To Reproduce

1. Load a config like this:

   [root@compute-0 ~]# cat /var/tmp/os-net-config_tests/config-ovs_bride.yaml
   network_config:
   - type: ovs_bridge
     name: br0
     use_dhcp: false
     use_dhcpv6: false
     members:
     - type: linux_bond
       name: bond0
       mtu: 9000
       bonding_options: "mode=active-backup"
       members:
       - type: interface
         name: nic5
         primary: true
     - type: vlan
       vlan_id: 137
       mtu: 9000
       device: bond0
       addresses:
       - ip_netmask: "172.31.0.100/24"
   

1. Applies a config like this

   [root@compute-0 ~]# ovs-vsctl show
   bf9dfa0a-663a-4af5-a860-0e08c8da34ac
       Bridge br0
           fail_mode: standalone
           Port br0
               Interface br0
                   type: internal
           Port vlan137
               tag: 137
               Interface vlan137
                   type: internal
           Port bond0
               Interface bond0
                   type: system
       ovs_version: "3.5.2-33.el9fdp"
   [root@compute-0 ~]# ip a sh vlan137
   286: vlan137: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9000 qdisc noqueue state UNKNOWN group default qlen 1000
       link/ether 2a:a7:18:8f:5f:62 brd ff:ff:ff:ff:ff:ff
       inet 172.31.0.100/24 brd 172.31.0.255 scope global noprefixroute vlan137
          valid_lft forever preferred_lft forever
   

That's the expected configuration. However, allowing device: bond0 in vlan may lead you to think that the vlan port will be added to the Linux bond instead of the OVS bridge.

The same configuration is applied removing device from vlan member.

Expected behavior
Raise verification error if device is added to a vlan member in a ovs_bridge.

Bug impact
No functional impact but confusing behavior.

Known workaround
Do not use device added to vlan member in a ovs_bridge.