feat: wire a netdev router's gateway and subnets to separate NICs

Author: nidzrai

components/ironic/cm-trait-based-networking.yaml

@@ -31,6 +31,19 @@ data:
           filter: port.category == 'network'
           max_count: 1
 
+    # Match each parent VIF's role tag to its NIC category.
+    # wip:after dougs's changes pr-1011790 ironic gains vif.* filter variables
+    # match vif.tags here instead the parent ports already carry these tags.
+    CUSTOM_NETDEV_ROLE_ATTACH:
+      order: 1
+      actions:
+        - action: attach_port
+          filter: port.category == 'outside' && network.tags == 'CUSTOM_NETDEV_OUTSIDE'
+          max_count: 1
+        - action: attach_port
+          filter: port.category == 'inside' && network.tags == 'CUSTOM_NETDEV_INSIDE'
+          max_count: 1
+
     # Attaches a single category=storage port for a storage VIF. Single-port
     # only for now (A/B grouping is deferred). Require it on a flavor with:
     #   openstack flavor set --property trait:CUSTOM_STORAGE_ATTACH=required <flavor>

python/neutron-understack/neutron_understack/ironic.py

@@ -5,6 +5,7 @@
 from openstack import connection
 from openstack import exceptions as sdk_exc
 from openstack.baremetal.baremetal_service import BaremetalService
+from openstack.baremetal.v1 import _common as baremetal_common
 from openstack.baremetal.v1.node import Node as BaremetalNode
 from openstack.baremetal.v1.port import Port as BaremetalPort
 from oslo_config import cfg
@@ -35,6 +36,22 @@
 _RECONCILE_PROVISION_TIMEOUT = 60
 _PANOS_DRIVER = "panos"
 _ROUTER_RELEASE_MARKER = "understack_router_release"  # release is in progress
+# Enrollment sets the node trait; adoption activates its TBN rule.
+ROLE_ATTACH_TRAIT = "CUSTOM_NETDEV_ROLE_ATTACH"
+_TENANT_VIF_KEY = "tenant_vif_port_id"
+
+
+def uses_port_roles(node) -> bool:
+    """Return True if Ironic will attach this node's VIFs by port role.
+
+    Reads instance_info, not node traits: Ironic applies a TBN trait only once
+    it is in instance_info.traits, which adoption sets.
+    """
+    instance_info = getattr(node, "instance_info", None)
+    if not isinstance(instance_info, dict):
+        return False
+    traits = instance_info.get("traits")
+    return isinstance(traits, list) and ROLE_ATTACH_TRAIT in traits
 
 
 @dataclass(frozen=True)
@@ -159,11 +176,34 @@ def router_id_for_release(node: BaremetalNode) -> str | None:
             return None
         return identities[0]
 
-    def attach_vif_to_node(self, node: str | BaremetalNode, vif_id: str) -> None:
-        """Attach a Neutron port (VIF) to the node."""
+    def attach_vif_to_node(
+        self,
+        node: str | BaremetalNode,
+        vif_id: str,
+        *,
+        tags: list[str] | None = None,
+    ) -> None:
+        """Attach a VIF, forwarding optional role tags to Ironic's TBN rules."""
         node_id = node.id if isinstance(node, BaremetalNode) else node
-        LOG.info("Attaching VIF %s to Ironic node %s", vif_id, node_id)
-        self.irclient.attach_vif_to_node(node, vif_id)
+        if not tags:
+            LOG.info("Attaching VIF %s to Ironic node %s", vif_id, node_id)
+            self.irclient.attach_vif_to_node(node, vif_id)
+            return
+
+        LOG.info(
+            "Attaching VIF %s to Ironic node %s with tags %s", vif_id, node_id, tags
+        )
+        # The SDK cannot send VIF tags; post directly with its retry policy.
+        response = self.irclient.post(
+            f"/nodes/{node_id}/vifs",
+            json={"id": vif_id, "tags": list(tags)},
+            microversion=baremetal_common.VIF_VERSION,
+            retriable_status_codes=baremetal_common.RETRIABLE_STATUS_CODES,
+        )
+        sdk_exc.raise_from_response(
+            response,
+            error_message=f"Failed to attach VIF {vif_id} to bare metal node {node_id}",
+        )
 
     def detach_vif_from_node(self, node: str | BaremetalNode, vif_id: str) -> bool:
         """Detach a VIF from the node.
@@ -184,6 +224,15 @@ def node_ports(self, node: str | BaremetalNode) -> list[BaremetalPort]:
         node_id = node.id if isinstance(node, BaremetalNode) else node
         return list(self.irclient.ports(details=True, node_id=node_id))
 
+    def port_for_vif(
+        self, node: str | BaremetalNode, vif_id: str
+    ) -> BaremetalPort | None:
+        """Return the node's baremetal port that the VIF is attached to, or None."""
+        for port in self.node_ports(node):
+            if (port.internal_info or {}).get(_TENANT_VIF_KEY) == vif_id:
+                return port
+        return None
+
     def adopt_node_for_router(
         self,
         node: str | BaremetalNode,
@@ -232,13 +281,20 @@ def adopt_node_for_router(
                 router_id,
                 router_name,
             )
-            self.irclient.update_node(
-                node,
-                retry_on_conflict=False,
-                lessee=project_id,
-                instance_id=router_id,
-                instance_name=router_name,
-            )
+            stamp = {
+                "lessee": project_id,
+                "instance_id": router_id,
+                "instance_name": router_name,
+            }
+            role_instance_info = self._role_attach_instance_info(node)
+            if role_instance_info is not None:
+                LOG.info(
+                    "Setting node %s instance_info.traits to %s",
+                    node_id,
+                    role_instance_info["traits"],
+                )
+                stamp["instance_info"] = role_instance_info
+            self.irclient.update_node(node, retry_on_conflict=False, **stamp)
             LOG.info("Node %s: adopt (manageable -> active)", node_id)
             # Use wait=False: the SDK waits for available after adopt, not active.
             # https://review.opendev.org/c/openstack/openstacksdk/+/999686
@@ -265,6 +321,29 @@ def adopt_node_for_router(
             adopted.instance_name,
         )
 
+    def _role_attach_instance_info(self, node: str | BaremetalNode) -> dict | None:
+        """Return instance_info whose traits match the node's port roles, or None.
+
+        A node with port roles gets exactly the role trait, so no other attach
+        rule can run first; a node without loses a stale one. None means no change.
+        Undeploy clears instance_info, so release needs no matching step.
+        """
+        current = (
+            node if isinstance(node, BaremetalNode) else self.irclient.get_node(node)
+        )
+        if current is None:
+            return None
+        instance_info = dict(current.instance_info or {})
+        traits = list(instance_info.get("traits") or [])
+        if ROLE_ATTACH_TRAIT in (current.traits or []):
+            wanted = [ROLE_ATTACH_TRAIT]
+        else:
+            wanted = [trait for trait in traits if trait != ROLE_ATTACH_TRAIT]
+        if wanted == traits:
+            return None
+        instance_info["traits"] = wanted
+        return instance_info
+
     def _return_node_to_available(
         self,
         node: str | BaremetalNode,