RHBA-2020:0760 - Bug Fix Advisory

Topic

Updated director installer packages that resolve various issues are now
available for Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.

Description

Red Hat OpenStack Platform provides the facilities for building, deploying
and monitoring a private or public infrastructure-as-a-service (IaaS) cloud
running on commonly available physical hardware.

Changes to the openstack-tripleo-common component:

• Before this update, an error caused the `octavia-api` container to always report an unhealthy state. This update resolves the issue. (BZ#1755683)

Changes to the openstack-tripleo-heat-templates component:

• Before this update, there was an issue where some Octavia controller services were not properly configured. With this update, the issue is resolved. (BZ#1709925)
• Before this update, when deploying Ceph RGW, the object-store endpoint that is created in the Identity service (keystone) was missing the `AUTH_%(tenant_id)s` suffix. This meant that public containers that were created in Ceph RGW could not be accessed without authentication.

With this update, the `account_in_url` configuration option for Ceph RGW is appended with `AUTH_%(tenant_id)s` for the object-store endpoints. Public containers can now be hosted in Ceph RGW and accessed without authentication. (BZ#1709968)

• This enhancement adds two new parameters, `GlanceImageImportPlugins` and `GlanceImageConversionOutputFormat`, to enable Image service (glance) plugins during the image import process.

For example, if you enable the `image_conversion` plugin, the following command imports a qcow2 image, stores it in raw format, and converts it automatically after import:

`glance image-create-via-import --disk-format qcow2 --container-format bare --name cirros --import-method web-download --uri http://download.cirros-cloud.net/0.4.0/cirros-0.4.0-x86_64-disk.img`

This means that you can store images always in raw format when you use RBD as an Image service driver. (BZ#1782229)

• This enhancement provides default Octavia timeouts that are suitable for production environments, and the following new heat parameters to override the defaults:
• OctaviaConnectionMaxRetries
• OctaviaBuildActiveRetries
• OctaviaPortDetachTimeout (BZ#1726733)
• Before this update, all OpenStack containers floated across all system CPUs, ignoring tuned cpu-partitioning profiles and the `isolcpus` boot parameter. This meant that containers could preempt CPUs that were dedicated to VMs (vCPUs) or OVS-DPDK, resulting in packet loss on VNFs or on OVS-DPDK.

This bug affected mainly NFV and other use cases that required isolated vCPUs. With this update, the issue is resolved. (BZ#1750781)

• This enhancement allows OpenStack Image Service (glance) volumes to be mounted in a containerized control plane, as required by ScaleIO. (BZ#1766735)

Changes to the openstack-tripleo-validations component:

• This update adds a feature that verifies that ceph-ansible is installed from the ceph-tools repository. (BZ#1760567)

Changes to the puppet-octavia component:

• This update adds the following parameters to fine-tune Octavia keepalived VRRP settings:

octavia::controller::vrrp_advert_int
Amphora role and priority advertisement internal in seconds.
Defaults to $::os_service_default

octavia::controller::vrrp_check_interval
VRRP health check script run interval in seconds.
Defaults to $::os_service_default

octavia::controller::vrrp_fail_count
Number of successive failures before transition to a fail rate.
Defaults to $::os_service_default.

octavia::controller::vrrp_success_count
Number of consecutive successes before transition to a success rate.
Defaults to $::os_service_default.

octavia::controller::vrrp_garp_refresh_interval
Time in seconds between gratuitous ARP announcements from the MASTER.
Defaults to $::os_service_default.

octavia::controller::vrrp_garp_refresh_count
Number of gratuitous ARP announcements to make on each refresh interval.
Defaults to $::os_service_default.

To customize your environment, see https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/13/html/advanced_overcloud_customization/. (BZ#1760871)

Solution

Before applying this update, ensure all previously released errata relevant
to your system have been applied.

Red Hat OpenStack Platform 13 runs on Red Hat Enterprise Linux 7.7.

The Red Hat OpenStack Platform 13 Release Notes contain the following:

• An explanation of the way in which the provided components interact to

form a working cloud computing environment.

• Technology Previews, Recommended Practices, and Known Issues.
• The channels required for Red Hat OpenStack Platform 13, including which

channels need to be enabled and disabled.

The Release Notes are available at:
https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/13/html/release_notes/

This update is available through 'yum update' on systems registered through
Red Hat Subscription Manager. For more information about Red Hat
Subscription Manager, see:

https://access.redhat.com/documentation/en-US/Red_Hat_Subscription_Management/1/html/RHSM/index.html

Affected Products

• Red Hat OpenStack for IBM Power 13 ppc64le
• Red Hat OpenStack 13 x86_64
• Red Hat OpenStack Director Deployment Tools 13 x86_64
• Red Hat OpenStack Director Deployment Tools for IBM Power LE 13 ppc64le

Fixes

• BZ - 1588302 - We should add CORS configuration in gnocchi.conf via tripleo installer.
• BZ - 1591081 - [RFE] logrote configuration interface for containerized component.
• BZ - 1599311 - neutron-sriov-agent config has bogus EXPERIMENTAL comment
• BZ - 1620202 - overcloudrc has incorrect no_proxy export
• BZ - 1623432 - [OSP13] With umask 027 undercloud installation fails to configure /var/www/cgi-bin/nova permissions properly
• BZ - 1628835 - OVS n-handler-threads and n-handler-threads parameters are incoherent with hypervisor isolated core list
• BZ - 1643616 - openstack image prepare cannot be stopped with CTRL-C
• BZ - 1709925 - Octavia A/B topology - health_manager/controller_ip_port_list is wrongly configured
• BZ - 1709968 - Overcloud deployed with rgw has incomplete swift endpoints
• BZ - 1714621 - [RHOSP13] [OVN-DVR] [Split-Controller] Deploying OVN-DVR with a split Control Plane [3x PCMK controller nodes & 3x non PCMK controller nodes]
• BZ - 1715372 - Instance-HA fails to evacuate after admin changes their password.
• BZ - 1719761 - Deploy with Octavia fails in Step5 with YaqlEvaluationException
• BZ - 1724898 - [OSP13] Backport role-specific parameter validation message for CLI
• BZ - 1726733 - Default amphora timeouts too high for production environments
• BZ - 1737335 - OvsDpdkSocketMemory should set nova::compute::reserved_huge_pages
• BZ - 1739596 - /usr/share/python-tripleoclient/undercloud.conf.sample doesn't have read permissions for others.
• BZ - 1745260 - cephfs_data_pool should be into ceph-ansible all vars not mds only
• BZ - 1745481 - [OVN] Provide the option to configure probe interval for openflow connection
• BZ - 1747156 - It appears to be enabled by default and setting enable_telemetry = false doesn't appear to disable telemetry at
• BZ - 1748513 - Unable to specify additional kernel related packages to install
• BZ - 1748514 - Unable to specify additional kernel related packages to install
• BZ - 1749315 - [Backport] Backport of upstream patch - Change datatype of revalidator,handler threads
• BZ - 1750643 - OSP13 - Backport Numvfs setting during update/upgrade
• BZ - 1750781 - Containers not pinned to host cpus
• BZ - 1752900 - [OSP13] Use of skip-deploy-identifier flag cause compute scale-out failure
• BZ - 1755683 - octavia_api container stuck in unhealthy state
• BZ - 1756474 - [OSP 13] bug back-port request - OctaviaFlavorId should be type string
• BZ - 1758353 - undercloud.conf default values provide insufficient range for ctlplane-subnet
• BZ - 1759207 - Ironic inspection fails when network has mtu less than 1500
• BZ - 1759677 - backport of paunch update from ERRATA RHEA-2019:2811
• BZ - 1760211 - Bump up default pacemaker monitor timeout value for OVN DBs
• BZ - 1760567 - create new undercloud validation to ensure ceph-ansible came from ceph-tools repos
• BZ - 1760635 - Backport LINKDELAY support into RHOSP13
• BZ - 1760871 - Add parameters to fine-tune Octavia keepalived VRRP settings
• BZ - 1761364 - Playing with removal policies can lead to deletion of wrong node ...
• BZ - 1761373 - [OSP13] With NovaResumeGuestsStateOnHostBoot: True a change to /etc/sysconfig/libvirt-guests triggers stop/start of instances
• BZ - 1762210 - Incorrect placement of Octavia services in composable role deployments
• BZ - 1763175 - [FFU][ceph-ansible] Impossible to set health_osd_check_retries from THT when migrating to containers
• BZ - 1766503 - [OSP13] Include nova::availability_zone in nova::api and nova::conductor
• BZ - 1766735 - [OSP13]Backport: Containerized control plane with Dell EMC VxFlexOS storage
• BZ - 1766843 - Empty resource_registry breaks updates and deployments
• BZ - 1767106 - Set Nova anti-affinity on in Octavia by default
• BZ - 1767373 - [RHOS 13][TLS everywhere] Failed running container for nova_libvirt
• BZ - 1767388 - [OSP13] Backport run nova_api unprivileged
• BZ - 1767704 - FFU - Controllers Upgrade fails JMESPathError in json_query filter plugin Unexpected token
• BZ - 1768063 - When External LB is used, minor updates fail while trying to work with haproxy-bundle
• BZ - 1768412 - [THT]Minor update is blocked for overcloud with pre-provisioned nodes
• BZ - 1768439 - AdminPassword with special character fails deployment
• BZ - 1769292 - getcert with -F option returns before cacert file is created
• BZ - 1772201 - After a minor update to 13z9 , "overcloud deploy" fails on compute steps
• BZ - 1772306 - recon middleware is not configured for swift account/container server
• BZ - 1772959 - [RHOSP 13] Use /var/lib/mistral for Ansible fact cache
• BZ - 1775587 - NovaEvacuate: InstanceHA evacuation fails with "Failed to get "write" lock Is another process using the image?" when using NFSv4
• BZ - 1776608 - httpd logs in tls_proxy containers are recorded not on host but inside docker containers
• BZ - 1777140 - Undercloud has iptables rule to allow traffic for horizon, which is not deployed
• BZ - 1777336 - add validation to ensure lvm2 package is installed on overcloud nodes if ceph is being deployed w/ already provisioned servers
• BZ - 1777512 - Cannot create OVS patch port via tripleo heat templates due to sed command in run-os-net-config.sh
• BZ - 1778052 - All api servers running under httpd with wsgi have /icons accessible
• BZ - 1778719 - Filtering by VIP in /extraconfig/nova_metadata/krb-service-principals/role.role.j2.yaml breaks deployment
• BZ - 1779307 - ServiceNetMap using hardcoded network names for ctlplane fallback
• BZ - 1780399 - Minor update fails due to RabbitMQ loopback_nodes configuration in latest RabbitMQ puppet module
• BZ - 1781439 - Update from z3 to z9 doesn't install tmpwatch package and it causes the failure of logrotate to container logs.
• BZ - 1782229 - Enable image import conversion & image output format via TripleO
• BZ - 1783156 - [OSP13] Backport role-specific parameter validation message for CLI
• BZ - 1783994 - [cisco_ucsm] Backport Needed for Cisco UCSM Plugin Manager working on RHOSP13
• BZ - 1784092 - [OSP13] deleted instances in multi cellv2 environment won't get archived/purged
• BZ - 1787616 - [Backport] Backport of paunch docker compose builder parameter
• BZ - 1790456 - Unable to customize mysql's haproxy stanza
• BZ - 1790792 - [OSP13]Network ci update jobs are failing when it tries to start the new containers: already exists
• BZ - 1791338 - THT: custom network VIPs are stored in a hieradata hash called network_virtual_ips, but it's impossible to access the hash's keys with hiera from hieradata
• BZ - 1792890 - [OSP13] Manila upgrade tasks failing with: The conditional check 'manila_share_pcs_res|succeeded' failed.
• BZ - 1793063 - [OSP13] Upgrade tasks can't stop auditd service
• BZ - 1794163 - Allow Ceph configs being written into sections other than "global"
• BZ - 1794315 - Rebase openstack-tripleo-puppet-elements to ada8f50
• BZ - 1794318 - os-net-config default behavior creates ifcfg-* files for virtual functions if run after instance shutdown
• BZ - 1794359 - Rebase puppet-manila to 9046976
• BZ - 1794483 - Rebase puppet-stdlib to 2f85336
• BZ - 1795505 - Add sshd resource into Networker.yaml
• BZ - 1795725 - Rebase instack-undercloud to b4832e2
• BZ - 1795794 - Rebase os-net-config to 30585d7
• BZ - 1795796 - Rebase puppet-gnocchi to 0a165cb
• BZ - 1795808 - Rebase puppet-openstacklib to 6645ca3
• BZ - 1795873 - Rebase puppet-ovn to 41c885c
• BZ - 1795961 - Rebase python-paunch to 2ddf40d
• BZ - 1795963 - Rebase python-os-brick to 8d3e40b
• BZ - 1796499 - Rebase openstack-tripleo-heat-templates to 66c5e92
• BZ - 1796830 - Rebase openstack-tripleo-common to 98956a9
• BZ - 1796935 - Rebase puppet-tripleo to 7c96510
• BZ - 1796976 - Rebase puppet-octavia to f01d673
• BZ - 1797516 - Rebase puppet-pacemaker to 447cef0
• BZ - 1798669 - [OSP13] deployment fails during TASK [Discovering nova hosts] DBDuplicateEntry Duplicate entry uniq_host_mappings0host
• BZ - 1800847 - Octavia controller services fail to load CA certificate
• BZ - 1802949 - Bump up default pacemaker monitor timeout value for OVN DBs
• BZ - 1803749 - Overcloud update converge fails when updating Octavia to OSP 13 z11 candidate

CVEs

(none)

References

(none)