Red Hat OpenStack

Technical Notes

Technical Notes for Red Hat Enterprise Linux OpenStack Platform and supporting packages.

Edition 1.0

Bruce Reeler

Red Hat Documentation Team

Steve Gordon

Red Hat Documentation Team

Legal Notice

Copyright © 2013 Red Hat, Inc.

This document is licensed by Red Hat under the Creative Commons Attribution-ShareAlike 3.0 Unported License. If you distribute this document, or a modified version of it, you must provide attribution to Red Hat, Inc. and provide a link to the original. If the document is modified, all Red Hat trademarks must be removed.

Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law.

Red Hat, Red Hat Enterprise Linux, the Shadowman logo, JBoss, MetaMatrix, Fedora, the Infinity Logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other countries.

Linux® is the registered trademark of Linus Torvalds in the United States and other countries.

Java® is a registered trademark of Oracle and/or its affiliates.

XFS® is a trademark of Silicon Graphics International Corp. or its subsidiaries in the United States and/or other countries.

MySQL® is a registered trademark of MySQL AB in the United States, the European Union and other countries.

Node.js® is an official trademark of Joyent. Red Hat Software Collections is not formally related to or endorsed by the official Joyent Node.js open source or commercial project.

The OpenStack® Word Mark and OpenStack Logo are either registered trademarks/service marks or trademarks/service marks of the OpenStack Foundation, in the United States and other countries and are used with the OpenStack Foundation's permission. We are not affiliated with, endorsed or sponsored by the OpenStack Foundation, or the OpenStack community.

All other trademarks are the property of their respective owners.

Abstract

These Technical Notes are provided to supplement the information contained in the text of Red Hat Enterprise Linux OpenStack Platform errata advisories released via Red Hat Network. Red Hat Enterprise Linux OpenStack Platform errata advisories are available at https://rhn.redhat.com/errata/rhel6-rhos-3-errata.html.

Preface

1. Document Conventions

This manual uses several conventions to highlight certain words and phrases and draw attention to specific pieces of information.

In PDF and paper editions, this manual uses typefaces drawn from the Liberation Fonts set. The Liberation Fonts set is also used in HTML editions if the set is installed on your system. If not, alternative but equivalent typefaces are displayed. Note: Red Hat Enterprise Linux 5 and later include the Liberation Fonts set by default.

1.1. Typographic Conventions

Four typographic conventions are used to call attention to specific words and phrases. These conventions, and the circumstances they apply to, are as follows.

Mono-spaced Bold

Used to highlight system input, including shell commands, file names and paths. Also used to highlight keys and key combinations. For example:

To see the contents of the file my_next_bestselling_novel in your current working directory, enter the cat my_next_bestselling_novel command at the shell prompt and press Enter to execute the command.

The above includes a file name, a shell command and a key, all presented in mono-spaced bold and all distinguishable thanks to context.

Key combinations can be distinguished from an individual key by the plus sign that connects each part of a key combination. For example:

Press Enter to execute the command.

Press Ctrl+Alt+F2 to switch to a virtual terminal.

The first example highlights a particular key to press. The second example highlights a key combination: a set of three keys pressed simultaneously.

If source code is discussed, class names, methods, functions, variable names and returned values mentioned within a paragraph will be presented as above, in mono-spaced bold. For example:

File-related classes include filesystem for file systems, file for files, and dir for directories. Each class has its own associated set of permissions.

Proportional Bold

This denotes words or phrases encountered on a system, including application names; dialog box text; labeled buttons; check-box and radio button labels; menu titles and sub-menu titles. For example:

Choose System → Preferences → Mouse from the main menu bar to launch Mouse Preferences. In the Buttons tab, select the Left-handed mouse check box and click Close to switch the primary mouse button from the left to the right (making the mouse suitable for use in the left hand).

To insert a special character into a gedit file, choose Applications → Accessories → Character Map from the main menu bar. Next, choose Search → Find… from the Character Map menu bar, type the name of the character in the Search field and click Next. The character you sought will be highlighted in the Character Table. Double-click this highlighted character to place it in the Text to copy field and then click the Copy button. Now switch back to your document and choose Edit → Paste from the gedit menu bar.

The above text includes application names; system-wide menu names and items; application-specific menu names; and buttons and text found within a GUI interface, all presented in proportional bold and all distinguishable by context.

Mono-spaced Bold Italic or Proportional Bold Italic

Whether mono-spaced bold or proportional bold, the addition of italics indicates replaceable or variable text. Italics denotes text you do not input literally or displayed text that changes depending on circumstance. For example:

To connect to a remote machine using ssh, type ssh username@domain.name at a shell prompt. If the remote machine is example.com and your username on that machine is john, type ssh john@example.com.

The mount -o remount file-system command remounts the named file system. For example, to remount the /home file system, the command is mount -o remount /home.

To see the version of a currently installed package, use the rpm -q package command. It will return a result as follows: package-version-release.

Note the words in bold italics above — username, domain.name, file-system, package, version and release. Each word is a placeholder, either for text you enter when issuing a command or for text displayed by the system.

Aside from standard usage for presenting the title of a work, italics denotes the first use of a new and important term. For example:

Publican is a DocBook publishing system.

1.2. Pull-quote Conventions

Terminal output and source code listings are set off visually from the surrounding text.

Output sent to a terminal is set in mono-spaced roman and presented thus:

books        Desktop   documentation  drafts  mss    photos   stuff  svn
books_tests  Desktop1  downloads      images  notes  scripts  svgs

Source-code listings are also set in mono-spaced roman but add syntax highlighting as follows:

static int kvm_vm_ioctl_deassign_device(struct kvm *kvm,
                 struct kvm_assigned_pci_dev *assigned_dev)
{
         int r = 0;
         struct kvm_assigned_dev_kernel *match;

         mutex_lock(&kvm->lock);

         match = kvm_find_assigned_dev(&kvm->arch.assigned_dev_head,
                                       assigned_dev->assigned_dev_id);
         if (!match) {
                 printk(KERN_INFO "%s: device hasn't been assigned before, "
                   "so cannot be deassigned\n", __func__);
                 r = -EINVAL;
                 goto out;
         }

         kvm_deassign_device(kvm, match);

         kvm_free_assigned_device(kvm, match);

out:
         mutex_unlock(&kvm->lock);
         return r;
}

1.3. Notes and Warnings

Finally, we use three visual styles to draw attention to information that might otherwise be overlooked.

Note

Notes are tips, shortcuts or alternative approaches to the task at hand. Ignoring a note should have no negative consequences, but you might miss out on a trick that makes your life easier.

Important

Important boxes detail things that are easily missed: configuration changes that only apply to the current session, or services that need restarting before an update will apply. Ignoring a box labeled 'Important' will not cause data loss but may cause irritation and frustration.

Warning

Warnings should not be ignored. Ignoring warnings will most likely cause data loss.

2. Getting Help and Giving Feedback

2.1. Do You Need Help?

If you experience difficulty with a procedure described in this documentation, visit the Red Hat Customer Portal at http://access.redhat.com. Through the customer portal, you can:

search or browse through a knowledgebase of technical support articles about Red Hat products.

submit a support case to Red Hat Global Support Services (GSS).

access other product documentation.

Red Hat also hosts a large number of electronic mailing lists for discussion of Red Hat software and technology. You can find a list of publicly available mailing lists at https://www.redhat.com/mailman/listinfo. Click on the name of any mailing list to subscribe to that list or to access the list archives.

2.2. We Need Feedback

If you find a typographical error in this manual, or if you have thought of a way to make this manual better, we would love to hear from you. Please submit a report in Bugzilla: http://bugzilla.redhat.com/ against the product Red Hat OpenStack.

When submitting a bug report, be sure to mention the manual's identifier: doc-Technical_Notes

If you have a suggestion for improving the documentation, try to be as specific as possible when describing it. If you have found an error, please include the section number and some of the surrounding text so we can find it easily.

Chapter 1. RHBA-2013:0968 — Red Hat Enterprise Linux OpenStack Platform 3 Bug Fix and Enhancement Update

The bugs contained in this chapter are addressed by advisory RHBA-2013:0968. Further information about this advisory is available at https://rhn.redhat.com/errata/RHBA-2013-0968.html.

1.1. novnc

BZ#974846

Previously, a VNC console would fail to open when one tried to open the console from the URL provided by the command: nova get-vnc-console <INSTANCE_ID> novnc. This has been fixed and the console now opens.

1.2. openstack-ceilometer

BZ#971574

Previously, multiple qpid exchanges were created by Ceilometer but not removed if not required, leading to system out of memory errors. This has been fixed by appropriate configuration so that unnecessary qpid exchanges are removed.

1.3. openstack-cinder

BZ#970558

Previously, volumes created from Glance images were not being re-sized according to the passed parameters, when using NFS or GlusterFS backends, even though Cinder's DB reported the correct size. This has been fixed so that the backing file gets re-sized correctly as shown in Cinder DB.

BZ#971571

Previously, multiple qpid exchanges were created by Cinder but not removed if not required, leading to system out of memory errors. This has been fixed by appropriate configuration so that unnecessary qpid exchanges are removed.

1.4. openstack-glance

BZ#965139

Previously, running Glance commands such as  “glance image-show” followed by non-ASCII arguments would cause an error. This has been fixed so that Unicode characters are also managed correctly.

1.5. openstack-heat

BZ#971572

Previously, multiple qpid exchanges were created by Heat but not removed if not required, leading to system out of memory errors. This has been fixed by appropriate configuration so that unnecessary qpid exchanges are removed

1.6. openstack-nova

BZ#971565

The Compute Conductor (openstack-nova-conductor) service was not correctly closing Qpid message exchanges. As a result after several hours of operations many open exchanges would remain in existence. The Compute Conductor service has been updated and now closes Qpid message exchanges correctly when they are no longer needed.

1.7. openstack-packstack

BZ#975007

The Block Storage service (openstack-cinder-volumes) is initialized earlier in the boot process than items listed in the rc.local file.

On systems deployed by PackStack and configured to use a volume group backed by loopback device for block storage this meant that the volume group was not available when the Block Storage service was started on boot. As a result the service would fail to start.

PackStack has been updated and now ensures that the Block Storage service is restarted once the rc.local file is processed and the volume group is available. This ensures that the Block Storage service continues to function correctly following reboot.

BZ#975050

The default PackStack configuration of Keystone generates UUID tokens. Administrators wishing to generate and use PKI tokens must:

1) Generate the PKI files using the keystone-manage command:

# keystone-manage pki_setup \
   --keystone-user keystone \
   --keystone-group keystone

2) Ensure that Keystone has ownership of the files in the /etc/keystone/ssl/ and /var/log/keystone/ directories:

# chown -R keystone:keystone /etc/keystone/ssl/ /var/log/keystone/

3) Update the value of the token_format configuration key in /etc/keystone/keystone.conf to PKI:

# openstack-config --set /etc/keystone/keystone.conf \
  token_format PKI

4) Restart the openstack-keystone service:

# service openstack-keystone restart

BZ#976081

Previously, after using PackStack to install OpenStack, one could start Swift successfully the first time. However, attempting to restart Swift after the first start failed. This has been fixed and Swift restarts correctly.

1.8. openstack-quantum

BZ#966347

Before OpenStack Networking had support for namespaces,  overlapping IP support was not enabled. Now that namespaces are supported, overlapping IPs are enabled by default.

1.9. openvswitch

BZ#957377

Previously, the openvswitch service would not start automatically upon reboot. The service has now been added to the runlevel so openvswitch now starts automatically after a reboot, if enabled.

1.10. python-ceilometerclient

BZ#974043

Previously, Ceilometer commands failed with a 404 Error unless the latest metering API was explicitly specified. This has been fixed by using the latest metering API by default, so Ceilometer commands work as expected.

Chapter 2. RHBA-2013:1020 — Red Hat Enterprise Linux OpenStack Platform 3 Bug Fix Update

The bugs contained in this chapter are addressed by advisory RHBA-2013:1020. Further information about this advisory is available at https://rhn.redhat.com/errata/RHBA-2013-1020.html.

2.1. openstack-nova

BZ#980950

Previously components that used AMQP for communication would log exceptions that occurred while the connection was being closed. Such components included the Compute service itself (openstack-nova-compute), the Compute Scheduler (openstack-nova-scheduler), and the Compute Conductor (openstack-nova-conductor).

These messages were spurious in that errors reading from or writing to the recently closed socket are expected and do not require administrator attention. As such logging of AMQP errors that occur while the connection is being closed is now disabled.

BZ#981028

The "default" OpenStack Networking security group is created automatically when creating a tenant network. The Compute service previously always checked for the presence of this "default" security group when launching instances. As a result launching a virtual machine instance when no tenant network had been created ended in error:

SecurityGroupNotFound: Security group default not found.

The Compute service has been updated to only check for the existence of the "default" security group when a tenant network for the instance to use exists.

2.2. python-django-horizon

BZ#980241

The "Help" link in the Dashboard (Horizon) directed users to the Red Hat OpenStack 2.0 (Folsom) documentation. The link has been updated to direct users to the Red Hat OpenStack 3.0 (Grizzly) documentation.

2.3. python-novaclient

BZ#976063

Attempts to re-authenticate on detecting possible token expiry actually re-used the expired token. As a result the novaclient instance would stop working once the original token had expired. By default tokens expire after 24 hours.

An update has been made to ensure the old authentication token has been discarded before attempting re-authentication. As a result the novaclient instance continues to work following expiry of the original token.

2.4. python-quantumclient

BZ#980964

The python-quantumclient package did not include a dependency on version 1.3 of the python-cliff package. This version of python-cliff is required to maintain Python 2.6 compatibility. If python-cliff 1.3 was not installed on the system, some quantum client actions would end in error:

AttributeError: 'module' object has no attribute 'compress'
'module' object has no attribute 'compress'

The python-quantumclient package has been updated and now includes a dependency on python-cliff version 1.3.

2.5. ruby193-foreman

BZ#978556

The Foreman package specification previously attempted to modify the permissions of a non-existent file, "ocal_secret_token.rb".

This resulted in an error message being displayed but no further negative consequences for the installation. The Foreman package specification has been updated to modify the permissions of the correct file, "local_secret_token.rb".

2.6. ruby193-foreman-selinux

BZ#980982

A new package, ruby193-foreman-selinux, has been added to Red Hat OpenStack. The ruby193-foreman-selinux package includes SELinux policies to support the installation and operation of Foreman on servers that run SELinux in enforcing mode.

2.7. ruby193-openstack-foreman-installer

BZ#978568

When deploying the Dashboard (Horizon) Foreman was not importing all required Puppet modules. As a result an SELinux boolean required to allow the web server (httpd) to run with SELinux set to enforcing mode was not set correctly. The additional Puppet modules are now included and httpd is able to run when SELinux is set to enforcing mode on new deployments performed using Foreman.

Chapter 3. RHBA-2013:1186 — Red Hat Enterprise Linux OpenStack Platform 3 Bug Fix and Enhancement Update

The bugs contained in this chapter are addressed by advisory RHBA-2013:1186. Further information about this advisory is available at https://rhn.redhat.com/errata/RHBA-2013-1186.html.

3.1. openstack-ceilometer

BZ#993103

Rebase package(s) to version: openstack-ceilometer-2013.1.3-1.el6ost

Important fixes:

For large datasets, MongoDB failed to sort without an index, causing sample retrieval to fail. This has been fixed by creating an index on descending timestamp which allows sorting.

Due to compute agent polling logic not having access to the complete metadata, resource metadata for instances was nulled out after boot. This has been fixed so that resource metadata for instances is not incorrectly overwritten.

If instances were booted without ramdisk and kernel images, resource metadata was not gracefully handled. This has been fixed so that missing image data does not cause an exception.

3.2. openstack-heat

BZ#993092

Rebase package(s) to version: openstack-2013.1.3-1.el6ost

Important fixes or notable enhancements:

Python-boto is an interface to Amazon Web Services. Recent versions of boto did not work with Heat due to a signature format change by AWS. This bug has now been fixed so that boto interfaces with Heat.

Previously, when an AWS::AutoScaling::LaunchConfiguration resource defined the SecurityGroups property, the creation of the instance group failed. This has been fixed so that the instance group is created correctly.

The RPC in Oslo has been replaced with the latest version to fix an exchange problem with Qpid.

3.3. openstack-packstack

BZ#986024

Previously when using Quantum/Neutron with packstack, networks/subnets/routers had to be manually configured, a process that was complex and could lead to errors.

The packstack --allinone command has been modified and new answer file options have been added:

CONFIG_KEYSTONE_DEMO_PW
  The demo tenant password. Automatically configured/no prompting just like the ADMIN_PW. Only actually used if CONFIG_PROVISION_DEMO=y

CONFIG_PROVISION_DEMO
  Whether to provision demo quantum networks/subnets/routers
  Requires: CONFIG_QUANTUM_INSTALL=y and CONFIG_QUANTUM_USE_NAMESPACES=y

CONFIG_PROVISION_TEMPEST
  Whether to set up tempest for running tests against the Openstack install
  Requires: CONFIG_QUANTUM_INSTALL=y and CONFIG_QUANTUM_USE_NAMESPACES=y

CONFIG_PROVISION_ALL_IN_ONE_OVS_BRIDGE
  Whether to set up the L3 external bridge with the appropriate IP address to act as the gateway for VMs.

The --allinone option will automatically enable CONFIG_PROVISION_DEMO and CONFIG_PROVISION_ALL_IN_ONE_OVS_BRIDGE if CONFIG_QUANTUM_INSTALL=y (which it is by default). --allinone --os-quantum-install=n still works for installing without Quantum.

Additional changes:
1) A new 'demo' keystone tenant has been added along with a keystonerc_demo file which can be sourced like the existing keystonerc_admin. You should log into Horizon using the 'demo' account instead of the 'admin' account due to the ownership of the private and public networks.

2) When launching a VM via Horizon, you additionally need to go to the "Network" tab and select the "private" network.

3) Current instructions specify creating a security group rule to allow SSH traffic. An ICMP rule has been added as well.

Instructions for installing Neutron using PackStack are available at http://openstack.redhat.com/Neutron-Quickstart.

BZ#990949

Previously, if linuxbridge was selected as the L2 agent during a PackStack interactive installation, PackStack would fail with the error:
ERROR : local variable 'iface_arr' referenced before assignment
    Please check log file /var/tmp/packstack/<timestamp>/openstack-setup.log for more information.
This has been fixed and linuxbridge can be set as the L2 agent.

BZ#997941

Previously, when running "packstack --allinone", certain kernel parameters were not set. Without this configuration security groups did not work correctly. This has been fixed and security groups now work correctly.

BZ#996782

Previously, when you added new servers to an existing cluster using PackStack, initialization was carried out on all nodes, including existing nodes where there were no changes required.

A new option has been added which allows you to use the same answerfile and exclude the existing servers from re-initialization when running PackStack on an existing cluster. This makes initialization faster.

The new option is "--exclude-server=EXCLUDE_SERVERS" where EXCLUDE_SERVERS is the comma separated list of IPs of nodes that must not be altered.

BZ#996694

Previously, the inifile module did not manage empty values well. Empty values need to be able to be set for Neutron. This has been fixed and the inifile module now manages empty values correctly.

3.4. openstack-quantum

BZ#993101

Rebase package(s) to version: openstack-quantum-2013.1.3-1.el6ost

Amongst several bugfixes, two critical bugs were fixed:

When a port had multiple IP addresses, the iptables security group implementation dropped all of the packets from that port. As a result, the port could not communicate. This has been fixed so that the port can communicate.

When a port was updated with an IP address that is not in any allocation pool, the port could no longer be updated. In addition, no new ports could be created. This has been fixed so that ports can be updated and hence new ports created.

3.5. python-django-horizon

BZ#997920

There was a bug which caused Horizon to not display security rules after a new rule had been added using the command line interface. This bug has been fixed so that Horizon correctly displays rules added using the CLI.

BZ#993104

Rebase package(s) to version: python-django-horizon-2013.1.3-1.el6ost

Four important fixes:

Previously, when trying to delete a Swift container that contains data (which cannot be done until the data is deleted), the user just received an unclear error message. Now the user gets a warning instead that explains the problem.

When using Quantum, it is now also possible to disassociate Floating IPs from the Instances page.

Previously, when multiple ports and/or CIDRs exist, the network topology diagram became hard to read due to inadequate spacing and text overlap. Now improvements have been made to the network topology diagram which make it more legible.

Localisation improvements: Previously, some variables and templates variables that should be translatable weren't marked as such. Now additional strings have been marked as translatable, and the translation files updated.

BZ#999608

An additional tab has been added to the Horizon dashboard GUI. This tab, titled "Red Hat", is on the left of the dashboard next to the "Project" and "Admin" tabs. It will only be visible if the redhat-access-plugin-rhos package has also been installed. (and httpd restarted)

Selecting this tab enables access to Red Hat subscriber services from within the dashboard, such as:
- Knowledge base article/solution viewing.
- Diagnostic services on console logs.

3.6. python-oslo-config

BZ#1000447

Previously in Glance, the "openstack-db --init" command failed when using the default configuration with an "unable to open database file" error. This was due to the location of files being incorrectly specified. This has been fixed and the Glance database is now correctly created and initialized.

3.7. ruby193-openstack-foreman-installer

BZ#993642

Previously, installation of an OpenStack controller node using the Foreman fails with an error of 'Invalid parameter glance_user_password at <filepath>/controller.pp:99'.

This has been fixed so that the Foreman now correctly creates a controller.

3.8. ruby193-ruby-wrapper

BZ#996677

The previous version of ruby 1.9.3 was outdated. However, the way it was packaged, it included wrapper scripts which were used by the Foreman. This meant that many bugfixes present in later patch levels of ruby 1.9.3 were not available.

This was fixed by separating the wrapper scripts into their own package. This allows later versions of ruby 1.9.3 to be provided (in this case, patch level 448), which contain numerous fixes. Now, when using the Foreman, you will see two packages (ruby193-ruby and ruby193-ruby-wrapper) instead of one.

Appendix A. Revision History

Revision History

Revision 1.0-4
Mon Sep 2 2013
Bruce Reeler

Added advisory RHBA-2013:1186.

Revision 1.0-3
Thu Aug 8 2013
Stephen Gordon

Updated brand.

Revision 1.0-2
Mon Jul 8 2013
Stephen Gordon

Added advisory RHBA-2013:1020.

Revision 1.0-1
Fri Jun 21 2013
Bruce Reeler, Stephen Gordon

Initial creation for RHBA-2013:0968.

Index

F

feedback

contact information for this manual, We Need Feedback

H

help

getting help, Do You Need Help?