RHBA-2017:1503 - Bug Fix Advisory

Topic

Updated OpenStack Networking packages that resolve various issues are now
available for Red Hat OpenStack Platform 9.0 (Mitaka) for RHEL 7.

Description

Red Hat OpenStack Platform provides the facilities for building a private
or public infrastructure-as-a-service (IaaS) cloud running on commonly
available physical hardware. This advisory includes packages for:

• OpenStack Networking service

OpenStack Networking (neutron) is a virtual network service for OpenStack.
Just as OpenStack Compute (nova) provides an API to dynamically request and
configure virtual servers, OpenStack Networking provides an API to
dynamically request and configure virtual networks. These networks connect
'interfaces' from other OpenStack services (e.g. virtual NICs from Compute
VMs). The OpenStack Networking API supports extensions to provide advanced
network capabilities (e.g. QoS, ACLs, network monitoring, etc.)

Changes to the openstack-neutron component:

• Cause: The default L3 HA implementation, keepalived, sometimes flips the master router instance to backup if it receives multiple SIGHUP signals in quick succession.

Consequence: The HA master router may be flipped to backup, disrupting L3 connectivity until the previous backup keepalived instance takes over.

Fix: To work around this keepalived behavior, Neutron L3 agent now throttles SIGHUP signals sent to keepalived to make sure keepalived has enough time to reload configuration without being disrupted with failovers.

Result: L3 connectivity implemented via HA routers is not disrupted on router updates in quick succession (for example, floating IP updates). (BZ#1398286)

• Feature:

This build makes L3 High Availability (HA) failover not dependent on Networking (neutron) components. It also reduces HA failover time since we are not depending on neutron to create any OVS flows during failover.

With this build, when both l2pop and arp_responder are enabled for the linuxbridge agent, the VM will fail to communicate with router. Temporary workaround is to set arp_responder=false. This is only a linuxbridge agent issue and the OVS agent works as expected. (BZ#1395533)

• Previously, it was possible for the OpenStack networking OVS agent to compare non-translated strings to translated, UTF-16 strings when a subprocess didn't run properly. On non-English locales, this could result in an exception, thereby preventing instances from booting.

To address this, failure checks were updated to depend on the actual return value of failed subprocesses instead of strings. This ensures that subprocess failures are handled properly under non-English locales. (BZ#1418329)

• Add http_proxy_to_wsgi to api-paste

This sets up the HTTPProxyToWSGI middleware in front of the Neutron-API. The purpose of this middleware is to set up the request URL correctly in case there is a proxy (for example, a loadbalancer such as HAProxy) in front of Neutron.

For example, when TLS connections are being terminated in the proxy, and you attempt to get the versions from the / resource of Neutron, the protocol is incorrect and reports as 'http' instead of 'https'. The HTTPProxyToWSGI middleware handles such cases and helps Keystone discovery work correctly. HTTPProxyToWSGI is off by default and needs to be enabled with a configuration value. (BZ#1451508)

• When HA routers are deleted, the L3 agent uses SIGKILL to kill the neutron-keepalived-state-change process and orphan its child process, 'ip -o monitor'. This would make memory consumption grow and, eventually, OOM killers to show up.

This fix implements a way to use SIGTERM to kill keepalived-state-change process gracefully and kill ip monitor on its cleanup. This ensures that there are no ip monitors being leaked when HA routers are deleted. (BZ#1383448)

Solution

Before applying this update, ensure all previously released errata relevant
to your system have been applied.

Red Hat OpenStack Platform 9 runs on Red Hat Enterprise Linux 7.3.

The Red Hat OpenStack Platform 9 Release Notes contain the following:

• An explanation of the way in which the provided components interact to

form a working cloud computing environment.

• Technology Previews, Recommended Practices, and Known Issues.
• The channels required for Red Hat OpenStack Platform 9, including which

channels need to be enabled and disabled.

The Release Notes are available at:
https://access.redhat.com/documentation/en/red-hat-openstack-platform/9/paged/release-notes

This update is available through 'yum update' on systems registered through
Red Hat Subscription Manager. For more information about Red Hat
Subscription Manager, see:

https://access.redhat.com/documentation/en-US/Red_Hat_Subscription_Management/1/html/RHSM/index.html

Affected Products

• Red Hat OpenStack 9 x86_64

Fixes

• BZ - 1383448 - Neutron L3 HA - stop of neutron-keepalived-state-change leaves stale "ip -o monitor address" processes
• BZ - 1395533 - l2pop fdb flows for HA router ports
• BZ - 1446169 - missing patch from mitaka upstream causes issues with updates/upgrades later

CVEs

(none)

References

(none)