[DNM] Check eventless neutron deployment

config/rbac/role.yaml

@@ -8,12 +8,6 @@ rules:
   - ""
   resources:
   - pods
-  verbs:
-  - get
-  - list
-- apiGroups:
-  - ""
-  resources:
   - secrets
   - services
   verbs:

hack/Containerfile.gunicorn

@@ -0,0 +1,14 @@
+FROM quay.rdoproject.org/podified-master-centos10/openstack-base:current-tested
+USER root
+RUN rpm -e  --nodeps centos-stream-repos centos-gpg-keys python-tcib-containers
+RUN dnf install --nogpgcheck --repofrompath=tmp,https://mirror.stream.centos.org/10-stream/BaseOS/x86_64/os --enablerepo=tmp centos-stream-repos centos-gpg-keys -y
+RUN dnf install --nogpgcheck -y --repofrompath=tmp,https://trunk.rdoproject.org/centos10-master/component/podified/consistent/ --enablerepo=tmp python-tcib-containers
+RUN dnf install iputils net-tools python3-unbound python3-openvswitch openvswitch -y
+RUN bash /usr/local/bin/uid_gid_manage neutron
+RUN cp /usr/share/tcib/container-images/kolla/neutron-base/neutron_sudoers /etc/sudoers.d/neutron_sudoers
+RUN chmod 440 /etc/sudoers.d/neutron_sudoers
+RUN curl -O https://bootstrap.pypa.io/get-pip.py && python3 get-pip.py
+RUN dnf remove -y python3-six
+RUN pip install -c https://releases.openstack.org/constraints/upper/master neutron neutron-fwaas tap-as-a-service networking-baremetal networking-generic-switch PyMySQL python-memcached
+RUN pip install -c https://releases.openstack.org/constraints/upper/master gunicorn
+USER neutron

hack/Containerfile.httpd

@@ -0,0 +1,14 @@
+FROM quay.rdoproject.org/podified-master-centos10/openstack-base:current-tested
+USER root
+RUN rpm -e  --nodeps centos-stream-repos centos-gpg-keys python-tcib-containers
+RUN dnf install --nogpgcheck --repofrompath=tmp,https://mirror.stream.centos.org/10-stream/BaseOS/x86_64/os --enablerepo=tmp centos-stream-repos centos-gpg-keys -y
+RUN dnf install --nogpgcheck -y --repofrompath=tmp,https://trunk.rdoproject.org/centos10-master/component/podified/consistent/ --enablerepo=tmp python-tcib-containers
+RUN dnf install iputils net-tools python3-unbound python3-openvswitch openvswitch python3-mod_wsgi mod_ssl httpd -y
+RUN bash /usr/local/bin/uid_gid_manage neutron
+RUN cp /usr/share/tcib/container-images/kolla/neutron-base/neutron_sudoers /etc/sudoers.d/neutron_sudoers
+RUN chmod 440 /etc/sudoers.d/neutron_sudoers
+RUN curl -O https://bootstrap.pypa.io/get-pip.py && python3 get-pip.py
+RUN dnf remove -y python3-six
+RUN pip install -c https://releases.openstack.org/constraints/upper/master neutron neutron-fwaas tap-as-a-service networking-baremetal networking-generic-switch PyMySQL python-memcached
+COPY neutron-wsgi /usr/bin/neutron-wsgi
+USER neutron

hack/Containerfile.uwsgi

@@ -0,0 +1,13 @@
+FROM quay.rdoproject.org/podified-master-centos10/openstack-base:current-tested
+USER root
+RUN rpm -e  --nodeps centos-stream-repos centos-gpg-keys python-tcib-containers
+RUN dnf install --nogpgcheck --repofrompath=tmp,https://mirror.stream.centos.org/10-stream/BaseOS/x86_64/os --enablerepo=tmp centos-stream-repos centos-gpg-keys -y
+RUN dnf install --nogpgcheck -y --repofrompath=tmp,https://trunk.rdoproject.org/centos10-master/component/podified/consistent/ --enablerepo=tmp python-tcib-containers
+RUN dnf install iputils net-tools python3-unbound python3-openvswitch openvswitch uwsgi-plugin-python3 -y
+RUN bash /usr/local/bin/uid_gid_manage neutron
+RUN cp /usr/share/tcib/container-images/kolla/neutron-base/neutron_sudoers /etc/sudoers.d/neutron_sudoers
+RUN chmod 440 /etc/sudoers.d/neutron_sudoers
+RUN curl -O https://bootstrap.pypa.io/get-pip.py && python3 get-pip.py
+RUN dnf remove -y python3-six
+RUN pip install -c https://releases.openstack.org/constraints/upper/master neutron neutron-fwaas tap-as-a-service networking-baremetal networking-generic-switch PyMySQL python-memcached
+USER neutron

hack/neutron-wsgi

@@ -0,0 +1,11 @@
+#!/usr/bin/env python3
+#PBR Generated from 'wsgi_scripts'
+import threading
+from neutron import server
+from neutron.server import api
+
+application = None
+lock = threading.Lock()
+with lock:
+    if application is None:
+        application = server.boot_server(api.api_server)

internal/controller/neutronapi_controller.go

@@ -116,6 +116,7 @@ type NeutronAPIReconciler struct {
 // +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=rolebindings,verbs=get;list;watch;create;update;patch
 // service account permissions that are needed to grant permission to the above
 // +kubebuilder:rbac:groups="security.openshift.io",resourceNames=anyuid,resources=securitycontextconstraints,verbs=use
+// +kubebuilder:rbac:groups="",resources=pods,verbs=create;delete;get;list;patch;update;watch;patch
 // +kubebuilder:rbac:groups=topology.openstack.org,resources=topologies,verbs=get;list;watch;update
 
 // Reconcile - neutron api
@@ -940,6 +941,11 @@ func (r *NeutronAPIReconciler) reconcileNormal(ctx context.Context, instance *ne
 			Resources:     []string{"securitycontextconstraints"},
 			Verbs:         []string{"use"},
 		},
+		{
+			APIGroups: []string{""},
+			Resources: []string{"pods"},
+			Verbs:     []string{"create", "get", "list", "watch", "update", "patch", "delete"},
+		},
 	}
 	rbacResult, err := common_rbac.ReconcileRbac(ctx, helper, instance, rbacRules)
 	if err != nil {
@@ -1314,7 +1320,7 @@ func (r *NeutronAPIReconciler) reconcileNormal(ctx context.Context, instance *ne
 		instance.Status.LastAppliedTopology = nil
 	}
 
-	deplDef, err := neutronapi.Deployment(instance, inputHash, serviceLabels, serviceAnnotations, topology, memcached)
+	deplDef, err := neutronapi.Deployment(ctx, r.Client, instance, inputHash, serviceLabels, serviceAnnotations, topology, memcached)
 	if err != nil {
 		instance.Status.Conditions.Set(condition.FalseCondition(
 			condition.DeploymentReadyCondition,
@@ -2029,17 +2035,35 @@ func (r *NeutronAPIReconciler) generateServiceSecrets(
 
 	templateParameters["VHosts"] = httpdVhostConfig
 
+	// Detect deployment strategy to create appropriate templates
+	detector := neutronapi.NewStrategyDetector(r.Client)
+	strategy, err := detector.DetectStrategy(ctx, instance)
+	if err != nil {
+		return fmt.Errorf("failed to detect deployment strategy for config generation: %w", err)
+	}
+
+	// Add deployment type to template parameters
+	templateParameters["DeploymentType"] = strategy.GetDeploymentType()
+
+	// Create base config secret with strategy-specific additional templates
+	strategyTemplates := strategy.GetConfigTemplates()
 	secrets := []util.Template{
 		{
-			Name:          fmt.Sprintf("%s-config", instance.Name),
-			Namespace:     instance.Namespace,
-			Type:          util.TemplateTypeConfig,
-			InstanceType:  instance.Kind,
-			CustomData:    customData,
-			Labels:        cmLabels,
-			ConfigOptions: templateParameters,
+			Name:               fmt.Sprintf("%s-config", instance.Name),
+			Namespace:          instance.Namespace,
+			Type:               util.TemplateTypeConfig,
+			InstanceType:       instance.Kind,
+			CustomData:         customData,
+			Labels:             cmLabels,
+			ConfigOptions:      templateParameters,
+			AdditionalTemplate: strategyTemplates,
 		},
-		{
+	}
+
+	// Add strategy-specific secrets
+	if strategy.GetDeploymentType() == "eventlet" || strategy.GetDeploymentType() == "httpd" {
+		// Add httpd config secret for strategies that use httpd
+		secrets = append(secrets, util.Template{
 			Name:         fmt.Sprintf("%s-httpd-config", instance.Name),
 			Namespace:    instance.Namespace,
 			Type:         util.TemplateTypeNone,
@@ -2051,8 +2075,9 @@ func (r *NeutronAPIReconciler) generateServiceSecrets(
 			},
 			CommonTemplates: []string{"ssl.conf"},
 			ConfigOptions:   templateParameters,
-		},
+		})
 	}
+
 	return secret.EnsureSecrets(ctx, h, instance, secrets, envVars)
 }
 

internal/neutronapi/const.go

@@ -29,6 +29,8 @@ const (
 	NeutronPublicPort int32 = 9696
 	// NeutronInternalPort -
 	NeutronInternalPort int32 = 9696
+	// NeutronInternalAPIPort - internal port used by neutron-server and uwsgi
+	NeutronInternalAPIPort int32 = 9697
 
 	// NeutronExtraVolTypeUndefined can be used to label an extraMount which
 	// is not associated with a specific backend