Conversation
…ction Signed-off-by: Piotr Resztak <piotr.resztak@gmail.com>
Signed-off-by: Piotr Resztak <piotr.resztak@gmail.com>
DeleteLogicalRouterNAT only matches on the external address, which can't remove the rules of one network from a router shared by several. Add a variant matching on the logical IP and move both onto a shared filter. Signed-off-by: Piotr Resztak <piotr.resztak@gmail.com>
In preparation for OVN networks sharing the logical router of a parent, introduce a router owner. A network without a parent owns its router and keeps its current OVN object names. Signed-off-by: Piotr Resztak <piotr.resztak@gmail.com>
Several places assumed the logical router belonged to a single network. Scope the SNAT rules to the subnets of the network being configured, compute the router policies across every network on the router, and only delete the router with its owner. Scoping the SNAT rules also fixes an existing bug. On update the network setup removed every snat rule from the router, including the per-NIC egress rules created from ipv4.address.external and ipv6.address.external, so any change to an OVN network dropped those until the instance NIC was restarted. Signed-off-by: Piotr Resztak <piotr.resztak@gmail.com>
An OVN network can now be created with a parent, attaching its own switch and subnet to that parent's logical router instead of creating a router of its own. Several internal subnets can then be routed by one router and share its uplink. A child keeps its own switch, DHCP, DNS, ACLs and instance ports, resolves the uplink through its parent, translates to the external port of the parent's router when NAT is enabled, and leaves the router, external switch and chassis group to the network owning them. Signed-off-by: Piotr Resztak <piotr.resztak@gmail.com>
…ncy group An OVN network with a parent depends on another logical network, not on a host interface like the physical networks keying off the same parent key. Signed-off-by: Piotr Resztak <piotr.resztak@gmail.com>
Forwards and load balancers install their listen address on the logical router, so check for a conflict across every network sharing it and let a child use the external address of its parent's router. Reject peers on a child and peers targeting one, as a child has no router of its own. Source the BGP next hop and DNS zone notification from the network providing the uplink. Signed-off-by: Piotr Resztak <piotr.resztak@gmail.com>
Signed-off-by: Piotr Resztak <piotr.resztak@gmail.com>
Signed-off-by: Piotr Resztak <piotr.resztak@gmail.com>
Signed-off-by: Piotr Resztak <piotr.resztak@gmail.com>
Signed-off-by: Piotr Resztak <piotr.resztak@gmail.com>
github-actions
Bot
added
Documentation
Member
Author
|
The first two commits allow us to specify the |
presztak
marked this pull request as ready for review
September 21, 2026 16:11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes: #1970