Skip to content

feat(neutron): Prevent SVI routers from using external gateways PUC-1754#2134

Merged
cardoe merged 1 commit into
mainfrom
svi_external_gateway
Jul 9, 2026
Merged

feat(neutron): Prevent SVI routers from using external gateways PUC-1754#2134
cardoe merged 1 commit into
mainfrom
svi_external_gateway

Conversation

@nidzrai

@nidzrai nidzrai commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

https://rackspace.atlassian.net/browse/PUC-1754

A single subscriber on the Svi class, resources.ROUTER_GATEWAY, [events.BEFORE_CREATE] , It fires before the gateway port is created, so nothing is written or rolled back. Neutron's callback-failure handler re-raises the underlying exception directly (raise e.errors[0].error), giving a Badrequest.

iAd-dev testing :
scenerio 1: create SVI flavoured router add external gateway

~ 🐍 openstack on ☁️  uc-dev-infra(baremetal) took 5s
❯ openstack router create --flavor svi nidhi-svi-router
+---------------------------+--------------------------------------+
| Field                     | Value                                |
+---------------------------+--------------------------------------+
| admin_state_up            | UP                                   |
| availability_zone_hints   |                                      |
| availability_zones        |                                      |
| created_at                | 2026-07-09T12:50:10Z                 |
| description               |                                      |
| enable_default_route_bfd  | False                                |
| enable_default_route_ecmp | False                                |
| enable_ndp_proxy          | None                                 |
| enable_snat               | True                                 |
| evpn_vni                  | 5                                    |
| external_gateway_info     | null                                 |
| external_gateways         | []                                   |
| flavor_id                 | e07c2c5f-9ac2-479a-a2ac-923872d0aff6 |
| ha                        | False                                |
| id                        | 6bedbc83-423d-45da-bbdb-9abc120e6e1d |
| name                      | nidhi-svi-router                     |
| project_id                | 32e02632f4f04415bab5895d1e7247b7     |
| revision_number           | 1                                    |
| routes                    |                                      |
| status                    | ACTIVE                               |
| tags                      |                                      |
| updated_at                | 2026-07-09T12:50:10Z                 |
+---------------------------+--------------------------------------+
(openstack)
~ 🐍 openstack on ☁️  uc-dev-infra(baremetal) took 4s
❯ openstack router set --external-gateway PUBLICNET nidhi-svi-router
BadRequestException: 400: Client Error for url: https://neutron.iad3-dev.undercloud.rackspace.net/v2.0/routers/6bedbc83-423d-45da-bbdb-9abc120e6e1d/update_external_gateways, Bad router request: SVI routers cannot have an external gateway..
(openstack)

scenerio 2 : Assign ext gateway while creating svi router

~ 🐍 openstack on ☁️  uc-dev-infra(baremetal) took 2s
❯ openstack router create --flavor svi  --external-gateway PUBLICNET nidhi-svi-router
BadRequestException: 400: Client Error for url: https://neutron.iad3-dev.undercloud.rackspace.net/v2.0/routers/7234dc0d-8a70-431d-ba32-54cd3539e3f0/update_external_gateways, Bad router request: SVI routers cannot have an external gateway..
(openstack)

[Multihoming lets one router have multiple external gateway ports at the same time, instead of only one classic external_gateway_info gateway.]
Scenerio 4: Multihoming : The router ended up with multiple entries in external_gateways

~ 🐍 openstack on ☁️  uc-dev-infra(baremetal) took 5s
❯ openstack router add gateway nidhi-dupe-router PUBLICNET

~ 🐍 openstack on ☁️  uc-dev-infra(baremetal)
❯ openstack router show nidhi-dupe-router
+---------------------------+----------------------------------------------------------------------------------------------------------------------+
| Field                     | Value                                                                                                                |
+---------------------------+----------------------------------------------------------------------------------------------------------------------+
| admin_state_up            | UP                                                                                                                   |
| availability_zone_hints   |                                                                                                                      |
| availability_zones        |                                                                                                                      |
| created_at                | 2026-07-06T12:53:41Z                                                                                                 |
| description               |                                                                                                                      |
| enable_default_route_bfd  | False                                                                                                                |
| enable_default_route_ecmp | False                                                                                                                |
| enable_ndp_proxy          | None                                                                                                                 |
| enable_snat               | True                                                                                                                 |
| evpn_vni                  | 1                                                                                                                    |
| external_gateway_info     | {"network_id": "356bb8c1-1470-452f-99e2-6252585c847a", "external_fixed_ips": [{"subnet_id":                          |
|                           | "36ecd265-c0cc-4079-ad73-1101164b4a5f", "ip_address": "204.232.163.34"}], "enable_snat": true}                       |
| external_gateways         | [{'network_id': '356bb8c1-1470-452f-99e2-6252585c847a', 'external_fixed_ips': [{'ip_address': '204.232.163.34',      |
|                           | 'subnet_id': '36ecd265-c0cc-4079-ad73-1101164b4a5f'}]}, {'network_id': '356bb8c1-1470-452f-99e2-6252585c847a',       |
|                           | 'external_fixed_ips': [{'ip_address': '204.232.163.31', 'subnet_id': '36ecd265-c0cc-4079-ad73-1101164b4a5f'}]}]      |
| flavor_id                 | None                                                                                                                 |
| ha                        | True                                                                                                                 |
| id                        | ed470efc-f119-4040-b0c1-123ae7784728                                                                                 |
| interfaces_info           | [{"port_id": "60080097-9727-4968-9dcd-10065871f049", "ip_address": "10.250.91.1", "subnet_id":                       |
|                           | "130d60d9-7408-42b4-a004-c82c49290e3f"}]                                                                             |
| name                      | nidhi-dupe-router                                                                                                    |
| project_id                | 32e02632f4f04415bab5895d1e7247b7                                                                                     |
| revision_number           | 4                                                                                                                    |
| routes                    |                                                                                                                      |
| status                    | ACTIVE                                                                                                               |
| tags                      |                                                                                                                      |
| updated_at                | 2026-07-09T12:57:49Z                                                                                                 |
+---------------------------+----------------------------------------------------------------------------------------------------------------------+

scenerio 4 : non-svi router are not impacted

openstack router create nidhi-plain-router
~ 🐍 openstack on ☁️  uc-dev-infra(baremetal) took 2s
❯ openstack router set --external-gateway PUBLICNET nidhi-plain-router
(openstack)
~ 🐍 openstack on ☁️  uc-dev-infra(baremetal) took 8s
❯ openstack router show nidhi-plain-router -c flavor_id -c external_gateway_info -c external_gateways
+-----------------------+--------------------------------------------------------------------------------------------------------------------------+
| Field                 | Value                                                                                                                    |
+-----------------------+--------------------------------------------------------------------------------------------------------------------------+
| external_gateway_info | {"network_id": "356bb8c1-1470-452f-99e2-6252585c847a", "external_fixed_ips": [{"subnet_id":                              |
|                       | "36ecd265-c0cc-4079-ad73-1101164b4a5f", "ip_address": "204.232.163.52"}], "enable_snat": true}                           |
| external_gateways     | [{'network_id': '356bb8c1-1470-452f-99e2-6252585c847a', 'external_fixed_ips': [{'ip_address': '204.232.163.52',          |
|                       | 'subnet_id': '36ecd265-c0cc-4079-ad73-1101164b4a5f'}]}]                                                                  |
| flavor_id             | None                                                                                                                     |
+-----------------------+--------------------------------------------------------------------------------------------------------------------------+
(openstack)

Known limitation [WIP]
A legacy SVI router that already had a gateway before this change could still receive additional gateways via the multihoming extra-gateway path (which skips ROUTER_GATEWAY BEFORE_CREATE). Not reachable in normal forward operation, since new SVI routers can never acquire a first gateway.

@nidzrai nidzrai force-pushed the svi_external_gateway branch from b0d19f5 to 2018018 Compare July 9, 2026 11:27
@nidzrai nidzrai force-pushed the svi_external_gateway branch from 7d09bd1 to 12c343a Compare July 9, 2026 13:22
@nidzrai nidzrai requested a review from a team July 9, 2026 13:52
@cardoe cardoe added this pull request to the merge queue Jul 9, 2026
Merged via the queue into main with commit ca7ec4a Jul 9, 2026
61 checks passed
@cardoe cardoe deleted the svi_external_gateway branch July 9, 2026 17:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants