(RHSA-2018:0602) Moderate: openstack-tripleo-common and openstack-tripleo-heat-templates update

openstack-tripleo-common contains the python library for code common to the Red Hat OpenStack Platform director CLI and GUI (codename tripleo).

openstack-tripleo-heat-templates is a collection of OpenStack Orchestration templates and tools (codename heat), which can be used to help deploy OpenStack.

Security Fix(es):

• openstack-tripleo-heat-templates: Ceph client keyring is world-readable when deployed by director (CVE-2017-12155)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Katuya Kawakami (NEC) for reporting this issue.

Bug Fix(es):

• All Compute and Controller nodes have bridge-mappings configured and therefore are eligible to schedule routers. However, if you scheduled a router on a Compute node that doesn’t have a connection to an external network, connectivity with the external network fails. This fix adds the ability to configure bridge-mappings in TripleO and in the director according to roles so that you can now exclude Compute nodes from router scheduling and maintain external network connectivity. (BZ#1510879)

• Previously, the CephPools parameter value was incorrectly consumed as a string list instead of as a JSON object. This prevented creating additional Ceph pools during the overcloud deployment, because attempting to pass a JSON object failed. This fix updates the CephPools parameter so that it now accepts any JSON object that describes additional pools to create in the Ceph cluster. Note: The JSON object structure must conform to ceph-ansible conventions. (BZ#1516389)

• There is currently a known issue with LDAP integration for Red Hat OpenStack Platform. The keystone_domain_confg tag is missing currently from keystone.yaml, preventing Puppet from properly applying the required configuration files. Consequently, LDAP integration with Red Hat OpenStack Platform will not be properly configured. As a workaround, you must manually edit keystone.yaml and add the missing tag. There are two ways to do this:

1. Edit the file directly:
   a. Log into the undercloud as the stack user.
   b. Open the keystone.yaml in the editor of your choice. For example:
   sudo vi /usr/share/openstack-tripleo-heat-templates/docker/services/keystone.yaml
   c. Append the missing puppet tag, keystone_domain_confg, to line 94. For example:
   puppet_tags: keystone_config
   Changes to:
   puppet_tags: keystone_config,keystone_domain_confg
   d. Save and close keystone.yaml.
   e. Verify you see the missing tag in the keystone.yaml file. The following command should return ‘1’:
   cat /usr/share/openstack-tripleo-heat-templates/docker/sercies/keystone.yaml | grep 'puppet_tags: keystone_config,keystone_domain_config' | wc -l

2. Or, use sed to edit the file inline:
   a. Login to the undercloud as the stack user.
   b. Run the following command to add the missing puppet tag:
   sed -i 's/puppet_tags\: keystone_config/puppet_tags\: keystone_config,keystone_domain_config/' /usr/share/openstack-tripleo-heat-templates/docker/services/keystone.yaml
   c. Verify you see the missing tag in the keystone.yaml file The following command should return ‘1’:
   cat /usr/share/openstack-tripleo-heat-templates/docker/sercies/keystone.yaml | grep 'puppet_tags: keystone_config,keystone_domain_config' | wc -l (BZ#1519057)

• It is only possible to deploy Ceph storage servers if their disk devices are homogeneous. (BZ#1520004)