RHBA-2019:1738 - Bug Fix Advisory

Topic

Updated director installer packages that resolve various issues are now
available for Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.

Description

Red Hat OpenStack Platform provides the facilities for building, deploying
and monitoring a private or public infrastructure-as-a-service (IaaS) cloud
running on commonly available physical hardware.

Changes to the openstack-tripleo-heat-templates component:

• This update fixes an issue where the container images didn’t update after you changed the content path for pacemaker. (BZ#1655250)
• Previously, iscid container was stuck in a restart loop after upgrading with `ffwd-upgrade converge`.

This update adds iscid service cleanup from systemd to solve this iscid container issue. (BZ#1697873)

• Previously, the manila API was not deployed with Apache httpd server.

With this update, the Apache logs are located in /var/log/containers/httpd/manila-api on the nodes with manila API container. (BZ#1701425)

• This update adds support for validating API endpoint connectivity for hostnames with IPv6 addresses. (BZ#1713305)
• Previously, you configured maxdelay in heat cron job with the HeatCronPurgeDeletedMaxDelay parameter.

With this update, you can also configure maxdelay in cinder database purge cron job and nova database archive cron job with the new parameters, CinderCronDbPurgeMaxDelay and NovaCronDBArchivedMaxDelay. (BZ#1603014)

• Previously, nodes experienced network issues because of ARP message failure after restarting the network or internal openvswitch.

With this update, the default kernel sysctl sends out gratuitous IPv4 or IPv6 ARP messages as required when networking is restarted. (BZ#1698557)

• This update adds a new director parameter, CinderNfsSnapshotSupport, which you can use to control Block Storage service (cinder) snapshots on NFS back ends. (BZ#1698683)
• This update adds support for a second ceph Storage Tier deployment capability through director. (BZ#1714227)

Changes to the puppet-manila component:

• Previously, if you enabled TLS throughout your environment, the communication between internal services, such as the haproxy and the manila API, was not secured.

With this update, the manila API supports TLS endpoints on the internal API network. (BZ#1701427)

Changes to the puppet-nova component:

• With this update, you can customize the libvirt nfs mount options with the puppet-nova `nfs_mount_options` parameter. (BZ#1650949)

Changes to the python-os-brick component:

• With this update, operations using FC connections, such as volume live migration, no longer fail because of uppercase world wide name (WWN) for storage backend and lowercase WWN for os-brick devices. (BZ#1710375)

Solution

Before applying this update, ensure all previously released errata relevant
to your system have been applied.

Red Hat OpenStack Platform 13 runs on Red Hat Enterprise Linux 7.6.

The Red Hat OpenStack Platform 13 Release Notes contain the following:

• An explanation of the way in which the provided components interact to

form a working cloud computing environment.

• Technology Previews, Recommended Practices, and Known Issues.
• The channels required for Red Hat OpenStack Platform 13, including which

channels need to be enabled and disabled.

The Release Notes are available at:
https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/13/html/release_notes/

This update is available through 'yum update' on systems registered through
Red Hat Subscription Manager. For more information about Red Hat
Subscription Manager, see:

https://access.redhat.com/documentation/en-US/Red_Hat_Subscription_Management/1/html/RHSM/index.html

Affected Products

• Red Hat OpenStack for IBM Power 13 ppc64le
• Red Hat OpenStack 13 x86_64
• Red Hat OpenStack Director Deployment Tools 13 x86_64
• Red Hat OpenStack Director Deployment Tools for IBM Power LE 13 ppc64le

Fixes

• BZ - 1603014 - [OSP13] cinder cron job definition should have randomized sleep command like puppet-heat for decreasing DB spike or lock contention.
• BZ - 1611997 - [Backport][OSP13][Deployment][RFE] Take into account NUMA locality of physical NICs when plugging instance VIFS from Neutron networks (static config)
• BZ - 1612382 - Insufficient sizing on the redo log on the Director
• BZ - 1614478 - FFWD: After upgrade, nova cell0 needs to be updated to remove bind_address and add proper database URL
• BZ - 1617094 - A deprecated parameter, nova_metadata_ip is configured in RHOSP13
• BZ - 1618689 - [OSP13][Octavia] octavia-api fails to start with IPv6
• BZ - 1623075 - Enable configuration of HAProxyStatsEnabled on another network via Director and fix its binding addresses
• BZ - 1635154 - puppet-neutron defines [AGENT] and [agent] sections in l3_agent.ini.
• BZ - 1641826 - Environment with pre-provisioned nodes after overcloud / container update returns [Errno 13] Permission denied: '/var/log/horizon/horizon.log' until horizon container is restarted
• BZ - 1643535 - [RHOSP 13] Impossible to use custom cinder-volume image with "rhosp13/openstack-cinder-volume" prefix
• BZ - 1647409 - octavia_api container is logging continuous tracebacks
• BZ - 1650949 - [OSP13] Add ability to override libvirt NFS mount options for NFS backed Cinder volumes
• BZ - 1651136 - [UPDATE] undercloud update for custom stack name is completed but it have post-upgrade error
• BZ - 1653727 - python-neutron-tests package dependences made update fail
• BZ - 1655250 - Openstack fails to update container images.
• BZ - 1673661 - [OSP13] Allow NovaNfs parameters to be role specific
• BZ - 1683729 - [RFE] Backport SAF-1.0 to OSP13
• BZ - 1688279 - [OSP13] Allow NovaRbdPoolName to be role specific
• BZ - 1690558 - [OSP13][Deployment][TLS] Deployment fails when enabling TLS when with 3 controllers in 3 profiles
• BZ - 1691328 - rhel-registration not working due to wrong absolute path
• BZ - 1692440 - Neutron SRIOV agent loop iteration exceeding polling interval, causing high CPU usage in neutron-rootwrap-daemon
• BZ - 1692932 - config-download backports from RHOSP 14 to RHOSP 13 (python-tripleoclient)
• BZ - 1693808 - Creating TERMINATED_HTTPS Octavia loadbalancer listener fails with 'Could not retrieve certificate' after z5 update
• BZ - 1695460 - Setting undercloud_public_host to IPv6 address fails to create stackrc file
• BZ - 1696476 - [RFE] Support for connecting director-deployed manila to an external Ganesha and Ceph cluster
• BZ - 1696713 - [THT]Default ulimit value for neutron containers (DHCP, L3 and OVS agents) limits a number of SDN entities in production environment
• BZ - 1697470 - Add ipa client make home directory option
• BZ - 1698036 - add the ovs_extra parameter to ovs vlan interfaces (OSP-13)
• BZ - 1698557 - RHEL 7 nodes do not send out gratuitous neighbor advertisements when flapping OVS VLAN internal ports or restarting the network in Red Hat OpenStack Platform
• BZ - 1698683 - [OSP13] Cannot configure nfs_snapshot_support properly in director
• BZ - 1698712 - availability_zone class is not included in scheduler.pp
• BZ - 1699046 - TLS Everywhere: ceph-nfs ganesha service fails to start after tripleo deployment
• BZ - 1699393 - [OSP13] deployment fails running nova_cellv2_discover_hosts process with a duplicate key
• BZ - 1699409 - Edge spine and leaf use case: TLS everywhere deployments fail with: is too long (HTTP 400) (Request-ID:
• BZ - 1699691 - Back port request for removing dependency internalAPI network.
• BZ - 1699972 - Tripleo::Profile::Base::Swift::Ringbuilder doesn't support IPv6
• BZ - 1700634 - Undercloud install failing at downloading rabbitmqadmin when deploying with IPv6
• BZ - 1701131 - OVN- We have to remove the option of setting OVNTunnelEncapType: vlan
• BZ - 1701256 - [osp13] A pacemaker_remoted node fails monitor (probe) and stop operations on a resource because it returns "rc=189"
• BZ - 1701425 - [OSP-13][RFE][Manila] Implement manila-api with httpd
• BZ - 1701427 - [OSP-13] TLS for Manila Internal services
• BZ - 1701432 - Want to run command 'docker run --security-opt=no-new-privileges' in OSP13.
• BZ - 1701901 - Provide option to disable EMC in puppet-vswitch
• BZ - 1701937 - Provide option to disable EMC in tripleo-heat-templates
• BZ - 1702335 - osp13 should have puppet-ceph stable/luminous
• BZ - 1702892 - [OSP13] Overcloud with Nova NFS backend deployment failure due to InvalidSchemaError
• BZ - 1703052 - networking-ansible fails to deploy
• BZ - 1703070 - networking-ansible fails to deploy
• BZ - 1703267 - [RFE] Expose MySQL lock_wait_timeout via puppet-tripleo
• BZ - 1703554 - [OSP13] Required changes to ovs-hw-offload.yaml
• BZ - 1704589 - [puppet-tripleo] Restrict SSH access access to specific remote subnets
• BZ - 1705350 - Add OpenDaylight deprecation warning in TripleO CLI
• BZ - 1707027 - [OSP13] Modify udev rule for VF representor rename
• BZ - 1707817 - [OSP13] Controller-replacement fails (controller-removal) because : /var/log/containers/nova/nova-manage.log is owned by root:root
• BZ - 1709209 - RHOSP13z5 or later prevent to access haproxy stats because of commit 3f8ce6fd96bc4f28a052b4c87a19b4b152734091
• BZ - 1710375 - [OSP13] live-migration fails with NoFibreChannelVolumeDeviceFound due to FC case sensitive scanning
• BZ - 1710456 - [OSP13] Fix NovaNfs role parameter precedence in conditions
• BZ - 1712391 - Deploying OSP 13 with TLS fails with error: No function "concat" matches supplied arguments"
• BZ - 1712465 - [RFE] (THT) Support --no-ntp and --domain options for ipa-client-install
• BZ - 1713305 - run-os-net-config.sh does not parse hostname that resolves to IPv6 address properly
• BZ - 1713388 - backport {{role.name}}RemovalPoliciesMode parameter to RHOSP13
• BZ - 1714205 - websocket-client needs a CA provided for TLS-enabled endpoints (or breaks ipv6+TLS support in openstack-zaqar)
• BZ - 1714227 - [RFE][Backport] Add Support for a Second Ceph Storage Tier deployment capability through director
• BZ - 1714813 - Rebase puppet-ceilometer to 636e53b
• BZ - 1715028 - TypeError when using DeploymentServerBlacklist
• BZ - 1715113 - Rebase puppet-gnocchi to f5356ee
• BZ - 1715582 - Rebase puppet-manila to 706bf9b
• BZ - 1715584 - Rebase puppet-octavia to d83ceb0
• BZ - 1716558 - Rebase openstack-tripleo-heat-templates to a3e4996
• BZ - 1716683 - Rebase puppet-tripleo to ffb1bd2
• BZ - 1716863 - Rebase puppet-ceph to 372379b
• BZ - 1717131 - Rebase instack-undercloud to d381995
• BZ - 1717225 - Rebase os-net-config to 580cce3
• BZ - 1717236 - Rebase python-os-brick to 2.3.7
• BZ - 1717485 - Missing SRIOV-OVN ymal file that enabling ovn with Neutron dhcp agent
• BZ - 1717534 - Rebase python-tripleoclient to 901074e
• BZ - 1718964 - [upgrades][13->14] Overcloud upgrade failed on underfined variable error 'python_interpreter'
• BZ - 1719673 - [OSP13] minor update fails because : /var/log/containers/nova/nova-manage.log is owned by root:root on compute nodes
• BZ - 1721595 - Undercloud update fails when public_host set to IPv6 with Lookup of key vswitch::ovs::package_ensure
• BZ - 1722636 - [DCN][Spine & Leaf] ssh timeout into compute overcloud nodes post overcloud.AllNodesDeploySteps
• BZ - 1722640 - [OSP13][Deployment][TLS] Deployment fails when enabling TLS when with 3 controllers in 3 profiles
• BZ - 1723306 - [UPDATE] controller update fails with error: " "CantStartEngineError: No sql_connection parameter is established"

CVEs

(none)

References

(none)