Allow creation of no-uplink OVN networks with both IPv4 and IPv6 disabled and without an associated logical router.

[stevmills]

Required information

• Distribution: Ubuntu
• Distribution version: Ubuntu 22.04.5 LTS
• Kernel version: 5.15.0-128-generic
• LXC version: 5.0.4
• Incus version: 6.8
• Storage backend in use: dir

Issue description

Incus already allows creation of OVN networks that specify network=none.

This issue is to request a new feature that also allows OVN networks to be created with both IPv4 and IPv6 disabled:

incus network create my-net network=none --type ovn ipv4.address=none ipv6.address=none

When both ipv4.address=none and ipv6.address=none are provided, the expected behavior would be that no associated logical router would get created for the new OVN network.

The use case behind this feature request is an attempt to deploy medium to large virtual environments to Incus using a tool that historically has targeted vSphere instantiations for deployment.

These environments intentionally use real router and firewall OS such Cisco's CSR and ASA virtual appliances and VyOS VMs to enhance realism.

The ability to create OVN networks without logical routers would be required to deploy these types of virtual environments.

[winiciusallan]

Hi @stgraber! I'm taking a look to solve this issue. Should change the State and setup functions to don't create a logical router?

Here, it is also checked if can assign IP addresses to the network

https://github.com/lxc/incus/blob/main/internal/server/network/driver_ovn.go#L2404

[stevmills]

Hi @winiciusallan! Thank you for looking at this! Yes, ideally the OVN network would be created with no logical router when both ipv4.address=none and ipv6.address=none are provided.

[stgraber]

@winiciusallan yeah, we'd need to remove that check and skip at least the CreateLogicalRouter in such situations, possibly some other router and subnet related calls, though I'd expect most of the subnet stuff to already handle it.

[winiciusallan]

Any thought about when network is not provided but ipv4.address=none and ipv6.address=none are?

e.g.

$ incus network create foo-net network=none ipv4_address=none ipv6_address=none
or
$ incus network create foo-net ipv4_address=none ipv6_address=none

[stgraber]

I think that should fail as without network=none we'll be looking at creating an external switch and router port to go to that switch which makes no sense if we're also requesting to not have any managed subnets (and therefore no router).

So I think ipv4.address=none ipv6.address=none should only be valid when network=none.

[winiciusallan]

I'm facing a problem with OVN State. I think that since we do not have a logical router and subnets, there is no interface to bind, and state is not created.

https://github.com/lxc/incus/blob/main/cmd/incus/network.go#L970

$ curl -s --unix-socket /var/lib/incus/unix.socket incus/1.0/networks/foo-net/state | jq
{
  "type": "error",
  "status": "",
  "status_code": 0,
  "operation": "",
  "error_code": 500,
  "error": "object not found",
  "metadata": null
}

We could have a state, but with empty values or the state does not exists is the desired behavior?

[winiciusallan]

However, I was able to create a network with ipv4.address=none,ipv6.address=none and no uplink. I can open a WIP pull request, so you can check it out and make some suggestions.

[stgraber]

The OVN state should be left nil in this case as it currently contains:

• Chassis
• Logical Router Name
• IPv4 uplink address
• IPv6 uplink address

None of which are relevant in this case.

So we can just make it so if we get ErrNotFound when getting the logical router in the state logic, we just leave that part of the struct nil.