[nidzrai]

Why

A Palo Alto router put its gateway and all its subnets on one trunk, on one
firewall NIC. In testing, outside and inside traffic both landed on eth1/20,
halving the firewall's bandwidth.

What does this change do?

Agreed with Doug and Kenny: the outside NIC carries the gateway, the inside NIC
carries the subnets.

• enroll-fw labels the ports from the firewall's interface names, comparing numbers as numbers (1/9 before 1/10): lowest is outside, next is inside, any others get no category. Fewer than two ports is refused, and so is a re-enroll that leaves out a port that still has a role. A firewall in service is never relabelled.
• Wiring builds a parent port and trunk per side on the shared anchor network (-outside, -inside), tags each parent outside or inside, and fails cleanly if the VIF lands on the wrong NIC. Each side is torn down on its own.
• New TBN rule CUSTOM_NETDEV_ROLE_ATTACH in components/ironic/cm-trait-based-networking.yaml: a VIF attaches only to the port whose category matches its tag.
• Ironic bump to f11a3586 (Backport TBN vif.* filter variables (1011790) ironic#18, Doug's vif.* TBN variables), so the rule reads the parent port's own tag with vif.tags.
• Backward compatible: routers created before this change keep their single trunk.

Rollout

The Ironic we run today rejects a TBN file with vif.tags. The file is mounted
live, so while ironic-conductor rolls to the new image, the old conductors
reject it and fall back to Ironic's built-in rule (first free port, any
category) for server VIFs. To avoid that, deploying the Ironic bump on its own
first.

Upgrade impact

• This change requires operator action to upgrade. If checked, add the
  upgrade-impact label and a release note: run scriv create from the
  repository root and describe the required action in the generated
  changelog.d/ file. See RELEASING.md.

Operator action means anything a deployment has to do beyond a normal resync:
deploy repo or values changes, new or removed secrets, enabling or disabling a
component, or a manual one-time step.

[github-actions]

Python test results

1 tests   - 465   1 ✅  - 460   0s ⏱️ -59s
1 suites ±  0   0 💤  -   5 
1 files   ±  0   0 ❌ ±  0 

Results for commit 739b719. ± Comparison against base commit e85aba1.

This pull request removes 466 and adds 1 tests. Note that renamed tests count towards both.

neutron_understack.tests.scenarios.test_baremetal_binding.TestBaremetalBinding ‑ test_baremetal_vif_attach_binds_hierarchically
neutron_understack.tests.scenarios.test_baremetal_binding.TestBaremetalBinding ‑ test_delete_keeps_segment_still_in_use
neutron_understack.tests.scenarios.test_baremetal_binding.TestBaremetalBinding ‑ test_port_delete_releases_dynamic_vlan_segment
neutron_understack.tests.scenarios.test_baremetal_binding.TestBaremetalBinding ‑ test_provisioning_network_delete_releases_unused_segment
neutron_understack.tests.scenarios.test_baremetal_binding.TestBaremetalBinding ‑ test_provisioning_network_port_binds
neutron_understack.tests.scenarios.test_baremetal_binding.TestBaremetalBinding ‑ test_second_port_same_physnet_reuses_dynamic_segment
neutron_understack.tests.scenarios.test_baremetal_binding.TestBaremetalBinding ‑ test_unsupported_vnic_type_is_not_bound_by_us
neutron_understack.tests.scenarios.test_baremetal_binding.TestBaremetalBinding ‑ test_vif_attach_without_ip_still_syncs
neutron_understack.tests.scenarios.test_baremetal_binding.TestBaremetalBinding ‑ test_vif_attach_without_physical_network_refuses_binding
neutron_understack.tests.scenarios.test_baremetal_binding.TestBaremetalBinding ‑ test_vif_detach_releases_segment_and_reconciles
…

tests.test_noop ‑ test_noop

♻️ This comment has been updated with latest results.