Security groups and OVS
In Havana the use of LibvirtHybridOVSBridgeDriver has been deprecated. However it is needed for security groups to function.
So on our stack I made the following changes In nova.conf
libvirt_vif_driver=nova.virt.libvirt.vif.LibvirtHybridOVSBridgeDriver
And I enabled ipfiltering on the bridge:
sysctl -w net.bridge.bridge-nf-call-iptables = 1
This makes security groups work again, however this comes with a rather hefty performance penalty.
I have therefore two questions: - How can I mitigate this performance problem? - If using LibvritHybridOVSBridge is deprecated, what should I actually use in stead?
Will this make security groups work again? And how do I configure ML2 on Havana? Documentation for Havana asumes you're using OVS...