Julian Sommer 2a61e3dafb fix: re-install br-imds flows lost on an ovs-vswitchd restart ...

ovs-vswitchd keeps OpenFlow rules only in memory, and nothing re-pushed
br-imds after a restart. br-imds is fail-mode=secure, so every guest on
the node lost all networking until its tap was set up again.

The daemon now checks each running guest's IMDS datapath every 10s: one
br-imds flow dump, plus the endpoint's accept_local, which a kernel-module
reload resets along with the reply rule and route. A guest missing any of
it goes through the existing install path; an intact one is never touched,
since the install starts by clearing the tap's flows.

A per-ENI lock in vm.Manager serialises attach, repair, and the
detach-plus-CleanupTap teardown, and a repair refuses a tap that has left
br-imds, so it cannot re-create ports for a guest being torn down.

TestIMDSDatapathSurvivesVswitchdRestart restarts ovs-vswitchd through
systemd and with SIGKILL under a guest with an Elastic IP.

2026-10-21 10:14:54 +10:00

..

e2e-coverage.md

fix: re-install br-imds flows lost on an ovs-vswitchd restart

2026-10-21 10:14:54 +10:00