RHBA-2017:1736 - Bug Fix Advisory

Topic

Updated OpenStack Networking packages that resolve various issues are now
available for Red Hat OpenStack Platform 9.0 (Mitaka) for RHEL 7.

Description

Red Hat OpenStack Platform provides the facilities for building a private
or public infrastructure-as-a-service (IaaS) cloud running on commonly
available physical hardware. This advisory includes packages for:

• OpenStack Networking service

OpenStack Networking (neutron) is a virtual network service for OpenStack.
Just as OpenStack Compute (nova) provides an API to dynamically request and
configure virtual servers, OpenStack Networking provides an API to
dynamically request and configure virtual networks. These networks connect
'interfaces' from other OpenStack services (e.g. virtual NICs from Compute
VMs). The OpenStack Networking API supports extensions to provide advanced
network capabilities (e.g. QoS, ACLs, network monitoring, etc.)

This update addresses the following issues:

• Prior to this update, when using wsgi_default_pool_size(=100) concurrent requests, the state change server would create a heavy CPU load on the l3 agent.

With this update, a new option `ha_keepalived_state_change_server_threads` has been added to configure the number of concurrent threads spawned for keepalived server connection requests; higher values increase the CPU load on the agent nodes. The default value is half of the number of CPUs present on the node. This allows operators to tune the number of threads to suit their environment. With more threads, simultaneous requests for multiple HA routers state change can be handled faster.
As a result, ha_keepalived_state_change_server_threads can be configured to avoid high load on l3 agents. (BZ#1381619)

• This enhancement configures ProcessMonitor in the HaproxyNSDriver class (v2) to use the external_process module, which allows it to monitor and respawn the haproxy processes as needed. The LBaaS agent (v2) will load options related to external_process in order to take a configured action when the HAproxy process dies unexpectedly. (BZ#1431152)
• This enhancement adds http_proxy_to_wsgi to api-paste. As a result, this places the HTTPProxyToWSGI middleware in front of the Neutron-API. The purpose of this middleware is to setup the request URL correctly in case there is a proxy (for example, a loadbalancer such as HAProxy) in front of neutron.

For example, when TLS connections are being terminated in the proxy, and you attempt to get the versions from the `/` neutron resource, the protocol is incorrect and reports as 'http' instead of 'https'. The HTTPProxyToWSGI middleware handles such cases and helps keystone discovery work correctly. HTTPProxyToWSGI is off by default and needs to be enabled with a configuration value. (BZ#1451508)

Solution

Before applying this update, ensure all previously released errata relevant
to your system have been applied.

Red Hat OpenStack Platform 9 runs on Red Hat Enterprise Linux 7.3.

The Red Hat OpenStack Platform 9 Release Notes contain the following:

• An explanation of the way in which the provided components interact to

form a working cloud computing environment.

• Technology Previews, Recommended Practices, and Known Issues.
• The channels required for Red Hat OpenStack Platform 9, including which

channels need to be enabled and disabled.

The Release Notes are available at:
https://access.redhat.com/documentation/en/red-hat-openstack-platform/9/paged/release-notes

This update is available through 'yum update' on systems registered through
Red Hat Subscription Manager. For more information about Red Hat
Subscription Manager, see:

https://access.redhat.com/documentation/en-US/Red_Hat_Subscription_Management/1/html/RHSM/index.html

Affected Products

• Red Hat OpenStack 9 x86_64

Fixes

• BZ - 1381619 - UnixDomainWSGIServer keepalived state change listener in L3 agent has an uncapped number of threads, overloading node
• BZ - 1431152 - Backport: [RFE] [Neutron] [LBaaS v2] Add process monitor for haproxy
• BZ - 1437818 - L3 agent failing with "Failed to process compatible router" errors
• BZ - 1451508 - backport request neutron: Add http_proxy_to_wsgi to api-paste
• BZ - 1463759 - OSP8 -> OSP9 upgrade: pacemaker resources are stopped and unmanaged post upgrade

CVEs

(none)

References

(none)