KVM: add configurable MAC/IP script hook for static ARP/NDP and routes

[wido]

Introduces a new agent.properties option vm.network.macip.static (false disabled by default) that makes BridgeVifDriver invoke modifymacip.sh on every NIC plug (VM start) and unplug (VM stop).

This will lead to static IPv4/IPv6 ARP/NDP entries to be programmed into the kernel.

This is very useful in EVPN+VXLAN environments as it can reduce BUM traffic. By setting static ARP/NDP entries bridges can be configured using 'neigh_suppress on' as the ARP/NDP entries are already set statically by CloudStack. No ARP/NDP traffic is needed in this case as it's handled locally.

When using EVPN+VXLAN you will need to change the modifyvxlan.sh script so that it does this:

bridge link show|grep ${VXLAN_BR}|awk '{print $2}'|grep "^${VXLAN_DEV}\$" > /dev/null
    if [[ $? -gt 0 ]]; then
        ip link set ${VXLAN_DEV} master ${VXLAN_BR}
        bridge link set dev ${VXLAN_DEV} neigh_suppress on
        bridge link set dev ${VXLAN_DEV} learning off
    fi

Further improvements can be made in general to the VXLAN+EVPN integration, but this should already resolve many problems people might have with BUM traffic.

[codecov]

Codecov Report

❌ Patch coverage is 12.00000% with 44 lines in your changes missing coverage. Please review.
✅ Project coverage is 19.48%. Comparing base (d2c8aa7) to head (3ff70d1).
⚠️ Report is 42 commits behind head on main.

Files with missing lines	Patch %	Lines
...cloud/hypervisor/kvm/resource/BridgeVifDriver.java	8.33%	42 Missing and 2 partials ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               main   #13495      +/-   ##
============================================
+ Coverage     18.93%   19.48%   +0.54%     
- Complexity    18471    19354     +883     
============================================
  Files          6221     6294      +73     
  Lines        560045   568214    +8169     
  Branches      68289    69609    +1320     
============================================
+ Hits         106048   110691    +4643     
- Misses       442372   445440    +3068     
- Partials      11625    12083     +458     

Flag	Coverage Δ
uitests	3.44% <ø> (-0.06%)	⬇️
unittests	20.74% <12.00%> (+0.59%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[DaanHoogland]

clgtm, why not set your script as default value for the property @wido ? (if it is well tested and robust, that is)

[wido]

clgtm, why not set your script as default value for the property @wido ? (if it is well tested and robust, that is)

Thanks, the reason the script does not always execute is that it could break existing setups. Therefor it is not set by default.

[DaanHoogland]

clgtm, why not set your script as default value for the property @wido ? (if it is well tested and robust, that is)

Thanks, the reason the script does not always execute is that it could break existing setups. Therefor it is not set by default.

yeah, that is what I meant by robust ;) np, fine like this as well.

[wido]

I tested and reviewed the code again. It worked on our environment, would be great to get feedback. This can be merged without changing anything to existing setups as you will need to enable it manually.

[weizhouapache]

code lgtm

[weizhouapache]

@blueorangutan package

[blueorangutan]

@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

[blueorangutan]

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 18429

[DaanHoogland]

@blueorangutan test

[blueorangutan]

@DaanHoogland a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

[blueorangutan]

[SF] Trillian test result (tid-16466)
Environment: kvm-ol8 (x2), zone: Advanced Networking with Mgmt server ol8
Total time taken: 54539 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13495-t16466-kvm-ol8.zip
Smoke tests completed. 152 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File

[wido]

We have this setup running in production for over two weeks now. It works as expected. It will not break any existing environments as it is a config setting which has to be changed prior to it becoming active.

[weizhouapache]

@wido
is it ready for merge ?

[wido]

@wido is it ready for merge ?

For me it is. Code is good and testing has been done by me.

[weizhouapache]

@wido is it ready for merge ?

For me it is. Code is good and testing has been done by me.

thanks @wido

merging