We were able to reproduce the issue when using virtual MAC with port security enabled.
After adding the <VIP, virtual MAC> address pair to the openstack ports of the keepalived units and restarting the units a test instance was able to ping the VIP correctly, resolving the VIP to the virtual MAC. A keepalived failover was triggered by isolating the master unit, shutting down its openstack port, but the traffic was sent to the wrong unit by OVN. - The master M1 unit is isolated. - The backup unit M2 becomes the master of the cluster and sends the gARP with the virtual MAC. - OVN updates the MAC-chassis binding, selecting as the egress chassis for the virtual MAC the chassis of unit M3, the one with the lowest priority. This is unexpected, as this unit was never elected as master of the keepalived cluster and never sent any gARP request. - OVN sends the traffic to M3, where the VIP is not configured. - Service is unavailable. We were not able to replicate the issue with port security disabled, after disabling port security and triggering a VIP movement the traffic flows to the correct master unit. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2166984 Title: OVN Mac_Binding table not refreshed after keepalived VIP failover between virtual port parents To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/ovn/+bug/2166984/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
