RHBA-2019:0944 - Bug Fix Advisory

Topic

Updated packages that resolve various issues are now available for Red Hat
OpenStack Platform 14.0 (Rocky) for RHEL 7.

Description

Red Hat OpenStack Platform provides the facilities for building, deploying
and monitoring a private or public infrastructure-as-a-service (IaaS) cloud
running on commonly available physical hardware.

Changes to the openstack-kuryr-kubernetes component:

• Prior to this update, a race condition between Octavia and Kuryr agents could result in the co-existence of Octavia-generated and Kuryr-generated security group rules. This caused failure of namespace isolation enforcement.

Now the Kuryr agent waits for and deletes Octavia-generated security group rules before generating Kuryr specific security group rules. This allows successful namespace isolation enforcement. (BZ#1663150)

• Previously, when the number of networks in the Kubernetes project exceeded the quota, the kuryr-controller pod would restart indefinitely due to having been marked as unhealthy. Now, a new readiness check validates the tenant's quota against the available Neutron resources. If the quota is reached, the controller pod is marked as 'Not Ready' and an action is required from the tenant side to increase the quota value or delete resources. (BZ#1631182)

Changes to the python-ovsdbapp component:

• This update fixes a networking-ovn bug that prevented load balancer traffic from being distributed even when distributed virtual routing (DVR) was enabled.

Prior to this update, auto-nested transactions failed when the return value of one command was used as input to another. Commands that returned values used in other commands that were bundled into the same auto-nested transaction could not return their values until after the transaction completed. This caused the networking-ovn load balancer problem.

Because most commands that return values are read-only, it is not necessary to initiate a transaction, because the data is already in memory. With this update, the read-only commands are run outside of a transaction, resolving the problem. (BZ#1669306)

Solution

Before applying this update, ensure all previously released errata relevant
to your system have been applied.

Red Hat OpenStack Platform 14 runs on Red Hat Enterprise Linux 7.6.

The Red Hat OpenStack Platform 14 Release Notes contain the following:

• An explanation of the way in which the provided components interact to

form a working cloud computing environment.

• Technology Previews, Recommended Practices, and Known Issues.
• The channels required for Red Hat OpenStack Platform 14, including which

channels need to be enabled and disabled.

The Release Notes are available at:
https://access.redhat.com/documentation/en/red-hat-openstack-platform/

This update is available through 'yum update' on systems registered through
Red Hat Subscription Manager. For more information about Red Hat
Subscription Manager, see:

https://access.redhat.com/documentation/en-US/Red_Hat_Subscription_Management/1/html/RHSM/index.html

Affected Products

• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat OpenStack for IBM Power 14 ppc64le
• Red Hat OpenStack 14 x86_64
• Red Hat OpenStack Director Deployment Tools 14 x86_64
• Red Hat OpenStack Director Deployment Tools for IBM Power LE 14 ppc64le

Fixes

• BZ - 1631182 - kuryr-controller keep restarting after the networks of k8s tenant exceeds quota
• BZ - 1638019 - OVN Functional CI job failed with ERROR -Regression
• BZ - 1663150 - Octavia adds default SG rule when creating listeners
• BZ - 1667007 - [neutron]Memory leak in neutron agents
• BZ - 1669306 - Add ability to run read-only Commands outside a transaction
• BZ - 1673103 - Removed networks after the tempest cleanup
• BZ - 1676533 - kuryr-controller pod restarts continuously (liveness probe fails) due to a load balancer in error status
• BZ - 1676915 - Skydive agent's deployment fails because it uses the same tag as the analyzer
• BZ - 1683302 - TLS-Everywhere - missing folder /var/lib/novajoin
• BZ - 1687874 - Provide python2-octaviaclient in Client-RH7-RHOS-TOOLS-14.0 repository
• BZ - 1690052 - Rebase ansible-tripleo-ipsec to 9.1.0
• BZ - 1690059 - Rebase openstack-barbican to ed17b57
• BZ - 1690060 - Rebase openstack-designate to 7f4c878
• BZ - 1690142 - Rebase openstack-heat-ui to 0b301df
• BZ - 1690152 - Rebase ansible-role-tripleo-modify-image to 9014df9
• BZ - 1690520 - Add maintenance release to /etc/rhosp-release
• BZ - 1690873 - Rebase python-vmware-nsxlib to 24a7ff4
• BZ - 1690973 - Rebase python-wsme to 1d73d6e
• BZ - 1690986 - Rebase openstack-octavia-ui to 85e4a3e
• BZ - 1690987 - Rebase python-glance-store to d001c3c
• BZ - 1690988 - Rebase python-hardware to b417976
• BZ - 1691006 - Rebase python-oslo-cache to 5f42092
• BZ - 1691007 - Rebase python-telemetry-tests-tempest to 0.2.0
• BZ - 1691371 - Rebase openstack-zaqar to fed6d77
• BZ - 1691476 - Rebase openstack-kuryr-kubernetes to 17d2635
• BZ - 1692403 - Rebase python-ovsdbapp to 0.12.3
• BZ - 1692601 - Rebase ansible-role-container-registry to d6a749a
• BZ - 1692602 - Rebase ansible-role-redhat-subscription to 1.0.2
• BZ - 1692836 - Rebase openstack-manila to c9f581c
• BZ - 1692839 - Rebase openstack-manila-ui to 4865df1
• BZ - 1693763 - Rebase openstack-selinux to c0dd7b6
• BZ - 1693904 - Rebase python-os-faults to 0.2.1
• BZ - 1700788 - Update version of AMQ Interconnect (metrics-qdr) from 1.2.0 to 1.3.0

CVEs

• CVE-2019-10138

References

(none)