Chapter 12. Tuning NFV in a Red Hat OpenStack Services on OpenShift environment

Procedure

1. Access the remote shell for the OpenStackClient pod from your workstation:

   $ oc rsh -n openstack openstackclient

2. To disable port security on a single port, run the following command:

   $ openstack port set --disable-port-security <port-id>

3. To prevent port security from being enabled on any newly created port on a network, run the following command:

   $ openstack network set --disable-port-security <network-id>

4. Exit the openstackclient pod:

   $ exit

Procedure

1. Access the remote shell for the OpenStackClient pod from your workstation:

   $ oc rsh -n openstack openstackclient

2. Create a network of type vlan.

   Example

   $ openstack network create trusted_vf_network \
   --provider-network-type vlan --provider-segment 111 \
   --provider-physical-network sriov2 --external --disable-port-security

3. Create a subnet.

   Example

   $ openstack subnet create --network trusted_vf_network \
     --ip-version 4 --subnet-range 192.168.111.0/24 --no-dhcp \
    subnet-trusted_vf_network

4. Create a port.

   Example

   Set the vnic-type option to direct, and the binding-profile option to true.

   $ openstack port create --network trusted_vf_network \
   --vnic-type direct --binding-profile trusted=true \
   sriov111_port_trusted

5. Create an instance, and bind it to the previously-created trusted port.

   Example

   $ openstack server create --image rhel --flavor dpdk \
   --network trusted_vf_network --port sriov111_port_trusted \
   --config-drive True --wait rhel-dpdk-sriov_trusted

6. Exit the openstackclient pod:

   $ exit

Verification

1. On the compute node that you created the instance, enter the following command:

   $ ip link

   Sample output

   7: p5p2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9000 qdisc mq state UP mode DEFAULT group default qlen 1000
       link/ether b4:96:91:1c:40:fa brd ff:ff:ff:ff:ff:ff
       vf 6 MAC fa:16:3e:b8:91:c2, vlan 111, spoof checking off, link-state auto, trust on, query_rss off
       vf 7 MAC fa:16:3e:84:cf:c8, vlan 111, spoof checking off, link-state auto, trust off, query_rss off

2. Verify that the trust status of the VF is trust on. The example output contains details of an environment that contains two ports. Note that vf 6 contains the text trust on.
3. You can disable spoof checking if you set port_security_enabled: false in the Networking service (neutron) network, or if you include the argument --disable-port-security when you run the openstack port create command.