RHBA-2019:2624 - Bug Fix Advisory

Topic

Updated director installer packages that resolve various issues are now
available for Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.

Description

Red Hat OpenStack Platform provides the facilities for building, deploying
and monitoring a private or public infrastructure-as-a-service (IaaS) cloud
running on commonly available physical hardware.

Changes to the openstack-tripleo-heat-templates component:

• With this update, you can now use the Red Hat OpenStack Platform 13 host-config-and-reboot environment during fast-forward upgrade:

1. Remove the `NodeUserData` mapping from the `first-boot` script
2. Add the `host-config-and-reboot.yaml` environment file to the deploy command
3. Add KernelArgs and TunedProfile configured to the OvS-DPDK role using role-specific parameters
4. Ensure that the KernelArgs and TunedProfile correspond to the OpenStack Platform 10 values. Any changes result in the node rebooting during fast-forward upgrade and the upgrade fails.

Ansible cannot handle reboots performed by the heat stack configuration. Any incorrect configuration that results in reboot causes the fast-forward upgrade process to fail.
[NOTE]
You can still perform the fast-forward upgrade with the existing first-boot scripts, even with the new patches present. (BZ#1614361)

• With this update, you can now configure automatic restart of instances on a Compute node if the node reboots without migrating the instances. You can configure Nova and the libvirt-guests agent to shut down the instances gracefully and restart them when the Compute node reboots. The following parameters are new in Red Hat OpenStack Platform 13: NovaResumeGuestsStateOnHostBoot (True/False) NovaResumeGuestsShutdownTimeout (default 300s) (BZ#1706992)
• Previously, when a stale shutdown happened on a node, the iscsi.service detected remaining information about the previous iscsi connection and recovered connections based on that information. This caused a conflict between the isci.service that runs on the host and the isci.service that runs in a container in Red Hat OpenStack Platform 13.

This fix disables the iscsi.service on the host when deploying iscsid in a container, which avoids the conflict. (BZ#1720561)

• Previously, director created volumes with no associated volume type. This caused errors during volume retype and migration operations.

With this update, director assigns the default volume type 'tripleo' when creating cinder volumes. You can change a cinder volume type by overriding the CinderDefaultVolumeType parameter.

NOTE: When you update the overcloud nodes, if you configured the cinder default volume type manually, set the CinderDefaultVolumeType to the manually configured value so that director does not assign the `tripleo' default value. (BZ#1720666)

Changes to the puppet-tripleo component:

• In rare circumstances, when you reboot a controller node several times, RabbitMQ can run in an inconsistent state that blocks API operations on the overcloud.

The symptoms for this issue are:

• Entries in any of the OpenStack service logs of the form:

DuplicateMessageError: Found duplicate message(629ff0024219488499b0fac0cacaa3a5). Skipping it.

• "openstack network agent list" returns that some agents are DOWN

To restore normal operation, run the following command on any one of the controller nodes:
pcs resource restart rabbitmq-bundle (BZ#1592528)

• With this enhancement, you can pass arbitrary mysql config options to the mysql cluster on the overcloud with the `tripleo::profile::base::database::mysql::mysql_server_options` hiera hash key. (BZ#1688385)
• Previously, the `ManilaCephFSDataPoolName` parameter used to set a custom name for CephFS daemons was not correctly set for the Shared File System service (manila). This caused the manila CephFS back end to fail when configured to use NFS as a gateway with a custom CephFS data pool name.

With this update, you can apply a custom name to the pool that CephFS and Ganesha use as file system shares. (BZ#1732562)

Solution

Before applying this update, ensure all previously released errata relevant
to your system have been applied.

Red Hat OpenStack Platform 13 runs on Red Hat Enterprise Linux 7.6.

The Red Hat OpenStack Platform 13 Release Notes contain the following:

• An explanation of the way in which the provided components interact to

form a working cloud computing environment.

• Technology Previews, Recommended Practices, and Known Issues.
• The channels required for Red Hat OpenStack Platform 13, including which

channels need to be enabled and disabled.

The Release Notes are available at:
https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/13/html/release_notes/

This update is available through 'yum update' on systems registered through
Red Hat Subscription Manager. For more information about Red Hat
Subscription Manager, see:

https://access.redhat.com/documentation/en-US/Red_Hat_Subscription_Management/1/html/RHSM/index.html

Affected Products

• Red Hat OpenStack for IBM Power 13 ppc64le
• Red Hat OpenStack 13 x86_64
• Red Hat OpenStack Director Deployment Tools 13 x86_64
• Red Hat OpenStack Director Deployment Tools for IBM Power LE 13 ppc64le

Fixes

• BZ - 1592528 - [OSP13] DuplicateMessageError after rolling restart of RabbitMQ
• BZ - 1614361 - [RFE][Improvement][FFU]System should not reboot if there's no changes to KernelArgs that require a reboot
• BZ - 1628960 - Case issue in validation-scripts/all-nodes.sh
• BZ - 1642588 - Director does not start openvswitch on overcloud nodes
• BZ - 1660588 - [OSP13] RamFilter, DiskFilter are deprecated and should not be enabled by default
• BZ - 1672160 - Need to validate the horizon.yaml template in RHOSP 13
• BZ - 1688385 - RFE: allow custom MySQL configs/tuning
• BZ - 1692258 - Unnecessary libvirt is enabled on controller nodes
• BZ - 1694471 - Restrict SSH access access to specific remote subnets
• BZ - 1700481 - Unclear if overcloud-secure and overcloud-secure-uefi are tech-preview in OSP 13
• BZ - 1706992 - [OSP13][RFE] Backport - After the compute reboot， the vm on compute state is shut off
• BZ - 1712401 - [OSP13] Python exception when passing vfid 0 to sriov_vf NIC
• BZ - 1714691 - [OVN ] there is no IP for external_ids:ovn-encap-ip on compute nodes
• BZ - 1714816 - [OSP13] sshd running inside nova_migration_target overrides /var/run/sshd.pid on host with pid 1
• BZ - 1714922 - Director Ceph LVM deployment fails with DeriveParams "No Ceph OSDs found in the overcloud definition ('ceph::profile::params::osds')"
• BZ - 1718286 - Failed obtaining certificate on director / freeipa installation launchpad#1816465
• BZ - 1718573 - openstack undercloud upgrade fails.
• BZ - 1718923 - tripleo-common: TripleO should configure server_certs_key_passphrase for Octavia
• BZ - 1718936 - puppet-octavia: TripleO should configure server_certs_key_passphrase for Octavia
• BZ - 1718940 - tripleo-heat-templates: TripleO should configure server_certs_key_passphrase for Octavia
• BZ - 1720561 - [RHOSP 13] iscsi.service on host should be disabled to avoid iscsid is started at host when some stale shutdown happens
• BZ - 1720666 - [OSP13] Director doesn't create a default volume type by default
• BZ - 1722272 - [OSP13] Fix handling of SR-IOV PF routes
• BZ - 1726207 - Octavia host set to IP_ADDRESS in tls-everywhere-endpoints-dns.yaml
• BZ - 1726261 - Amphora loadbalancers fail to create
• BZ - 1726322 - Swift container fails when the network file doesn't exist in openstack overcloud deploy command
• BZ - 1727947 - [OSP13] Sporadic error 504 when running a deploy on large clouds
• BZ - 1729553 - [OSP13] set default ulimit to nova_libvirt
• BZ - 1729762 - [OSP13] Swift container fails when the network file doesn't exist in openstack overcloud deploy command
• BZ - 1730782 - AVC denials from logrotate on multiple containers
• BZ - 1731258 - os-net-config fails to shutdown interface before adding to a bond
• BZ - 1732562 - [OSP 13] [manila] Unable to configure name of NFS-Ganesha's rados pool
• BZ - 1736488 - Redis THT templates contain malformed metadata_settings
• BZ - 1736752 - TLS everywhere in place upgrade fails on overcloud.AllNodesDeploySteps.ControllerDeployment_Step3
• BZ - 1738344 - openstack overcloud config download very slow. Also, deployment with config download fails because we bust the 3600 websocket timeout
• BZ - 1741524 - [OSP13] Octavia OSP13 CI jobs failing with NovaEnableRbdBackend error
• BZ - 1744758 - [OSP13] TLS Everywhere jobs timeout

CVEs

(none)

References

(none)