RHBA-2019:1744 - Bug Fix Advisory

Topic

Updated OpenStack Networking packages that resolve various issues are now
available for Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.

Description

Red Hat OpenStack Platform provides the facilities for building, deploying
and monitoring a private or public infrastructure-as-a-service (IaaS) cloud
running on commonly available physical hardware. This advisory includes
packages for:

• OpenStack Networking service

OpenStack Networking (neutron) is a virtual network service for OpenStack.
Just as OpenStack Compute (nova) provides an API to dynamically request and
configure virtual servers, OpenStack Networking provides an API to
dynamically request and configure virtual networks. These networks connect
'interfaces' from other OpenStack services (e.g. virtual NICs from Compute
VMs). The OpenStack Networking API supports extensions to provide advanced
network capabilities (e.g. QoS, ACLs, network monitoring, etc.)

Changes to the openstack-neutron component:

• Previously, the oslopolicy-policy-generator tool changed how it executed policy generation and did not run for neutron.

With this update, an enforcer function is added and the oslopolicy-policy-generator tool runs for neutron. (BZ#1678771)

• This update resolves an issue with Layer 2 agent and openvswitch in large-scale neutron deployments with Distributed Virtual Routing (DVR), where instances lost IP addresses after a restart of L2 agent. (BZ#1692156)

Changes to the openstack-octavia component:

• HAProxy, used for network load balancing, must be version 1.6 or higher to correctly support the PING type health monitor.

The version of HAProxy included with Red Hat OpenStack Platform 13 is an older version than 1.6 that uses TCP connect instead when you configure the PING type health monitor. (BZ#1581337)

• This feature is "community support" and not supported by Red Hat per RHOSP SLA. (BZ#1671022)
• This update fixes a system load and resource utilization issue relating to the octavia API process. (BZ#1676975)
• Previously, Octavia revoked access to secrets automatically whenever load balancing resources no longer required access to them.

With this update, Octavia does not revoke access to secrets automatically. (BZ#1680494)

• With this update, setting a neutron quality of service (QoS) policy on a virtual IP while the QoS extension is disabled causes the octavia load balancer API to return HTTP 400, instead of ERROR. (BZ#1687697)
• Previously, octavia amphorae load balancers in Active/Standby mode experienced network issues when configured with duplicate IPv6 addresses.

With this update, you cannot misconfigure the load balancer with duplicate IPv6 addresses. (BZ#1683611)

• Previously, keys and certificates used for internal workflow communication with octavia amphorae were unencrypted.

This update adds a new option, `server_certs_key_passphrase`, in the certificates section to address this. (BZ#1686517)

Changes to the python-networking-ansible component:

• This update adds support for the Ansible Networking ML2 plugin, which provides the following functionality:
• Isolated Tenant network capability for ironic baremetal guests.
• Automated switch configuration for baremetal nodes.
• Use of the same ML2 driver for multiple switch platforms. (BZ#1651191)

Changes to the python-networking-ovn component:

• Previously, Address Resolution Protocol (ARP) failed for High Availability floating IP with Virtual Router Redundancy Protocol (VRRP) deployment.

With this update, floating IP on Virtual IP works correctly. (BZ#1707241)

Solution

Before applying this update, ensure all previously released errata relevant
to your system have been applied.

Red Hat OpenStack Platform 13 runs on Red Hat Enterprise Linux 7.6.

The Red Hat OpenStack Platform 13 Release Notes contain the following:

• An explanation of the way in which the provided components interact to

form a working cloud computing environment.

• Technology Previews, Recommended Practices, and Known Issues.
• The channels required for Red Hat OpenStack Platform 13, including which

channels need to be enabled and disabled.

The Release Notes are available at:
https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/13/html/release_notes/

This update is available through 'yum update' on systems registered through
Red Hat Subscription Manager. For more information about Red Hat
Subscription Manager, see:

https://access.redhat.com/documentation/en-US/Red_Hat_Subscription_Management/1/html/RHSM/index.html

Affected Products

• Red Hat OpenStack for IBM Power 13 ppc64le
• Red Hat OpenStack 13 x86_64

Fixes

• BZ - 1581337 - Add config for disabling creation of PING type HMs
• BZ - 1588413 - some DVR tests in neutron_tempest_plugin not checking enabled extensions
• BZ - 1651191 - [RFE] Include the Ansible Networking ML2 Plugin in OSP 13
• BZ - 1657546 - Policies create_port:fixed_ips:* ignored
• BZ - 1669499 - queue "ironic-neutron-agent-heartbeat.info" keeps on populating messages with no consumer
• BZ - 1671702 - Pull python-networking-ansible into OSP from RDO
• BZ - 1676785 - Improve error message when trying to create a security rule specifying ports on protocol 112 (VRRP)
• BZ - 1676975 - Open files counts for octavia-api grow dramatically under normal operation
• BZ - 1678771 - Unable to dump policy using oslopolicy-policy-generator for neutron
• BZ - 1680494 - Octavia can lose access to barbican secrets if they are re-used
• BZ - 1680574 - Unable to dump policy using oslopolicy-policy-generator
• BZ - 1683611 - Ipv6 LB in Active/Standby mode with IPv6 members, composable roles(Octavia on networker), curl response is too long.
• BZ - 1686517 - [ACTIVE-STANDBY]- openstack-octavia: Private keys written to world-readable log files
• BZ - 1687457 - Neutron doesn't allow the gateway to be the first v6 address
• BZ - 1692156 - Instance not receiving IP on DVR enabled tenant network due to missing flows
• BZ - 1697277 - octavia services use more cpu after each performance iteration
• BZ - 1699973 - improve the resource quota message response
• BZ - 1700455 - Use Loadbalancer ids instead of names to facilitate debugging
• BZ - 1707241 - Unable to use "Highly available VIPs on OpenStack VMs with VRRP" in OVN based deployment
• BZ - 1710875 - [OSP13] Octavia CI job "DFG-network-octavia-13-pep8-rhos" Fails
• BZ - 1716735 - Rebase python-networking-vmware-nsx to 18d35f4
• BZ - 1717055 - Rebase python-networking-bigswitch to 54e871d
• BZ - 1717127 - Rebase openstack-neutron to 605162c
• BZ - 1717214 - Rebase openstack-octavia to a3a1411
• BZ - 1717217 - Rebase openstack-neutron-lbaas to b80e960
• BZ - 1717234 - Rebase python-networking-baremetal to 5141cae
• BZ - 1722422 - [OSP 13] Exceptions In Neutron Policy Enforcement

CVEs

(none)

References

(none)