RHBA-2019:0446 - Bug Fix Advisory

Topic

Updated director installer packages that resolve various issues are now
available for Red Hat OpenStack Platform 14.0 (Rocky) for RHEL 7.

Description

Red Hat OpenStack Platform provides the facilities for building, deploying
and monitoring a private or public infrastructure-as-a-service (IaaS) cloud
running on commonly available physical hardware.

Changes to the openstack-tripleo-common component:

• Previously, fernet key rotation failed because the workflow task `tripleo.fernet_keys.v1.rotate_fernet_keys` generated keys but did not push them to Keystone nodes on the overcloud. This fix updates `openstack-tripleo-common-9.4.1-0.20181012010880` to push the keys to the Keystone nodes, and fernet key rotation is now successful. (BZ#1639495)

Changes to the openstack-tripleo-heat-templates component:

• Previously, the Octavia Health Manager did not receive heartbeat messages from amphorae in Octavia composable role deployments. This caused the firewall on Network nodes to drop packets, and the the load balancers did not return an ONLINE operating status. After this fix, the Octavia Health Manager now receives heartbeat message from amphorae, and the load balancers can go online. (BZ#1658688)
• Previously, per-node customization with the heat `NodeDataLookup` parameter was not possible with RHEL 7.6. This was caused by updated versions of dmidecode 3.1 or later that returned system UUIDs in lowercase. This fix updates the `openstack-tripleo-heat-templates` package to accept uppercase or lowercase UUIDs. (BZ#1671049)
• This enhancement adds the boolean parameter `NovaLibvirtVolumeUseMultipath`, which provides a value for the multipath configuration parameter `libvirt/volume_use_multipath` in the `nova.conf` file for Compute nodes. You can set this parameter for each Compute role. Default value is `False`. (BZ#1645489)
• This enhancement sets the number of RPC workers to `1` by default in OVN tripleo deployments. The goal of this setting is to reduce the number of workers to save memory resources and the number of connections to OVSDB, in cases where the Neutron DHCP agent is not deployed alongside OVN services. (BZ#1658484)
• Previously, iSCSI connections that were created by the containerized nova service were not visible to the host. This caused the connections to fail to shut down during the shutdown sequence causing hosts to hang. After this fix, iSCSI connection information is now available to the host and the connections can gracefully shut down. (BZ#1665554)
• This enhancement adds the networking-ansible heat parameter `IronicDefaultNetworkInterface`, which determines the value of the `default_network_interface` parameter in the `ironic.conf` configuration file. This value is set to the `neutron` interface by default, which enables virtual networking through Neutron on bare metal nodes.

Note: The switches attached to the bare metal nodes must be programmable by the networking service if the `default_network_interface` is set to `neutron`. (BZ#1673172)

• Previously, per-node customization with the heat `NodeDataLookup` parameter was not possible with RHEL 7.6. This was caused by updated versions of dmidecode 3.1 or later that returned system UUIDs in lowercase. This fix updates the `openstack-tripleo-heat-templates` package to accept uppercase or lowercase UUIDs. (BZ#1678895)
• This enhancement improves security by increasing the auto-generated SECRET_KEY to 64 characters (BZ#1599633)
• The location of Pacemaker log files for RabbitMQ containers was not set to the correct path, which caused unnecessary log files to be created in /var/log/secure. This fix adds mounting of the /var/log/btmp path during the start of the RabbitMQ container, which enables Pacemaker to create the logs in the correct location. (BZ#1642521)

Solution

Before applying this update, ensure all previously released errata relevant
to your system have been applied.

Red Hat OpenStack Platform 14 runs on Red Hat Enterprise Linux 7.6.

The Red Hat OpenStack Platform 14 Release Notes contain the following:

• An explanation of the way in which the provided components interact to

form a working cloud computing environment.

• Technology Previews, Recommended Practices, and Known Issues.
• The channels required for Red Hat OpenStack Platform 14, including which

channels need to be enabled and disabled.

The Release Notes are available at:
https://access.redhat.com/documentation/en/red-hat-openstack-platform/

This update is available through 'yum update' on systems registered through
Red Hat Subscription Manager. For more information about Red Hat
Subscription Manager, see:

https://access.redhat.com/documentation/en-US/Red_Hat_Subscription_Management/1/html/RHSM/index.html

Affected Products

• Red Hat OpenStack for IBM Power 14 ppc64le
• Red Hat OpenStack 14 x86_64
• Red Hat OpenStack Director Deployment Tools 14 x86_64
• Red Hat OpenStack Director Deployment Tools for IBM Power LE 14 ppc64le

Fixes

• BZ - 1275730 - snmpd repeatedly logs errors for "Cannot statfs net:[###...#]"
• BZ - 1543101 - Opstools | We should add example values for collectd-gnocchi in the environment template file
• BZ - 1565999 - [RFE] Scale the OCP cluster on additional BM nodes from TripleO
• BZ - 1573470 - Roles Undercloud.yaml and UndercloudLight.yaml have the same name
• BZ - 1593341 - Allow option for amphora image to be automatically uploaded in raw format
• BZ - 1595330 - [RFE] Enable HA deployments of OpenShift via director
• BZ - 1599633 - Horizon SECRET_KEY should be 64 charecters as per upstream documentation
• BZ - 1611224 - Importing deployment plan from Git repository is broken
• BZ - 1615463 - Error: Check if a temporary URL key already exists while running create_swift_temp_url_key
• BZ - 1629392 - cannot install undercloud because / is too small
• BZ - 1631454 - openstack overcloud node clean reports all nodes were cleaned, but one node is stuck in clean_wait
• BZ - 1635698 - "openstack overcloud delete overcloud" fails with "Error occurred during stack delete None"
• BZ - 1636748 - Unexpected error when trying to download logs file
• BZ - 1638931 - plan-environment.yaml in home dir can break undercloud install/upgrade
• BZ - 1639493 - old fernet tokens are not cleaned up on the controller
• BZ - 1639495 - fernet token rotation fails to automatically get deployed to the overcloud
• BZ - 1642521 - Missing /var/log/btmp in rabbitmq container causes unnecessary logs in /var/log/secure.
• BZ - 1644254 - Network-Role lines disappear in network topology diagram
• BZ - 1645307 - Introspection in OC fails with ironic composable role.
• BZ - 1645489 - [OSP14][Deployment] Backport tripleo support for nova:libvirt:use_volume_multipath
• BZ - 1646195 - Undercloud Neutron Sanity Check validations doesn't work anymore
• BZ - 1647510 - Swift increased the number of workers from OSP13
• BZ - 1647566 - overcloud deployment received 504 Gateway Time-out
• BZ - 1647636 - deactivation of interactive login in get-occ-config.sh
• BZ - 1649005 - OSP14 | Service Assurance | metrics-qdr container log level is set to DEBUG by default therefore log file grows rapidly.
• BZ - 1651931 - [OSP14] track revert downstream-only - nova_metadata container is in unhealthy state on undercloud and overcloud nodes
• BZ - 1653357 - ceilometer_agent_notification container is stuck at restarting when panko is disabled
• BZ - 1653674 - Provisioning predictable IPs don't need ctlplane_fixed_ip set to true
• BZ - 1653684 - Non intuitive provisioning predictable IPs procedure
• BZ - 1654293 - [OSP14] overcloud status provide None before actual overcloud status
• BZ - 1654404 - Adding environments/services/ironic-inspector.yaml should enable the "inspector" inspect interface
• BZ - 1654615 - disk-image-create fails while creating an image with iscsi-boot with "get_image_element_array: command not found"
• BZ - 1655300 - Receiving an error message when deleting the overcloud
• BZ - 1655431 - Disabling heartbeat interface for failover, LB goes into error state, New backup amphora is not created
• BZ - 1655776 - Incorrect capabilities handling on node update (OSP-14)
• BZ - 1655886 - Non-breaking white space in NodeUserData makes upload of templates into mistral timeout
• BZ - 1656074 - os-net-config don't restart vlan when a change append on bond (OSP-14)
• BZ - 1657771 - OSP14 | Health check for collectd container fails due to DeleteSocket issue.
• BZ - 1658393 - multiple-nic sample template only add routes to External and Tenant interface
• BZ - 1658484 - OVN tripleo deployment should configure neutron config rpc_workers to a low number (1 is enough, and higher when using SRIOV)
• BZ - 1658688 - Octavia health manager doesn't receive heartbeat message from amp on composable role
• BZ - 1660075 - The validator "Check the number of IP addresses available to overcloud nodes" fails when it have to pass
• BZ - 1660088 - The validator "Check network_gateway on the provisioning network" passes when it should fail
• BZ - 1660091 - [OSP14] nova_vnc_proxy container reports unhealthy state on IPv6 environments
• BZ - 1663448 - [OSP14] neutron/auth_url has admin endpoint URL in nova.conf
• BZ - 1663922 - [OSP14] Updating openstack-nova-common on the compute will break nova permissions in the containers
• BZ - 1664428 - Define creator role by default when deploying with Barbican
• BZ - 1665161 - [Backport] Configure switchdev while there is no vfs bounded
• BZ - 1665554 - [OSP14] Compute-node gets stalled during OS shutdown when using iSCSI-backend volume
• BZ - 1665613 - standalone deployment fails on galera setup due to being a slave
• BZ - 1666617 - OVN metadata agent fails when using TLS Everywhere
• BZ - 1667020 - Action mistral.actions.action_factory.GetOvercloudConfig raises "ERROR: None"
• BZ - 1667068 - [RFE] Add new role "ComputeOvsDpdkSriov"
• BZ - 1667447 - /etc/pki/ca-trust/source/anchors/cm-local-ca.pem has wrong permissions after undercloud installation
• BZ - 1667584 - Upgrade OSP13->OSP14 fails during converge: "[ERROR]: The python-notario library is missing. Please install it on the node"
• BZ - 1667987 - HorizonSecureCookies is missing from the new environments/ssl/enable-tls.yaml
• BZ - 1668886 - [CI] TLS everywhere deployments fail with: Invalid input for field/attribute compact_services
• BZ - 1671049 - OSP Director - handle lowercase uuid change for dmidecode >= 3.1 for ceph-ansible per-node customizations
• BZ - 1671253 - Missing ContainerImagePrepare service in ControllerStorageNfs role
• BZ - 1671331 - Rebase puppet-tripleo to import
• BZ - 1671461 - Rebase openstack-tripleo-validations to import
• BZ - 1672243 - Rebase openstack-tripleo-heat-templates to import
• BZ - 1672526 - [OSP14] stack update failures caused by permission changes under '/var/lib/nova/mnt' on the compute nodes
• BZ - 1672940 - haproxy log should not be written in /var/log/messages
• BZ - 1673172 - [Hackfest] OSP14 - missing 'IronicDefaultNetworkInterface: neutron' inside neutron-ml2-ansible.yaml
• BZ - 1673859 - Rebase openstack-mistral to import
• BZ - 1673867 - Rebase puppet-glance to 2312a82
• BZ - 1673868 - Rebase puppet-horizon to 3c299a8
• BZ - 1673869 - Rebase puppet-keystone to a6f2cfc
• BZ - 1673870 - Rebase puppet-manila to 8fb1fa1
• BZ - 1673871 - Rebase puppet-mistral to 177f637
• BZ - 1673925 - Rebase os-net-config to 8e9242b
• BZ - 1674048 - [OSP14 Hackfest] Overcloud images are missing the gdisk package
• BZ - 1676524 - Rebase openstack-tripleo-image-elements to import
• BZ - 1676532 - Rebase openstack-tripleo-ui to import
• BZ - 1677796 - Rebase instack-undercloud to 227ce3f
• BZ - 1678511 - Rebase puppet-ceph to 658c951
• BZ - 1678852 - Rebase diskimage-builder to 379f1bd
• BZ - 1678895 - [OSP 14][tripleo-heat-templates] - make uuid for hiera per-node customization case insensitive.
• BZ - 1679598 - Deployment with composable roles and networks fails with: "2019-02-20 23:46:15Z [overcloud]: CREATE_FAILED The Referenced Attribute (Controller tenant1_ip_address) is incorrect."
• BZ - 1683688 - Rebase puppet-octavia to import
• BZ - 1684590 - Major upgrade OSP13->OSP14 fails during UC upgrade: ERROR: os-net-config configuration failed "UnboundLocalError: local variable 'interface' referenced before assignment"

CVEs

(none)

References

(none)