RHBA-2019:2957 - Bug Fix Advisory

Topic

Updated OpenStack Networking packages that resolve various issues are now
available for Red Hat OpenStack Platform 15.0 (Stein) for RHEL 8.

Description

Red Hat OpenStack Platform provides the facilities for building, deploying
and monitoring a private or public infrastructure-as-a-service (IaaS) cloud
running on commonly available physical hardware. This advisory includes
packages for:

• OpenStack Networking service

OpenStack Networking (neutron) is a virtual network service for OpenStack.
Just as OpenStack Compute (nova) provides an API to dynamically request and
configure virtual servers, OpenStack Networking provides an API to
dynamically request and configure virtual networks. These networks connect
'interfaces' from other OpenStack services (e.g. virtual NICs from Compute
VMs). The OpenStack Networking API supports extensions to provide advanced
network capabilities (e.g. QoS, ACLs, network monitoring, etc.)

Changes to the openstack-neutron component:

• Neutron bulk port creation (create multiple ports in a single request) has been optimized for speed and is now significantly faster. The benefits of this improvement include faster initialization of containers via Kuryr on neutron networks. (BZ#1504662)
• When you supplied a security group during bulk port creation, the resulting ports received both the requested security group and the tenant default security group. This fix changes the behavior so only the requested security group is assigned. This ensures the correct security group applies during bulk port creation. (BZ#1749744)

Changes to the openstack-octavia component:

• The Load Balancing service (octavia) now provides the capability to refine access policies for its load balancers, by allowing you to change security group ownership to a security group associated with a user project. (The user project must be on the whitelist.)

In previous RHOSP releases, you could not restrict access to the load balancer, because octavia exclusively assigned the project ID to the security group associated with the VIP and VRRP ports on the load balancing agent (amphora). (BZ#1693268)

Changes to the python-networking-ovn component:

• If a Compute host crashed and ovn-controller did not clean up the Port_Binding chassis column, the Logical_Switch_Port is never set to DOWN. A lack of transition detection between the UP to DOWN state meant there was no update to the port status. This caused problems for workload evacuation during a Compute failure. This patch monitors the Port_Binding chassis column for changes, which resolves the transition detection issues and allows successful evacuation when a Compute node fails. (BZ#1731968)

Solution

Before applying this update, ensure all previously released errata relevant
to your system have been applied.

Red Hat OpenStack Platform 15 runs on Red Hat Enterprise Linux 8.0.

The Red Hat OpenStack Platform 15 Release Notes contain the following:

• An explanation of the way in which the provided components interact to

form a working cloud computing environment.

• Technology Previews, Recommended Practices, and Known Issues.
• The channels required for Red Hat OpenStack Platform 15, including which

channels need to be enabled and disabled.

The Release Notes are available at:
https://access.redhat.com/documentation/en/red-hat-openstack-platform/

This update is available through 'yum update' on systems registered through
Red Hat Subscription Manager. For more information about Red Hat
Subscription Manager, see:

https://access.redhat.com/documentation/en-US/Red_Hat_Subscription_Management/1/html/RHSM/index.html

Affected Products

• Red Hat OpenStack for IBM Power 15 ppc64le
• Red Hat OpenStack 15 x86_64

Fixes

• BZ - 1504662 - [RFE] Fast bulk neutron port create/update operations
• BZ - 1693268 - loadbalancer listener requires security group customization
• BZ - 1731968 - Instance evacuation failed: Virtual Interface creation failed
• BZ - 1749744 - Ports created by bulk operation are assigned default security group apart from the requested sg

CVEs

(none)

References

(none)