Known issues¶

[29798] Services verification fails during the OpenStack control plane update¶

^{Fixed in 2019.2.4}, ^{OPENSTACK VCP UPDATE}, ^{QUEENS, PIKE}

During the update of the OpenStack control plane of an MCP OpenStack deployment, the verification of some services may fail due to the race condition. The list of the affected services include Aodh, Barbican, Designate, Glance, Gnocchi, Heat, Ironic, Manila, Nova, Octavia, and Panko.

The workaround is to retry the last stage of the Deploy - upgrade control VMs Jenkins pipeline job.

[29849] OpenContrail fails to create network objects¶

^{Fixed in 2019.2.4}, ^{OPENSTACK WITH OPENCONTRAIL}, ^UPDATE

After the update of OpenContrail 4.x in the MCP OpenStack deployments, if SSL is enabled on the Keystone internal endpoints, the network objects such as networks, subnets, and others, may not be created.

To verify whether your OpenStack deployment is affected:

1. Open /etc/contrail/vnc_api_lib.ini.

2. Verify that the insecure parameter in the auth section is set to true:

   insecure = true
   

   If the insecure parameter is not set, proceed with the workaround.

Workaround:

1. Log in to the Salt Master node.

2. Set the insecure parameter to true in the /etc/contrail/vnc_api_lib.ini file:

   salt -C 'I@opencontrail:control' cmd.run "sed -i '/^AUTHN_URL.*/a insecure = true' /etc/contrail/vnc_api_lib.ini"
   

3. Restart all contrail-api workers:

   salt -C 'I@opencontrail:control' cmd.run "doctrail controller service contrail-api* restart"
   

[29809] OpenContrail states fail on the OpenStack compute nodes¶

^{Fixed in 2019.2.4}, ^{INITIAL DEPLOYMENT}

During an initial deployment of MCP OpenStack with OpenContrail, the OpenContrail states fail due to the dependencies of the Python packages for OpenContrail.

The workaround is to restart salt-minions on the target compute hosts.

[29843] Pike to Queens upgrade fails for the OpenStack deployments with Octavia¶

^{Fixed in 2019.2.4}, ^{OPENSTACK PIKE TO QUEENS UPGRADE}, ^OCTAVIA

During the upgrade of the OpenStack control plane from Pike to Queens of the MCP OpenStack deployments with Octavia, the Deploy - upgrade control VMs pipeline job may fail with the NotFound: The resource could not be found. (HTTP 404) error.

Workaround:

1. Log in to the Salt Master node.

2. Apply the following state:

   salt 'ctl01*' state.sls salt.minion
   

3. Rerun the Deploy - upgrade control VMs pipeline job from the Jenkins web UI.

[29844] OpenStack with Octavia update fails due to a missing CA certificate¶

^{Fixed in 2019.2.4}, ^{OPENSTACK VCP UPDATE}, ^OCTAVIA

During the update of the OpenStack control plane of MCP OpenStack deployments with Octavia, the Deploy - upgrade control VMs pipeline job may fail during the application of the octavia.upgrade.verify._api state with the Internal Server Error (HTTP 500) error due to a missing ca-cert.pem.

Workaround:

1. Log in to the Salt Master node.

2. Apply the following state:

   salt -C "I@salt:minion:ca" state.sls salt.minion
   

3. Rerun the Deploy - upgrade control VMs pipeline job from the Jenkins web UI.

[29812] The OpenContrail web UI service fails to start after update¶

^{Fixed in 2019.2.4}, ^{OPENSTACK WITH OPENCONTRAIL}, ^UPDATE

After updating OpenContrail 4.x version, the contrail-webui service may fail to start due to the missing quotation mark in /etc/contrail/config.global.js.

Workaround:

1. Log in to the Salt Master node.

2. Add the missing quotation mark in /etc/contrail/config.global.js:

   salt -C 'I@opencontrail:control' cmd.run template=jinja \
   "sed -i \"s/config.imageManager.authProtocol.*/config.imageManager.authProtocol = '{{pillar.opencontrail.web.identity.protocol}}';/g\" /etc/contrail/config.global.js"
   

   After execution of the command above, the contrail-webui and contrail-webui-middleware services should restart automatically.

3. Verify that the contrail-web and contrail-webui-middleware services are in the active state:

   salt -C 'I@opencontrail:control' cmd.run "doctrail controller contrail-status"