Summary
If an interface is used somewhere in the VPP services configuration, and it is removed from VPP, this leads to a commit crash due to failed dependencies.
How to reproduce
(commit after each step)
- Configure VPP
set system option kernel cpu disable-nmi-watchdog set system option kernel cpu isolate-cpus '2-3' set system option kernel cpu nohz-full '2-3' set system option kernel cpu rcu-no-cbs '2-3' set system option kernel disable-hpet set system option kernel disable-mce set system option kernel disable-mitigations set system option kernel disable-softlockup set system option kernel memory hugepage-size 2M hugepage-count '1024' set system option reboot-on-upgrade-failure '5' set system syslog local facility all level 'info' set system syslog local facility local7 level 'debug' set vpp settings interface eth0 set vpp settings interface eth1 set vpp settings poll-sleep-usec '1000' set vpp settings resource-allocation memory main-heap-size '1G'
- Use the interface attached to VPP somewhere in the configuration:
set vpp nat nat44 address-pool translation interface 'eth1' set vpp nat nat44 interface inside 'eth0' set vpp nat nat44 interface outside 'eth1'
- Remove an interface from VPP:
delete vpp settings interface eth1
The commit will be validated and tried to be committed, but since now eth1 is not part of VPP, the NAT configuration cannot be applied, and the commit will stop on dependencies:
vyos@vyos# commit [ vpp ] WARNING: NOTE: Current dataplane capacity (estimated): 2 M IPv4 routes. Exceeding these values will lead to a dataplane out-of-memory condition and a crash. Extensive use of features like ACLs, NAT and others may reduce the numbers above. Please read the documentation for details: https://docs.vyos.io/ dependent vpp_nat_nat44: eth1 must be a VPP interface for outside NAT interface [[vpp]] failed Commit failed [edit]
After this, we have VPP NAT in the CLI config, but not in the VPP dataplane:
vyos@vyos# show | commands | grep nat set vpp nat nat44 address-pool translation interface 'eth1' set vpp nat nat44 interface inside 'eth0' set vpp nat nat44 interface outside 'eth1' [edit] vyos@vyos# run show vpp nat nat44 interfaces NAT44 interfaces: [edit] vyos@vyos#
Suggested fix
We need to validate dependencies before committing changes in VPP.