OVN plugin: add Firewall service to OVN VPC offering

The default OVN VPC offering was missing the Firewall service, causing
tier creation to fail with "Service/provider combination Firewall/Ovn
is not supported by VPC" when the network offering included Firewall.

OVN implements firewall rules natively via OVN ACLs and OvnElement
advertises the Firewall service in its capabilities, but the VPC
offering creation loop only iterated getSupportedServices() which
excludes Firewall for legacy VR-based VPCs.

Add Service.Firewall explicitly to the OVN VPC offering service map,
plus a schema migration to patch existing installations.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql

@@ -163,3 +163,14 @@ CREATE TABLE IF NOT EXISTS `cloud`.`ovn_vpc_peerings` (
     CONSTRAINT `fk_ovn_vpc_peerings_zone` FOREIGN KEY (`zone_id`) REFERENCES `cloud`.`data_center`(`id`),
     CONSTRAINT `fk_ovn_vpc_peerings_account` FOREIGN KEY (`account_id`) REFERENCES `cloud`.`account`(`id`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+-- Add Firewall service to the default OVN VPC offering so that OVN VPC tiers
+-- using network offerings with Firewall/Ovn pass the service validation check.
+INSERT IGNORE INTO `cloud`.`vpc_offering_service_map` (`vpc_offering_id`, `service`, `provider`)
+    SELECT vo.id, 'Firewall', 'Ovn'
+    FROM `cloud`.`vpc_offerings` vo
+    WHERE vo.unique_name = 'VPC offering with OVN - NAT Mode'
+      AND NOT EXISTS (
+          SELECT 1 FROM `cloud`.`vpc_offering_service_map` sm
+          WHERE sm.vpc_offering_id = vo.id AND sm.service = 'Firewall'
+      );

server/src/main/java/com/cloud/network/vpc/VpcManagerImpl.java

@@ -527,12 +527,15 @@ public void doInTransactionWithoutResult(final TransactionStatus status) {
                         if (svc == Service.UserData) {
                             svcProviderMap.put(svc, configDriveProvider);
                         } else if (svc == Service.Vpn) {
-                            // Out of scope for OVN VPC v1 - no VPN provider in the offering.
                             continue;
                         } else {
                             svcProviderMap.put(svc, ovnProvider);
                         }
                     }
+                    // OVN implements Firewall natively via OVN ACLs; VPC tiers use it
+                    // instead of (or alongside) NetworkACL. getSupportedServices()
+                    // excludes Firewall for legacy VR-based VPCs, so add it explicitly.
+                    svcProviderMap.put(Service.Firewall, ovnProvider);
                     createVpcOffering(VpcOffering.DEFAULT_VPC_NAT_OVN_OFFERING_NAME, VpcOffering.DEFAULT_VPC_NAT_OVN_OFFERING_NAME, svcProviderMap, false,
                             State.Enabled, null, false, false, false, NetworkOffering.NetworkMode.NATTED, null, false, false);
                 }