RHBA-2019:1680 - Bug Fix Advisory

Topic

Updated OpenStack Networking packages that resolve various issues are now
available for Red Hat OpenStack Platform 14.0 (Rocky) for RHEL 7.

Description

Red Hat OpenStack Platform provides the facilities for building, deploying
and monitoring a private or public infrastructure-as-a-service (IaaS) cloud
running on commonly available physical hardware. This advisory includes
packages for:

• OpenStack Networking service

OpenStack Networking (neutron) is a virtual network service for OpenStack.
Just as OpenStack Compute (nova) provides an API to dynamically request and
configure virtual servers, OpenStack Networking provides an API to
dynamically request and configure virtual networks. These networks connect
'interfaces' from other OpenStack services (e.g. virtual NICs from Compute
VMs). The OpenStack Networking API supports extensions to provide advanced
network capabilities (e.g. QoS, ACLs, network monitoring, etc.)

Changes to the openstack-octavia component:

• Previously, when the `PING` type health monitor was configured, HAProxy would silently use TCP connect instead. This is because Red Hat OpenStack Platform uses an older version of HAProxy that does not support external monitors. The setting `allow_ping_health_monitors` is now set to `False` by default. (BZ#1644883)
• This update fixes the following issues:
• Excessive use of the CPU by the Octavia housekeeping service when creating or deleting amphorae and load balancers.
• A bug that caused an excessive number of RabbitMQ connections to be opened. (BZ#1661575)
• Previously, the octavia-api package would orphan AMQP connections leading to a large number of open files accumulating on the file system. This patch fixes that issue. (BZ#1676971)
• Previously, setting the QoS policy on a VIP would cause the load balancer provisioning status to become `ERROR`. This has been fixed. If the QoS extension is disabled when trying to set a QoS policy, the API will appropriately return an HTTP 400 to the user. The provisioning status is now maintained as 'ACTIVE'. (BZ#1697273)
• Previously, amphorae running an IPv6 load balancer in Active/Standby mode were configured with the same VIP address. This has been fixed, eliminating the possibility of an IPv6 address conflict. (BZ#1706757)
• Octavia will now encrypt certificates and keys used for secure communication with amphorae in its internal workflows. Additionally, a new option, `server_certs_key_passphrase` is available under the certificates section with a default value, `insecure-key-do-not-use-this-key`. (BZ#1676473)

Changes to the python-networking-ovn component:

• This patch fixes an issue wherein the floating IP address on a router configured with VRRP (Virtual Router Redundancy Protocol) on OVN would fail to work. This was due to an additional flow in router ingress pipeline blocking ARP resolution for the floating IP. This has been resolved by not having an address on unbound logical switch ports. (BZ#1714119)

Changes to the python-networking-ovn component:

• This patch fixes an issue wherein the floating IP address on a router configured with VRRP (Virtual Router Redundancy Protocol) on OVN would fail to work. This was due to an additional flow in router ingress pipeline blocking ARP resolution for the floating IP. This has been resolved by not having an address on unbound logical switch ports. (BZ#1714119)

Solution

Before applying this update, ensure all previously released errata relevant
to your system have been applied.

Red Hat OpenStack Platform 14 runs on Red Hat Enterprise Linux 7.6.

The Red Hat OpenStack Platform 14 Release Notes contain the following:

• An explanation of the way in which the provided components interact to

form a working cloud computing environment.

• Technology Previews, Recommended Practices, and Known Issues.
• The channels required for Red Hat OpenStack Platform 14, including which

channels need to be enabled and disabled.

The Release Notes are available at:
https://access.redhat.com/documentation/en/red-hat-openstack-platform/

This update is available through 'yum update' on systems registered through
Red Hat Subscription Manager. For more information about Red Hat
Subscription Manager, see:

https://access.redhat.com/documentation/en-US/Red_Hat_Subscription_Management/1/html/RHSM/index.html

Affected Products

• Red Hat OpenStack for IBM Power 14 ppc64le
• Red Hat OpenStack 14 x86_64

Fixes

• BZ - 1644883 - Add config for disabling creation of PING type HMs
• BZ - 1661575 - octavia services use more cpu after each performance iteration
• BZ - 1667920 - OVN migration job failed with ERROR! 'ignore_error' is not a valid attribute for a Task
• BZ - 1672782 - [Hackfest] Error in ovn_migration.sh validation wont let you use $HOME/ovn-extras.yaml
• BZ - 1672785 - [Hackfest] networking-ovn-migration-mtu output is confusing during ovn_migration.sh reduce-mtu call
• BZ - 1672790 - [Hackfest][migration] the ovs_migration.sh generate-inventory references the wrong next step
• BZ - 1676473 - [ACTIVE-STANDBY]- openstack-octavia: Private keys written to world-readable log files
• BZ - 1676971 - Open files counts for octavia-api grow dramatically under normal operation
• BZ - 1706757 - Ipv6 LB in Active/Standby mode with IPv6 members, composable roles(Octavia on networker), curl response is too long.
• BZ - 1708088 - Policies create_port:fixed_ips:* ignored
• BZ - 1709581 - [OSP14] Octavia CI job "DFG-network-octavia-14-pep8-rhos" Fails
• BZ - 1711883 - Rebase python-networking-bigswitch to 13.0.3
• BZ - 1711951 - Rebase python-networking-l2gw to 925096c
• BZ - 1712007 - Rebase openstack-neutron-lbaas-ui to 1ad5c98
• BZ - 1712366 - Rebase python-networking-odl to 4bd2dc1
• BZ - 1712367 - Rebase python-networking-bgpvpn to 8a2106d
• BZ - 1712578 - Rebase python-networking-fujitsu to 1aafc66
• BZ - 1713687 - Rebase openstack-neutron-fwaas to 55a5a41
• BZ - 1713689 - Rebase openstack-neutron-lbaas to 74dddcb
• BZ - 1713813 - Rebase openstack-octavia to 2bf15e8
• BZ - 1714119 - Unable to use "Highly available VIPs on OpenStack VMs with VRRP" in OVN based deployment
• BZ - 1714259 - Rebase python-networking-vmware-nsx to df5960e
• BZ - 1714270 - Rebase python-networking-ansible to 57b593e
• BZ - 1714285 - Rebase python-networking-baremetal to a48fe19
• BZ - 1714627 - Rebase openstack-neutron to de95bc6
• BZ - 1714837 - Rebase python-networking-ovn to e673daf
• BZ - 1719799 - Cannot install python-neutron-tests package

CVEs

(none)

References

(none)