Jump to: navigation, search

ReleaseNotes/Icehouse

Revision as of 03:13, 5 April 2014 by Fifieldt (talk | contribs) (Key New Features)

OpenStack 2014.1 (Icehouse) Release Notes

General Upgrade Notes

  • Windows packagers should use pbr 0.8 to avoid bug 1294246

OpenStack Object Storage (Swift)

Key New Features

Known Issues

None

Upgrade Notes

OpenStack Compute (Nova)

Key New Features

Upgrade Support

  • Limited live upgrades are now supported. This enables deployers to upgrade controller infrastructure first, and subsequently upgrade individual compute nodes without requiring downtime of the entire cloud to complete.

Compute Drivers

Libvirt (KVM)
  • The Libvirt compute driver now supports providing modified kernel arguments to booting compute instances. The kernel arguments are retrieved from the os_command_line key in the image metadata as stored in Glance, if a value for the key was provided. Otherwise the default kernel arguments are used.
  • The Libvirt driver now supports using VirtIO SCSI (virtio-scsi) instead of VirtIO Block (virtio-blk) to provide block device access for instances. Virtio SCSI is a para-virtualized SCSI controller device designed as a future successor to VirtIO Block and aiming to provide improved scalability and performance.
  • The Libvirt Compute driver now supports adding a Virtio RNG device to compute instances to provide increased entropy. Virtio RNG is a paravirtual random number generation device. It allows the compute node to provide entropy to the compute instances in order to fill their entropy pool. The default entropy device used is /dev/random, however use of a physical hardware RNG device attached to the host is also possible. The use of the Virtio RNG device is enabled using the hw_rng property in the metadata of the image used to build the instance.
  • The Libvirt driver now allows the configuration of instances to use video driver other than the default (cirros). This allows the specification of different video driver models, different amounts of video RAM, and different numbers of heads. These values are configured by setting the hw_video_model, hw_video_vram, and hw_video_head properties in the image metadata. Currently supported video driver models are vga, cirrus, vmvga, xen and qxl.
  • Watchdog support has been added to the Libvirt driver. The watchdog device used is i6300esb. It is enabled by setting the hw_watchdog_action property in the image properties or flavor extra specifications (extra_specs) to a value other than disabled. Supported hw_watchdog_action property values, which denote the action for the watchdog device to take in the event of an instance failure, are poweroff, reset, pause, and none.
  • The High Precision Event Timer (HPET) is now disabled for instances created using the Libvirt driver. The use of this option was found to lead to clock drift in Windows guests when under heavy load.
  • The libvirt driver now supports waiting for an event from Neutron during instance boot for better reliability. This requires a suitably new Neutron that supports sending these events, and avoids a race between the instance expecting networking to be ready and the actual plumbing that is required.
VMware
  • The VMware Compute drivers now support the virtual machine diagnostics call. Diagnostics can be retrieved using the "nova diagnostics INSTANCE" command, where INSTANCE is replaced by an instance name or instance identifier.
  • The VMware Compute drivers now booting an instance from an ISO image.
  • The VMware Compute drivers now support the aging of cached images.
XenServer
  • Added initial support for PCI passthrough
  • Maintained group B status through the introduction of the XenServer CI
  • Improved support for ephemeral disks (including migration and resize up of multiple ephemeral disks)
  • Support for vcpu_pin_set, essential when you pin CPU resources to Dom0
  • Numerous performance and stability enhancements

API

  • In OpenStack Compute, the OS-DCF:diskConfig API attribute is no longer supported in V3 of the nova API.
  • The Compute API currently supports both XML and JSON formats. Support for the XML format is now deprecated and will be retired in a future release.
  • The Compute API now exposes a mechanism for permanently removing decommissioned compute nodes. Previously these would continue to be listed even where the compute service had had been disabled and the system re-provisioned. This functionality is provided by the ExtendedServicesDelete API extension.
  • Separated the V3 API admin_actions plugin into logically separate plugins so operators can enable subsets of the functionality currently present in the plugin.
  • The Compute service now uses the tenant identifier instead of the tenant name when authenticating with OpenStack Networking (Neutron). This improves support for the OpenStack Identity API v3 which allows non-unique tenant names.
  • The Compute API now exposes the hypervisor IP address, allowing it to be retrieved by administrators using the nova hypervisor-show command.

Scheduler

  • The scheduler now includes an initial implementation of a caching scheduler driver. The caching scheduler uses the existing facilities for applying scheduler filters and weights but caches the list of available hosts. When a user request is passed to the caching scheduler it attempts to perform scheduling based on the list of cached hosts, with a view to improving scheduler performance.
  • A new scheduler filter, AggregateImagePropertiesIsolation, has been introduced. The new filter schedules instances to hosts based on matching namespaced image properties with host aggregate properties. Hosts that do not belong to any host aggregate remain valid scheduling targets for instances based on all images. The new Compute service configuration keys aggregate_image_properties_isolation_namespace and aggregate_image_properties_isolation_separator are used to determine which image properties are examined by the filter.
  • Weight normalization in OpenStack Compute: See:
    • https://review.openstack.org/#/c/27160/ Weights are normalized, so there is no need to inflate multipliers artificially. The maximum weight that a weigher will put for a node is 1.0 and the minimum is 0.0.
  • The scheduler now supports server groups. The following types are supported - anti-affinity and affinity filters. That is, a server that is deployed will be done according to a predefined policy.

Other Features

  • Notifications are now generated upon the creation and deletion of keypairs.
  • Notifications are now generated when an Compute host is enabled, disabled, powered on, shut down, rebooted, put into maintenance mode and taken out of maintenance mode.
  • Compute services are now able to shutdown gracefully by disabling processing of new requests when a service shutdown is requested but allowing requests already in process to complete before terminating.
  • The Compute service determines what action to take when instances are found to be running that were previously marked deleted based on the value of the running_deleted_instance_action configuration key. A new shutdown value has been added. Using this new value allows administrators to optionally keep instances found in this state for diagnostics while still releasing the runtime resources.
  • File injection is now disabled by default in OpenStack Compute. Instead it is recommended that the ConfigDrive and metadata server facilities are used to modify guests at launch. To enable file injection modify the inject_key and inject_partition configuration keys in /etc/nova/nova.conf and restart the Compute services. The file injection mechanism is likely to be disabled in a future release.
  • A number of changes have been made to the expected format /etc/nova/nova.conf configuration file with a view to ensuring that all configuration groups in the file use descriptive names. A number of driver specific flags, including those for the Libvirt driver, have also been moved to their own option groups.

Known Issues

  • OpenStack Compute has some features that use newer API versions from other projects, but the following are the only API versions tested in Icehouse:
    • Keystone v2
    • Cinder v1
    • Glance v1
  • The libvirt driver backed by Xen or LXC is an untested configuration (group C on HypervisorSupportMatrix). Since it's untested, a change made it in that broke both of these configurations. [1]

Upgrade Notes

  • Scheduler and weight normalization (https://review.openstack.org/#/c/27160/): In previous releases the Compute and Cells scheduler used raw weights (i.e. the weighers returned any value, and that was the value used by the weighing proccess).
    • If you were using several weighers for Compute:
      • If several weighers were used (in previous releases Nova only shipped one weigher for compute), it is possible that your multipliers were inflated artificially in order to make an important weigher prevail against any other weigher that returned large raw values. You need to check your weighers and take into account that now the maximum and minimum weights for a host will always be 1.0 and 0.0.
    • If you are using cells:
      • nova.cells.weights.mute_child.MuteChild: The weigher returned the value mute_weight_value as the weight assigned to a child that didn't update its capabilities in a while. It can still be used, but will have no effect on the final weight that will be computed by the weighing process, that will be 1.0. If you are using this weigher to mute a child cell you need to adjust the mute_weight_multiplier.
      • nova.cells.weights.weight_offset.WeightOffsetWeigher introduces a new configuration option offset_weight_multiplier. This new option has to be adjusted. In previous releases, the weigher returned the value of the configured offset for each of the cells in the weighing process. While the winner of that process will still be the same, it will get a weight of 1.0. If you were using this weigher and you were relying in its value to make it prevail against any other weighers you need to adjust its multiplier accordingly.
  • An early Docker compute driver was included in the Havana release. This driver has been moved from Nova into its own repository. The new location is http://git.openstack.org/cgit/stackforge/nova-docker
  • https://review.openstack.org/50668 - The compute_api_class configuration option has been removed.
  • https://review.openstack.org/#/c/54290/ - The following deprecated configuration option aliases have been removed in favor of their new names:
    • service_quantum_metadata_proxy
    • quantum_metadata_proxy_shared_secret
    • use_quantum_default_nets
    • quantum_default_tenant_id
    • vpn_instance_type
    • default_instance_type
    • quantum_url
    • quantum_url_timeout
    • quantum_admin_username
    • quantum_admin_password
    • quantum_admin_tenant_name
    • quantum_region_name
    • quantum_admin_auth_url
    • quantum_api_insecure
    • quantum_auth_strategy
    • quantum_ovs_bridge
    • quantum_extension_sync_interval
    • vmwareapi_host_ip
    • vmwareapi_host_username
    • vmwareapi_host_password
    • vmwareapi_cluster_name
    • vmwareapi_task_poll_interval
    • vmwareapi_api_retry_count
    • vnc_port
    • vnc_port_total
    • use_linked_clone
    • vmwareapi_vlan_interface
    • vmwareapi_wsdl_loc
  • The PowerVM driver has been removed: https://review.openstack.org/#/c/57774/
  • The keystone_authtoken defaults changed in nova.conf: https://review.openstack.org/#/c/62815/
  • libvirt lvm names changed from using instance_name_template to instance uuid (https://review.openstack.org/#/c/76968). Possible manual cleanup required if using a non default instance_name_template.
  • rbd disk names changed from using instance_name_template to instance uuid. Manual cleanup required of old virtual disks after the transition. (TBD find review)
  • Icehouse brings libguestfs as a requirement. Installing icehouse dependencies on a system currently running havana may cause the havana node to begin using libguestfs and break unexpectedly. It is recommended that libvirt_inject_partition=-2 be set on havana nodes prior to starting an upgrade of packages on the system if the nova packages will be updated last.
  • Creating a private flavor now adds access to the tenant automatically. This was the documented behavior in Havana, but the actual mplementation in Havana and previous versions of Nova did not add the tenant automatically to private flavors.
  • Nova previously included a nova.conf.sample. This file was automatically generated and is no longer included directly. If you are packaging Nova and wish to include the sample config file, see etc/nova/README.nova.conf for instructions on how to generate the file at build time.
  • Nova now defaults to requiring an event from Neutron when booting libvirt guests. If you upgrade Nova before Neutron, you must disable this feature in Nova until Neutron supports it by setting vif_plugging_is_fatal=False and vif_plugging_timeout=0. Recommended order is: Nova (with this disabled), Neutron (with the notifications enabled), and then enable vif_plugging_is_fatal=True with the default value of vif_plugging_timeout.
  • Nova supports a limited live upgrade model for the compute nodes in Icehouse. To do this, upgrade controller infrastructure (everthing except nova-compute) first, but set the [upgrade_levels]/compute=icehouse-compat option. This will enable Icehouse controller services to talk to Havana compute services. Upgrades of individual compute nodes can then proceed normally. When all the computes are upgraded, unset the compute version option to retain the default and restart the controller services. NB: Certain operations (such as resize/migrate) will not work while the compute version is pinned.
  • The following configuration options are marked as deprecated in this release. See nova.conf.sample for their replacements. [GROUP]/option
    • [DEFAULT]/rabbit_durable_queues
    • [rpc_notifier2]/topics
    • [DEFAULT]/log_config
    • [DEFAULT]/logfile
    • [DEFAULT]/logdir
    • [DEFAULT]/base_dir_name
    • [DEFAULT]/instance_type_extra_specs
    • [DEFAULT]/db_backend
    • [DEFAULT]/sql_connection
    • [DATABASE]/sql_connection
    • [sql]/connection
    • [DEFAULT]/sql_idle_timeout
    • [DATABASE]/sql_idle_timeout
    • [sql]/idle_timeout
    • [DEFAULT]/sql_min_pool_size
    • [DATABASE]/sql_min_pool_size
    • [DEFAULT]/sql_max_pool_size
    • [DATABASE]/sql_max_pool_size
    • [DEFAULT]/sql_max_retries
    • [DATABASE]/sql_max_retries
    • [DEFAULT]/sql_retry_interval
    • [DATABASE]/reconnect_interval
    • [DEFAULT]/sql_max_overflow
    • [DATABASE]/sqlalchemy_max_overflow
    • [DEFAULT]/sql_connection_debug
    • [DEFAULT]/sql_connection_trace
    • [DATABASE]/sqlalchemy_pool_timeout
    • [DEFAULT]/memcache_servers
    • [DEFAULT]/libvirt_type
    • [DEFAULT]/libvirt_uri
    • [DEFAULT]/libvirt_inject_password
    • [DEFAULT]/libvirt_inject_key
    • [DEFAULT]/libvirt_inject_partition
    • [DEFAULT]/libvirt_vif_driver
    • [DEFAULT]/libvirt_volume_drivers
    • [DEFAULT]/libvirt_disk_prefix
    • [DEFAULT]/libvirt_wait_soft_reboot_seconds
    • [DEFAULT]/libvirt_cpu_mode
    • [DEFAULT]/libvirt_cpu_model
    • [DEFAULT]/libvirt_snapshots_directory
    • [DEFAULT]/libvirt_images_type
    • [DEFAULT]/libvirt_images_volume_group
    • [DEFAULT]/libvirt_sparse_logical_volumes
    • [DEFAULT]/libvirt_images_rbd_pool
    • [DEFAULT]/libvirt_images_rbd_ceph_conf
    • [DEFAULT]/libvirt_snapshot_compression
    • [DEFAULT]/libvirt_use_virtio_for_bridges
    • [DEFAULT]/libvirt_iscsi_use_multipath
    • [DEFAULT]/libvirt_iser_use_multipath
    • [DEFAULT]/matchmaker_ringfile
    • [DEFAULT]/agent_timeout
    • [DEFAULT]/agent_version_timeout
    • [DEFAULT]/agent_resetnetwork_timeout
    • [DEFAULT]/xenapi_agent_path
    • [DEFAULT]/xenapi_disable_agent
    • [DEFAULT]/xenapi_use_agent_default
    • [DEFAULT]/xenapi_login_timeout
    • [DEFAULT]/xenapi_connection_concurrent
    • [DEFAULT]/xenapi_connection_url
    • [DEFAULT]/xenapi_connection_username
    • [DEFAULT]/xenapi_connection_password
    • [DEFAULT]/xenapi_vhd_coalesce_poll_interval
    • [DEFAULT]/xenapi_check_host
    • [DEFAULT]/xenapi_vhd_coalesce_max_attempts
    • [DEFAULT]/xenapi_sr_base_path
    • [DEFAULT]/target_host
    • [DEFAULT]/target_port
    • [DEFAULT]/iqn_prefix
    • [DEFAULT]/xenapi_remap_vbd_dev
    • [DEFAULT]/xenapi_remap_vbd_dev_prefix
    • [DEFAULT]/xenapi_torrent_base_url
    • [DEFAULT]/xenapi_torrent_seed_chance
    • [DEFAULT]/xenapi_torrent_seed_duration
    • [DEFAULT]/xenapi_torrent_max_last_accessed
    • [DEFAULT]/xenapi_torrent_listen_port_start
    • [DEFAULT]/xenapi_torrent_listen_port_end
    • [DEFAULT]/xenapi_torrent_download_stall_cutoff
    • [DEFAULT]/xenapi_torrent_max_seeder_processes_per_host
    • [DEFAULT]/use_join_force
    • [DEFAULT]/xenapi_ovs_integration_bridge
    • [DEFAULT]/cache_images
    • [DEFAULT]/xenapi_image_compression_level
    • [DEFAULT]/default_os_type
    • [DEFAULT]/block_device_creation_timeout
    • [DEFAULT]/max_kernel_ramdisk_size
    • [DEFAULT]/sr_matching_filter
    • [DEFAULT]/xenapi_sparse_copy
    • [DEFAULT]/xenapi_num_vbd_unplug_retries
    • [DEFAULT]/xenapi_torrent_images
    • [DEFAULT]/xenapi_ipxe_network_name
    • [DEFAULT]/xenapi_ipxe_boot_menu_url
    • [DEFAULT]/xenapi_ipxe_mkisofs_cmd
    • [DEFAULT]/xenapi_running_timeout
    • [DEFAULT]/xenapi_vif_driver
    • [DEFAULT]/xenapi_image_upload_handler

OpenStack Image Service (Glance)

Key New Features

Known Issues

Upgrade Notes

OpenStack Dashboard (Horizon)

Key New Features

Known Issues

Upgrade Notes

OpenStack Identity (Keystone)

Key New Features

  • New API features
    • /v3/OS-FEDERATION/ allows Keystone to consume federated authentication via Shibboleth for multiple Identity Providers, and mapping federated attributes into OpenStack group-based role assignments (see documentation).
    • POST /v3/users/{user_id}/password allows API users to update their own passwords (see documentation).
    • GET v3/auth/token?nocatalog allows API users to opt-out of receiving the service catalog when performing online token validation (see documentation).
    • /v3/regions provides a public interface for describing multi-region deployments (see documentation).
    • /v3/OS-SIMPLECERT/ now publishes the certificates used for PKI token validation (see documentation).
    • /v3/OS-TRUST/trusts is now capable of providing limited-use delegation via the remaining_uses attribute of trusts.
  • The assignments backend (the source of authorization data) has now been completely separated from the identity backend (the source of authentication data). This means that you can now back your deployment's identity data to LDAP, and your authorization data to SQL, for example.
  • KVS drivers are now capable of writing to persistent Key-Value stores such as Redis, Cassandra, or MongoDB.
  • Keystone's driver interfaces are now implemented as Abstract Base Classes (ABCs) to make it easier to track compatibility of custom driver implementations across releases.
  • Keystone's default etc/policy.json has been rewritten in an easier to read format.
  • Notifications are now emitted in response to create, update and delete events on roles, groups, and trusts.
  • Custom extensions and driver implementations may now subscribe to internal-only event notifications, including disable events (which are only exposed externally as part of update events).
  • Keystone now emits Cloud Audit Data Federation (CADF) event notifications in response to authentication events.
  • Additional plugins are provided to handle external authentication via REMOTE_USER with respect to single-domain versus multi-domain deployments.
  • policy.json can now perform enforcement on the target domain in a domain-aware operationusing, for example, %(target.{entity}.domain_id)s.
  • The LDAP driver for the assignment backend now supports group-based role assignment operations.
  • Keystone now publishes token revocation events in addition to providing continued support for token revocation lists. Token revocation events are designed to consume much less overhead (when compared to token revocation lists) and will enable Keystone eliminate token persistence during the Juno release.
  • Deployers can now define arbitrary limits on the size of collections in API responses (for example, GET /v3/users might be configured to return only 100 users, rather than 10,000). Clients will be informed when truncation has occurred.
  • Lazy translation has been enabled to translating responses according to the requested Accept-Language header.
  • Keystone now emits i18n-ready log messages.
  • Collection filtering is now performed in the driver layer, where possible, for improved performance.

Known Issues

  • Bug 1291157: If using the OS-FEDERATION extension, deleting an Identity Provider or Protocol does not result in previously-issued tokens being revoked. This will not be fixed in the stable/icehouse branch.

Upgrade Notes

  • The v2 API has been prepared for deprecation, but remains stable in the Icehouse release. It may be formally deprecated during the Juno release pending widespread support for the v3 API.
  • Backwards compatibility for keystone.middleware.auth_token has been removed. auth_token middleware module is no longer provided by Keystone itself, and must be imported from keystoneclient.middleware.auth_token instead.
  • The s3_token middleware module is no longer provided by Keystone itself, and must be imported from keystoneclient.middleware.s3_token instead. Backwards compatibility for keystone.middleware.s3_token will be removed in Juno.
  • The default token duration has been reduced from 24 hours to just 1 hour. This effectively reduces the number of tokens that must be persisted at any one time, and (for PKI deployments) reduces the overhead of the token revocation list.
  • keystone.contrib.access.core.AccessLogMiddleware has been deprecated in favor of either the eventlet debug access log or Apache httpd access log and may be removed in the K release.
  • keystone.contrib.stats.core.StatsMiddleware has been deprecated in favor of external tooling and may be removed in the K release.
  • keystone.middleware.XmlBodyMiddleware has been deprecated in favor of support for "application/json" only and may be removed in the K release.
  • TODO: unified assignment table migration
  • TODO: deprecations for the move to oslo-incubator db
  • TODO: mutable domain_id is false by default we opted (iirc) to say "this is security related" so if osmeone relies on that they need to re-enable it -morganfainberg
  • TODO: any non-ideal default values that will be changed in the future

OpenStack Network Service (Neutron)

Key New Features

Known Issues

None yet.

Upgrade Notes

OpenStack Block Storage (Cinder)

Key New Features

Known Issues

None yet

Upgrade Notes

OpenStack Metering (Ceilometer)

Key New Features

Known Issues

https://bugs.launchpad.net/ceilometer/+bug/1297528

Upgrade Notes

None yet

OpenStack Orchestration (Heat)

Key New Features

Known Issues

None yet

Upgrade Notes

None yet

OpenStack Database service (Trove)

Key New Features

Known Issues

None yet

Upgrade Notes

None yet

OpenStack Documentation

Key New Features

Known Issues

Upgrade Notes

None yet