RHEA-2014:0953 - Product Enhancement Advisory

Topic

OpenStack Networking service packages for Red Hat Enterprise Linux OpenStack
Platform 5.0 (Icehouse) for RHEL 6 are now available.

Description

Red Hat Enterprise Linux OpenStack Platform provides the facilities for building
a private or public infrastructure-as-a-service (IaaS) cloud running on commonly
available physical hardware. This advisory includes packages for:

• OpenStack Networking service ("Neutron").
• OpenStack Networking client ("python-neutronclient").

OpenStack Networking (Neutron) is a virtual network service for OpenStack. Just
as OpenStack Compute (Nova) provides an API to dynamically request and configure
virtual servers, In addition, OpenStack Networking provides an API to
dynamically request and configure virtual networks.

• In Red Hat Enterprise Linux OpenStack Platform 5.0, OpenStack Networking

notifies Compute about port status changes, and to do so it requires Identity
credentials in the file neutron.conf.
Prior to this update, an instance's network ports were not created if the
Compute (nova) API configuration was missing from neutron.conf.
This update addresses this issue by disabling 'nova-neutron' notifications by
default in Red Hat Enterprise Linux OpenStack Platform 5.0.
As a result, instances will boot without dependency on the notification feature.
Enabling Compute's notifications is recommended in order to mitigate race
behavior issues.
This is managed in the following neutron.conf parameters:
notify_nova_port_status_changes=true
notify_nova_on_port_data_changes=true
nova_url=http://[nova_api]:[nova_api_port]/v2
nova_admin_username=[admin_username]
nova_admin_password=[admin_password]
nova_admin_tenant_id=[admin_tenant_id]
nova_admin_auth_url=http://[keystone_service_ip]:[keystone_port]/v2.0
With this workaround in place, OpenStack Networking will correctly notify
Compute of port changes. (BZ#1094506)

• An argument that would make the agent read the /etc/neutron/fwaas_driver.ini

configuration file was missing in the previous release's neutron-vpn-agent
service files. As a result, neutron-vpn-agent didn't apply configuration from
the configuration file. At the same time, the L3 agent that is replaced by
neutron-vpn-agent did read the file. This introduced inconsistency in how
different L3 agents were configured.
The service files have been updated so that the configuration file is now read
on agent startup, and configuration from the file is applied for
neutron-vpn-agent. (BZ#1098596)

• Previously, the OpenStack Networking (neutron) package did not depend on the

iproute2 version with network-namespace support. This meant that OpenStack
Networking was installed, but failed to operate with network namespaces.
An explicit dependency has been added to either install or update iproute2 to a
version with network-namespace support. OpenStack Networking can now operate
with network namespaces. (BZ#1101315)

• When deleting a port, under some circumstances a deadlock occurred when two

inter-dependent threads attempted to access the same database row.
This resulted in the database library returning an OperationalError after a
delay of approximately 50 seconds.
This has been fixed by moving notifications which could cause this type of
conflict to outside the database transaction.
Now, these types deadlock do not occur. (BZ#1117818)

• With this release, openstack-neutron is now rebased to upstream version

2014.1.1. This rebase applies the following updates:

• OVS agent now handles 'openvswitch service restart' correctly.
• Querying for security groups is optimized.
• The router-list command performance is optimized, reducing the average time of

the operation for 10-30%.

• Multiple updates to VMware NSX, Cisco N1KV, and other plugins.

(BZ#1118484)

These packages also fix various bugs found in the Red Hat Enterprise Linux
OpenStack Platform 4 release.

Documentation for these bug fixes is available in the Technical Notes document:
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux_Open Stack_Platform/5/html/Technical_Notes/index.html

Solution

Before applying this update, ensure all previously released errata
relevant to your system have been applied.

Red Hat Enterprise Linux OpenStack Platform 5 for RHEL 6 runs on Red Hat
Enterprise Linux 6.5.

The Red Hat Enterprise Linux OpenStack Platform 5 for RHEL 6 Release Notes
contain the following:

• An explanation of how the provided components interact to form a working cloud

computing environment.

• Technology Previews, Recommended Practices, and Known Issues.
• The channels required for Red Hat Enterprise Linux OpenStack Platform 5 for

RHEL 6, including which channels need to be enabled and disabled.

The Release Notes are available at:
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux_OpenStack_Platform/5/html/Release_Notes/index.html

This update is available through the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

Affected Products

• Red Hat OpenStack 5.0 for RHEL 6 x86_64

Fixes

• BZ - 1042945 - [RFE][neutron]: Data Migration for Depricated Quantum Plugins-and-Drivers
• BZ - 1094506 - Instances will not boot after upgrade because of missing required config for neutron/nova notifications
• BZ - 1098596 - neutron-vpn-agent does not use the /etc/neutron/fwaas_driver.ini
• BZ - 1101261 - Multiple RPC workers and Neutron nova notifications don't play nice
• BZ - 1101315 - openstack-neutron should require a version of iproute that includes netns.
• BZ - 1108562 - Booting a VM overloads Neutron service; DHCP agent sends unneeded RPC request per port
• BZ - 1113953 - neutron-openvswitch-agent exits with 1 on SIGTERM
• BZ - 1115408 - Neutron packaging attempts to update sudoers config file avoiding usual procedure
• BZ - 1117818 - DB locking errors when deleting multiple instances that have floating IPs associated to them.
• BZ - 1118484 - Rebase openstack-neutron to 2014.1.1

CVEs

(none)

References

• http://www.redhat.com/security/updates/classification/#none