RHBA-2017:0314 - Bug Fix Advisory

Topic

Updated OpenStack Networking packages that resolve various issues are now
available for Red Hat OpenStack Platform 10.0 (Newton) for RHEL 7.

Description

Red Hat OpenStack Platform provides the facilities for building, deploying
and monitoring a private or public infrastructure-as-a-service (IaaS) cloud
running on commonly available physical hardware. This advisory includes
packages for:

• OpenStack Networking service

OpenStack Networking (neutron) is a virtual network service for OpenStack.
Just as OpenStack Compute (nova) provides an API to dynamically request and
configure virtual servers, OpenStack Networking provides an API to
dynamically request and configure virtual networks. These networks connect
'interfaces' from other OpenStack services (e.g. virtual NICs from Compute
VMs). The OpenStack Networking API supports extensions to provide advanced
network capabilities (e.g. QoS, ACLs, network monitoring, etc.)

This update includes the following enhancements and fixes:

• Previously, every time neutron-keepalived-state-change was killed, the IP monitor process it spawned remained in an orphaned state. This resulted in leaked memory over time and required manual actions from administrators.

With this update, the process is killed gracefully and its child IP monitor process will be killed as well, avoiding this memory leak. (BZ#1397418)

• Previously, when ports were created with port_security disabled, the explicit iptables rules were not applied to allow the traffic. This resulted in packets hitting a default REJECT rule, and all traffic was blocked.

With this fix, firewall rules are correctly installed on ports with port_security disabled and traffic is allowed. (BZ#1406263)

• This enhancement implements ProcessMonitor in the HaproxyNSDriver class (v2) to use the external_process module, which allows it to monitor and respawn the haproxy processes as needed. The LBaaS agent (v2) will load options related to external_process in order to take a configured action when the HAproxy process dies unexpectedly. (BZ#1415828)
• This enhancement adds the ability to automatically reschedule load balancers from dead LBaaS agents. Previously, load balancers could be scheduled across multiple LBaaS agents, however if a hypervisor died, the load balancers scheduled to that node would cease operation. With this update, these load balancers are automatically rescheduled to a different agent. This feature is turned off by default and controlled using `allow_automatic_lbaas_agent_failover`. (BZ#1415829)
• Previously, when a network was deleted, all ports and subnets were deleted before it could be determined if a metadata proxy had been spawned. Consequently, a false negative proxy was not killed, causing the system to eventually run out of memory. With this update, the metadata proxy process is killed unconditionally when the network is deleted. (BZ#1416265)

Solution

Before applying this update, ensure all previously released errata relevant
to your system have been applied.

Red Hat OpenStack Platform 10 runs on Red Hat Enterprise Linux 7.3.

The Red Hat OpenStack Platform 10 Release Notes contain the following:

• An explanation of the way in which the provided components interact to

form a working cloud computing environment.

• Technology Previews, Recommended Practices, and Known Issues.
• The channels required for Red Hat OpenStack Platform 10, including which

channels need to be enabled and disabled.

The Release Notes are available at:
https://access.redhat.com/documentation/en/red-hat-openstack-platform/10/single/release-notes/

This update is available through 'yum update' on systems registered through
Red Hat Subscription Manager. For more information about Red Hat
Subscription Manager, see:

https://access.redhat.com/documentation/en-US/Red_Hat_Subscription_Management/1/html/RHSM/index.html

Affected Products

• Red Hat OpenStack 10 x86_64

Fixes

• BZ - 1377633 - OVS FW driver ignores all non tcp udp icmp protocol rules
• BZ - 1397418 - neutron-keepalived-state-change lives behind big processes
• BZ - 1401798 - All LBaaS tests fails when running with latest version of tempest
• BZ - 1406263 - iptables rule blocks traffic even with port_security_enabled set to False
• BZ - 1415828 - Backport: [RFE] [Neutron] [LBaaS v2] Add process monitor for haproxy
• BZ - 1415829 - Backport: [RFE] [Neutron] [LBaaS v2] Loadbalancers should be rescheduled when a LBaaS agent goes offline
• BZ - 1416265 - neutron-ns-metadata-proxy are not deleted after network is deleted
• BZ - 1421806 - Rebase openstack-neutron to 9.2.0

CVEs

(none)

References

(none)