Merge ~fnordahl/ubuntu/+source/ovn:bug/1914988-focal into ~ubuntu-server-dev/ubuntu/+source/ovn:ubuntu/focal

[Frode Nordahl]

[Frode Nordahl (fnordahl)]

Built package available in https://launchpad.net/~fnordahl/+archive/ubuntu/lp1914988

diff --git a/debian/changelog b/debian/changelog
index 39d34f9..3a96e4b 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+ovn (20.03.2-0ubuntu0.20.04.2) focal; urgency=medium
+
+  * d/p/lp-1914988-Add-IGMP_Group-to-ovn-controller-RBAC.patch:
+    Add RBAC rules for IGMP_Group table (LP: #1914988).
+  * d/p/lp-1937075-ovn-ctl-Fix-stucked-while-do-cluster-db-init.patch:
+    Fix issue where clustered database might not be upgraded (LP: #1937075).
+
+ -- Frode Nordahl <[e-mail]>  Thu, 23 Sep 2021 12:03:00 +0200
+
 ovn (20.03.2-0ubuntu0.20.04.1) focal; urgency=medium
 
   * New upstream point release (LP: #1924981):
diff --git a/debian/patches/lp-1914988-Add-IGMP_Group-to-ovn-controller-RBAC.patch b/debian/patches/lp-1914988-Add-IGMP_Group-to-ovn-controller-RBAC.patch
new file mode 100644
index 0000000..d01b973
--- /dev/null
+++ b/debian/patches/lp-1914988-Add-IGMP_Group-to-ovn-controller-RBAC.patch
@@ -0,0 +1,99 @@
+Origin: backport, https://github.com/ovn-org/ovn/commit/e92d8cb838d407aac7d44c9d27f862df42fbb8d2
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/ovn/+bug/1914988
+Last-Update: 2021-09-23
+
+From 096cdb5d6239bcfebc93ef7ccc037693d76def7b Mon Sep 17 00:00:00 2001
+From: Pedro Guimaraes <[e-mail]>
+Date: Sun, 7 Feb 2021 16:07:08 +0100
+Subject: [PATCH] Add IGMP_Group to ovn-controller RBAC
+
+If RBAC and IGMP snooping are enabled, ovn-controllers need to
+be able to register new entries to table IGMP_Group as requests
+are detected.
+
+For that, ovn-controllers need to have read/write access to
+IGMP_Group table.
+
+Signed-off-by: Pedro Guimaraes <[e-mail]>
+Reported-at: https://github.com/ovn-org/ovn/issues/77
+Acked-by: Frode Nordahl <[e-mail]>
+Signed-off-by: Numan Siddique <[e-mail]>
+(cherry picked from commit e92d8cb838d407aac7d44c9d27f862df42fbb8d2)
+---
+ AUTHORS.rst            |  1 +
+ northd/ovn-northd.c    | 12 ++++++++++++
+ ovn-architecture.7.xml | 16 ++++++++++++++++
+ 3 files changed, 29 insertions(+)
+
+diff --git a/AUTHORS.rst b/AUTHORS.rst
+index 79ee520a1..d7a4f89a1 100644
+--- a/AUTHORS.rst
++++ b/AUTHORS.rst
+@@ -287,6 +287,7 @@ Paul Fazzone                       [e-mail]
+ Paul Ingram
+ Paul-Emmanuel Raoul                [e-mail]
+ Pavithra Ramesh                    [e-mail]
++Pedro Guimaraes                    [e-mail]
+ Peter Downs                        [e-mail]
+ Philippe Jung                      [e-mail]
+ Pim van den Berg                   [e-mail]
+diff --git a/northd/ovn-northd.c b/northd/ovn-northd.c
+index 9cc2c04bb..d091c3972 100644
+--- a/northd/ovn-northd.c
++++ b/northd/ovn-northd.c
+@@ -11295,6 +11295,10 @@ static const char *rbac_svc_monitor_auth[] =
+     {""};
+ static const char *rbac_svc_monitor_auth_update[] =
+     {"status"};
++static const char *rbac_igmp_group_auth[] =
++    {""};
++static const char *rbac_igmp_group_update[] =
++    {"address", "chassis", "datapath", "ports"};
+ 
+ static struct rbac_perm_cfg {
+     const char *table;
+@@ -11353,6 +11357,14 @@ static struct rbac_perm_cfg {
+         .update = rbac_svc_monitor_auth_update,
+         .n_update = ARRAY_SIZE(rbac_svc_monitor_auth_update),
+         .row = NULL
++    },{
++        .table = "IGMP_Group",
++        .auth = rbac_igmp_group_auth,
++        .n_auth = ARRAY_SIZE(rbac_igmp_group_auth),
++        .insdel = true,
++        .update = rbac_igmp_group_update,
++        .n_update = ARRAY_SIZE(rbac_igmp_group_update),
++        .row = NULL
+     },{
+         .table = NULL,
+         .auth = NULL,
+diff --git a/ovn-architecture.7.xml b/ovn-architecture.7.xml
+index 46508e64a..9df3e978b 100644
+--- a/ovn-architecture.7.xml
++++ b/ovn-architecture.7.xml
+@@ -2172,6 +2172,22 @@
+         modified by ovn-controller.
+       </p>
+     </dd>
++
++    <dt><code>IGMP_Group</code></dt>
++    <dd>
++      <p>
++        <code>Authorization</code>: disabled (all clients are considered
++        to be authorized).
++      </p>
++      <p>
++        <code>Insert/Delete</code>: row insertion/deletion are permitted.
++      </p>
++      <p>
++        <code>Update</code>: The columns <code>address</code>,
++        <code>chassis</code>, <code>datapath</code>, and
++        <code>ports</code> may be modified by ovn-controller.
++      </p>
++    </dd>
+   </dl>
+ 
+   <p>
+-- 
+2.32.0
+
diff --git a/debian/patches/lp-1937075-ovn-ctl-Fix-stucked-while-do-cluster-db-init.patch b/debian/patches/lp-1937075-ovn-ctl-Fix-stucked-while-do-cluster-db-init.patch
new file mode 100644
index 0000000..d66d17c
--- /dev/null
+++ b/debian/patches/lp-1937075-ovn-ctl-Fix-stucked-while-do-cluster-db-init.patch
@@ -0,0 +1,45 @@
+Origin: backport, https://github.com/ovn-org/ovn/commit/65cc0e225b5922a72f0d40c2c39da0210669c21a
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/ovn/+bug/1937075
+Last-Update: 2021-09-23
+
+From 8ab04a8ec2414a949f634fc965088162d238b4c6 Mon Sep 17 00:00:00 2001
+From: Tao YunXiang <[e-mail]>
+Date: Tue, 17 Mar 2020 11:16:10 +0800
+Subject: [PATCH] ovn-ctl: Fix stucked while do cluster db init
+
+For cluster mode, only the first server, which is the leader, in a cluster
+should do init. But, sometimes, the role of the first server would transfer
+leadership, so we should add --no-leader-only in case the ovn-northd stucked.
+
+Co-authored-by: Liu Chang <[e-mail]>
+Co-authored-by: Rong Yin <[e-mail]>
+Signed-off-by: Tao YunXiang <[e-mail]>
+Signed-off-by: Liu Chang <[e-mail]>
+Signed-off-by: Rong Yin <[e-mail]>
+Acked-by: Numan Siddique <[e-mail]>
+Signed-off-by: Han Zhou <[e-mail]>
+(cherry picked from commit 65cc0e225b5922a72f0d40c2c39da0210669c21a)
+---
+ utilities/ovn-ctl | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/utilities/ovn-ctl b/utilities/ovn-ctl
+index a763f7750..c361b9d62 100755
+--- a/utilities/ovn-ctl
++++ b/utilities/ovn-ctl
+@@ -300,10 +300,9 @@ $cluster_remote_port
+         "$@" "$file"
+     fi
+ 
+-    # Initialize the database if it's running standalone,
+-    # active-passive, or is the first server in a cluster.
++    # Initialize the database if it's NOT joining a cluster.
+     if test -z "$cluster_remote_addr"; then
+-        $(echo ovn-${db}ctl | tr _ -) init
++        $(echo ovn-${db}ctl | tr _ -) --no-leader-only init
+     fi
+ 
+     if test $mode = cluster; then
+-- 
+2.32.0
+
diff --git a/debian/patches/series b/debian/patches/series
new file mode 100644
index 0000000..9afd08f
--- /dev/null
+++ b/debian/patches/series
@@ -0,0 +1,2 @@
+lp-1914988-Add-IGMP_Group-to-ovn-controller-RBAC.patch
+lp-1937075-ovn-ctl-Fix-stucked-while-do-cluster-db-init.patch