OVS agent: Correct bridge setup ordering

This patch fixes three issues that combined to break tunnel networks.

The first issue was the the failure mode was being set on the
integration bridge after the canary flow was installed. This
immediately wiped out the canary flow.

The second problem was that the main loop would sync tunnel networks
right before resetting the tunnel bridge when the canary flow was
missing. This meant that it would sync all of the tunnels via RPC and
then wipe them out.

The final issue was that after resetting the tunnel bridge in the
main loop, the tunnel_sync variable was not set to True, so the
tunnels would never be resynchronized.

This patch addresses the three issues in the following ways:
1. Set the failure mode on the bridge before the canary flow is
installed.
2. Run the OVS restart logic before the tunnel synchronization.
3. If the restart logic is triggered, set tunnel_sync to True to
trigger synchronization.

Closes-Bug: #1292105
Change-Id: I6381e3fee49910127c420dd2e3205c64cdb9e185

Author: kevinbenton

neutron/plugins/openvswitch/agent/ovs_neutron_agent.py

@@ -179,7 +179,6 @@ def __init__(self, integ_br, tun_br, local_ip,
 
         self.int_br = ovs_lib.OVSBridge(integ_br, self.root_helper)
         self.setup_integration_br()
-        self.int_br.set_secure_mode()
         # Stores port update notifications for processing in main rpc loop
         self.updated_ports = set()
         self.setup_rpc()
@@ -728,6 +727,7 @@ def setup_integration_br(self):
         #   ovs-vsctl -- --may-exist add-br BRIDGE_NAME
         # which does nothing if bridge already exists.
         self.int_br.create()
+        self.int_br.set_secure_mode()
 
         self.int_br.delete_port(cfg.CONF.OVS.int_peer_patch_port)
         self.int_br.remove_all_flows()
@@ -1334,6 +1334,13 @@ def rpc_loop(self, polling_manager=None):
                 ancillary_ports.clear()
                 sync = False
                 polling_manager.force_polling()
+            ovs_restarted = self.check_ovs_restart()
+            if ovs_restarted:
+                self.setup_integration_br()
+                self.setup_physical_bridges(self.bridge_mappings)
+                if self.enable_tunneling:
+                    self.setup_tunnel_br()
+                    tunnel_sync = True
             # Notify the plugin of tunnel IP
             if self.enable_tunneling and tunnel_sync:
                 LOG.info(_("Agent tunnel out of sync with plugin!"))
@@ -1342,12 +1349,6 @@ def rpc_loop(self, polling_manager=None):
                 except Exception:
                     LOG.exception(_("Error while synchronizing tunnels"))
                     tunnel_sync = True
-            ovs_restarted = self.check_ovs_restart()
-            if ovs_restarted:
-                self.setup_integration_br()
-                self.setup_physical_bridges(self.bridge_mappings)
-                if self.enable_tunneling:
-                    self.setup_tunnel_br()
             if self._agent_has_updates(polling_manager) or ovs_restarted:
                 try:
                     LOG.debug(_("Agent rpc_loop - iteration:%(iter_num)d - "

neutron/tests/unit/openvswitch/test_ovs_tunnel.py

@@ -107,12 +107,12 @@ def setUp(self):
         self.mock_int_bridge = self.ovs_bridges[self.INT_BRIDGE]
         self.mock_int_bridge_expected = [
             mock.call.create(),
+            mock.call.set_secure_mode(),
             mock.call.delete_port('patch-tun'),
             mock.call.remove_all_flows(),
             mock.call.add_flow(priority=1, actions='normal'),
             mock.call.add_flow(priority=0, table=constants.CANARY_TABLE,
                                actions='drop'),
-            mock.call.set_secure_mode(),
         ]
 
         self.mock_map_tun_bridge = self.ovs_bridges[self.MAP_TUN_BRIDGE]