)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":16688,"name":"Rodolfo Alonso","email":"ralonsoh@redhat.com","username":"rodolfo-alonso-hernandez"},"change_message_id":"6a70bf2dcfc59da0bfcce9862e390187563bd8ff","unresolved":true,"context_lines":[{"line_number":7,"context_line":"[OVN] Deny direct deletion of the DHCP/metadata port"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"With ML2/OVN, each network has a single port (device_owner"},{"line_number":10,"context_line":"\"network:distributed\", device_id \"ovnmeta-\u003cid\u003e\") that provides DHCP"},{"line_number":11,"context_line":"and metadata. Users, including admins, could delete it through the"},{"line_number":12,"context_line":"API, which silently broke DHCP and metadata for the network."},{"line_number":13,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"dd63ffa3_eed8181e","line":10,"range":{"start_line":10,"start_character":63,"end_line":10,"end_character":67},"updated":"2026-10-05 14:01:28.000000000","message":"no, the DHCP is provided via OF rules + ovn-controller, not through this port","commit_id":"d8e38190293d0f6d813e7fc4f13a8e4e2a1476b1"},{"author":{"_account_id":27337,"name":"Mathieu GRZYBEK","email":"mathieu@stackhpc.com","username":"mgrzybek"},"change_message_id":"fd24d3caaefdeb8ab90a8cfd75811e12cb89697e","unresolved":false,"context_lines":[{"line_number":7,"context_line":"[OVN] Deny direct deletion of the DHCP/metadata port"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"With ML2/OVN, each network has a single port (device_owner"},{"line_number":10,"context_line":"\"network:distributed\", device_id \"ovnmeta-\u003cid\u003e\") that provides DHCP"},{"line_number":11,"context_line":"and metadata. Users, including admins, could delete it through the"},{"line_number":12,"context_line":"API, which silently broke DHCP and metadata for the network."},{"line_number":13,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"98b5b3bd_d0b25985","line":10,"range":{"start_line":10,"start_character":63,"end_line":10,"end_character":67},"in_reply_to":"dd63ffa3_eed8181e","updated":"2026-10-06 15:38:42.000000000","message":"Done","commit_id":"d8e38190293d0f6d813e7fc4f13a8e4e2a1476b1"}],"/PATCHSET_LEVEL":[{"author":{"_account_id":16688,"name":"Rodolfo Alonso","email":"ralonsoh@redhat.com","username":"rodolfo-alonso-hernandez"},"change_message_id":"5f054afdac764695f2c138b0dc9e01429cf1c452","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"5874dbb7_b994cd97","updated":"2026-10-05 13:54:12.000000000","message":"This patch cannot work in an environment with several workers, as commented in mech_driver.\n\nI\u0027m not in favor o against this patch, by suggesting the change in the code. I still need to review if it is valid to prevent the metadata port deletion or not.","commit_id":"d8e38190293d0f6d813e7fc4f13a8e4e2a1476b1"},{"author":{"_account_id":16688,"name":"Rodolfo Alonso","email":"ralonsoh@redhat.com","username":"rodolfo-alonso-hernandez"},"change_message_id":"8a2199120a52dc01a196c4a4869ca0eb1e3f5486","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"99c51a6a_09a0f9b8","updated":"2026-10-06 17:45:24.000000000","message":"All good for me. This is also configurable thus any admin can change it via policy config file.","commit_id":"af11b268d2aad05f7d21f17e5dac37e119fba3d2"},{"author":{"_account_id":1131,"name":"Brian Haley","email":"haleyb.dev@gmail.com","username":"brian-haley"},"change_message_id":"1ec847fad50ef15129d7661b9f87695292baf982","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"db104ace_f9e3bc0d","updated":"2026-10-06 23:38:56.000000000","message":"lgtm","commit_id":"af11b268d2aad05f7d21f17e5dac37e119fba3d2"}],"neutron/plugins/ml2/drivers/ovn/mech_driver/mech_driver.py":[{"author":{"_account_id":16688,"name":"Rodolfo Alonso","email":"ralonsoh@redhat.com","username":"rodolfo-alonso-hernandez"},"change_message_id":"5f054afdac764695f2c138b0dc9e01429cf1c452","unresolved":true,"context_lines":[{"line_number":750,"context_line":"        ctx \u003d payload.context"},{"line_number":751,"context_line":"        if not hasattr(ctx, _OVN_NET_DELETE_FLAG):"},{"line_number":752,"context_line":"            setattr(ctx, _OVN_NET_DELETE_FLAG, set())"},{"line_number":753,"context_line":"        getattr(ctx, _OVN_NET_DELETE_FLAG).add(payload.resource_id)"},{"line_number":754,"context_line":""},{"line_number":755,"context_line":"    def _prevent_metadata_port_delete(self, resource, event, trigger,"},{"line_number":756,"context_line":"                                      payload):"}],"source_content_type":"text/x-python","patch_set":2,"id":"d6b35a1a_fec6c437","line":753,"range":{"start_line":753,"start_character":16,"end_line":753,"end_character":42},"updated":"2026-10-05 13:54:12.000000000","message":"That will be available per worker only, not globally. Each event (network deletion in this case) is processed by a single worker only.\n\nWhat you can do is to tint the metadata ports, for example, in `(network events.BEFORE_DELETE)` (here), in the NB, adding some kind of key in `external_ids`.","commit_id":"d8e38190293d0f6d813e7fc4f13a8e4e2a1476b1"},{"author":{"_account_id":27337,"name":"Mathieu GRZYBEK","email":"mathieu@stackhpc.com","username":"mgrzybek"},"change_message_id":"fd24d3caaefdeb8ab90a8cfd75811e12cb89697e","unresolved":false,"context_lines":[{"line_number":750,"context_line":"        ctx \u003d payload.context"},{"line_number":751,"context_line":"        if not hasattr(ctx, _OVN_NET_DELETE_FLAG):"},{"line_number":752,"context_line":"            setattr(ctx, _OVN_NET_DELETE_FLAG, set())"},{"line_number":753,"context_line":"        getattr(ctx, _OVN_NET_DELETE_FLAG).add(payload.resource_id)"},{"line_number":754,"context_line":""},{"line_number":755,"context_line":"    def _prevent_metadata_port_delete(self, resource, event, trigger,"},{"line_number":756,"context_line":"                                      payload):"}],"source_content_type":"text/x-python","patch_set":2,"id":"92aa1905_3608937a","line":753,"range":{"start_line":753,"start_character":16,"end_line":753,"end_character":42},"in_reply_to":"15c02516_758bb887","updated":"2026-10-06 15:38:42.000000000","message":"Done","commit_id":"d8e38190293d0f6d813e7fc4f13a8e4e2a1476b1"},{"author":{"_account_id":27337,"name":"Mathieu GRZYBEK","email":"mathieu@stackhpc.com","username":"mgrzybek"},"change_message_id":"4c6708ca2af6c5f444d308ee7de57f3d8b32ed49","unresolved":true,"context_lines":[{"line_number":750,"context_line":"        ctx \u003d payload.context"},{"line_number":751,"context_line":"        if not hasattr(ctx, _OVN_NET_DELETE_FLAG):"},{"line_number":752,"context_line":"            setattr(ctx, _OVN_NET_DELETE_FLAG, set())"},{"line_number":753,"context_line":"        getattr(ctx, _OVN_NET_DELETE_FLAG).add(payload.resource_id)"},{"line_number":754,"context_line":""},{"line_number":755,"context_line":"    def _prevent_metadata_port_delete(self, resource, event, trigger,"},{"line_number":756,"context_line":"                                      payload):"}],"source_content_type":"text/x-python","patch_set":2,"id":"15c02516_758bb887","line":753,"range":{"start_line":753,"start_character":16,"end_line":753,"end_character":42},"in_reply_to":"d6b35a1a_fec6c437","updated":"2026-10-06 15:37:11.000000000","message":"I think that the policy-based approach it easier.","commit_id":"d8e38190293d0f6d813e7fc4f13a8e4e2a1476b1"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"83366ed61d6bddd184ec24a3a9c7f2aca436fe5d","unresolved":true,"context_lines":[{"line_number":753,"context_line":"        getattr(ctx, _OVN_NET_DELETE_FLAG).add(payload.resource_id)"},{"line_number":754,"context_line":""},{"line_number":755,"context_line":"    def _prevent_metadata_port_delete(self, resource, event, trigger,"},{"line_number":756,"context_line":"                                      payload):"},{"line_number":757,"context_line":"        \"\"\"Deny the deletion of the OVN metadata port of a network."},{"line_number":758,"context_line":""},{"line_number":759,"context_line":"        The port provides DHCP and metadata to the network, so it can only be"}],"source_content_type":"text/x-python","patch_set":2,"id":"987878d3_4565cb62","line":756,"updated":"2026-10-05 14:28:42.000000000","message":"we should avoid such hard coded \"policies\" as much as possible and instead I think this can be done as the API policy. I recently did something similar for preventing direct deletion of the ports owned by nova, see patch https://github.com/openstack/neutron/commit/c3273b06faf0089ba1135913470d2ada7bf516f0","commit_id":"d8e38190293d0f6d813e7fc4f13a8e4e2a1476b1"},{"author":{"_account_id":27337,"name":"Mathieu GRZYBEK","email":"mathieu@stackhpc.com","username":"mgrzybek"},"change_message_id":"fd24d3caaefdeb8ab90a8cfd75811e12cb89697e","unresolved":false,"context_lines":[{"line_number":753,"context_line":"        getattr(ctx, _OVN_NET_DELETE_FLAG).add(payload.resource_id)"},{"line_number":754,"context_line":""},{"line_number":755,"context_line":"    def _prevent_metadata_port_delete(self, resource, event, trigger,"},{"line_number":756,"context_line":"                                      payload):"},{"line_number":757,"context_line":"        \"\"\"Deny the deletion of the OVN metadata port of a network."},{"line_number":758,"context_line":""},{"line_number":759,"context_line":"        The port provides DHCP and metadata to the network, so it can only be"}],"source_content_type":"text/x-python","patch_set":2,"id":"124e7d24_84a3787b","line":756,"in_reply_to":"1efcdac3_42f5cc02","updated":"2026-10-06 15:38:42.000000000","message":"Done","commit_id":"d8e38190293d0f6d813e7fc4f13a8e4e2a1476b1"},{"author":{"_account_id":16688,"name":"Rodolfo Alonso","email":"ralonsoh@redhat.com","username":"rodolfo-alonso-hernandez"},"change_message_id":"a82e89f117883127f094d9fd1b952b7b77fd595c","unresolved":true,"context_lines":[{"line_number":753,"context_line":"        getattr(ctx, _OVN_NET_DELETE_FLAG).add(payload.resource_id)"},{"line_number":754,"context_line":""},{"line_number":755,"context_line":"    def _prevent_metadata_port_delete(self, resource, event, trigger,"},{"line_number":756,"context_line":"                                      payload):"},{"line_number":757,"context_line":"        \"\"\"Deny the deletion of the OVN metadata port of a network."},{"line_number":758,"context_line":""},{"line_number":759,"context_line":"        The port provides DHCP and metadata to the network, so it can only be"}],"source_content_type":"text/x-python","patch_set":2,"id":"dc532c52_62b91fd8","line":756,"in_reply_to":"987878d3_4565cb62","updated":"2026-10-05 14:38:23.000000000","message":"I agree with Slawek: a policy check would be sufficient for this bug. Of course, that implies the admin use would be able (by default) to delete the port.","commit_id":"d8e38190293d0f6d813e7fc4f13a8e4e2a1476b1"},{"author":{"_account_id":16688,"name":"Rodolfo Alonso","email":"ralonsoh@redhat.com","username":"rodolfo-alonso-hernandez"},"change_message_id":"5bf098050347992d34fda89598905401ae59ef35","unresolved":true,"context_lines":[{"line_number":753,"context_line":"        getattr(ctx, _OVN_NET_DELETE_FLAG).add(payload.resource_id)"},{"line_number":754,"context_line":""},{"line_number":755,"context_line":"    def _prevent_metadata_port_delete(self, resource, event, trigger,"},{"line_number":756,"context_line":"                                      payload):"},{"line_number":757,"context_line":"        \"\"\"Deny the deletion of the OVN metadata port of a network."},{"line_number":758,"context_line":""},{"line_number":759,"context_line":"        The port provides DHCP and metadata to the network, so it can only be"}],"source_content_type":"text/x-python","patch_set":2,"id":"ebefcb4b_80aad161","line":756,"in_reply_to":"dc532c52_62b91fd8","updated":"2026-10-05 15:00:25.000000000","message":"I\u0027ve also proposed https://bugs.launchpad.net/neutron/+bug/2169598. This RFE would allow to enable/disable the metadata per port. If a metadata port is deleted by accident, it would be possible to re-enable it again.","commit_id":"d8e38190293d0f6d813e7fc4f13a8e4e2a1476b1"},{"author":{"_account_id":27337,"name":"Mathieu GRZYBEK","email":"mathieu@stackhpc.com","username":"mgrzybek"},"change_message_id":"4c6708ca2af6c5f444d308ee7de57f3d8b32ed49","unresolved":true,"context_lines":[{"line_number":753,"context_line":"        getattr(ctx, _OVN_NET_DELETE_FLAG).add(payload.resource_id)"},{"line_number":754,"context_line":""},{"line_number":755,"context_line":"    def _prevent_metadata_port_delete(self, resource, event, trigger,"},{"line_number":756,"context_line":"                                      payload):"},{"line_number":757,"context_line":"        \"\"\"Deny the deletion of the OVN metadata port of a network."},{"line_number":758,"context_line":""},{"line_number":759,"context_line":"        The port provides DHCP and metadata to the network, so it can only be"}],"source_content_type":"text/x-python","patch_set":2,"id":"1efcdac3_42f5cc02","line":756,"in_reply_to":"ebefcb4b_80aad161","updated":"2026-10-06 15:37:11.000000000","message":"Indeed. It looks easier and the code is less intrusive.","commit_id":"d8e38190293d0f6d813e7fc4f13a8e4e2a1476b1"}]}