github-actions[bot] commented on issue #13521: URL: https://github.com/apache/cloudstack/issues/13521#issuecomment-5356776549
## ๐ฏ Triage report Private-VLAN (PVLAN) isolation on shared networks with KVM/OVS is broken: VMs cannot reach their default gateway due to OVS flow table 1 stripping the VLAN tag and then failing to match on the untagged packet. A maintainer-proposed script fix (`ovs-pvlan-kvm-vm.sh`) resolved the gateway-ping issue but introduced a regression where VM-to-VM isolation (the entire point of PVLANs) is also broken โ VMs can now ping each other across the isolated VLAN. ### ๐ Assessment | Dimension | Value | Reasoning | |---|---|---| | **Type** | type:bug | OVS flow rules for PVLAN incorrectly match/rewrite traffic, breaking both connectivity and isolation | | **Component** | component:networking, component:kvm | Bug is in the OVS PVLAN scripts used by the KVM hypervisor plugin | | **Severity** | Severity:Major | Breaks a security-relevant isolation feature (private VLANs) โ traffic that should be isolated is not, which is a functional/security regression, not just a connectivity nuisance | | **Labels** | type:bug, component:networking, component:kvm, Severity:Major | See above | | **Coding agent** | Needs more info | The flow-rule change needed is partially known (`ovs-pvlan-kvm-vm.sh` table=1 matching), but a full fix requires re-deriving correct OVS flow semantics for PVLAN isolation between community/isolated ports without breaking gateway reachability โ needs a maintainer/contributor with OVS expertise and a test environment | ### ๐ Similar issues No closely related open duplicates found. <details><summary>๐ก Notes and suggestions</summary> The maintainer's suggested change (`vlan_tci=0x0000` match instead of re-adding the VLAN tag) fixed gateway connectivity but removed the isolation between VM ports, which defeats the purpose of PVLANs. The real fix likely needs a table=1 rule that matches on the stripped/untagged packet **and** still enforces the isolated/community/promiscuous port relationships (i.e., re-inserting the appropriate community/isolated group actions instead of a blanket `output:<port>`). The reporter has a live test environment and offered to test further changes โ a maintainer with OVS/PVLAN knowledge should propose a refined flow rule. </details> > Generated by [Daily Issue Triage](https://github.com/apache/cloudstack/actions/runs/32375697891) ยท sonnet50 224.8K ยท [โท](https://github.com/search?q=repo%3Aapache%2Fcloudstack+%22gh-aw-workflow-call-id%3A+apache%2Fcloudstack%2Fdaily-issue-triage%22&type=issues) > <details> <summary>Add this agentic workflows to your repo</summary> To install this agentic workflow, run ``` gh aw add githubnext/agentics/workflows/daily-issue-triage.md@d7c1dc4b72b00607a67caaffdcc216cb64379cf9 ``` </details> <!-- gh-aw-agentic-workflow: Daily Issue Triage, engine: copilot, version: 1.0.52, model: claude-sonnet-5, id: 32375697891, workflow_id: daily-issue-triage, run: https://github.com/apache/cloudstack/actions/runs/32375697891 --> <!-- gh-aw-workflow-call-id: apache/cloudstack/daily-issue-triage --> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
