Ussuri Series Release Notes


New Features

  • A new Heat parameter ‘ZaqarWsTimeout’ exposes the Puppet variable ‘tripleo::haproxy::zaqar_ws_timeout_tunnel’. This allows operators to configure the Mistral API timeout. It currently defaults to four hours.

Deprecation Notes

  • As the fast forward upgrade workflow to skip multiple releases now relies on the very same upgrade_tasks, there is no need to mantain the fast_forward_upgrade_tasks, as well as any of its references.


New Features

  • Add new BarbicanClient tripleo service for configuring DCN/Edge nodes to access a barbican service running in the control plane. The client service is disabled by default, and can be enabled by including the environments/services/barbican-edge.yaml environment file when deploying a DCN/Edge stack.

  • Added new PublicTLSCAFile parameter, that is used to set the ca cert in clouds.yaml for keystone public endpoint. This defaults to empty string (‘’) assuming that the certs are already trusted.

  • Add GlanceImagePrefetcherInterval parameter to run periodic job which fetches the queued images for caching in cache directory, when image cache is enabled.

  • Add boolean parameter NovaSchedulerQueryPlacementForAvailabilityZone that sets scheduler/query_placement_for_availability_zone parameter. It allows the scheduler to look up a host aggregate with metadata key of availability zone set to the value provided by incoming request, and request result from placement be limited to that aggregate. Default value for NovaSchedulerQueryPlacementForAvailabilityZone is false.

  • Adds the “OctaviaLogOffload” setting to enable amphora log offloading.

  • Added support for VxFlexOS cinder block storage backend driver

Deprecation Notes

  • Usage of the option NeutronFirewallDriver which was used to set firewall_driver config option in the Neutron server’s config is now deprecated. Firewall driver should be set per agent in the agent’s config. It can be done using NeutronOVSFirewallDriver option. Option in the Neutron server was in there just for backward compatybility reasons but since Newton release all Neutron agents are reporting to the server what firewall driver is used so there is no need to keep this legacy, server side option anymore.

Bug Fixes

  • Ensure the barbican Key Manager settings are configured on DCN/Edge nodes when the barbican service is deployed in the control plane. See bug 1886070.

Other Notes

  • The ValidateNtp has been removed from the all nodes validation configuration. During the time sync configuration we already do a check to ensure the ntp servers are available. If they are not we will fail with an appropriate message. The ValidateNtp option came from a time before we could fail in a more explicit way.


New Features

  • Adds support for IGMP snooping (Multicast) in the Neutron ML2/OVS driver.

  • Added enhancements to Octavia’s OVN driver configuration, so it can connect to OVN_Northbound DB using SSL/TLS.

  • The new EnableCache parameter is added to enable/disable chacing using memcached services. The parameter is true by default, but should be false when memcached service is disabled in the deployment.

  • Add boolean parameter NovaSchedulerEnableIsolatedAggregateFiltering which allows to set scheduler/enable_isolated_aggregate_filtering parameter. This configures scheduler to restrict hosts in aggregates based on matching required traits in the aggregate metadata and the instance flavor/image. If an aggregate is configured with a property with key trait:$TRAIT_NAME and value required, the instance flavor extra_specs and/or image metadata must also contain trait:$TRAIT_NAME=required to be eligible to be scheduled to hosts in that aggregate. Default value for NovaSchedulerEnableIsolatedAggregateFiltering is False.

  • For baremetal operations on DHCPv6-stateful networks multiple IPv6 addresses can now be allocated for neutron ports created for provisioning, cleaning, rescue or inspection. The new parameter IronicDhcpv6StatefulAddressCount controls the number of addresses to allocate.

  • Add Heat parameter EnableMysqlAuthEd25519, which when set to true, configures MySQL user credentials to require ed25519-based authentication to the mariadb server, instead of the default SHA1-based native authentication.

  • Adding two parameters to manage vPMEM [0] configuration parameters. NovaPMEMMappings parameter set Nova’s configuration option pmem_namespaces that reflects mappings between vPMEM and physical PMEM namespaces. NovaPMEMNamespaces creates and manages physical backend PMEM namespaces which win be used as backend for vPMEM. NovaPMEMMappings example: 6GB:ns0|ns1|ns2,LARGE:ns3 will expose namespaces ns0, ns1, ns2 using label 6GB and namespace ns3 using label LARGE. NovaPMEMNamespaces example: 100G:ns0|14096M:ns1 will create two namespaces: ns0 - size 100G, ns1 - size 14096M.

  • Added the parameter PortPhysnetCidrMap in the ironic inspector service template. The parameter takes a mapping of IP subnet CIDR to physical network. When the physnet_cidr_map processing hook is enabled the physical_network property of baremetal ports is populated based on this mapping. See Bug: 1870529.

  • Support for Dell EMC SC backend cinder driver. Supports both iSCSI and FC volume drivers and support deploying one or multiple cinder SC storage backends.

  • Support for Dell EMC Xtremio backend cinder driver. Supports both iSCSI and FC volume drivers and support deploying one or multiple cinder Xtremio storage backends.

Upgrade Notes

  • Exclude /var/lib/ironic/* from rsync, this is a leftover from the initial containerization of TripleO; now we have host prep tasks, the ironic conductor and inspector bind mount /var/lib/ironic and generate the data that they need. But this data should not be in the config volume or it can conflict from each other when rsync runs at the same time. Check launchpad bug 1868934. TripleO upgrade tasks and host prep tasks will take care of removing the var directory from the config volumes and the containers will just use the bind mount, like it should be doing now. These tasks will run during a minor update, major upgrade, and fast forward upgrade.

Deprecation Notes

  • Support for Dell EMC PS Series aka Eqlx was removed, because the driver was deprecated in Train release and has been removed from cinder.

  • Resource OS::TripleO::Services::CinderBackendDellSc is no longer supported. Use the new resource OS::TripleO::Services::CinderBackendDellEMCSc.

  • Support for Sahara services is now deprecated, and will be removd in a future release.

  • The following parameters has been deprecated and are no longer used: ´´CephIPv6``, CorosyncIPv6, RabbitIPv6, MemcachedIPv6, MysqlIPv6, RedisIPv6 and NeutronOverlayIPVersion. The IP version is now detected by looking at the CIDR of network subnets instead.

  • KeepalivedRestart is deprecated and has no effect. The workaround isn’t needed anymore since we now deploy keepalived-2.0.10-4. This version has support for ‘dynamic_interfaces’ which is required when the network config was changed and os-net-config restarts the network interface.

  • Keepalived service is deprecated in Train and will be removed in the next cycle. The VIPs are now created by os-net-config for both the Undercloud and Standalone. If you need HA VIPs, please deploy Pacemaker.

  • Resource OS::TripleO::Services::CinderBackendDellEMCVMAXISCSI is no longer supported. Use the new resource OS::TripleO::Services::CinderBackendDellEMCPowermax.

  • Resource OS::TripleO::Services::CinderBackendDellEMCXTREMIOIscsi is no longer supported. Use the new resource OS::TripleO::Services::CinderBackendDellEMCXtremio.

Other Notes

  • Pacemaker is now deployed by default on the Overcloud and Standalone deployments. It has become the de-facto service to handle services in HA and also Virtual IPs.


New Features

  • Added parameters NovaVNCProxySSLCiphers and NovaVNCProxySSLMinimumVersion to manage the allowed TLS ciphers and minimum protocol version to enforce for incoming client connections to the VNC proxy service.

  • Adds NovaMaxDiskDevicesToAttach parameter that controls compute/max_disk_devices_to_attach parameter in Nova. This parameter sets maximum number of disk devices allowed to attach to a single server.

  • Introduce “{{}}ExtraGroupVars” which allows to define a dictionary of Ansible group vars per role. These extra group vars will override any pre-defined group var from a service.

  • Add parameters for configuring multiple glance-api backends. The existing GlanceBackend parameter represents the default backend, and a new GlanceMultistoreConfig parameter is a hash representing the configuration of additional backends. A new GlanceStoreDescription parameter provides a means of describing each backend.

    The configuration can specify any combination of supported backend types. Multiple rbd backends can be specified, but cinder, file and swift backends are limited to one each.

  • Now virtlogd will output its logs into an independent log file, /var/log/containers/libvirt/virtlogd.log, instead of host journal.

  • LibvirtVirtlogdLogLevel and LibvirtVirtlogdLogFilters were added to set logging parameters in virtlogd.

  • Add boolean parameter NeutronDhcpAgentDnsmasqEnableAddr6List to support the dnsmasq_enable_addr6_list option in dhcp agent settings. (See bug: #1861032)

  • Add boolean parameter NovaSchedulerPlacementAggregateRequiredForTenants which allows to set scheduler/placement_aggregate_required_for_tenants parameter. It controls whether or not a tenant with no aggregate affinity will be allowed to schedule to any available node. If aggregates are used to limit some tenants but not all, then this should be False. If all tenants should be confined via aggregate, then this should be True. Default value for NovaSchedulerPlacementAggregateRequiredForTenants is false.

  • Adds support for IGMP snooping (Multicast) in the OVN driver. Defaults to False. IGMP snooping requires OVN version 2.12 or above.

  • Add posibilities to configure replication_probe_interval for ovsdb-server by OVNDBSReplicationInterval. It configure probe interval for connection for ovsdb-server when it is in backup mode and connects to the active ovsdb-server for replication

Upgrade Notes

  • Adds a new parameter NeutronMetadataWorkers for OVN. This parameters allows users to configure the number of OVN metadata workers separately from the value of NeutronWorkers. The OVN metadata workers are deployed onto the compute nodes and not on the controllers/gateways as the OVS ones.

  • Removed the environments/standalone.yaml. This file should not be used and the environments/standalone/standalone-tripleo.yaml should be used instead.

Bug Fixes

  • The parameter ControlPlaneSubnetCidr was missing in the network/ports/net_vip_map_external.j2.yaml and network/ports/net_vip_map_external_v6.j2.yaml template files. This caused deployment failure since the VipMap resource pass this property. (See Bug: #1864912)

  • Fixed an issue where disabling one or more networks in network_data.yaml caused deployment failure. (See bug: #1842001)

  • Fixes an issue where the parameter CloudNameStorageManagement was used for all custom networks with service_net_map_replace defined. (See bug: 1862679.)

  • Fixed an issue where containers octavia_api and octavia_driver_agent would fail to start on node reboot.


New Features

  • Added the configuration option to set reserved_huge_pages. When NovaReservedHugePages is set, “reserved_huge_pages” is set to the value of NovaReservedHugePages. If NovaReservedHugePages is unset and OvsDpdkSocketMemory is set, reserved_huge_pages value is calcuated from KernelArgs and OvsDpdkSocketMemory. KernelArgs helps determine the default huge page size used, the default is set to 2048kb and OvsDpdkSocketMemory helps determine the number of hugepages to reserve.

  • Adds parameter for configuring heat client_retry_limit config option to increase the number of retries for transient errors.

  • Added the Octavia anti-affinity parameters.

  • The new parameter CephExternalMultiConfig may be used to configure OpenStack to use multiple external Ceph clusters.

  • Introduces two new parameters to configure the archive deleted instances cron job. 1) NovaCronArchiveDeleteAllCells To make sure deleted instances get archived also from the cell0 in a single cell deployment and also in additional cell databases in case of a multi cell deployment.

    2) NovaCronArchiveDeleteRowsAge –before is required to prevent the orphaning of libvirt guests if/when nova-compute is down when a db archive cron job fires.

    This change also modifies 1) the default from 100 to 1000 for NovaCronArchiveDeleteRowsMaxRows to match the default from the nova-manage command instead the default of 100 from the puppet-nova parameter.

    2) changes the default for NovaCronPurgeShadowTablesAllCells from false to true also the nova-manage db purge command needs to run for all cells instead of only the default cell.

  • Added a TripleO service OvsDpdkNetcontrold to enable netcontrold PMD rebalance tool for OvS-DPDK deployments.

  • HA services use a special container image name derived from the one configured in Heat parameter plus a fixed tag part, i.e. ‘<registry>/<namespace>/<servicename>:pcmklatest’. To implement rolling update without service disruption, this ‘pcmklatest’ tag is adjusted automatically during minor update every time a new image is pulled. A new Heat parameter ClusterCommonTag can now control the prefix part of the container image name. When set to true, the container name for HA services will look like ‘container-common-tag/<servicename>:pcmklatest’. This allows rolling update of HA services even when the <namespace> changes in Heat.

  • Enable the new container image naming scheme for HA services. They are now configured in pacemaker to use container image name like ‘container-common-tag/<servicename>:pcmklatest’. This allows rolling update of HA services even when the <namespace> changes in Heat.

  • Add the ability to deploy the glance-api service at DCN/Edge sites. Glance service at the Edge shares the same database as the Glance service in the central control plane, but allows other services such as Cinder and Nova to access a Glance endpoint that is local to the DCN/Edge site.

  • Enabling additional healtchecks for Swift to monitor account, container and object replicators as well as the rsync process.

  • The ansible tripleo-hosts-entries is now used for adding individual entries to /etc/hosts for each overcloud node. This role is used instead of the output data from the Heat stack.

Deprecation Notes

  • NovaEnableNUMALiveMigration was removed and has no effect, becuase the corresponding parameter in nova was deprecated in Train release.

  • The deployed-server bootstrap environments, templates, and scripts that were previously deprecated are now removed. These removals include deployed-server/ deployed-server/deployed-server-bootstrap-centos.yaml deployed-server/ deployed-server/deployed-server-bootstrap-rhel.yaml environments/deployed-server-bootstrap-environment-centos.yaml environments/deployed-server-bootstrap-environment-rhel.yaml

  • The environment file at environments/service/neutron-server.yaml has been removed in ussuri as it was previously deprecated in train.

  • Environment file host-config-and-reboot.yaml has been removed and the required functionality is part of BootParams service.

  • ExternalPublicUrl, ExternalAdminUrl and ExternalInternalUrl are deprecated. ExternalSwiftPublicUrl, ExternalSwiftAdminUrl and ExternalSwiftInternalUrl should now be used.

Bug Fixes

  • After we switch default neutron driver to ovn also NeutronPluginExtensions should contain dns because “qos,port_security,dns” is default value for ovn

  • All roles now default to using the net-config-static-bridge.yaml nic config when using deployed-server. Since OVN is the default in TripleO, Compute roles need to have br-ex. Previously when using deployed-server, the default nic config for the non-Controller roles was net-config-static.yaml, which did not create br-ex.

  • Fixes an issue where filtering of networks for kerberos service principals was too aggressive, causing deployment failure. See bug 1854846.

  • The WSGI timeout for Heat API is now set to 600 seconds to match the HAProxy timeout and the RPC response timeout. Previously, it was set to 60 seconds, which resulted in API requests timing out.

  • HA container naming scheme has been updated to look like ‘container.common.tag/<servicename>:pcmklatest’, in order for podman to not prepend any host suffix in front of this tag, otherwise this confuses the podman resource agent in pacemaker.

  • Fixes an issue where TripleO fails to set the Barbican key ID for Swift with a permission error if the config files are not relabeled.

Other Notes

  • Not a functionnal change, only cosmetics. For better understanding and readability, changing all the svirt_sandbox_file_t to shorter, nicer container_file_t


New Features

  • Added the “connection_logging” parameter for the Octavia service.

  • Added support for running the Octavia driver agent in a container. This will enable features such as the OVN load balancer provider in octavia as well as other third party providers.

  • Added the Octavia log offload parameters.

  • Inclusion and configuration of ReaR service to undercloud and overcloud nodes.

  • The ManageNetworks parameter has been added. The parameter controls management of the network and related resources (subnets and segments) with either create, update, or delete operations (depending on the stack operation). Does not apply to ports which will always be managed as needed. Defaults to true. For multi-stack use cases where the network related resources have already been managed by a separate stack, this parameter can be set to false.

  • Provides the option to set the “ovn_emit_need_to_frag” configuration option to the “ovn” section of etc/neutron/plugins/ml2_conf.ini. This option tells ovn whether it should emit ICMP “need to frag” packets in case of MTU mismatch. Before enabling this configuration make sure that it’s supported by the host kernel (version >= 5.2) or by checking the output of the following command ‘ovs-appctl -t ovs-vswitchd dpif/show-dp-features br-int | grep “Check pkt length action”’. Defaults to False.

  • This parameter sets inactive probe interval of the JSON session from ovn-metadata to the OVN SB database. By default this it is 5s which not be sufficient in loaded systems or during high control-plane activity spikes, leading to unnecessary reconnections to OVSDB server. Now it is extended by default to 1 min and it is configurable by param OVNRemoteProbeInterval.

  • Added new heat param OVNOpenflowProbeInterval to set ovn_openflow_probe_interval which is inactivity probe interval of the OpenFlow connection to the OpenvSwitch integration bridge, in seconds. If the value is zero, it disables the connection keepalive feature, by default this value is set on 60s. If the value is nonzero, then it will be forced to a value of at least 5s.

  • Under pressure, the default monitor timeout value of 20 seconds is not enough to prevent unnecessary failovers of the ovn-dbs pacemaker resource. While spawning a few VMs in the same time this could lead to unnecessary movements of master DB, then re-connections of ovn-controllers (slaves are read-only), further peaks of load on DBs, and at the end it could lead to snowball effect. Now this value can be configurable by OVNDBSPacemakerTimeout which will configure tripleo::profile::pacemaker::ovn_dbs_bundle (default is set to 60s).

  • TripleO will now configure iptables using the TripleO-Ansible role, tripleo-firewall. This role implements all of the same interfaces and behaviors as the puppet manifest.

  • A new parameter has been added, ExtraFirewallRules. This parameter provides a user interface to configure additional iptables rules.

Upgrade Notes

  • If deprecated parameter InotifyIntancesMax is used in deployment, then user should use parameter InotifyInstancesMax with correct spelling during upgrade.

Deprecation Notes

  • Deprecated InotifyIntancesMax parameter as it is misspelt.

  • The OS::TripleO::Services::NeutronServer service mapping is deprecated in favor of using OS::TripleO::Services::NeutronApi. Any role definitions still using OS::TripleO::Services::NeutronServer need to either be updated to use OS::TripleO::Services::NeutronApi instead, or they can make use of the environment file at environments/services/neutron-server.yaml to enable the old mapping. The environment file will be removed in the ussuri release.

  • The roles file at deployed-server/deployed-server-roles-data.yaml is deprecated in train. It’s contents are the same as roles_data.yaml, and no special roles files are needed when using deployed-server.

  • The roles file at deployed-server/deployed-server-roles-data.yaml is now removed in ussuri as it was deprecated in train. Note that the default roles_data.yaml file can now be used when using deployed-server.

  • OpenDaylight service templates and environment files have been removed. It was deprecated in Stein and removed in Train.

  • The heat template tripleo-firewall-baremetal-puppet.yaml has been deprecated. While this template can still be used to configure the TripleO-Firewall service, it is no longer preferred and will be removed in a future release.

  • Configuring firewall rules with extraconfig is no longer being supported. All firewall rules should be converted such that they’re set within the user defined parameter ExtraFirewallRules.

Bug Fixes

  • Fixed an issue where Octavia controller services were not properly configured.

  • Added new parameter with correct spelling InotifyInstancesMax.

  • Restart certmnonger after registering system with IPA. This prevents cert requests not completely correctly when doing a brownfield update.

Other Notes

  • Add “radvd_user” configuration parameter to the Neutron L3 container. This parameter defines the user pased to radvd. The default value is “root”.