Release Notes for Contrail Release 1.20

Transcription

1 Release Notes for Contrail Release 1.20 Release 1.20 October 2014 Contents Introduction New and Changed Features Load Balancing-as-a-Service (LBaaS) Source NAT Supported Platforms Known Behavior Known Issues Upgrading Contrail Software from Release 1.20 or Greater to Release Documentation Feedback Requesting Technical Support Self-Help Online Tools and Resources Opening a Case with JTAC Revision History

2 Release Notes: Contrail Controller 1.20 Introduction New and Changed Features Juniper Networks Contrail is an open, standards-based software solution that delivers network virtualization and service automation for federated cloud networks. It provides self-service provisioning, improves network troubleshooting and diagnostics, and enables service chaining for dynamic application environments across enterprise virtual private cloud (VPC), managed Infrastructure as a Service (IaaS), and Networks Functions Virtualization (NFV) use cases. These release notes accompany Release 1.20 of Juniper Networks Contrail. They describe new features, limitations, and known problems.. For the latest, most complete information about outstanding and resolved issues with Contrail, see the Juniper Networks online defect search application at The features listed in this section are new or changed as of Contrail Release A brief description of each new feature is included. Load Balancing-as-a-Service (LBaaS) on page 2 Source NAT on page 2 Supported Platforms on page 2 Load Balancing-as-a-Service (LBaaS) Load Balancing-as-a-Service is a feature available through OpenStack Neutron. Contrail Release 1.20 allows the use of the Neutron API for LBaaS to apply open-source load-balancing technologies to provide actual load balancing of requests in the Contrail system. The LBaaS load balancer enables the creation of a pool of virtual machines serving applications, all front-ended by a virtual-ip. For more information about implementing LBaaS, refer to Load-Balancing-as-a-Service in Contrail. Source NAT Source NAT (SNAT) is supported in Contrail Release The SNAT feature enables guest VMs to access the public network without configuring a floating IP per instance. This feature is supported using Neutron API with flag router:external=true. Supported Platforms Contrail Release 1.20 adds support for OpenStack Icehouse. Known Behavior The following are known behaviors in this release of Contrail. 2

3 Known Issues Adding a rule containing Classless Inter-Domain Routing (CIDR) doesn't create a link between the routing-instances, therefore, no routes will be exchanged. The link can be created using another policy rule or through logical routers. When a subnet X is added to a router, the router will route for all subnets of the virtual network to which subnet X belongs. Example: VN1 has three subnets: /24, /24, and /24, and another virtual network, public_vn. When a router is added to the subnet of public_vn and /24, all the routes in VN1 (including /24 and /24) are routable from public_vn. Before upgrading a vrouter, the administrator needs to shut down the guest running on the server. Live migration of a virtual machine is not supported. The following steps for upgrading a compute node are recommended: 1. Pause all instances on the server, using the OpenStack Horizon interface. 2. Upgrade the vrouter on the compute node, using fab scripts. 3. Reboot. 4. Restart guest virtual machines. Do not modify images used for launching service instances using Horizon Web UI or Glance shell commands. Only administrators can launch virtual machines on specific compute nodes. For new projects, users need to create an IPAM and network policy before creating a virtual network. If you are using the Internet Explorer Web browser, the minimum requirement is IE 9.0 and the recommended version is IE In Contrail release 1.10, all of the daemons now support reading the configuration file upon startup, in addition to reading command-line options. Command-line options of previous releases have been deprecated. The daemon names are changed to follow a common naming scheme. Every attempt is made to keep this change transparent to user. The Fabric upgrade scripts handle the configuration file migration. Tools such as contrail-status support the new daemon names. More details of these changes can be found in the following blog articles on GitHub: Contrail daemons' configuration and Contrail process names' changes in R1.10 Known Issues This section lists known limitations with this release. Bug numbers are listed and can be researched in Launchpad.net at 3

4 Release Notes: Contrail Controller 1.20 When CIDR is configured as the source and a virtual network or policy is configured at the destination of a policy, the configuration fails because there is no virtual network name at the source of the policy Creating a new subnet or updating an existing subnet on host routes and DNS servers through Horizon is not reflected in the Contrail UI virtual network edit until the page is refreshed Attaching an interface to a virtual machine on OpenStack Icehouse fails The Puppet agent on a node stops after a node reboot due to a stale lock On CentOS, an invalid user token error results in rejecting the request during virtual network creation The state for non-master schema shows as Initializing when it should show state as Standby Cannot update the name of the virtual IP in LBaaS When using OpenStack Icehouse, the command nova interface-attach fails, however, the port does get bound to the virtual machine In an Ubuntu Icehouse setup, if a bad request error is returned during a virtual machine creation, it may cause the virtual machine to be stuck in a Scheduling state When using Icehouse, sometimes one of the service virtual machines in an ECMP service chain keeps going into an error state On an Ubuntu Havana setup, if you have upgraded from a previous version you may experience very high disk usage on the database nodes When the load balancer healthmonitor is associated to an ssh load balancer pool, ssh connections to the VIP always fail When a FIP is associated with a VIP, clicking on the instance details of the FIP returns an error If Contrail services are initializing for a long time upon completion of provisioning, it can cause the XMPP or BGP connection to fail. After the services reach an active state, the compute nodes will subscribe to the control nodes and the XMPP connection gets established The network namespace (netns) does not launch after an upgrade from Contrail Release 1.10 to Release A workaround is specified in bug The OpenStack Horizon plugin for Contrail does not get upgraded when the cluster is upgraded to Contrail Release 1.20 from Contrail release numbers lower than A workaround is specified specified in bug If the same ICMP ID is used on virtual machines that allow traffic between them, there might be inconsistent traffic flow behavior if a different ingress or egress rule is configured on each VM. This is because vrouter uses ICMP ID as part of the flow key. Example A vm1-vn2 has the rule onlyegress and vm1-vn1 has the rule onlyingress. The expected behavior is 4

5 Known Issues traffic vm1-vn > vm1-vn1 should be allowed traffic vm1-vn > vm1-vn2 should be denied However, sometimes traffic is allowed from both sides, and sometimes traffic from both sides is denied. This is because the VMs are using the same ICMP ID A virtual machine (VM) with a floating IP is not able to ping to the floating IP virtual network subnet gateway IP In Ubuntu Havana, a policy with 10 or more rules can take more than 5 seconds to load The quota-list displays the default-project ID, which is not seen in the Keystone tenant-list When a virtual network subnet address range is deleted from a VN and a new range is added, sometimes the Contrail UI reports an overlapping subnet, even though it has been deleted Ping fails if mirror instance in in-network mode is present in a service chain While trying to delete a router from the network topology page, delete hangs and fails to delete the router. However, the router can be deleted from the Router page A Neutron error occurs while creating a subnet with a block having a single IP A service stop or restart of api, such as service contrail-api stop, restarts all services in the config A service instance (SI) launch is failing, due to svc-mon is looking to authenticate the user in a stale or non-existent tenant. The problem can occur when a project is recreated, such as delete and then add, with the same name and launch SI as previously. The workaround for this issue is to restart the svc-mon daemon In OpenStack Tempest testing, a virtual machine with a floating IP is not able to ping to the FIP VN subnet gateway IP. Also, ssh to a VM using its floating IP and ping to the gateway of the FIP VN is failing TCP/UDP traffic fails on a nested compute setup if encap is MPLSoGR in the overlay. As an example, two VMs were launched in two virtual compute-nodes in a cluster, where the vrouter encap mode was MPLSoGR. Ping between the VMs passed, but ssh traffic failed For policy inheritance, using src or dest as other policy names is not supported. Inheritance of both src and dest address of a policy as a rule of another policy is not allowed or supported Traffic drop is seen in a transparent service chain case when one of the service VMs is deleted A cluster can be down due to Cassandra database service not responding A second run of setup_all can cause the rabbitmq.config to be corrupt. On successive runs of setup_all, if rabbitmq fails to start, ensure that /etc/rabbitmq/rabbitmq.config is populated correctly with no duplicate entries. Then rerun setup_all

6 Release Notes: Contrail Controller 1.20 There can be a svc_monitor crash upon using Horizon to delete an ECMP service instance virtual machine. This can occur in the following scenario: A transparent service instance is created with the service scaling option enabled. A policy is attached between two virtual networks to allow traffic by using the service instance. If the service instance is deleted using Horizon, a svc_monitor crash can occur If a Security Group List has a group with the same name in different tenants, an instance launch may fail, because Neutron returns multiple matches for the same name. This is a known limitation in Neutron. For more details, refer to bug Load Balancing as a Service (LBaaS) User cannot update the name of a VIP in LBaaS Upgrading from Contrail Release 1.10 to Release 1.20 can sometimes break service instances, due to a change in the ordering of interfaces (left, right changed to right, left) between the two releases. See workarounds in Server Manager Provisioning CentOS is failing with Server Manager. This is because provisioning of the CentOS target with Server Manager is not supported for Contrail Release Deleting the ISO image from server-manager removes the Cobbler profile of the systems target nodes. Consequently, the IP address lease for the nodes will not be renewed When multiple clients are present, simultaneously posting of requests to Server Manager causes some requests to be dropped. Client sees requests as "None". This error can occur when the request from one client is time consuming, such as adding a package or adding an image, and a second client requests a service simultaneously Issuing a provision command immediately after issuing a reimage command to the cluster causes an XMPP connection problem on a multinode setup. This can occur when there are multinodes, for example, two control nodes and two compute nodes, and the reimage completion time differs from server to server. If one of the compute nodes is on a delayed server, it could miss establishing the XMPP connection with the control node Storage The pools bar chart usage data includes data written on OSDs that are no longer operational The detach node functionality does not detach storage resources High availability storage is not supported, consequently, storage will not work properly with highly available OpenStack nodes. Only the first storage-master role node will have storage software installed on it For installations performed using fab commands, NTP must be manually configured to sync the time within the cluster

7 Known Issues For installations performed using fab commands, the UID or GID of the Nova user must be identical across all compute nodes. This should happen if compute nodes are configured identically With multiple Ceph pools, the weights of OSD drives may not be set correctly There is no R1.20 upgrade storage component, consequently upgrading the base Contrail software to R1.20 does not break any existing storage functionality, however, R1.20 storage functionality will not be present. You must perform a full installation of Release 1.20 to get R1.20 storage functionality Neutron APIs The user is able to attach a second port in the same VN to a VM. This can occur when an instance is created without any nic arguments, so the only available VN is selected for the port. This will also prevent assignment of a floating IP upon reboot.. This is standard Neutron behavior Updating allowed_address_pairs without any value or with action to clear generates an internal server error. This is a Neutron error A VM can be launched on a virtual network that has been disabled or its state is down. This is a known Neutron issue Quota defaults for security group, router, security group rule, and floating IP are not the same as stock OpenStack. Contrail doesn't use the Neutron database in MySQL, consequently defaults are different if nothing is configured in neutron.conf. This could affect a standard OpenStack user Neutron subnet disable gateway is not supported. Contrail does not have an equivalent for Neutron --no-gateway code Routing occurs even when a Neutron router attribute of admin_state_up is set to False. At this time, the user will have to delete the router or remove the subnet to prevent routing The Contrail agent works with only the first port IP if the port is configured with multiple IPs. Although Neutron supports multiple IPs on a port, this feature is not available in Contrail In a multi-config setup, a subnet-delete immediately after a port-delete may fail, with an error message stating there are existing references to the subnet. Users will have to retry the delete when this happens If you change the name of a virtual network, the Contrail UI might still display the old name. The new name will show correctly in Neutron net-list and in Horizon If a non-default IP is selected for the gateway, that selection must be identified in the allocation pool Setting max_dns_servers in neutron.conf is not supported Configuring extra routes on a Layer 3 Neutron router is not supported in Contrail Performing an interface-detach shuts down the VM. Although the command completes successfully, in the compute logs it says that the interface detach has failed, and the 7

8 Release Notes: Contrail Controller 1.20 VM is moved to the Shutoff state, and the port is also removed. This is due to a known issue in libvert User is able to attach a second port in the same VN to a VM No quota check is set for nat_instance High Availability The Redis server does not restart automatically if the redis-server service is stopped or killed. In this state the queries to opserver do not work. The workaround is detailed in the bug report, with an attached script On a setup with a single openstack node, with multiple Contrail nodes hosting neutron-server, the neutron_url in /etc/nova/nova.conf of the openstack nova-api needs to be updated to the VIP of the contrail neutron-server cluster Upgrading Contrail Software from Release 1.20 or Greater to Release 2.10 Use the following procedure to upgrade an installation of Contrail software from one release to a more recent release. This procedure is valid starting from Contrail Release 1.20 and greater. NOTE: If you are installing Contrail for the first time, refer to the full documentation and installation instructions in Installing the Operating System and Contrail Packages. Instructions are given for both CentOS and Ubuntu versions. The only Ubuntu versions supported for upgrading are Ubuntu and To upgrade Contrail software from Contrail Release 1.20 or greater to Contrail Release 2.10 or greater: 1. Download the file contrail-install-packages-x.xx-xxx.xxx.noarch.rpm deb from and copy it to the /tmp directory on the config node, as follows: CentOS : scp <id@server>:/path/to/contrail-install-packages-x.xx-xxx.xxx.noarch.rpm /tmp Ubuntu : scp <id@server>:/path/to/contrail-install-packages-x.xx-xx~havana_all.deb /tmp NOTE: The variables xxx.-xxx and so on represent the release and build numbers that are present in the name of the installation packages that you download. 2. Install the contrail-install-packages, using the correct command for your operating system: 8

9 Upgrading Contrail Software from Release 1.20 or Greater to Release 2.10 CentOS: yum localinstall /tmp/contrail-install-packages-x.xx-xxx.xxx..noarch.rpm Ubuntu: dpkg i /tmp/ contrail-install-packages_x.xx-xxx~havana_all.deb 3. Set up the local repository by running the setup.sh: cd /opt/contrail/contrail_packages;./setup.sh 4. Ensure that the testbed.py that was used to set up the cluster with Contrail is intact at /opt/contrail/utils/fabfile/testbeds/. Ensure that testbed.py has been set up with a combined control_data section (required as of Contrail Release 1.10). Ensure that the do_parallel flag is set to True in testbed.py, see bug in Launchpad.net. See Populating the Testbed Definitions File. 5. Upgrade the software, using the correct set of commands to match your operating system and vrouter, as described in the following: Change to the utils folder: cd /opt/contrail/utils; \ and select the correct upgrade procedure from the following to match your operating system and vrouter. In the following, <from> refers to the currently installed release number, such as 1.20, 1.21, 2.0: CentOS Upgrade Procedure: fab upgrade_contrail:<from>,/tmp/contrail-install-packages-x.xx-xxx.xxx.noarch.rpm; Ubuntu Procedure: fab upgrade_contrail:<from>,/tmp/contrail-install-packages-x.xx-xxx~havana_all.deb; Ubuntu Upgrade, Two Procedures: There are two different upgrade procedures for Ubuntu upgrade to Contrail Release 2.10, depending on which vrouter (contrail-vrouter generic or contrail-vrouter-dkms) is installed in your current setup. As of Contrail Release 2.10, the recommended kernel version for an Ubuntu based system is Both procedures can use the command fab upgrade_kernel_all to upgrade the kernel. Ubuntu Upgrade Procedure For System With contrail-vrouter generic: Use the following upgrade procedure for Contrail Release 1.20 systems based on Ubuntu with the contrail-vrouter generic installed. The command sequence upgrades the kernel version and also reboots the compute nodes when finished. fab install_pkg_all:/tmp/contrail-install-packages-x.xx-xxx~havana_all.deb; fab migrate_compute_kernel; 9

10 Release Notes: Contrail Controller 1.20 fab upgrade_contrail:<from>,/tmp/contrail-install-packages-x.xx-xxx~havana_all.deb; fab upgrade_kernel_all; fab restart_openstack_compute; Ubuntu Upgrade Procedure For System with contrail-vrouter-dkms: Use the following upgrade procedure for Contrail R1.20 systems based on Ubuntu with the contrail-vrouter-dkms. The command sequence upgrades the kernel version and also reboots the compute nodes when finished. fab upgrade_contrail:<from>,/tmp/contrail-install-packages-x.xx-xxx~havana_all.deb; All nodes in the cluster can be upgraded to kernel version by using the following fabric-utils command: fab upgrade_kernel_all 6. On the OpenStack node, soft reboot all of the virtual machines. You can do this in the OpenStack dashboard or log into the node that uses the openstack role and issue the following commands: source /etc/contrail/openstackrc ; nova reboot <vm-name> You can also use the following fab command to reboot all virtual machines: fab reboot_vm 7. Check to ensure that the openstack-nova-novncproxy is still running: service openstack-nova-novncproxy status If necessary, restart the service: service openstack-nova-novncproxy restart 8. (For Contrail Storage option, only.) Contrail Storage has its own packages. To upgrade Contrail Storage, download the file: contrail-storage-packages_x.x-xx*.deb from and copy it to the /tmp directory on the config node, as follows: Ubuntu: scp <id@server>:/path/to/contrail-storage-packages_x.x-xx*.deb /tmp NOTE: Use only Icehouse packages (for example, contrail-storage-packages_2.0-22~icehouse_all.deb) because OpenStack Havana is no longer supported. Use the following statement to upgrade the software: cd /opt/contrail/utils; \ 10

11 Documentation Feedback Ubuntu: fab upgrade_storage:<from>,/tmp/contrail-storage-packages_2.0-22~icehouse_all.deb; When upgrading to Contrail Release 2.10, add the following steps if you have live migration configured. Upgrades to Release 2.0 do not require these steps. Select the command that matches your live migration configuration. fab setup_nfs_livem or fab setup_nfs_livem_global Related Documentation Contrail Getting Started Guide Documentation Feedback Requesting Technical Support We encourage you to provide feedback, comments, and suggestions so that we can improve the documentation. You can provide feedback by using either of the following methods: Technical product support is available through the Juniper Networks Technical Assistance Center (JTAC). If you are a customer with an active J-Care or Partner Support Service support contract, or are covered under warranty, and need post-sales technical support, you can access our tools and resources online or open a case with JTAC. JTAC policies For a complete understanding of our JTAC procedures and policies, review the JTAC User Guide located at Product warranties For product warranty information, visit JTAC hours of operation The JTAC centers have resources available 24 hours a day, 7 days a week, 365 days a year. Self-Help Online Tools and Resources For quick and easy problem resolution, Juniper Networks has designed an online self-service portal called the Customer Support Center (CSC) that provides you with the following features: Find CSC offerings: Search for known bugs: Find product documentation: Find solutions and answer questions using our Knowledge Base: 11

12 Release Notes: Contrail Controller 1.20 Download the latest versions of software and review release notes: Search technical bulletins for relevant hardware and software notifications: Join and participate in the Juniper Networks Community Forum: Open a case online in the CSC Case Management tool: To verify service entitlement by product serial number, use our Serial Number Entitlement (SNE) Tool: Opening a Case with JTAC You can open a case with JTAC on the Web or by telephone. Use the Case Management tool in the CSC at Call JTAC ( toll-free in the USA, Canada, and Mexico). Revision History For international or direct-dial options in countries without toll-free numbers, see April 2014 Revision 1, Contrail March 2014 Revision 1, Contrail 1.04 January 2014 Revision 1, Contrail October 2013 Revision 1, Contrail September 2013 Revision 1, Contrail 1.0 All rights reserved. Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. The Juniper Networks Logo, the Junos logo, and JunosE are trademarks of Juniper Networks, Inc. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners. Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice. 12