Video: OpenStack Neutron Packet Walkthrough (DVR) by David Mahler
https://www.youtube.com/watch?v=7IXEtUEZslg

SERVER_ID=11111111-2222-3333-4444-555555555555

nova interface-list ${SERVER_ID}

PORT_TOKEN=$(nova interface-list ${SERVER_ID} | grep ACTIVE | cut -d "|" -f3 | cut -d"-" -f1)
echo PORT_TOKEN=${PORT_TOKEN}

COMPUTE_NODE=$(openstack server show -c "OS-EXT-SRV-ATTR:hypervisor_hostname" -f value ${SERVER_ID})
echo ${COMPUTE_NODE}

ssh ${COMPUTE_NODE} brctl show | grep ${PORT_TOKEN}
TAP_DEVICE=$(ssh ${COMPUTE_NODE} brctl show | grep ${PORT_TOKEN} | grep tap)

TAP_DEVICE=$(ssh ${COMPUTE_NODE} brctl show | grep ${PORT_TOKEN} | grep tap)
echo ${TAP_DEVICE}

# second console
echo tcpdump -i ${TAP_DEVICE} -n -e icmp
ssh ${COMPUTE_NODE}



# 3th console
ssh ${COMPUTE_NODE}
iptables -S | grep o${PORT_TOKEN} | grep ${PORT_TOKEN}
# todo:
iptables -S neutron-openvswi-s${PORT_TOKEN}-f

iptables -S neutron-openvswi-sg-chain | grep #${PORT_TOKEN}

docker exec -it openvswitch_vswitchd bash
ovs-vsctl show

ovs-vsctl show | grep -U1 ${PORT_TOKEN}

# NORMAL missiong
watch -n .5 "ovs-ofctl dump-flows br-int table=0 | grep -v n_packets=0"


ovs-appctl -t /var/run/openvswitch/ovs-vswitchd.*.ctl fdb/show br-int | egrep "MAC|fa:11:22:33:44:55"

ovs-ofctl show br-int | grep 293 -A5

brctl show | grep qvo${PORT_TOKEN}-fb

Notes

Get VM data

# OPTINAL: find VM name
# openstack server list --all | grep XXX

# get FROM VM ID
SERVER_STRING=www-dev
SERVER_ID=$(openstack server list --all --name ${SERVER_STRING} -c ID -f value)
echo ${SERVER_ID}

SERVER_IP_ADDRESS=10.0.0

PORT_TOKEN=$(nova interface-list ${SERVER_ID} | grep ${SERVER_IP_ADDRESS} | awk -F'|' '/ACTIVE/ {gsub(/ /,"",$3); print substr($3,0,9)}')
NETWORK_TOKEN=$(nova interface-list ${SERVER_ID} | grep ${SERVER_IP_ADDRESS} | awk -F'|' '/ACTIVE/ {gsub(/ /,"",$4); print substr($4,0,9)}')
SERVER_NAME=$(openstack server show ${SERVER_ID} -c name -f value)
SERVER_IP=$(nova interface-list ${SERVER_ID} | grep ${SERVER_IP_ADDRESS} | awk -F'|' '/ACTIVE/ {gsub(/ /,"",$5); print $5}')
SERVER_MAC=$(nova interface-list ${SERVER_ID} | grep ${SERVER_IP_ADDRESS} | awk -F'|' '/ACTIVE/ {gsub(/ /,"",$6); print $6}')
COMPUTE_NODE=$(openstack server show -c "OS-EXT-SRV-ATTR:hypervisor_hostname" -f value ${SERVER_ID})
SERVER_DEV=$(ssh ${COMPUTE_NODE} brctl show | grep ${PORT_TOKEN} | paste - - | sed -e 's/[\t]/ /g;s/  */ /g' | awk '{print $5" "$4}')

# show server data
echo "
SERVER_NAME: ${SERVER_NAME}
SERVER_ID: ${SERVER_ID}
SERVER_IP: ${SERVER_IP}
SERVER_MAC: ${SERVER_MAC}
SERVER_DEV: ${SERVER_DEV}
PORT_TOKEN: ${PORT_TOKEN}
NETWORK_TOKEN: ${NETWORK_TOKEN}
COMPUTE_NODE: ${COMPUTE_NODE}
"

Search for broken openvswitch devices

CLI
https://developer.openstack.org/firstapp-libcloud/networking.html

# search server by port ID
openstack port show -c device_id -f value ${PORT_ID}
openstack show show ${PORT_ID}
openstack router show ${PORT_ID}

Port
https://docs.openstack.org/python-openstackclient/latest/cli/command-objects/port.html

# get port ID for OVS interface
openstack port list -c id -f value | grep $(awk '{print substr($OVS_INTERFACE,4,8)}')

# list all port by subnet
openstack port list --fixed-ip subnet=mgmt-dev-net --sort-column Name

# list all devices by network
openstack port list --network mgmt-dev -c device_id -f value

# allow incomming (ingress) SSH for specific IP / subnet
openstack security group rule create default \
    --protocol tcp \
    --dst-port 22 \
    --remote-ip 10.20.30.40/32

# allow incomming http traffic
openstack security group rule create default --protocol tcp --dst-port 80

# create port without security
openstack port create openstack-net-port1 --network openstack-net --no-security-group --disable-port-security --no-fixed-ip
openstack port set --disable-port-security openstack-net-port1

# get all port by subnet
openstack port list -c ID -f value --fixed-ip subnet=dev-net1

# search ports (filter with json)
openstack port list -c ID -c "Fixed IP Addresses" -f json | jq -r '.[] | select(."Fixed IP Addresses"[].ip_address | startswith("10.11")).ID'

Creat and assign port

# show VPN objects
openstack vpn ipsec site connection list
openstack vpn endpoint group list
openstack vpn service list
openstack vpn ipsec policy list
openstack vpn ike policy list

# show IP
openstack vpn service list --long
openstack vpn service list -c ID -f value | xargs -i openstack vpn service show {}
openstack vpn ipsec site connection list -c ID -f value | xargs -L1 openstack vpn ipsec site connection show

Restart VPN

openstack vpn ipsec site connection set --disable vpn-conn1
openstack vpn ipsec site connection set --enable vpn-conn1

Check VPN peer address

PRIVATE_PEER_ADDRESSES=$(openstack vpn ipsec site connection list -c "Peer Address" -f value | egrep "^10.|^172.|^192.")
for PRIVATE_PEER_ADDRESSE in ${PRIVATE_PEER_ADDRESSES}; do
    echo "PRIVATE_PEER_ADDRESSES: ${PRIVATE_PEER_ADDRESSE}"

    CONNECTION_ID=$(openstack vpn ipsec site connection list | grep ${PRIVATE_PEER_ADDRESSE} | cut -d" " -f2)
    openstack vpn ipsec site connection show ${CONNECTION_ID}

    VPN_SERVICE_ID=$(openstack vpn ipsec site connection show ${CONNECTION_ID} -c "VPN Service" -f value)
    openstack vpn service show ${VPN_SERVICE_ID}

    PROJECT_ID=$(openstack vpn service show ${VPN_SERVICE_ID} -c project_id -f value)
    openstack project show ${PROJECT_ID}
done

OpenStack IpSec VPN ports

UDP 500
UDP 4500
ESP IP Protocol 50

IPSec VPN – Diffie-Hellman Groups

DH Group 1:    768-bit Key
DH Group 2:   1024-bit Key
DH Group 5:   1536-bit Key
DH Group 14:  2048-bit Key

Links
https://docs.openstack.org/neutron/rocky/admin/vpnaas-scenario.html

# List your volumes
openstack volume list

openstack volume type list --public --long
openstack volume backend pool list
cinder --os-volume-api-version 3.50 attachment-delete 

openstack volume set --non-bootable

Search for multiple volume attachment ids

# search for double attachments
openstack volume list --all-projects -c ID -c "Attached to" | egrep "Attached.*Attached"

# search in DB
DB_PASS=$(grep nova_database_password /etc/kolla/passwords.yml | cut -d " " -f2)

mysql -h db.service.example.com --password=${DB_PASS} -P 3306 -u nova -D nova -e "
    select *
    FROM block_device_mapping
    where attachment_id in (
        SELECT attachment_id
        FROM block_device_mapping
        where attachment_id is not null
        and deleted = 0
        group by attachment_id
        having count(*) > 1
    )
"

# SQL
mysql -h db.service.example.com --password=${DB_PASS} -P 3306 -u nova -D nova -e "select * from block_device_mapping"  | grep 1234567890-1111-33333-a400-111111111111
mysql -h db.service.example.com --password=${DB_PASS} -P 3306 -u nova -D nova -e "select * from block_device_mapping where volume_id = '1234567890-1111-33333-a400-111111111111"

SELECT volume_id
FROM block_device_mapping
where volume_id is not null
and deleted = 0
group by volume_id
having count(*) > 1

(Force) delete volume

cinder reset-state --state available ${VOLUME_ID}
cinder reset-state --attach-status detached ${VOLUME_ID}
openstack volume delete ${VOLUME_ID}

Backup / Snapshot
https://docs.openstack.org/python-openstackclient/latest/cli/command-objects/volume-snapshot.html

Download rescure iso
wget https://download.grml.org/grml64-small_2022.11.iso

Create rescure system

openstack image create systemrescuecd \
  --file grml64-small_2022.11.iso \
  --disk-format iso \
  --container-format bare \
  --min-ram 512 \
  --property hw_cdrom_bus=scsi

# show image
openstack image list --name systemrescuecd

Attach rescure system

openstack server rescue --image systemrescuecd ${SERVER_ID}

# Login to VM console and fix issues
Detach rescure system

openstack server unrescue ${SERVER_ID}

Links
https://help.switch.ch/engines/documentation/rescue-vm/
https://grml.org/

CLI

# change user password
openstack user set --password pass123 user1

# list user (for domain)
openstack --os-cloud=dev-admin user list --domain my_dom_1

openstack user list
openstack user show USER_ID
openstack domain show DOMAIN_ID
openstack project list --user USER_ID

Role

# list
openstack role assignment list --names --user ${USER_ID}

# add
openstack role add --user ${USER_ID} --project ${PROJECT_ID} creator

# remove
openstack role remove --user ${USER_ID} --project ${PROJECT_ID} admin

Get unpriviliged user ID

# get unpriviliged user project ID
openstack project list -c id -f value

# as admin
openstack user list --project ${PROJECT_ID}

roles

# show user roles
MGMT_USER_ID=b912ba4325fbb6c18483602245f9b515b
openstack role assignment list --user ${MGMT_USER_ID} --names

Show subnet details

openstack subnet list --network public
openstack subnet show public-10.0.0.0/24

Modify database

DB_PASS=$(grep neutron_database_password /etc/kolla/passwords.yml | cut -d " " -f2)
mysql -h db.service.example.com --password=${DB_PASS} -P 6033 -u neutron -D neutron
select * from neutron.subnets where cidr like '10.0.0%';
update subnets set cidr='10.0.0.0/23' WHERE cidr = '10.0.0.0/24';
exit;

# update subnet name
openstack subnet set --name public-10.0.0.0/23 public-10.0.0.0/24

# extend allocation-pool
openstack subnet set --allocation-pool start=10.0.0.255,end=10.0.1.254 public-10.0.0.0/23

# show subnet details
openstack subnet show public-10.0.0.0/23

Restart network agent

Get VM data

openstack server show -c name -c id -c addresses -c OS-EXT-SRV-ATTR:host ${SERVER_ID}
nova interface-list ${SERVER_ID}
nova migration-list --instance-uuid ${SERVER_ID} | grep -v "2019-"

Create VM
https://docs.openstack.org/python-openstackclient/latest/cli/command-objects/server.html#server-create

openstack server create u2204-vm1 \
  --image "Ubuntu 22.04" \
  --flavor m1.small \
  --key-name foo-key \
  --network foo-net \
  --security-group default \
  --availability-zone=eu1-az1

CLI