Red Hat Enterprise Linux OpenStack Platform 6 Technical Notes
Red Hat Enterprise Linux OpenStack Platform 6 Technical Notes Technical Notes for Red Hat Enterprise Linux OpenStack Platform and supporting packages. OpenStack Documentation Team Red Hat Enterprise Linux OpenStack Platform 6 Technical Notes Technical Notes for Red Hat Enterprise Linux OpenStack Platform and supporting packages. OpenStack Documentation Team Red Hat Customer Content Services [email protected] Legal No tice Copyright © 2015 Red Hat, Inc. This document is licensed by Red Hat under the Creative Commons AttributionShareAlike 3.0 Unported License. If you distribute this document, or a modified version of it, you must provide attribution to Red Hat, Inc. and provide a link to the original. If the document is modified, all Red Hat trademarks must be removed. Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law. Red Hat, Red Hat Enterprise Linux, the Shadowman logo, JBoss, MetaMatrix, Fedora, the Infinity Logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other countries. Linux ® is the registered trademark of Linus Torvalds in the United States and other countries. Java ® is a registered trademark of Oracle and/or its affiliates. XFS ® is a trademark of Silicon Graphics International Corp. or its subsidiaries in the United States and/or other countries. MySQL ® is a registered trademark of MySQL AB in the United States, the European Union and other countries. Node.js ® is an official trademark of Joyent. Red Hat Software Collections is not formally related to or endorsed by the official Joyent Node.js open source or commercial project. The OpenStack ® Word Mark and OpenStack Logo are either registered trademarks/service marks or trademarks/service marks of the OpenStack Foundation, in the United States and other countries and are used with the OpenStack Foundation's permission. We are not affiliated with, endorsed or sponsored by the OpenStack Foundation, or the OpenStack community. All other trademarks are the property of their respective owners. Abstract These Technical Notes are provided to supplement the information contained in the text of Red Hat Enterprise Linux OpenStack Platform errata advisories released through Red Hat Network. T able o f Co nt e nt s T able o f Co ntents . .hapt C . . . .e.r. 1. . .O . .ve . .r.vie . .w . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2. . . . . . . . . . .hapt C . . . .e.r. 2. . . RHEA-20 . . . . . . . .15:0 . . . 14 ..8 . .— . .o. pe . . ns . . .t ac . . k-ne . . . . ut . . r. o .n . .e. nhanc . . . . . .e.me . . nt . . .advis ....o . .r y . . . . . . . . .4. . . . . . . . . 2.1. openstack-neutron 4 . .hapt C . . . .e.r. 3. . . RHEA-20 . . . . . . . .15:0 . . . 152 . . . .—. .o.pe . . ns . . t. ac . . k-no . . . . va . . .e.nhanc . . . . . e. me . . .nt . . advis . . . . .o. r.y. . . . . . . . . . . .8. . . . . . . . . 3 .1. openstack-nova 8 . .hapt C . . . .e.r. 4. .. RHEA-20 . . . . . . . .15:0 . . . 154 . . . .— . .pyt . . .ho . . n-django . . . . . . . . -ho . . . r. iz . .o.n. e . .nhanc . . . . .e. me . . .nt . . advis . . . . .o.r.y. . . .12 .......... 4 .1. python-django-horizon 12 . .hapt C . . . .e.r. 5. . . RHBA-20 . . . . . . . .15:0 . . . 157 . . . .— . .Re . .d . .Hat . . . Ent . . .e . r. pr . . is . .e. Linux . . . . . .O.pe . . ns . . t. ac . .k . .6..0 . .bug . . . .f.ix .............. advis o r y 19 5.1. ceph 19 5.2. openstack-cinder 19 5.3. openstack-nova 19 5.4. openstack-puppet-m odules 20 5.5. openstack-selinux 20 . .hapt C . . . .e.r. 6. .. RHBA-20 . . . . . . . .15:0 . . . .6.33 . .— . . pyt . . . ho . . n-django . . . . . . . . -ho . . . r. iz . .o.n. .bug . . . f. ix . . advis . . . . .o.r.y. . . . . . . . . .22 .......... 6 .1. python-django-horizon 22 6 .2. python-django-openstack-auth 23 . .hapt C . . . .e.r. 7. . . RHBA-20 . . . . . . . .15:0 ...6 . .39 . .— . . o. pe . . .ns . .t.ac . .k-ke . . . ys . . t. o . ne . . . bug . . . .f.ix . .advis ....o . .r y . . . . . . . . . . . . .24 .......... 7.1. openstack-keystone 24 . .hapt C . . . .e.r. 8. .. RHBA-20 . . . . . . . .15:0 . . . .6.4.0. — . . Re . . .d. Hat . . . .Ent . . .e.r.pr . .is .e . .Linux . . . . .O . .pe . .nSt . . .ac . .k. Plat . . . .f.o.r.m . .Bug ............. Fix and Enhanc e me nt Advis o r y 25 8 .1. diskim age-builder 25 8 .2. instack-undercloud 8 .3. libguestfs 25 25 8 .4. m ariadb-galera 8 .5. openstack-selinux 26 26 . .hapt C . . . .e.r. 9. .. RHSA-20 . . . . . . . .15:0 . . . .78 . .9. — . . Impo . . . . .r t. ant . . . :. o . pe . . .ns . .t.ac . .k-pac . . . . .ks . .t ac ..k . .and . . . .o.pe . .ns . . t.ac . .k............. puppe t -mo dule s s e c ur it y and bug f ix updat e 27 9 .1. openstack-packstack 9 .2. openstack-selinux 27 28 9 .3. vulnerability 29 . .hapt C . . . .e.r. 10 . . .. RHSA-20 . . . . . . . .15:0 . . . .79 . .0. — . . Impo . . . . .r t. ant . . . :. o . pe . . .ns . .t.ac . .k-no . . . .va . . s. e. c. ur . . it . .y, . .bug . . . .f ix, . . .and ............. e nhanc e me nt updat e 30 1 0.1. openstack-nova 30 1 0.2. vulnerability 32 . . .vis Re . . io . .n. .His . . t. o . r. y . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .33 .......... 1 Re d Hat Ent e r pr is e Linux O pe nSt ac k Plat f o r m 6 T e c hnic al No t e s Chapt er 1. Overview The s e Te chnical Note s are provide d to s upple me nt the information containe d in the te xt of Re d Hat Ente rpris e Linux Ope nStack Platform e rrata advis orie s re le as e d through Re d Hat Ne twork. If the te xt for an advis ory's proble m de s cription is too le ngthy to fit into the advis ory its e lf, bug lis tings for that advis ory are publis he d as a chapte r in this docume nt. The following table contains the lis t of e rrata advis orie s for this ve rs ion. T able 1.1. Errat a Adviso ries Relea se Adviso ries 6.0 Errata chapte rs : Chapte r 2, Chapte r 3, Chapte r 4, Chapte r 5, advisory RHEA-2015:0148 — openstack-neutron enhancement advisory RHEA-2015:0152 — openstack-nova enhancement advisory RHEA-2015:0154 — python-django-horizon enhancement advisory RHBA-2015:0157 — Red Hat Enterprise Linux Openstack 6.0 bug fix Additional advis orie s include : RHEA-2015:0144 - Re d Hat Ente rpris e Linux Ope nStack Platform 6.0 Enhance me nt Advis ory. RHEA-2015:0145 - ope ns tack-s wift e nhance me nt advis ory. RHEA-2015-0146 - ope ns tack-s ahara e nhance me nt update . RHEA-2015-0147 - ope ns tack-he at e nhance me nt advis ory. RHEA-2015:0149 - ope ns tack-ce ilome te r e nhance me nt advis ory. RHEA-2015:0150 - ope ns tack-glance e nhance me nt advis ory. RHEA-2015:0151 - ope ns tack-cinde r e nhance me nt advis ory. RHEA-2015:0153 - ope ns tack-ke ys tone e nhance me nt advis ory. RHEA-2015:0155 - ope ns tack-packs tack and ope ns tack-puppe t-module s e nhance me nt advis ory. 2 C hapt e r 1. O ve r vie w Relea se Adviso ries 6.0.1 Errata chapte rs : Chapte r 6, RHBA-2015:0633 — python-django-horizon bug fix advisory Chapte r 7, RHBA-2015:0639 — openstack-keystone bug fix advisory Chapte r 8, RHBA-2015:0640 — Red Hat Enterprise Linux OpenStack Platform Bug Fix and Enhancement Advisory Additional advis orie s include : RHBA-2015:0630 RHBA-2015:0631 RHBA-2015:0632 RHBA-2015:0634 RHBA-2015:0635 RHBA-2015:0636 RHBA-2015:0637 RHBA-2015:0638 RHSA-2015:0643 RHSA-2015:0644 RHSA-2015:0645 - ope ns tack-packs tack bug fix advis ory - ope ns tack-s wift bug fix advis ory - ope ns tack-s ahara bug fix advis ory - ope ns tack-he at bug fix advis ory - ope ns tack-ne utron bug fix advis ory - ope ns tack-ce ilome te r bug fix advis ory - ope ns tack-cinde r bug fix advis ory - ope ns tack-nova bug fix advis ory - Important: qe mu-kvm-rhe v s e curity update - Low: ope ns tack-glance s e curity and bug fix update - Important: re dhat-acce s s -plugin-ope ns tack s e curity update The s e package s include re bas e s to 2014.2.2 for the Block Storage , Compute , Das hboard, Ide ntity, Image , Ne tworking, Orche s tration, Sahara, Te le me try, and Trove s e rvice s . 6.0.2 Errata chapte rs : Chapte r 9, RHSA-2015:0789 — Important: openstack-packstack and openstackpuppet-modules security and bug fix update Chapte r 10, RHSA-2015:0790 — Important: openstack-nova security, bug fix, and enhancement update Additional advis orie s include : RHBA-2015:0784 - ope ns tack-cinde r bug fix advis ory RHBA-2015:0785 - ope ns tack-ne utron bug fix advis ory RHBA-2015:0786 - ope ns tack-ce ilome te r bug fix advis ory RHBA-2015:0787 - Re d Hat Ente rpris e Linux Ope nStack Platform Bug Fix and Enhance me nt Advis ory RHSA-2015:0788 - Mode rate : novnc s e curity update 3 Re d Hat Ent e r pr is e Linux O pe nSt ac k Plat f o r m 6 T e c hnic al No t e s Chapt er 2. RHEA-2015:0148 — openst ack-neut ron enhancement advisory The bugs containe d in this chapte r are addre s s e d by advis ory RHEA-2015:0148. Furthe r information about this advis ory is available at https ://rhn.re dhat.com/e rrata/RHEA-20150148.html. 2.1. openst ack-neut ron BZ#10 29871 This enhancement enables changes to a subnet's IP address allocation pool using the update command. Previously, administrators were unable to change the allocation pool range for a subnet. If shrinking the pool, consideration must be given to IP addresses that have already been allocated. BZ#10 42396 This enhancement adds high availability for OpenStack Networking (neutron) virtual routers. This was added due to the impact of virtual routers going down with a network node; instances would lose external connectivity. Virtual routers can now be created with the 'High availability' flag, if the administrator sets it as the default. As a result, routers will then be created on multiple network nodes, with a designated single active instance node. The active node forwards traffic while the standbys monitor the master. In the event of failure impacting the active node, one of the standby will take over as the new active node. BZ#10 42550 This update enables OpenStack Networking (neutron) to create a Provider Network that uses an upstream device with Router Advertisement multicasts. As a result, instances are able to use Stateless Address Autoconfiguration (SLAAC) to configure their IPv6 networking. BZ#10 44272 With this enhancement, Tenant networks can now be created that use the 'dnsmasq' process inside the DHCP agent to serve additional configuration to IPv6 DHCP clients, including support for IPv6 stateless subnets. BZ#10 46786 This enhancement allows the creation of Tenant networks that use the 'radvd' process within the L3 agent for Router Advertisement messages. 4 C hapt e r 2. RHEA-20 15:0 14 8 — o pe ns t ac k-ne ut r o n e nhanc e me nt advis o r y As a result, instances are able to use Stateless Address Autoconfiguration (SLAAC) or DHCPv6 to configure their IPv6 networking. BZ#10 85645 This enhancement enables ipset kernel groups to be used for matching IP addresses in iptables security groups. The previous implementation of security groups, which made intensive use of iptable rules, resulted in an exponential growth of iptable rules in some cases. Specifically, multiple IP addresses previously needed to be added to the security groups of each Compute node's network port. As a result of this enhancement, the size of iptables rules on Compute nodes are significantly reduced, resulting in a performance increase in accepting new connections. BZ#110 340 4 With this enhancement, all tables are now included during the creation of the database schema. This behavior allows for easier plugin management. Consequently, all OpenStack Networking (neutron) tables are present in the database after upgrading to Red Hat Enterprise Linux OpenStack Platform 6. BZ#1162698 Prior to this update, the DHCP server was not available from inside instances attached to IPv6 DHCP subnets. This update addresses this issue by creating a port in the DHCP agent namespace. As a result, the DHCP server is accessible from inside instances, and instances are able to receive DHCP information. BZ#1169125 Previously, Router Advertisements sent by the OpenStack Networking (neutron) L3 agent had the 'Other (O)' flag unset for DHCP stateless subnets. Consequently, the DHCP client was not aware of additional configuration options available from the DHCP server, so would not attempt to request these. This update addresses this issue by setting the 'Other (O)' flag for Router Advertisements sent to DHCP stateless subnets. As a result, the DHCP client is notified about additional DHCP configuration options, and is able to request allocation. BZ#1173987 In deployments using IPv6 networks with OpenStack Networking, IPv6 subnets do not have a gateway set. As a result, IPv6 networks do not work as expected. 5 Re d Hat Ent e r pr is e Linux O pe nSt ac k Plat f o r m 6 T e c hnic al No t e s BZ#1177612 Prior to this update, Keepalived removed virtual routes if the VIPs changed order and the VIP that was previously first changed its position. Consequently, as the router's default gateway is configured as a virtual route, the router's default route may vanish, breaking external connectivity for all instances. This behaviour was due to Keepalived's requirement that the first VIP in the keepalived configuration file remains first after sending a HUP signal to keepalived. This update addresses this issue by generating a fake address and using it as the first VIP. Consequently, the first VIP is a stable constant value and remains fixed in place, and the router's default route no longer vanishes as a result. BZ#1177615 Prior to this update, all instances of a HA router (master and slave) had IPv6 link local addresses configured on each interface. As a result, IPv6 traffic was being generated once every two minutes and each MAC address was identical between different instances of a HA router. Consequently, the interface's MAC address was re-learned by the physical switches of the datacenter, thereby resultin in traffic being sent to the incorrect node. This update resolves this issue be removing IPv6 link local addresses from slave instances of HA routers. As a result, the IPv6 addresses only appear on the master instance, thereby ensuring that slaves never generate traffic, and that the MAC addresses appear only on the master node. BZ#1177616 Prior to this update, when configuring a new floating IP on a HA router, the L3 agent observed the state on the system in order to decide if to write the new address to the keepalived.conf. If the address was not configured on the external device of the router, it was added to the configuration. Note that the agent never appends to the keepalived conf but overwrites it on every reconfiguration, this means that when restarting an agent and and waiting for it to sync with the controller, there are varying outcomes depending on the role of the instance: * On a master instance, none of the floating IPs will be written to the keepalived configuration file, as all of the pre-existing floating IPs are already configured on the system and thus will not be written to the new configuration file, in effect removing them. As a result, master instances will delete previously configured floating IPs whenever the L3 agent is restarted. * On a slave instance, floating IPs are never configured on the host, thus are always added to the configuration file. As a result, slave instances will have multiple copies of every floating IP in keepalived's configuration file. This has no actual effect. 6 C hapt e r 2. RHEA-20 15:0 14 8 — o pe ns t ac k-ne ut r o n e nhanc e me nt advis o r y This update addresses this issue by configuring the L3 agent to instead uses its in-memory cache of the keepalived configuration, rather than state observation. Since the configuration is inmemory, after the agent restarts, it's cache is empty, thus all floating IPs are added to the file. From that point on, a floating IP is configured if it's not present in the configuration. Consequently, floating IP addresses are configured properly on HA routers on both master and slave instances. BZ#1177995 This enhancement allows SR-IOV virtual functions (VF) to passthrough to 'flat' project network types. This is due to PCI passthrough with SR-IOV not being VLAN-specific. As a result, OpenStack Networking project networks with the "flat" network type can now take advantage of SR-IOV networking support. 7 Re d Hat Ent e r pr is e Linux O pe nSt ac k Plat f o r m 6 T e c hnic al No t e s Chapt er 3. RHEA-2015:0152 — openst ack-nova enhancement advisory The bugs containe d in this chapte r are addre s s e d by advis ory RHEA-2015:0152. Furthe r information about this advis ory is available at https ://rhn.re dhat.com/e rrata/RHEA-20150152.html. 3.1. openst ack-nova BZ#9580 57 When Compute is configured to only set up VNC/SPICE servers on a specific network interface, the host's IP address is recorded in the libvirt guest XML. Previously, if the guest was migrated to a different host, the IP address of the source host remained in the guest XML and the guest failed to launch on the target host because the IP address was incorrect. With this update, the libvirt guest XML is now updated during migration to refer to the IP address of the target host. Migration can be performed for guests, even when the VNC/SPICE servers are configured to only bind to the IP address of a specific network interface. BZ#974199 This feature exposes interactive web-based serial consoles to openstack VMs through a websocket proxy. Generally used as a debugging tool (for example, VMs can be accessed even if network configuration fails). A new service (websocket proxy) is now available that handles websocket connections to the serial consoles of the VMs. The websocket proxy can be deployed on a machine other than from the hypervisor. BZ#97850 0 The host argument for the 'nova evacuate' command has been made optional. This means that the user no longer has to know the host destination, simplifying evacuation in the case of an unplanned failure. BZ#10 410 54 Compute now automatically attempts a controlled shutdown for stop, rescue, and delete instance actions. If the controlled shutdown fails, Compute falls back to a forced shutdown. BZ#10 41376 OpenStack Compute now supports associating SR-IOV PCI devices 8 C hapt e r 3. RHEA-20 15:0 152 — o pe ns t ac k-no va e nhanc e me nt advis o r y with networks and binding Neutron SR-IOV ports to them. PCIPassthrough to SR-IOV virtual functions provide direct access to networking hardware specialized for virtualization with one physical device supporting multiple virtual machines. By supporting SR-IOV devices, virtual machines can now employ SR-IOV hardware for networking. BZ#10 90 269 OpenStack Compute can now optionally provide a config drive to instances based on a property on the image in the OpenStack Image service. Previously, Compute configuration determined whether a config drive was used and what format to use for it. With this update, users can now indicate config drive requirements using image properties. BZ#10 97514 In previous releases, every virtual CPU was configured as a socket. Some guest operating systems have arbitrary limits on the number of sockets they support, but are not limited in the number of cores or threads. This prevented an instance's OS from taking full advantage of the virtual CPUs configured. With this release, the Compute service can now control an instance's virtual CPU topology. This allows an administrator and/or tenant users to specify constraints for the number of threads, cores and sockets to use for a guest instance. The Compute service will use the constraint information to configure a suitable guest CPU topology. With this, a guest OS such as Windows can take full advantage of all virtual CPUs without encountering support limits. BZ#10 97987 Compute can now provide dedicated CPU resources, where each guest virtual CPU has full access to a specific host CPU. Previous releases of Compute guest CPUswere permitted to float across any host CPU. Even when the NUMA feature was enabled, the CPUs could still float within a NUMA node. Host CPUs would also overcommit so many virtual CPUs contended for the host resource. This made it impossible to provide strong performance guarantees to guest operating system workloads. With this update, the cloud administrator now has the ability to set up a host aggregate, which provides a pool of hosts that supports guests with dedicated CPU resource assignment. The cloud administrator or tenant user can make use of these pools to run instances with guaranteed CPU resource. BZ#10 97989 Previous Compute versions delegated all CPU placement to the operating system kernel. Although the kernel attempted to keep guest processes running on a single NUMA node, this was not enforced. This meant that guests could drift across NUMA nodes, 9 Re d Hat Ent e r pr is e Linux O pe nSt ac k Plat f o r m 6 T e c hnic al No t e s resulting in an inefficient usage of host resources and limiting guest performance. With this update, Compute can now place guest instances on specific host NUMA nodes. The cloud administrator or tenant user can set preferences for the guest NUMA topology layout by enabling a scheduler filter that performs intelligent NUMA placement (affinity server group using hw:numa_policy=strict metadata). Compute takes into account the guest topology and then pins the guest instance to one or more host NUMA nodes, resulting in a more consistent guest performance and efficient use of host resources. BZ#110 4924 A single guest can now have multiple network interfaces attached to the same logical host network. Previous versions of OpenStack Compute had an artificial restriction that a single guest cannot have multiple network interfaces connected to the same host network. There are, however, some valid use cases where this is required and thus Compute could not satisfy those use cases. With this update, the tenant user can now set up guest network interfaces without any restrictions imposed by Compute. BZ#112740 5 When using nova-network with multiple networks, it is now possible to set the MTU, enable or disable DHCP, set the DHCP server, and indicate whether the network shares addresses with other networks. Previously, it was not possible to set these parameters on a per-network basis, making it more difficult to use nova-network with multiple networks. With this update, administrators now have more flexibility with settings when using multiple networks with nova-network. BZ#1157742 Previously, if you created a server group with an anti-affinity policy, the policy was honored only during the initial boot, and not for a later VM migration (cold, live, or evacuate). Because the request information is not persisted, migrations did not honor anti-affinity policies, which could lead to inconsistencies (for example, a non-affinity policy for a group with VM1 and VM2 could lead to both VMs being placed on the same host if VM2 was migrated). With this update, migrations now respect affinity policies. The server group and group policy of the VM to be migrated is now identified and checked before migration. BZ#1160 40 5 RBD snapshots and cloning are now used for Ceph-based ephemeral disk snapshots. With this update, data is manipulated within the Ceph server, rather than transferred across nodes, resulting in 10 C hapt e r 3. RHEA-20 15:0 152 — o pe ns t ac k-no va e nhanc e me nt advis o r y better snapshotting performance for Ceph. BZ#1180 60 7 RBD snapshots and cloning are now used for Ceph-based ephemeral disk snapshots. With this update, data is manipulated within the Ceph server, rather than transferred across nodes, resulting in better snapshotting performance for Ceph. 11 Re d Hat Ent e r pr is e Linux O pe nSt ac k Plat f o r m 6 T e c hnic al No t e s Chapt er 4. RHEA-2015:0154 — pyt hon-django-horizon enhancement advisory The bugs containe d in this chapte r are addre s s e d by advis ory RHEA-2015:0154. Furthe r information about this advis ory is available at https ://rhn.re dhat.com/e rrata/RHEA-20150154.html. 4.1. pyt hon-django-horizon BZ#8910 62 An admin user can now specify the Provider network type (the physical mechanism by which the virtual network is implemented), when creating a new network. Previously, the dashboard (horizon) defaulted to the 'Local' provider network type, and it was not possible to select another type. The types 'Flat', 'VLAN', 'GRE', and 'VXLAN', and 'Local' can now be selected in the new 'Provider Network Type' drop-down field. Depending on the type, a segmentation ID, tunnel ID, or physical network name must be additionally specified. BZ#10 41966 Role-based access control (RBAC) checks are now supported for actions that interact with the Compute service (nova); rules are defined in the /etc/openstack-dashboard/nova_policy.json configuration file. RBAC checks allow an administrator to finely tune a user's access. For example, an administrator might allow end users to view the complete flavor listing. BZ#10 41967 Role-based access control (RBAC) checks are now supported for actions calling the network service; rules are defined in the /etc/openstack-dashboard/neutron_policy.json configuration file. RBAC checks allow an administrator to finely tune a user's access. For example, an administrator might prevent end users from creating a subnet or changing a firewall policy. BZ#10 41971 An admin user can now evacuate a compute host using the dashboard. Two tabs now provide information for hypervisors: 'Hypervisor' and 'Compute Host' (Admin > Hypervisors). If a host is down, an 'Evacuate Host' action is now visible for it on the Compute Host tab (providing a modal window to perform the evacuation). BZ#10 41986 Support has been added for Block Storage volume backups in the dashboard. Users can now create, view, delete, and restore volume 12 C hapt e r 4 . RHEA-20 15:0 154 — pyt ho n-django -ho r iz o n e nhanc e me nt advis o r y backups. Note: This functionality is not displayed by default. To display volume-backup action items, update the /etc/openstackdashboard/local_settings file with: OPENSTACK_CINDER_FEATURES = { 'enable_backup': True, } After updating the file, restart the httpd service with 'systemctl restart httpd'. BZ#10 41991 There was a need to enable/disable Neutron related features based on the extension list from Neutron and remove Neutron related settings in local_settings.py. -Neutron features like LBaaS, FWaaS or VPNaaS are provided as extensions in Neutron. These features are now enabled only when they are included in the extension list from Neutron. Also, changed the default settings of enable_lb/firewall/vpn to True. The default of these settings were set to False to avoid confusion to users because LB/FW/VPNaaS are optional features in Neutron. With this change, the corresponding features in Horizon are enabled dynamically, so it was reasonable to change the default to True. BZ#10 420 23 An additional 'Action Log' tab is now available for specific instances (Project > Compute > Instances > <instance>. The tab lists all actions which have been carried out on that specific instance. For example, a tenant user can now use the 'Action Log' tab to see who created or shut down an instance. BZ#10 420 28 With this feature, there is now a widget for managing Glance metadata dictionary. The admin user is now able to edit properties of images directly under admin/images/edit. BZ#10 420 70 When using OpenStack Networking (neutron) with the dhcp_agent_scheduler extension, it is now possible to add and remove DHCP agents from networks using the dashboard. This makes it easier to manage the high availability of DHCP agents for OpenStack Networking. When logged in as admin and navigating to the Admin Networks panel, a new DHCP Agents column with the number of agents associated with each network is now visible. Clicking on a network name displays the network's details together with a new 'DHCP Agents' table where the admin can add and delete agents. 13 Re d Hat Ent e r pr is e Linux O pe nSt ac k Plat f o r m 6 T e c hnic al No t e s BZ#10 42113 Need for an interface to allow the user to assign domain role to users. -The Identity Dashboard has been extended to support managing roles and users in different domains. BZ#10 46790 Extra Specs support for volume types has been added to the dashboard. An admin can now add additional keys and values to volume types (GUI implementation of the 'cinder type-key' command). To view extra specs, select Admin> Volumes > Volume Types, and click the type's 'View Extra Specs' action. BZ#10 530 88 OpenStack Networking (neutron) has introduced new attributes for IPv6 networks: 'Router Advertisement' and 'Address Assignment', which enables IPv6 subnets to be configured with more granularity. If OpenStack Networking is in use and an IPv6 subnet is being created, the dashboard now offers the following options in the 'IPv6 Address Configuration Mode' drop-down field: "SLAAC", "DHCPv6 stateful", "DHCPv6 stateless provided by OpenStack." Providing no option means that addresses are configured manually or by a non-OpenStack system. BZ#10 56389 The ability for an administrator to manage image metadata (custom properties) has been added to the dashboard. The admin user can now add, update, or delete image metadata (implements the 'glance image-update <imageID> --property <key>=<value>' command). To view or update an image's metadata, select Admin > System > Images, and click the image's 'Update Metadata' action. BZ#10 57828 Role-based access control (RBAC) checks are now supported for actions that interact with the Orchestration service (heat); rules are defined in the /etc/openstackdashboard/heat_policy.json configuration file. RBAC checks allow an administrator to finely tune a user's access. For example, an administrator might prevent end users from changing a stack template. BZ#10 58578 Add support for Datastores to Trove dashboard. Basic support for Trove has been added to Horizon. 14 C hapt e r 4 . RHEA-20 15:0 154 — pyt ho n-django -ho r iz o n e nhanc e me nt advis o r y -Added Datastore type/version drop down in Launch Instance -Added Datastore type/version in Instance List and Instance Details BZ#10 59472 JavaScript libraries have been separated out from the dashboard (horizon) source code into separate, external packages. This improves the maintanbility of the source code. BZ#10 620 37 With this feature, there is now a separate Identity dashboard. BZ#10 7630 7 The user can now sort tables by timestamp in the dashboard (a timestamp parser has been added). For example, in the Project > Compute > Overview window, the user can now sort instances by 'Time since created'. BZ#10 7630 9 Table filtering has been updated in the dashboard to use API query attributes. A drop-down box and an input field for filtering have been added to tables for admin instances, admin images, and project instances. For example, the admin instances table might be filtered for 'Status=Active'. BZ#10 80 743 Code for the Sahara dashboard has been merged into the dashboard (horizon) code. If Sahara is correctly installed (openstacksahara) and configured, no further dashboard configuration is necessary to display the 'Data Processing' tab for each region (Project > Data Processing). BZ#10 950 55 A 'Metadata' column has been added to the Flavors table (Admin > System > Flavors) that displays whether extra specs have been specified for a flavor ('Yes' or 'No'). The user can now click on either the column value or the 'Update Metadata' action to view or update defined metadata. BZ#10 97517 Need for a feature to enable resetting the state of a volume exposed in the administrator dashboard. This functionality is currently available only through the CLI command: # cinder reset-state --state available <volume-id> 15 Re d Hat Ent e r pr is e Linux O pe nSt ac k Plat f o r m 6 T e c hnic al No t e s -Exposed the functionality of the 'cinder reset-state' command in the UI. As is the case with the 'cinder reset-state' command, this change permits an operator to select any valid status, regardless of the current status of the volume. BZ#10 97997 With this feature, administrators can now reset the state of a snapshot. BZ#110 1371 With this feature, basic support for Trove was added to Horizon. Management of incremental backups is now supported. BZ#110 3560 You can now perform a 'cinder retype' through the dashboard. This allows you to migrate volumes or to change any volumes setting (that are set from the volume's type) through the web interface. BZ#110 7491 Functionality for Cinder Quality of Service (QoS) extra specs management such as maximum IO/seconds (maxIOPS) is now available in the administrator dashboard. Currently qos specs must be managed via the cinder CLI commands: - cinder-qos-create - cinder-qos-delete - cinder-qos-key - cinder-qos-list - cinder-qos-show And their associations to volume types are handled with the cinder CLI commands: - cinder-qos-associate - cinder-qos-get-association - cinder-qos-disassociate - cinder-qos-disassociate-all BZ#110 7925 Cinder CLI has a upload-to-image function that supports uploading a volume into glance as an image - this functionality needs to be made available in Horizon. -It is now possible to use a glance image as source to create a cinder volume in Horizon. BZ#110 8436 16 C hapt e r 4 . RHEA-20 15:0 154 — pyt ho n-django -ho r iz o n e nhanc e me nt advis o r y This enhancement adds MAC address learning management to the Dashboard (horizon). Users are able to view and toggle the MAC address learning state of a port, in environments where this feature is supported. BZ#110 940 9 The description for the 'Create Volume Type' dialogue has been enhanced to make it clear that creating a type is equivalent to the 'cinder type-create' command. After the volume type is created, the user can then further define the type by adding extra specs. BZ#110 9420 In Horizon, there’s a feature need to automatically populate the "Format" field in the Create Image modal after the user has filled out the Image Source/Image File fields. -Auto populate the image format field based on the file extension. BZ#1117613 Support for Neutron DVR (Distributed Virtual Router) has been implemented in Horizon. Neutron DVR includes new changes to neutron CLI specifically in areas of router-creation, router-scheduling, show commands etc., while adding in admin functionality for distributed virtual router (DVR) functionality to Horizon. BZ#1118943 Need to be able to disable console access when not accessible from outside a cloud-provider's infrastructure. -A config option added to /etc/openstack_dashboard/local_settings: CONSOLE_TYPE. Valid options are "AUTO", "VNC", "SPICE", "RDP" or None. When it's set to None, console access is disabled. BZ#1124133 Add support for Spark jobs in Sahara data processing UI. Support for Spark EDP jobs in the data processing dashboard has been added. The changes are: -Added Spark as a job type when creating jobs -Added some help text for Spark job creation -Hide appropriate configuration fields when launching a Spark job -Made job type drop down translatable 17 Re d Hat Ent e r pr is e Linux O pe nSt ac k Plat f o r m 6 T e c hnic al No t e s BZ#11250 93 There was a need to add the ability for admins to create/update/delete custom properties and metadata for Images. This is useful for admins and users to meaningfully describe images by sharing key-value pairs and tag metadata. A new "Update metadata" option is now visible in the Admin Images panel that enables you to custom properties and metadada for Images. BZ#1128398 Need for a feature wherein operators can disable L3 Router features by configuration options. -New config The default deployments this option option 'enable_router' to OPENSTACK_NEUTRON_NETWORK. is True as router feature is enabled in most and it is the current default behavior of Horizon. If is False, Router panel disappears. -Network Topology panel shows routers in the topology map and also has "Create Router" button. If "enable_router" is set to False, routers in the topology map are not displayed, and "Create Router" button is not shown. -'enable_floatingip' option to OPENSTACK_NEUTRON_NETWORK. Similar to the floating IP feature in Neutron provided by L3 router extension. If this option is set to False, "Floating IP" tab and "Associate/Disassociate Floating IP" menu in the instance table are not shown. BZ#1141366 In previous versions, the dashboard displayed a column with the header titled "Instance uptime", which implied that it listed the uptime of an instance (Project > Compute > Overview or Admin > System Instances). This title was not correct because Compute (nova) simply returns a timestamp for when an instance is created. The column header has been named to "Time since created". BZ#1170 348 Rebase python-django-horizon to 2014.2.1. Highlights, important fixes, or notable enhancements: - Overview page: OverflowError when cinder limits are negative - Cinder API v2 support instance view - Alternate navigation broken - Default `target={}` value leaks into subsequent `policy.check()` calls 18 C hapt e r 5. RHBA-20 15:0 157 — Re d Hat Ent e r pr is e Linux O pe ns t ac k 6 .0 bug f ix advis o r y Chapt er 5. RHBA-2015:0157 — Red Hat Ent erprise Linux Openst ack 6.0 bug fix advisory The bugs containe d in this chapte r are addre s s e d by advis ory RHBA-2015:0157. Furthe r information about this advis ory is available at https ://rhn.re dhat.com/e rrata/RHBA-20150157.html. 5.1. ceph BZ#1181770 Previously, certain cleanup activities in librbd1 resulted in 'nova-compute' crashing with a segmentation fault, in specific cases where a Ceph RBD backend was in use. This fix ensures the context is correctly cleaned up before returning. As a result, 'nova-compute' operates correctly with Ceph RBD backends. 5.2. openst ack-cinder BZ#1184455 At present, an unversioned requirement to 'python-taskflow', and missing requirements to 'libcgroup-tools', 'pythonkeystonemiddleware', and 'openstack-cinder' means that upgrade activities may not function as expected. As a current workaround, you can install both 'openstack-cinder' and its missing requirements by using the following command: 'yum install -y libcgroup-tools python-keystonemiddleware pythontaskflow openstack-cinder' 5.3. openst ack-nova BZ#117110 8 Previously, using an unlimited quota value (-1) resulted in the inability to start an instance, with a subsequent "HTTP 500 IndexError: list index out of range" error being raised. This fix enables the ability to set an unlimited quota value in 'nova.conf', with the result that instances can now be started using this configuration. BZ#1177298 Previously, using a multibyte character in a flavor name would result in a Python unicode exception. This update addresses this issue by adding a unicode type string test to ensure expected behavior from multibyte character names. BZ#1181571 19 Re d Hat Ent e r pr is e Linux O pe nSt ac k Plat f o r m 6 T e c hnic al No t e s Previously, when reverting an instance resize operation, Compute (nova) would fail to consider the backing volume as shared between the original and new instance. Consequently, the resized volume would be deleted during the operation; since RBD volumes are shared, this meant the original volume was also removed, preventing the instance from booting. With this fix, when the instance volume is of type RBD, Compute now considers it to be shared and does not delete the volume during revert/resize operations. As a result, revert/resize operations succeed as expected. BZ#1181673 Prior to this update, a number of unit tests were broken as a result of backport activity. Consequently, not all unit tests were able to complete without errors. This update addresses this issue by using an object flavor instead of a dict in 'test_driver.py'. As a result, all unit tests now pass as expected. 5.4. openst ack-puppet -modules BZ#1158942 There is currently no supported user-facing (dashboard or CLI ) mechanism for consuming the websocket URL exposed by the serial console support. A utility is available to test this feature at https://github.com/larsks/novaconsole, however there should not be an expectation that the virtual serial console will function by default, as configuration steps are required. BZ#118130 7 The python-pbr package required by Red Hat Enterprise Linux OpenStack Platform puppet modules is not present in Red Hat Enterprise Linux OpenStack Platform 6. Installation using PackStack will fail if Ironic (a Technology Preview package) is enabled. Manual installation is required for Ironic at the moment. 5.5. openst ack-selinux BZ#1186628 Previously, versions of the SELinux policies prior to 'selinuxpolicy-3.12.1-153.el7_0.13' were missing specific policies for the Image Service (glance) API service. As a result, attempting to install multi-node clouds with SELinux in 'enforcing' mode would result in failure during installation and configuration of the Image Service API service. 20 C hapt e r 5. RHBA-20 15:0 157 — Re d Hat Ent e r pr is e Linux O pe ns t ac k 6 .0 bug f ix advis o r y This update addresses this issue with the openstack-selinux package now requiring 'selinux-policy-3.12.1-153.el7_0.13'. Consequently, the correct policies are in place to allow a complete installation with SELinux set to 'enforcing'. 21 Re d Hat Ent e r pr is e Linux O pe nSt ac k Plat f o r m 6 T e c hnic al No t e s Chapt er 6. RHBA-2015:0633 — pyt hon-django-horizon bug fix advisory The bugs containe d in this chapte r are addre s s e d by advis ory RHBA-2015:0633. Furthe r information about this advis ory is available at https ://rhn.re dhat.com/e rrata/RHBA-20150633.html. 6.1. pyt hon-django-horizon BZ#10 78956 In some cases, such as environments where the Identity service was backed by LDAP with specific policies, there were previous restrictions as to how end-users could change their password. This meant that end users were unable to change their password through the dashboard and would receive an error message when trying to do so. A policy check for "identity:check_password" has been added to the 'Change password' panel, so that when "identity:change_password" is set to a more restrictive policy in /etc/openstack-dashboard/keystone_policy.json, the 'Change password' panel is no longer displayed. This change has now resolved the issue. BZ#11270 70 In the Router Network Profiles panel (available only when using the Cisco N1K Neutron plug-in), many of the Network Profile fields could not be updated but they were still shown in the update form. Thereby, the update form was misleading, letting the user modify fields when the changes couldn't be saved. Code has been fixed to mark the fields that cannot be changed as "read-only" in the form. Thus, when updating a network, only the fields that can be updated are editable and the issue is now resolved. BZ#1188394 Rebase package(s) to version: 2014.2.2 Highlights and important bug fixes: -Project limits don't update when using the input selector to change instance count -While the HA property is update-able, and resulting router-get invocations suggest that the router is HA, the migration itself fails on the agent. This is deceiving and confusing and should be blocked until the migration itself is fixed in a future patch. -Project Limits don't refresh while selecting Flavor 22 C hapt e r 6 . RHBA-20 15:0 6 33 — pyt ho n-django -ho r iz o n bug f ix advis o r y -Private flavor update with horizon will cause access issue of existed instances -Horizon crashed when parsing volume list including a volume without name 6.2. pyt hon-django-openst ack-aut h BZ#1174748 One needed to log in twice after a keystone token timed out. Code has been updated and the issue is now fixed. 23 Re d Hat Ent e r pr is e Linux O pe nSt ac k Plat f o r m 6 T e c hnic al No t e s Chapt er 7. RHBA-2015:0639 — openst ack-keyst one bug fix advisory The bugs containe d in this chapte r are addre s s e d by advis ory RHBA-2015:0639. Furthe r information about this advis ory is available at https ://rhn.re dhat.com/e rrata/RHBA-20150639.html. 7.1. openst ack-keyst one BZ#1130 726 With this release, keystone now emits CADF notifications for role assignment events, providing a more complete audit trail. Role assignment operations affect a user's access to cloud resources; keeping an audit trail of these actions can be important to detect malicious actions. 24 0 15:0 6 4 0 — Re d Hat Ent e r pr is e Linux O pe nSt ac k Plat f o r m Bug Fix and Enhanc e me nt Advis o r y Chapt er 8. RHBA-2015:0640 — Red Hat Ent erprise Linux OpenSt ack Plat form Bug Fix and Enhancement Advisory The bugs containe d in this chapte r are addre s s e d by advis ory RHBA-2015:0640. Furthe r information about this advis ory is available at https ://rhn.re dhat.com/e rrata/RHBA-20150640.html. 8.1. diskimage-builder BZ#1182642 When an overcloud node boots up, it runs os-collect-config as a part of registration. The os-collect-config script saves data from the Orchestration (heat) metadata API locally and then calls os-refresh-config any time that metadata has changed. Subsequent calls to the registration script call subscriptionmanager again and it returns a non-zero exit code. With the return of a non-zero exit code, the script fails, the stack results in a timeout, and multiple registrations can occur. There is no current workaround. BZ#118310 4 Previous to the Satellite 6 release, the katello-agent and its dependencies needed the rhel-7-server-rh-common-beta-rpms repository to be enabled. Since the Satellite 6 release, necessary packages have been moved to the rhel-7-server-rhcommon-rpms repository. However, upstream code still references the rhel-7-server-rh-common-beta-rpms repository which no longer have the latest packages, causing Satellite instances to fail. 8.2. inst ack-undercloud BZ#11830 99 An iptables setting in the undercloud causes overcloud nodes to fail to register since the nodes have no external access. As a workaround, run the following command on the undercloud image: iptables -D FORWARD -j REJECT --reject-with icmp-host-prohibited 8.3. libguest fs BZ#11860 70 This enhancement includes a feature, virt-v2v, which allows users the ability to convert images from a variety of hypervisors to run on OpenStack cloud. 25 Re d Hat Ent e r pr is e Linux O pe nSt ac k Plat f o r m 6 T e c hnic al No t e s 8.4. mariadb-galera BZ#1179360 Previously, mariadb-galera would generate an SSL certificate with the parameter CN set to "$(hostname) mariadb-galera cluster". Creating this SSL certificate would fail if the hostname was long enough such that the resulting string was greater than 64 characters. With this update, the certificate is generated with only the hostname to avoid using a CN value that is too long. 8.5. openst ack-selinux BZ#1185444 This update introduces the rabbitmq-cluster resource agent for managing clustered RabbitMQ instances with the Pacemaker cluster manager. 26 mpo r t ant : o pe ns t ac k-pac ks t ac k and o pe ns t ac k-puppe t -mo dule s s e c ur it y and bug f ix updat e Chapt er 9. RHSA-2015:0789 — Import ant : openst ackpackst ack and openst ack-puppet -modules securit y and bug fix updat e The bugs containe d in this chapte r are addre s s e d by advis ory RHSA-2015:0789. Furthe r information about this advis ory is available at https ://rhn.re dhat.com/e rrata/RHSA-20150789.html. 9.1. openst ack-packst ack BZ#1117277 With this enhancement, if OpenStack Networking is enabled, Packstack will display a warning if the Network Manager service is active on hosts. BZ#1123117 With this update, a new feature has been added that enables to install OpenStack Identity service to run via Apache httpd processes. A new parameter 'CONFIG_KEYSTONE_SERVICE_NAME' has been added. Value 'httpd' will switch on Apache support while value 'keystone' allows Identity service run in it's own process as was implemented in the previous versions. BZ#1195258 When using Packstack in a multi-node configuration, VXLAN ports (4789) on the firewall were not open for the other nodes. As a result, openvswitch did not function properly. With this update, this issue has been addressed by opening the port 4789 on all compute and network nodes. BZ#11990 47 A typo in the code caused Sahara option that uses OpenStack Networking to be always false. With this update, the error has been addresses. As a result, Sahara now uses OpenStack Networking if the parameter 'CONFIG_NEUTRON_INSTALL is set to 'y'. BZ#11990 72 Packstack set Ironic password to value "PW_PLACEHOLDER" instead of real generated or user provided default password. This was fixed by ensuring packstack has USE_DEFAULT set to false at password option. Now packstack should configure ironic with the predefined password. 27 Re d Hat Ent e r pr is e Linux O pe nSt ac k Plat f o r m 6 T e c hnic al No t e s BZ#11990 76 An error in the Packstack code was responsible for setting the glance_image provider region value to RegionOne ignoring any region setting updated by the user. With this update, Packstack now allows the user to set a custom region name for the glance_image provider parameter. BZ#1199114 Prior to this update, users had to install the OpenStack Unified Client separately after completing an installation of Packstack. As the requirement for the OpenStack Unified Client is quite common, Packstack now installs it by default. BZ#1199562 This enhancement allows the passing of additional command-line options when creating an answer file. Previously, '--gen-answerfile' did not allow the specification of additional options. Instead, manual file editing was required to change any default options. With this update, it is now possible to combine '--gen-answerfile' with additional options, which are then included in the subsequently generated answer file. BZ#1199565 This enhancement updates Packstack to retain temporary directories when running an installation in debug mode. This assists with troubleshooting activities, as retaining the temporary directories allows easier failure debugging. As a result, temporary directories are not deleted when running Packstack with the --debug command line option. BZ#1199589 Prior to this update, some validators did not use 'validate_not_empty' to ensure that certain parameters contained values. As a result, a number of internal validations could not be properly handled, leading to the possibility of unexpected errors. This update fixes validators to use validate_not_empty when required, resulting in correct validation behavior from validators. 9.2. openst ack-selinux BZ#1195252 A quiet dependency on a newer version of selinux-policy causes 28 mpo r t ant : o pe ns t ac k-pac ks t ac k and o pe ns t ac k-puppe t -mo dule s s e c ur it y and bug f ix updat e openstack-selinux 0.6.23 to fail to install modules when paired with selinux-policy packages from Red Hat Enterprise Linux 7.0 or 7.0.z. This causes Identity and other OpenStack services to receive 'AVC' denials under some circumstances, causing them to malfunction. The following workarounds allow the OpenStack services to function correctly: 1) Leave openstack-selinux at 0.6.18-2.el7ost until you are ready to update to Red Hat Enterprise Linux 7.1. At that time, a 'yum update' will resolve the issue. 2) Install the updated selinux-policy and selinux-policy-targeted packages from Red Hat Enterprise Linux 7.1 (version selinuxpolicy-3.13.1-23.el7 or later), then update openstack-selinux to version 0.6.23-1.el7ost. 9.3. vulnerabilit y BZ#120 1875 It was discovered that the puppet manifests, as provided with the openstack-puppet-modules package, would configure the pcsd daemon with a known default password. If this password was not changed and an attacker was able to gain access to pcsd, they could potentially run shell commands as root. 29 Re d Hat Ent e r pr is e Linux O pe nSt ac k Plat f o r m 6 T e c hnic al No t e s Chapt er 10. RHSA-2015:0790 — Import ant : openst acknova securit y, bug fix, and enhancement updat e The bugs containe d in this chapte r are addre s s e d by advis ory RHSA-2015:0790. Furthe r information about this advis ory is available at https ://rhn.re dhat.com/e rrata/RHSA-20150790.html. 10.1. openst ack-nova BZ#10 17288 libvirt did not previously support snapshot merge or delete operations using libgfapi. This meant that the user could not delete snapshots of a Red Hat Storage (glusterfs) Block Storage volume attached to an instance when using libgfapi. With this update, libvirt and the Compute service now correctly handle Block Storage volume snapshots with libgfapi enabled, and these snapshots can now be deleted. BZ#110 0 535 OpenStack Bare Metal Provisioning (ironic) is now included in this release as a Technology Preview. This service provisions bare-metal machines using common technologies (such as PXE boot and IPMI) to cover a wide range of hardware, while supporting pluggable drivers to allow the addition of vendor-specific functionality. BZ#110 4926 Support has been added for intelligent NUMA node placement for guests that have been assigned a host PCI device. PCI I/O devices, such as Network Interface Cards (NICs), can be more closely associated with one processor than another. This is important because there are different memory performance and latency characteristics when accessing memory directly attached to one processor than when accessing memory directly attached to another processor in the same server. With this update, Openstack guest placement can be optimized by ensuring that a guest bound to a PCI device is scheduled to run on a NUMA node that is associated with the guest's pCPU and memory allocation. For example, if a guest's resource requirements fit in a single NUMA node, all guest resources will now be associated with the same NUMA node. BZ#1165961 An invalid template was previously supplied for network interface injection (flat_injected=true in /etc/nova/nova.conf), which meant that the network configuration of instance was incorrect. With this fix, a valid Jinja2 network interface configuration 30 0 . RHSA-20 15:0 79 0 — Impo r t ant : o pe ns t ac k-no va s e c ur it y, bug f ix, and e nhanc e me nt updat e template is now provided, and the networking of instances is correctly configured. BZ#1171454 Previously, you could not launch an instance with multiple interfaces attached to the same network by using --nic net-id= <id>; the instance would fail to boot. With this update, Compute now checks for duplicate networks at the Compute API layer, and an instance boot using a specific network ID with multiple vNICs can succeed. BZ#1175348 Previously, the Compute service did not follow live migration status. As a result, if something wrong happened, the instance status did not report the error and this could result in two "same" instances running in the cloud (across the source and target servers). With this update, a new object has been introduced to follow each step until a live migration succeeds or fails. This means that when a migration now fails, the error is reported on the instance's status if necessary, and a rollback is then done to avoid two "same" instances running in the cloud. BZ#1190 719 Previously, emulator threads (for vCPUs) floated on the union of the set of all NUMA CPUs, even if the CPUs were dedicated, which meant that an emulator thread could consume CPU time from another guest instance. With this fix, emulator threads now only use the union of dedicated host CPUs, and that CPU's time, on which guest vCPUs are running. BZ#1191174 Previously, if multipathing was enabled for the Compute service in /etc/nova/nova.conf and CHAP authentication was enabled in an IBM Storwize backend, attaching an Block Storage volume to an instance failed on boot ("Login I/O error, failed to receive a PDU\niscsiadm"). That is, if the Block Storage server was configured to protect the target-discovering phase using CHAP authentication, the discovery command failed (because authentication failed). With this update, the Block Storage driver now sends authentication properties (discovery_auth_method, discovery_auth_username, discovery_auth_password) to CHAP, the discovery command succeeds, and volume attachment succeeds. BZ#1193737 Previously, when the primary path to a Cinder iSCSI volume was down, a volume could not be attached to the instance, even if the Compute and Block Storage backend driver's multipath feature was 31 Re d Hat Ent e r pr is e Linux O pe nSt ac k Plat f o r m 6 T e c hnic al No t e s enabled. This meant that users of the cloud system could fail to attach a volume (or boot a server booted from a volume). With this fix, the host can now have a separate configuration option if the block traffic is on a separate network; the volume is then attached using the secondary path. BZ#11940 73 A previous overly restrictive ban on live migration of vfat config drives, and the incorrect handling of config drives with RBD storage, meant that the live migration of instances with config drives was not supported. With this update, vfat config drives can now be live migrated, and config drive persistence is handled appropriately with RBD storage. This means that live migration is now possible when using vfat config drives with storage either local to the compute node or remote with RBD storage. (To use vfat config drives, set config_drive_format in /etc/nova/nova.conf to 'vfat'.) BZ#1198429 The previous value of the Compute auth_version parameter in /usr/share/nova/nova-dist.conf of 'v2.0' forced Identity's auth_token middleware to use v2 authentication, which in turn prevented multi-domain Identity service deployments. With this update, the auth_version parameter now has a new default value of 'v3.0'; middleware authentication can now validate tokens outside of the default domain. 10.2. vulnerabilit y BZ#1190 112 It was discovered that the OpenStack Compute (nova) console websocket did not correctly verify the origin header. An attacker could use this flaw to conduct a cross-site websocket hijack attack. Note that only Compute setups with VNC or SPICE enabled were affected by this flaw. 32 Re vis io n His t o r y Revision Hist ory Revisio n 6.0 .2-0 T ue Apr 7 20 15 Summer Lo ng Update d ove rvie w to include 6.0.2 chapte rs and advis orie s ; two e rrata chapte rs adde d. Revisio n 6.0 .1-1 T hu Mar 5 20 15 Summer Lo ng Update d ove rvie w to include 6.0.1 chapte rs and advis orie s ; thre e e rrata chapte rs adde d. Revisio n 6.0 .0 -2 Mo n Feb 9 20 15 Summer Lo ng Re le as e for Re d Hat Ente rpris e Linux Ope nStack Platform 6. 33
© Copyright 2024