RHBA-2016:1104 - Bug Fix Advisory

Topic

Updated OpenStack Networking packages that resolve various issues are now
available for Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for
RHEL 7.

Description

Red Hat Enterprise Linux OpenStack Platform provides the facilities for
building a private or public infrastructure-as-a-service (IaaS) cloud
running on commonly available physical hardware. This advisory includes
packages for:

• OpenStack Networking service

OpenStack Networking (neutron) is a virtual network service for OpenStack.
Just as OpenStack Compute (nova) provides an API to dynamically request and
configure virtual servers, OpenStack Networking provides an API to
dynamically request and configure virtual networks. These networks connect
'interfaces' from other OpenStack services (e.g. virtual NICs from Compute
VMs). The OpenStack Networking API supports extensions to provide advanced
network capabilities (e.g. QoS, ACLs, network monitoring, etc.)

Changes to the openstack-neutron component:

• Previously, OpenStack Networking ports would sometimes become stuck in the BUILD state during migration of an instance. Because Layer 2 population uses the port state to determine if there are ports in an ACTIVE state on a node, and uses that metric to decide if a tunnel can be formed to that node, networking connectivity between nodes would be broken because a tunnel could not be formed correctly. Previously, when an OVS agent retrieves information about a port during a migration, it would cause the port to enter the BUILD state if performed at a specific timing. Now, this happens only if the port is unbound, or if the port is bound to the host requesting the information, so the port does not enter and stay in the BUILD state. (BZ#1289995)
• Previously, ipset was not declared as a dependency of the Open vSwitch and Linux Bridge Neutron agents. However, ipset is a dependency of the openstack-neutron package. This would result in nodes where the packages for the Open vSwitch or Linux Bridge agent were installed but the openstack-neutron package was not installed missing ipset, which the L2 agents require ipset to configure security groups. Now, ipset is a dependency of the openstack-openvswitch-agent and openstack-linuxbridge-agent packages depend on ipset. (BZ#1321870)

Solution

Before applying this update, ensure all previously released errata relevant to your system have been applied.

Red Hat Enterprise Linux OpenStack Platform 6 runs on Red Hat Enterprise Linux 7.2.

The Red Hat Enterprise Linux OpenStack Platform 6 Release Notes contain the following:

• An explanation of the way in which the provided components interact to form a working cloud computing environment.
• Technology Previews, Recommended Practices, and Known Issues.
• The channels required for Red Hat Enterprise Linux OpenStack Platform 6, including which channels need to be enabled and disabled.

The Release Notes are available at:
https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux_OpenStack_Platform/6/html/Release_Notes/index.html

This update is available through the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258

Affected Products

• Red Hat OpenStack 6.0 x86_64

Fixes

• BZ - 1289995 - Vxlan tunnel to the controller is not created on a compute node after perform multiple vm autoevacuations
• BZ - 1321870 - neutron - Error while processing VIFS ports fails to apply iptables rules

CVEs

(none)

References

• http://www.redhat.com/security/updates/classification/#normal