** Description changed:
+ [Impact]
+
+ Updated OVN 22.03 packages in Jammy generate Southbound logical flows using
+ the ct_commit_nat action and flags.from_ctrl field. The original OVN
+ 22.09.1 packages in Zed do not understand these constructs.
+
+ During the upgrade, ovn-controller rejects the affected logical flows,
+ logging:
+
+ error parsing actions "ct_commit_nat;": Syntax error at
+ `ct_commit_nat' expecting action.
+
+ error parsing match "flags.from_ctrl && udp.src == 53": Syntax error at
+ `flags.from_ctrl' expecting field name.
+
+ This prevents the affected flows from being installed and can disrupt
+ network traffic during the upgrade.
+
+ The proposed package, 22.09.1-0ubuntu0.22.10.1~cloud2, backports
+ ct_commit_nat and the related load-balancer handling. It also includes
+ the CVE-2025-0650 fix providing flags.from_ctrl.
+
+ [Test Plan]
+
+ Deploy a Jammy Charmed OpenStack cloud using updated OVN 22.03 packages.
+ Configure instances on different compute hosts, security groups, floating
+ IPs, OVN DNS records, and an OVN load balancer.
+
+ Confirm that the Southbound database contains flows referencing both
+ ct_commit_nat and flags.from_ctrl.
+
+ Reproduce the upgrade failure by upgrading through Zed using the
+ unfixed OVN 22.09.1 package. Record the package versions, controller
+ parsing errors, and affected connectivity.
+
+ Repeat from the same pre-upgrade state, using
+ 22.09.1-0ubuntu0.22.10.1~cloud2 from zed-proposed.
+
+ Verify that:
+
+ * All relevant units install the candidate package and their OVN
+ services remain healthy.
+ * No ct_commit_nat or flags.from_ctrl parsing errors appear in the
+ ovn-controller logs during the upgrade.
+ * Controllers converge and process subsequent network configuration.
+ * Existing and newly created instances have working east-west and
+ floating-IP connectivity.
+ * OVN DNS resolution works with security groups enabled.
+ * Related ICMP traffic through an OVN load balancer is delivered with
+ the correct NAT translation.
+
+ Run the Charmed OpenStack functional and upgrade tests and attach the
+ results, package versions, and relevant logs before marking verification
+ complete.
+
+ [Where problems could occur]
+
+ The patches change logical action parsing, load-balancer handling of
+ related traffic, and the ACL treatment of OVN-generated DNS responses.
+
+ Regressions could affect connection tracking or NAT for related ICMP
+ traffic, prevent logical flows from being installed, or incorrectly allow
+ or block DNS traffic.
+
+ Validation must cover both existing connections and new network
+ configuration after the upgrade. DNS testing must confirm that legitimate
+ OVN-generated replies work while workload-generated traffic remains
+ subject to the configured security-group rules.
+
+ [Other Info]
+
+ This SRU backports the missing compatibility fixes to OVN 22.09.1.
+ It does not update OVN to 22.09.3.
+
+ ---
+
The charmed OpenStack product currently make use of a step by step
upgrade process.
This includes stepping through interim releases of OVN.
While OVN itself supports direct upgrades between LTS versions, it is
impractical in the current organization of apt repositories.
Between 22.03 and 22.04 releases, two new actions has been introduced
and backported to resolve critical issues.
These patches have made their way into the ovn 22.03 package in Jammy,
but not to the intermediate versions currently maintained in UCA. As a
consequence, when users attempt to upgrade they will hit an data path
impacting issue, and find messages below logged by the ovn-controller:
2025-06-19T06:14:46.085Z|00025|lflow|WARN|error parsing actions
"ct_commit_nat;": Syntax error at `ct_commit_nat' expecting action.
2025-06-19T06:14:46.089Z|00026|lflow|WARN|error parsing match
"flags.from_ctrl && udp.src == 53": Syntax error at `flags.from_ctrl' expecting
field name.
2025-06-19T06:22:56.626Z|00032|lflow|WARN|error parsing actions
"ct_commit_nat;": Syntax error at `ct_commit_nat' expecting action.
2025-06-19T06:22:56.628Z|00034|lflow|WARN|error parsing match
"flags.from_ctrl && udp.src == 53": Syntax error at `flags.from_ctrl' expecting
field name.
The required patches to resolve this are:
474bdfcad038 ("Skip only OVN DNS responder packets from OUT_ACL.")
650f06b9f3e2 ("northd: Allow related traffic through LB")
31196346fcad ("actions: Add new action called ct_commit_nat")
** Description changed:
[Impact]
Updated OVN 22.03 packages in Jammy generate Southbound logical flows using
the ct_commit_nat action and flags.from_ctrl field. The original OVN
22.09.1 packages in Zed do not understand these constructs.
During the upgrade, ovn-controller rejects the affected logical flows,
logging:
- error parsing actions "ct_commit_nat;": Syntax error at
- `ct_commit_nat' expecting action.
+ error parsing actions "ct_commit_nat;": Syntax error at
+ `ct_commit_nat' expecting action.
- error parsing match "flags.from_ctrl && udp.src == 53": Syntax error at
- `flags.from_ctrl' expecting field name.
+ error parsing match "flags.from_ctrl && udp.src == 53": Syntax error at
+ `flags.from_ctrl' expecting field name.
This prevents the affected flows from being installed and can disrupt
network traffic during the upgrade.
-
- The proposed package, 22.09.1-0ubuntu0.22.10.1~cloud2, backports
- ct_commit_nat and the related load-balancer handling. It also includes
- the CVE-2025-0650 fix providing flags.from_ctrl.
[Test Plan]
Deploy a Jammy Charmed OpenStack cloud using updated OVN 22.03 packages.
Configure instances on different compute hosts, security groups, floating
IPs, OVN DNS records, and an OVN load balancer.
Confirm that the Southbound database contains flows referencing both
ct_commit_nat and flags.from_ctrl.
Reproduce the upgrade failure by upgrading through Zed using the
unfixed OVN 22.09.1 package. Record the package versions, controller
parsing errors, and affected connectivity.
Repeat from the same pre-upgrade state, using
22.09.1-0ubuntu0.22.10.1~cloud2 from zed-proposed.
Verify that:
* All relevant units install the candidate package and their OVN
- services remain healthy.
+ services remain healthy.
* No ct_commit_nat or flags.from_ctrl parsing errors appear in the
- ovn-controller logs during the upgrade.
+ ovn-controller logs during the upgrade.
* Controllers converge and process subsequent network configuration.
* Existing and newly created instances have working east-west and
- floating-IP connectivity.
+ floating-IP connectivity.
* OVN DNS resolution works with security groups enabled.
* Related ICMP traffic through an OVN load balancer is delivered with
- the correct NAT translation.
+ the correct NAT translation.
Run the Charmed OpenStack functional and upgrade tests and attach the
results, package versions, and relevant logs before marking verification
complete.
[Where problems could occur]
The patches change logical action parsing, load-balancer handling of
related traffic, and the ACL treatment of OVN-generated DNS responses.
Regressions could affect connection tracking or NAT for related ICMP
traffic, prevent logical flows from being installed, or incorrectly allow
or block DNS traffic.
Validation must cover both existing connections and new network
configuration after the upgrade. DNS testing must confirm that legitimate
OVN-generated replies work while workload-generated traffic remains
subject to the configured security-group rules.
[Other Info]
This SRU backports the missing compatibility fixes to OVN 22.09.1.
It does not update OVN to 22.09.3.
---
The charmed OpenStack product currently make use of a step by step
upgrade process.
This includes stepping through interim releases of OVN.
While OVN itself supports direct upgrades between LTS versions, it is
impractical in the current organization of apt repositories.
Between 22.03 and 22.04 releases, two new actions has been introduced
and backported to resolve critical issues.
These patches have made their way into the ovn 22.03 package in Jammy,
but not to the intermediate versions currently maintained in UCA. As a
consequence, when users attempt to upgrade they will hit an data path
impacting issue, and find messages below logged by the ovn-controller:
2025-06-19T06:14:46.085Z|00025|lflow|WARN|error parsing actions
"ct_commit_nat;": Syntax error at `ct_commit_nat' expecting action.
2025-06-19T06:14:46.089Z|00026|lflow|WARN|error parsing match
"flags.from_ctrl && udp.src == 53": Syntax error at `flags.from_ctrl' expecting
field name.
2025-06-19T06:22:56.626Z|00032|lflow|WARN|error parsing actions
"ct_commit_nat;": Syntax error at `ct_commit_nat' expecting action.
2025-06-19T06:22:56.628Z|00034|lflow|WARN|error parsing match
"flags.from_ctrl && udp.src == 53": Syntax error at `flags.from_ctrl' expecting
field name.
The required patches to resolve this are:
474bdfcad038 ("Skip only OVN DNS responder packets from OUT_ACL.")
650f06b9f3e2 ("northd: Allow related traffic through LB")
31196346fcad ("actions: Add new action called ct_commit_nat")
** Description changed:
[Impact]
Updated OVN 22.03 packages in Jammy generate Southbound logical flows using
the ct_commit_nat action and flags.from_ctrl field. The original OVN
22.09.1 packages in Zed do not understand these constructs.
During the upgrade, ovn-controller rejects the affected logical flows,
logging:
error parsing actions "ct_commit_nat;": Syntax error at
`ct_commit_nat' expecting action.
error parsing match "flags.from_ctrl && udp.src == 53": Syntax error at
`flags.from_ctrl' expecting field name.
This prevents the affected flows from being installed and can disrupt
network traffic during the upgrade.
[Test Plan]
Deploy a Jammy Charmed OpenStack cloud using updated OVN 22.03 packages.
Configure instances on different compute hosts, security groups, floating
IPs, OVN DNS records, and an OVN load balancer.
Confirm that the Southbound database contains flows referencing both
ct_commit_nat and flags.from_ctrl.
-
- Reproduce the upgrade failure by upgrading through Zed using the
- unfixed OVN 22.09.1 package. Record the package versions, controller
- parsing errors, and affected connectivity.
-
- Repeat from the same pre-upgrade state, using
- 22.09.1-0ubuntu0.22.10.1~cloud2 from zed-proposed.
Verify that:
* All relevant units install the candidate package and their OVN
services remain healthy.
* No ct_commit_nat or flags.from_ctrl parsing errors appear in the
ovn-controller logs during the upgrade.
* Controllers converge and process subsequent network configuration.
* Existing and newly created instances have working east-west and
floating-IP connectivity.
* OVN DNS resolution works with security groups enabled.
* Related ICMP traffic through an OVN load balancer is delivered with
the correct NAT translation.
Run the Charmed OpenStack functional and upgrade tests and attach the
results, package versions, and relevant logs before marking verification
complete.
[Where problems could occur]
The patches change logical action parsing, load-balancer handling of
related traffic, and the ACL treatment of OVN-generated DNS responses.
Regressions could affect connection tracking or NAT for related ICMP
traffic, prevent logical flows from being installed, or incorrectly allow
or block DNS traffic.
Validation must cover both existing connections and new network
configuration after the upgrade. DNS testing must confirm that legitimate
OVN-generated replies work while workload-generated traffic remains
subject to the configured security-group rules.
[Other Info]
- This SRU backports the missing compatibility fixes to OVN 22.09.1.
- It does not update OVN to 22.09.3.
-
---
The charmed OpenStack product currently make use of a step by step
upgrade process.
This includes stepping through interim releases of OVN.
While OVN itself supports direct upgrades between LTS versions, it is
impractical in the current organization of apt repositories.
Between 22.03 and 22.04 releases, two new actions has been introduced
and backported to resolve critical issues.
These patches have made their way into the ovn 22.03 package in Jammy,
but not to the intermediate versions currently maintained in UCA. As a
consequence, when users attempt to upgrade they will hit an data path
impacting issue, and find messages below logged by the ovn-controller:
2025-06-19T06:14:46.085Z|00025|lflow|WARN|error parsing actions
"ct_commit_nat;": Syntax error at `ct_commit_nat' expecting action.
2025-06-19T06:14:46.089Z|00026|lflow|WARN|error parsing match
"flags.from_ctrl && udp.src == 53": Syntax error at `flags.from_ctrl' expecting
field name.
2025-06-19T06:22:56.626Z|00032|lflow|WARN|error parsing actions
"ct_commit_nat;": Syntax error at `ct_commit_nat' expecting action.
2025-06-19T06:22:56.628Z|00034|lflow|WARN|error parsing match
"flags.from_ctrl && udp.src == 53": Syntax error at `flags.from_ctrl' expecting
field name.
The required patches to resolve this are:
474bdfcad038 ("Skip only OVN DNS responder packets from OUT_ACL.")
650f06b9f3e2 ("northd: Allow related traffic through LB")
31196346fcad ("actions: Add new action called ct_commit_nat")
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2115328
Title:
[uca][zed][antelope][bobcat] Upgrade failure due to missing patches
To manage notifications about this bug go to:
https://bugs.launchpad.net/cloud-archive/+bug/2115328/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
