RHBA-2019:2629 - Bug Fix Advisory

Topic

Updated OpenStack Networking packages that resolve various issues are now
available for Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.

Description

Red Hat OpenStack Platform provides the facilities for building, deploying
and monitoring a private or public infrastructure-as-a-service (IaaS) cloud
running on commonly available physical hardware. This advisory includes
packages for:

• OpenStack Networking service

OpenStack Networking (neutron) is a virtual network service for OpenStack.
Just as OpenStack Compute (nova) provides an API to dynamically request and
configure virtual servers, OpenStack Networking provides an API to
dynamically request and configure virtual networks. These networks connect
'interfaces' from other OpenStack services (e.g. virtual NICs from Compute
VMs). The OpenStack Networking API supports extensions to provide advanced
network capabilities (e.g. QoS, ACLs, network monitoring, etc.)

Changes to the openstack-neutron component:

• Previously, the Neutron SR-IOV agent set two possible states for virtual functions (VFs), `enable` or `disable`, which forced the VF link state regardless of the physical function (PF) link state.

With this update, the Neutron SR-IOV agent sets VFs to `auto` or `disable`. The `auto` state replicates the PF `up` or `down` automatically. As a result, if the PF is in the `down` state, the VF does not transmit or receive, even with other VFs in the same embedded switch (NIC).

NOTE: This behavior is not standard and depends on the NIC vendor implementation. Check the driver manual for the actual behavior of a VF in the `auto` state when the PF is `down`. (BZ#1656978)

• Previously, it was possible for admin role users to create security group rules for regular users without the security group owner being aware.

With this update, the owner of a security group can use `admin_context` to list the rules of a security group when processing GET /security-groups API requests, even if a rule was created by another user. (BZ#1709610)

Solution

Before applying this update, ensure all previously released errata relevant
to your system have been applied.

Red Hat OpenStack Platform 13 runs on Red Hat Enterprise Linux 7.6.

The Red Hat OpenStack Platform 13 Release Notes contain the following:

• An explanation of the way in which the provided components interact to

form a working cloud computing environment.

• Technology Previews, Recommended Practices, and Known Issues.
• The channels required for Red Hat OpenStack Platform 13, including which

channels need to be enabled and disabled.

The Release Notes are available at:
https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/13/html/release_notes/

This update is available through 'yum update' on systems registered through
Red Hat Subscription Manager. For more information about Red Hat
Subscription Manager, see:

https://access.redhat.com/documentation/en-US/Red_Hat_Subscription_Management/1/html/RHSM/index.html

Affected Products

• Red Hat OpenStack for IBM Power 13 ppc64le
• Red Hat OpenStack 13 x86_64

Fixes

• BZ - 1656978 - [Neutron] - VF link-state needs to be set to Auto
• BZ - 1686863 - Functional tests failures
• BZ - 1691044 - Adding ports to VM trunk takes too long with OVN neutron backend
• BZ - 1709610 - Security Group filtering hides rules from user
• BZ - 1714422 - br-tun gets a wrong arp drop rule when dvr is connected to a network but not used as gateway
• BZ - 1717067 - Problems with non-ASCII characters in LBAAS deployments - ERROR neutron_lbaas.agent.agent_manager UnicodeEncodeError: 'ascii' codec can't encode character u'\xfa' in position 25: ordinal not in range(128)
• BZ - 1721346 - Make OVS controller inactivity_probe configurable
• BZ - 1723935 - dhcp agent dnsmasq process mgmt race condition between launch and operations
• BZ - 1725750 - Maintenance Task: Race condition while creating resources
• BZ - 1740028 - Add ODL deprecation warning in n-odl

CVEs

(none)

References

(none)