal | bool }}"}],"source_content_type":"text/x-jinja2","patch_set":81,"id":"8e803a54_e10167ba","line":76,"updated":"2026-03-30 19:20:56.000000000","message":"why?","commit_id":"d0c69a2bcdab1793d5e91357d1b121d941f4c3fa"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"b849b2d297aac03c0f938557162150f28727c1c6","unresolved":false,"context_lines":[{"line_number":73,"context_line":"lock_path \u003d /var/lib/neutron/tmp"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"[agent]"},{"line_number":76,"context_line":"root_helper \u003d sudo /var/lib/kolla/venv/bin/neutron-rootwrap /etc/neutron/rootwrap.conf"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"[database]"},{"line_number":79,"context_line":"connection \u003d mysql+pymysql://{{ neutron_database_user }}:{{ neutron_database_password }}@{{ neutron_database_address }}/{{ neutron_database_name }}{{ \u0027?ssl_ca\u003d\u0027 ~ openstack_cacert if neutron_database_enable_tls_internal | bool }}"}],"source_content_type":"text/x-jinja2","patch_set":81,"id":"36106371_554e77dd","line":76,"in_reply_to":"8e803a54_e10167ba","updated":"2026-04-09 13:04:57.000000000","message":"Restored. These were just tests, we ran into rootwrap issues (https://bugs.launchpad.net/neutron/+bug/2146547) which were causing strange, misleading errors on Rocky","commit_id":"d0c69a2bcdab1793d5e91357d1b121d941f4c3fa"}],"ansible/roles/neutron/templates/neutron_ovn_vpn_agent.ini.j2":[{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"72b32f15aa95e83f76f8db4def1da9db3a4dae4e","unresolved":true,"context_lines":[{"line_number":1,"context_line":"{% set vpn_device_driver \u003d \u0027neutron_vpnaas.services.vpn.device_drivers.ovn_ipsec.OvnStrongSwanDriver\u0027 if kolla_base_distro in [\u0027ubuntu\u0027, \u0027debian\u0027] else \u0027neutron_vpnaas.services.vpn.device_drivers.ovn_ipsec.OvnLibreSwanDriver\u0027 %}"},{"line_number":2,"context_line":"[DEFAULT]"},{"line_number":3,"context_line":"transport_url \u003d {{ rpc_transport_url }}"},{"line_number":4,"context_line":"interface_driver \u003d neutron.agent.linux.interface.OVSInterfaceDriver"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"[AGENT]"},{"line_number":7,"context_line":"extensions \u003d vpnaas"}],"source_content_type":"text/x-jinja2","patch_set":10,"id":"c00be3e2_2b954335","line":4,"updated":"2024-11-06 07:43:26.000000000","message":"Where is that in https://docs.openstack.org/neutron-vpnaas/latest/configuration/ovn_vpn_agent.html ?","commit_id":"45d4f9b1fee44d1382cb34f3417c7e14c225086e"},{"author":{"_account_id":34380,"name":"Maximilian Stinsky","email":"maximilian@stinsky.com","username":"mstinsky"},"change_message_id":"2d8e7bc8539faa289563294080b603c493b78bf1","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{% set vpn_device_driver \u003d \u0027neutron_vpnaas.services.vpn.device_drivers.ovn_ipsec.OvnStrongSwanDriver\u0027 if kolla_base_distro in [\u0027ubuntu\u0027, \u0027debian\u0027] else \u0027neutron_vpnaas.services.vpn.device_drivers.ovn_ipsec.OvnLibreSwanDriver\u0027 %}"},{"line_number":2,"context_line":"[DEFAULT]"},{"line_number":3,"context_line":"transport_url \u003d {{ rpc_transport_url }}"},{"line_number":4,"context_line":"interface_driver \u003d neutron.agent.linux.interface.OVSInterfaceDriver"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"[AGENT]"},{"line_number":7,"context_line":"extensions \u003d vpnaas"}],"source_content_type":"text/x-jinja2","patch_set":10,"id":"c62169d1_099df4f9","line":4,"in_reply_to":"c00be3e2_2b954335","updated":"2024-11-06 08:28:35.000000000","message":"Not sure whats up with the neutron-vpnaas documentation, but both drivers do exist: https://github.com/openstack/neutron-vpnaas/blob/stable/2024.2/neutron_vpnaas/services/vpn/device_drivers/ovn_ipsec.py#L361-L376","commit_id":"45d4f9b1fee44d1382cb34f3417c7e14c225086e"}],"releasenotes/notes/implement-neutron-ovn-vpn-agent-b848fb4c245e415e.yaml":[{"author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"change_message_id":"54460dc5746a6b4a85185b2720769b3a90cb5245","unresolved":true,"context_lines":[{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    Add support for deploying neutron_ovn_vpn_agent."},{"line_number":5,"context_line":"    This enables the use of vpnaas in ovn environemnts."}],"source_content_type":"text/x-yaml","patch_set":3,"id":"2fd0c865_368c0a54","line":5,"range":{"start_line":5,"start_character":42,"end_line":5,"end_character":54},"updated":"2024-07-23 12:04:36.000000000","message":"environments\n\nthat will fix the pep8 failure","commit_id":"f1a3a6e3ddbce4c2b553f91e951d990636c38696"},{"author":{"_account_id":34380,"name":"Maximilian Stinsky","email":"maximilian@stinsky.com","username":"mstinsky"},"change_message_id":"0a042c4ae12adf22a39c330f9755baf1add89c2b","unresolved":false,"context_lines":[{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    Add support for deploying neutron_ovn_vpn_agent."},{"line_number":5,"context_line":"    This enables the use of vpnaas in ovn environemnts."}],"source_content_type":"text/x-yaml","patch_set":3,"id":"2c1fd7d9_51d853c0","line":5,"range":{"start_line":5,"start_character":42,"end_line":5,"end_character":54},"in_reply_to":"2fd0c865_368c0a54","updated":"2024-07-24 07:18:35.000000000","message":"Done","commit_id":"f1a3a6e3ddbce4c2b553f91e951d990636c38696"},{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"eda672fc99a7f5b64fef5f16e0e6ede155969cf7","unresolved":true,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    Add support for deploying neutron_ovn_vpn_agent."},{"line_number":5,"context_line":"    This enables the use of vpnaas in ovn environments."}],"source_content_type":"text/x-yaml","patch_set":5,"id":"4136868b_07949777","line":5,"range":{"start_line":4,"start_character":4,"end_line":5,"end_character":55},"updated":"2024-07-30 14:59:24.000000000","message":"Please also add a reference (link) to your new vpnaas docs, so users are able to find them, thank you! 👍","commit_id":"a0fd273021babbee5bb4f7c897667134db401abb"},{"author":{"_account_id":34380,"name":"Maximilian Stinsky","email":"maximilian@stinsky.com","username":"mstinsky"},"change_message_id":"67b57f673cc4c325e1b8fe8503ca7c92d5f871d5","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    Add support for deploying neutron_ovn_vpn_agent."},{"line_number":5,"context_line":"    This enables the use of vpnaas in ovn environments."}],"source_content_type":"text/x-yaml","patch_set":5,"id":"16a9186e_a8c261bb","line":5,"range":{"start_line":4,"start_character":4,"end_line":5,"end_character":55},"in_reply_to":"4136868b_07949777","updated":"2024-07-31 10:14:50.000000000","message":"Done","commit_id":"a0fd273021babbee5bb4f7c897667134db401abb"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"72b32f15aa95e83f76f8db4def1da9db3a4dae4e","unresolved":true,"context_lines":[{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    Add support for deploying neutron_ovn_vpn_agent."},{"line_number":5,"context_line":"    This enables the use of vpnaas in ovn environments."},{"line_number":6,"context_line":"    https://docs.openstack.org/kolla-ansible/latest/reference/networking/neutron-extensions.html#neutron-vpnaas-vpn-as-a-service"}],"source_content_type":"text/x-yaml","patch_set":10,"id":"0e53137e_828b5bd9","line":6,"updated":"2024-11-06 07:43:26.000000000","message":"that needs to be an RST link","commit_id":"45d4f9b1fee44d1382cb34f3417c7e14c225086e"},{"author":{"_account_id":34476,"name":"Marc Vorwerk","email":"marc+ubuntu@marc-vorwerk.de","username":"marc-vorwerk"},"change_message_id":"e676d7a163a29997fdd629742b62f8b857698a80","unresolved":false,"context_lines":[{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    Add support for deploying neutron_ovn_vpn_agent."},{"line_number":5,"context_line":"    This enables the use of vpnaas in ovn environments."},{"line_number":6,"context_line":"    https://docs.openstack.org/kolla-ansible/latest/reference/networking/neutron-extensions.html#neutron-vpnaas-vpn-as-a-service"}],"source_content_type":"text/x-yaml","patch_set":10,"id":"4d8654ca_f3b07444","line":6,"in_reply_to":"0e53137e_828b5bd9","updated":"2024-11-06 10:42:51.000000000","message":"Done","commit_id":"45d4f9b1fee44d1382cb34f3417c7e14c225086e"}],"roles/kolla-ansible-tempest/defaults/main.yml":[{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"6b70df4a2a8d454a57612ebc02858a7058245e5a","unresolved":true,"context_lines":[{"line_number":3,"context_line":"  - python-tempestconf"},{"line_number":4,"context_line":"  - tempest"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"kolla_ansible_tempest_build_timeout: 1200"},{"line_number":7,"context_line":"kolla_ansible_tempest_cirros_ver: \"0.6.3\""},{"line_number":8,"context_line":"kolla_ansible_tempest_exclude_regex: []"},{"line_number":9,"context_line":"kolla_ansible_tempest_packages_extra: []"}],"source_content_type":"text/x-yaml","patch_set":81,"id":"04ad60e7_95bce7a1","line":6,"updated":"2026-03-30 19:20:56.000000000","message":"Why?","commit_id":"d0c69a2bcdab1793d5e91357d1b121d941f4c3fa"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"bb2d60668048e58070b500d59d970961ead7f6aa","unresolved":false,"context_lines":[{"line_number":3,"context_line":"  - python-tempestconf"},{"line_number":4,"context_line":"  - tempest"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"kolla_ansible_tempest_build_timeout: 1200"},{"line_number":7,"context_line":"kolla_ansible_tempest_cirros_ver: \"0.6.3\""},{"line_number":8,"context_line":"kolla_ansible_tempest_exclude_regex: []"},{"line_number":9,"context_line":"kolla_ansible_tempest_packages_extra: []"}],"source_content_type":"text/x-yaml","patch_set":81,"id":"99c3ac6a_7e26790d","line":6,"in_reply_to":"04ad60e7_95bce7a1","updated":"2026-03-31 12:40:53.000000000","message":"Acknowledged","commit_id":"d0c69a2bcdab1793d5e91357d1b121d941f4c3fa"}],"roles/kolla-ansible-tempest/tasks/main.yml":[{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"6b70df4a2a8d454a57612ebc02858a7058245e5a","unresolved":true,"context_lines":[{"line_number":45,"context_line":"    tempest_log_file: \"test-tempest-run{{ \u0027-post-upgrade\u0027 if post_upgrade | bool else \u0027\u0027 }}\""},{"line_number":46,"context_line":"  ansible.builtin.shell:"},{"line_number":47,"context_line":"    chdir: \"/home/zuul/tempest\""},{"line_number":48,"context_line":"    # NOTE(vurmil): We limit concurrency to 1 because OVN tests fail with 500 errors"},{"line_number":49,"context_line":"    # when higher concurrency is used due to too many simultaneous requests."},{"line_number":50,"context_line":"    cmd: \u003e"},{"line_number":51,"context_line":"      {{ kolla_ansible_venv_path }}/bin/tempest run"}],"source_content_type":"text/x-yaml","patch_set":81,"id":"8e8bb123_2323116e","line":48,"updated":"2026-03-30 19:20:56.000000000","message":"After this patch or always?","commit_id":"d0c69a2bcdab1793d5e91357d1b121d941f4c3fa"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"bb2d60668048e58070b500d59d970961ead7f6aa","unresolved":false,"context_lines":[{"line_number":45,"context_line":"    tempest_log_file: \"test-tempest-run{{ \u0027-post-upgrade\u0027 if post_upgrade | bool else \u0027\u0027 }}\""},{"line_number":46,"context_line":"  ansible.builtin.shell:"},{"line_number":47,"context_line":"    chdir: \"/home/zuul/tempest\""},{"line_number":48,"context_line":"    # NOTE(vurmil): We limit concurrency to 1 because OVN tests fail with 500 errors"},{"line_number":49,"context_line":"    # when higher concurrency is used due to too many simultaneous requests."},{"line_number":50,"context_line":"    cmd: \u003e"},{"line_number":51,"context_line":"      {{ kolla_ansible_venv_path }}/bin/tempest run"}],"source_content_type":"text/x-yaml","patch_set":81,"id":"b1485d97_4eaec08c","line":48,"in_reply_to":"8e8bb123_2323116e","updated":"2026-03-31 12:40:53.000000000","message":"Acknowledged","commit_id":"d0c69a2bcdab1793d5e91357d1b121d941f4c3fa"}],"tests/run.yml":[{"author":{"_account_id":23084,"name":"Bartosz Bezak","email":"bartosz@stackhpc.com","username":"b.bezak"},"change_message_id":"cda301ac9317f64a8b1b34f1c257c08a36c0b7fd","unresolved":true,"context_lines":[{"line_number":414,"context_line":"            SCENARIO: \"{{ scenario }}\""},{"line_number":415,"context_line":"          when: openstack_core_tested or scenario in [\u0027ironic\u0027, \u0027magnum\u0027, \u0027nfv\u0027, \u0027zun\u0027, \u0027octavia\u0027]"},{"line_number":416,"context_line":""},{"line_number":417,"context_line":"        - name: Test OVN VPNaaS"},{"line_number":418,"context_line":"          import_role:"},{"line_number":419,"context_line":"            name: test-ovn-vpnaas"},{"line_number":420,"context_line":"          when: scenario \u003d\u003d \u0027ovn\u0027"}],"source_content_type":"text/x-yaml","patch_set":106,"id":"c288760b_3c6d1c9c","line":417,"updated":"2026-04-16 09:33:44.000000000","message":"CI is failing on R10 ovn jobs, I assume because of https://bugs.launchpad.net/neutron/+bug/2146308, therefore it needs to be removed from tests on R10 and marked as TODO/FIXME to fix it when neutron bugs is fixed, also ideally create precheck checking if somebody enables that on R10, and also WARN note in the docs.","commit_id":"579cdc6f20145eb0b5ce4a82ba6bf13877af7216"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"287495c1c922a7ab374fd333ce3ca85039d41087","unresolved":false,"context_lines":[{"line_number":414,"context_line":"            SCENARIO: \"{{ scenario }}\""},{"line_number":415,"context_line":"          when: openstack_core_tested or scenario in [\u0027ironic\u0027, \u0027magnum\u0027, \u0027nfv\u0027, \u0027zun\u0027, \u0027octavia\u0027]"},{"line_number":416,"context_line":""},{"line_number":417,"context_line":"        - name: Test OVN VPNaaS"},{"line_number":418,"context_line":"          import_role:"},{"line_number":419,"context_line":"            name: test-ovn-vpnaas"},{"line_number":420,"context_line":"          when: scenario \u003d\u003d \u0027ovn\u0027"}],"source_content_type":"text/x-yaml","patch_set":106,"id":"6d80b499_7b9bb40b","line":417,"in_reply_to":"c288760b_3c6d1c9c","updated":"2026-04-16 13:31:02.000000000","message":"Acknowledged","commit_id":"579cdc6f20145eb0b5ce4a82ba6bf13877af7216"}],"tests/test-ovn.sh":[{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"6b70df4a2a8d454a57612ebc02858a7058245e5a","unresolved":true,"context_lines":[{"line_number":1,"context_line":"#!/bin/bash"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"set -o xtrace"},{"line_number":4,"context_line":"set -o errexit"}],"source_content_type":"text/x-sh","patch_set":81,"id":"7285d691_8f0a9a93","line":1,"updated":"2026-03-30 19:20:56.000000000","message":"Rework this into an Ansible roles under roles/ - we started that work some time ago and I don’t think we want to add up to bash scripts","commit_id":"d0c69a2bcdab1793d5e91357d1b121d941f4c3fa"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"b849b2d297aac03c0f938557162150f28727c1c6","unresolved":false,"context_lines":[{"line_number":1,"context_line":"#!/bin/bash"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"set -o xtrace"},{"line_number":4,"context_line":"set -o errexit"}],"source_content_type":"text/x-sh","patch_set":81,"id":"f2b339d3_c22ef014","line":1,"in_reply_to":"7285d691_8f0a9a93","updated":"2026-04-09 13:04:57.000000000","message":"Done. I\u0027ve restored the original file and moved the tests into an Ansible role under roles/test-ovn-vpnaas/ as requested.","commit_id":"d0c69a2bcdab1793d5e91357d1b121d941f4c3fa"}],"tools/init-vpn":[{"author":{"_account_id":32553,"name":"Sven Kieske","email":"sven_oss@posteo.de","username":"skieske"},"change_message_id":"eda672fc99a7f5b64fef5f16e0e6ede155969cf7","unresolved":true,"context_lines":[{"line_number":2,"context_line":""},{"line_number":3,"context_line":"# Script originally copied from https://wiki.openstack.org/wiki/Neutron/VPNaaS/HowToInstall"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"EXT_NW_ID\u003d`openstack network list --name public1 -f value -c ID`"},{"line_number":6,"context_line":"WEST_SUBNET\u003d\u0027192.168.10.0/24\u0027"},{"line_number":7,"context_line":"EAST_SUBNET\u003d\u0027192.168.20.0/24\u0027"},{"line_number":8,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":5,"id":"e0b12a83_f2e293bc","line":5,"range":{"start_line":5,"start_character":0,"end_line":5,"end_character":2},"updated":"2024-07-30 14:59:24.000000000","message":"this runs before the new check function, which checks if credentials are supplied, please rearrange it appropriately so we don\u0027t run into an error here if no credentials where supplied, thanks.","commit_id":"a0fd273021babbee5bb4f7c897667134db401abb"},{"author":{"_account_id":34380,"name":"Maximilian Stinsky","email":"maximilian@stinsky.com","username":"mstinsky"},"change_message_id":"67b57f673cc4c325e1b8fe8503ca7c92d5f871d5","unresolved":false,"context_lines":[{"line_number":2,"context_line":""},{"line_number":3,"context_line":"# Script originally copied from https://wiki.openstack.org/wiki/Neutron/VPNaaS/HowToInstall"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"EXT_NW_ID\u003d`openstack network list --name public1 -f value -c ID`"},{"line_number":6,"context_line":"WEST_SUBNET\u003d\u0027192.168.10.0/24\u0027"},{"line_number":7,"context_line":"EAST_SUBNET\u003d\u0027192.168.20.0/24\u0027"},{"line_number":8,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":5,"id":"6ca45e4c_dec13cbc","line":5,"range":{"start_line":5,"start_character":0,"end_line":5,"end_character":2},"in_reply_to":"e0b12a83_f2e293bc","updated":"2024-07-31 10:14:50.000000000","message":"Done","commit_id":"a0fd273021babbee5bb4f7c897667134db401abb"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"6b70df4a2a8d454a57612ebc02858a7058245e5a","unresolved":true,"context_lines":[{"line_number":1,"context_line":"#!/usr/bin/env bash"},{"line_number":2,"context_line":"# Script originally copied from https://wiki.openstack.org/wiki/Neutron/VPNaaS/HowToInstall"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"WEST_SUBNET\u003d\u0027192.168.10.0/24\u0027"}],"source_content_type":"application/octet-stream","patch_set":81,"id":"3200183e_7361fb3f","line":1,"updated":"2026-03-30 19:20:56.000000000","message":"Ditto","commit_id":"d0c69a2bcdab1793d5e91357d1b121d941f4c3fa"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"def76bf57cf412c781539b5024d516fbe714eaea","unresolved":false,"context_lines":[{"line_number":1,"context_line":"#!/usr/bin/env bash"},{"line_number":2,"context_line":"# Script originally copied from https://wiki.openstack.org/wiki/Neutron/VPNaaS/HowToInstall"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"WEST_SUBNET\u003d\u0027192.168.10.0/24\u0027"}],"source_content_type":"application/octet-stream","patch_set":81,"id":"f59d6883_7817cd34","line":1,"in_reply_to":"09cf8e7e_df56dcb8","updated":"2026-04-14 10:05:33.000000000","message":"Let it be here for now, we\u0027ll need to clean up /tools one day","commit_id":"d0c69a2bcdab1793d5e91357d1b121d941f4c3fa"},{"author":{"_account_id":37306,"name":"Piotr Milewski","display_name":"Piotr Milewski","email":"vurmil@gmail.com","username":"vurmil"},"change_message_id":"43143d36f4e3fb25529ca880d8eef15cc71d9618","unresolved":true,"context_lines":[{"line_number":1,"context_line":"#!/usr/bin/env bash"},{"line_number":2,"context_line":"# Script originally copied from https://wiki.openstack.org/wiki/Neutron/VPNaaS/HowToInstall"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"WEST_SUBNET\u003d\u0027192.168.10.0/24\u0027"}],"source_content_type":"application/octet-stream","patch_set":81,"id":"09cf8e7e_df56dcb8","line":1,"in_reply_to":"3200183e_7361fb3f","updated":"2026-04-09 12:57:41.000000000","message":"This is an end-user test, unrelated to VPN testing. Do you want me to remove it?","commit_id":"d0c69a2bcdab1793d5e91357d1b121d941f4c3fa"}]}