We have quite similar setup, though pre-2025.1

But from what I can recall, options:virtual-parents should contain both Octavia ports at all times.
From what I recall, virtual-parents are identified through allowed address pairs mappings, as you need to add the VIP to be allowed on MAC addresses of vrrp interfaces. There is also a strict requirement of having port security enabled on such ports.
So a thing to check would be that your Octavia network has port security enabled by default, and you configure security groups accordingly on amphora instances instead of disabling it. And also check that allowed address pairs are defined for amphora management ports

With that I would expect external_ids behavior and port state in Neutron to be not that relevant.

On Thu, 3 Jul 2025, 12:24 Maximilian Stinsky-Damke, <Maximilian.Stinsky-Damke@wiit.cloud> wrote:
Greetings,

I'm currently debugging a strange issue related to Octavia loadbalancer failovers and was wondering if anyone has encountered something similar or has any insights.

We're running Neutron with ML2/OVN and the ovn-bgp-agent. When we create Octavia load balancers using the Amphora driver, they come up fine. After attaching a floating IP, the ovn-bgp-agent correctly announces the FIP.
However, during load balancer failovers, we sometimes observe that the FIP is no longer being announced. After some debugging, we found that the ovn-bgp-agent stops announcing the FIP because the VIP port in OVN is down and no longer has a neutron:host_id set in external_ids.
Digging deeper, we noticed that the VIP port's options:virtual-parents only includes a single port ID and it's not the one corresponding to the current VRRP master. As a result, OVN doesn't associate the VIP with the active amphora, causing the port to be up=false and leaving the external_ids:neutron:host_id field empty. Because of this, no bgp-agent sees itself as responsible for announcing the FIP.

Looking at the Octavia amphora ports in Neutron, all of them have the correct allowed address pairs set. This should normally result in the correct virtual-parents being reflected in OVN.

Interestingly, I was able to reproduce this behavior even with the SINGLE topology in Octavia, a failover sometimes removes the entire options fields related to virtual-parents and virtual-ip from the VIP port.
Manually unsetting and re-setting the allowed address pair on the affected port always restores the correct virtual-parents, and the announcement resumes.
Now the question is how could this happen? It seems completely random, but it's very reproducible in my environment.

We're running Neutron 2025.1 (26.0.0) with OVN 24.03.1-5.el9.
I haven't found any errors in the Neutron server logs indicating issues writing to OVN, or any relevant tracebacks.

Thanks in advance for any input or ideas!

Best regards,
Max