neutron-vpnaas — Scenarios

sequenceDiagram
  autonumber
  participant C as Client
  participant S as neutron-server (VPNOVNDriverPlugin + IPsecOvnVPNDriver)
  participant DB as MariaDB
  participant NB as OVN NB (via ML2/OVN)
  participant MQ as RabbitMQ
  participant A as neutron-ovn-vpn-agent (vpn-host-1)
  participant K as qvpn-<router> namespace (strongSwan)

  C->>S: POST /v2.0/vpn/vpnservices {router_id}
  S->>DB: SELECT routers / ports (gateway check)
  S->>DB: INSERT vpnservices (PENDING_CREATE), providerresourceassociations
  S->>S: schedule_router: live VPN agents from AgentCache
  alt no live VPN agent
    S->>DB: UPDATE vpnservices SET status=ERROR
    S-->>C: 409 RouterReschedulingFailed (row kept in ERROR)
  else agent found
    S->>DB: INSERT routervpnagentbindings, vpn_ext_gws (PENDING_CREATE)
    S->>DB: INSERT port vpn-gw-<router> (external net), network/subnet 169.254.0.0/28, port vpn-ns-<router> 169.254.0.2
    S->>NB: Logical_Switch(_Port), Logical_Router_Port (via ML2/OVN)
    S->>DB: UPDATE vpn_ext_gws SET status=ACTIVE; UPDATE vpnservices SET external_v4_ip
    S-->>C: 201 {status: PENDING_CREATE, external_v4_ip}
  end
  Note over S,A: no RPC yet: a service without connection is not sent to agents

  C->>S: POST /v2.0/vpn/ipsec-site-connections {vpnservice_id, ikepolicy_id, ipsecpolicy_id, local/peer EPG, peer_address, psk}
  S->>S: validations (mode, groups, IP versions, DPD, MTU, DNS for FQDN)
  alt invalid
    S-->>C: 400 / 404 (02-errors)
  else valid
    S->>DB: INSERT ipsec_site_connections (PENDING_CREATE)
    S->>DB: router extra routes: peer CIDRs via 169.254.0.2
    S->>NB: Logical_Router_Static_Route (via ML2/OVN)
    S->>MQ: cast vpnservice_updated {router:{id}} → ipsec_agent.vpn-host-1
    S-->>C: 201 {status: PENDING_CREATE}
  end
  MQ->>A: vpnservice_updated
  A->>MQ: call get_vpn_services_on_host {host} → ipsec_driver
  MQ->>S: get_vpn_services_on_host
  S->>DB: join vpnservices/connections/routervpnagentbindings (+ auto-schedule)
  S-->>A: [service + connections + policies + CIDRs + psk]
  A->>S: call get_vpn_transit_network_details {router_id}
  S-->>A: {gw_port, transit_port, 169.254.0.1, external_network}
  A->>K: ip netns add qvpn-<router>; plug vg<port> (external) and vr<port> (transit); routes local CIDRs via 169.254.0.1
  A->>K: write ipsec.conf/secrets; ipsec start; ipsec stroke up-nb <conn>
  A->>K: ipsec status
  A->>S: call update_status [{service ACTIVE|DOWN, connections …, updated_pending_status: true}]
  S->>DB: UPDATE vpnservices / ipsec_site_connections status
  C->>S: GET /v2.0/vpn/ipsec-site-connections/{id}
  S-->>C: 200 {status: ACTIVE}

sequenceDiagram
  autonumber
  participant C as Client
  participant S as neutron-server (VPNDriverPlugin + IPsecVPNDriver)
  participant DB as MariaDB
  participant MQ as RabbitMQ
  participant L as neutron-l3-agent + vpnaas extension
  participant R as qrouter-<router> (strongSwan / Libreswan)

  C->>S: POST /v2.0/vpn/ipsec-site-connections
  S->>S: IpsecVpnValidator: ah-esp policy?
  alt ah-esp
    S-->>C: 400 IpsecValidationFailure
  else
    S->>DB: INSERT ipsec_site_connections (PENDING_CREATE)
    S->>DB: SELECT L3 agents hosting the router (alive, admin up)
    S->>MQ: cast vpnservice_updated → ipsec_agent.<l3 host> (one per hosting agent, both for HA)
    S-->>C: 201 PENDING_CREATE
  end
  MQ->>L: vpnservice_updated
  L->>S: call get_vpn_services_on_host (only if the L3 agent is not dvr mode)
  S-->>L: services
  L->>R: iptables nat POSTROUTING -s local -d peer -m policy --pol ipsec -j ACCEPT
  alt HA router in backup state
    L->>R: disable (stop daemon, remove config)
  else master / non-HA
    L->>R: render config; ipsec start (or reload)
  end
  L->>S: call update_status (report_status at end of sync)
  S->>DB: UPDATE statuses

sequenceDiagram
  autonumber
  participant T as report_status timer (every ipsec_status_check_interval = 60 s)
  participant A as agent device driver
  participant K as ipsec daemon (namespace)
  participant S as neutron-server
  participant DB as MariaDB

  loop every 60 s
    T->>A: report_status()
    A->>K: ip netns exec … neutron-vpn-netns-wrapper --cmd=ipsec,status
    K-->>A: "<conn> … INSTALLED" / "ROUTED" / exit code 1|3
    A->>A: compare with process_status_cache
    alt something changed
      A->>A: update cache first
      A->>S: call update_status [changed services only]
      alt server reachable
        S->>DB: UPDATE status (ACTIVE ↔ DOWN)
      else MessagingTimeout
        Note over A,S: change lost until the next change (cache already updated)
      end
    else no change
      Note over A: no RPC
    end
  end

sequenceDiagram
  autonumber
  participant M as Maintenance worker (holds OVN NB lock)
  participant NB as OVN NB/SB
  participant AC as AgentCache (server memory)
  participant DB as MariaDB
  participant MQ as RabbitMQ
  participant A1 as VPN agent host-1 (dead)
  participant A2 as VPN agent host-2

  Note over A1: process stopped: no more neutron:ovn-vpnagent-sb-cfg updates
  loop every max(agent_down_time // 2, 1) s
    M->>NB: ping_all_chassis: NB_Global.nb_cfg++ (rate-limited)
    NB-->>A2: SB_Global.nb_cfg updated (SbGlobalUpdateEvent)
    A2->>NB: Chassis_Private external_ids:neutron:ovn-vpnagent-sb-cfg = nb_cfg
    NB-->>AC: ChassisVPNAgentWriteEvent → AgentCache.update(host-2)
    M->>AC: get_agents(VPN Agent, alive=False) → host-1 (nb_cfg lag > 1 and last update > agent_down_time)
    M->>DB: SELECT routervpnagentbindings WHERE vpn_agent_id IN (host-1)
    M->>DB: BEGIN; DELETE binding(router, host-1); choose least-loaded live agent; INSERT binding(router, host-2); COMMIT
    M->>MQ: cast vpnservice_removed_from_agent → ipsec_agent.host-1 (lost)
    M->>MQ: call vpnservice_added_to_agent {router_ids} → ipsec_agent.host-2
    alt host-2 answers
      MQ->>A2: sync([router]): build qvpn-<router>, start strongSwan
      M->>DB: update_port binding:host_id=host-2 (vpn-gw and vpn-ns ports)
      NB-->>NB: ML2/OVN moves the ports to host-2's chassis
    else call fails twice
      M->>DB: DELETE binding(router, host-2)
      Note over M: RouterReschedulingFailed logged; router unhosted until an agent auto-schedules it
    end
  end

sequenceDiagram
  autonumber
  participant C as Client
  participant S as neutron-server
  participant DB as MariaDB
  participant MQ as RabbitMQ
  participant A as VPN agent

  C->>S: DELETE /v2.0/vpn/ipsec-site-connections/{id}
  S->>DB: DELETE ipsec_site_connections (+ ipsecpeercidrs cascade)
  S->>DB: remove router extra routes no longer needed
  S->>MQ: cast vpnservice_updated
  S-->>C: 204
  MQ->>A: sync: service has no connection → not returned → destroy process, delete qvpn-<router>
  C->>S: DELETE /v2.0/vpn/vpnservices/{id}
  alt connections remain
    S-->>C: 409 VPNServiceInUse
  else
    S->>DB: DELETE vpnservices, provider association
    S->>MQ: cast vpnservice_updated
    opt last service on the router
      S->>DB: vpn_ext_gws → PENDING_DELETE
      S->>DB: delete vpn-gw port, vpn-ns port, transit router interface, subnet, network
      S->>DB: DELETE vpn_ext_gws
    end
    S-->>C: 204
  end

sequenceDiagram
  autonumber
  participant A as neutron-ovn-vpn-agent
  participant OVS as local OVSDB
  participant SB as OVN SB
  participant S as neutron-server workers
  participant MQ as RabbitMQ

  A->>OVS: get Open_vSwitch external_ids:system-id → chassis name
  A->>SB: connect (retry up to 180 s back-off), monitor SB_Global, Chassis, own Chassis_Private
  A->>SB: db_add Chassis_Private external_ids neutron:ovn-vpnagent-id = uuid5(chassis, 'vpn_agent')
  A->>SB: db_set external_ids neutron:ovn-vpnagent-sb-cfg = Chassis_Private.nb_cfg
  SB-->>S: ChassisVPNAgentWriteEvent (create) → AgentCache: "VPN Agent" alive
  A->>MQ: call get_vpn_services_on_host (initial sync) → auto-schedules unhosted routers to this agent
  loop on every SB_Global.nb_cfg change
    SB-->>A: SbGlobalUpdateEvent
    A->>SB: db_set neutron:ovn-vpnagent-sb-cfg = nb_cfg
    SB-->>S: ChassisVPNAgentWriteEvent (update)
  end
  opt ovn-controller restarted (own Chassis_Private re-created)
    SB-->>A: ChassisPrivateCreateEvent
    A->>SB: re-register + ack nb_cfg
    A->>MQ: full sync
  end