Bug 1493961

For reference this is the section from the POST-UPGRADE section:

~~~
OpenStack Block Storage (cinder) API uses a new sizelimit filter in Red Hat OpenStack Platform 11. However, following an upgrade path from OpenStack Platform 9 to OpenStack Platform 10 to OpenStack Platform 11 might not update to this new filter. Check the filter on Controller or Cinder API nodes using the following command:

$ grep filter:sizelimit /etc/cinder/api-paste.ini -A1
The filter should appear as the following:

[filter:sizelimit]
paste.filter_factory = oslo_middleware.sizelimit:RequestBodySizeLimiter.factory
If not, replace the value in the /etc/cinder/api-paste.ini file of each Controller or Cinder API node and restart the httpd service:

$ sudo sed -i s/cinder.api.middleware.sizelimit/oslo_middleware.sizelimit/ /etc/cinder/api-paste.ini
$ sudo systemctl restart httpd
~~~

Hi,

This is fixed there https://bugzilla.redhat.com/show_bug.cgi?id=1444643 .  So this workaround is no longer needed since openstack-tripleo-heat-templates-5.3.0-2.el7ost.

Martin, is that ok or do we still need the doc workaround ?

(In reply to Sofer Athlan-Guyot from comment #2)
> Hi,
> 
> This is fixed there https://bugzilla.redhat.com/show_bug.cgi?id=1444643 . 
> So this workaround is no longer needed since
> openstack-tripleo-heat-templates-5.3.0-2.el7ost.
> 
> Martin, is that ok or do we still need the doc workaround ?

What we did:
1) performed a minor update of the OSP10 env to latest at Sep 20th. Since the
   mentioned errata got released on the 6th Sept we should have had this. I
   do not have logs to check that now.
2) update to OSP11 with openstack-tripleo-heat-templates-6.2.0-3.el7ost. This 
   should also have the fix, but we still have seen the issue and had to fix 
   /etc/cinder/api-paste.ini .

We realized it in step 3.6.3 to update the computes, and as the workaround is mentioned in the 3.7 Post-Upgrade Notes it was/is too late in the process. 

So not sure why we have seen the issue even with the fix in place. Might be 
better to keep the workaround and add move it before the upgrade of the computes?

(In reply to Martin Schuppert from comment #3)
> (In reply to Sofer Athlan-Guyot from comment #2)
> > Hi,
> > 
> > This is fixed there https://bugzilla.redhat.com/show_bug.cgi?id=1444643 . 
> > So this workaround is no longer needed since
> > openstack-tripleo-heat-templates-5.3.0-2.el7ost.
> > 
> > Martin, is that ok or do we still need the doc workaround ?
> 
> What we did:
> 1) performed a minor update of the OSP10 env to latest at Sep 20th. Since the
>    mentioned errata got released on the 6th Sept we should have had this. I
>    do not have logs to check that now.

Hum, starting from osp10 is too late for this patch as it does not get applied during update but only during upgrade.

> 2) update to OSP11 with openstack-tripleo-heat-templates-6.2.0-3.el7ost.
> This 
>    should also have the fix, but we still have seen the issue and had to fix 
>    /etc/cinder/api-paste.ini .

So the working path is osp9 (the above patch in osp10) -> upgrade to 10.  Anything else won't work.  It doesn't do anything in osp10->11 upgrade.

> 
> We realized it in step 3.6.3 to update the computes, and as the workaround
> is mentioned in the 3.7 Post-Upgrade Notes it was/is too late in the
> process. 
> 
> So not sure why we have seen the issue even with the fix in place. Might be 
> better to keep the workaround and add move it before the upgrade of the
> computes?

The fix is only applied during osp9->10 upgrade, that's why.  The "good" workaround for osp9->10 upgrade is the one in that diff: https://review.openstack.org/#/c/459271/6/extraconfig/tasks/major_upgrade_controller_pacemaker_2.sh

Applying this will enable you to not have to constantly patch this file.  Basically to end this you have to:

 cp /etc/cinder/api-paste.ini.rpmnew /etc/cinder/api-paste.ini

As soon as you are in line with rpm then it gets updated.

So I would say that the workaround in the documentation is just asking for trouble.  This file will never be updated by rpm as it detects a modification (an added newline is enough).  For each upgrade you'll have an api-paste.ini.rpmnew file and you'll have to make some adjustment manually.

So back to the fix.  What it does is that it revert the deprecated way of setting up tls in OSP9 so that it looks like the original api-paste.ini from the package.  The normal rpm upgrade can kick in instead of having any rpmnew file created.

So back to documentation.  The best way to get this out manually is:

  diff /etc/cinder/paste-ini.conf.rpmnew /etc/cinder/paste-ini.conf

check that there is no user site modification. Then

  cp /etc/cinder/paste-ini.conf.rpmnew /etc/cinder/paste-ini.conf

And you won't be bothered anymore.

(In reply to Sofer Athlan-Guyot from comment #4)
> (In reply to Martin Schuppert from comment #3)
> > (In reply to Sofer Athlan-Guyot from comment #2)
> > > Hi,
> > > 
> > > This is fixed there https://bugzilla.redhat.com/show_bug.cgi?id=1444643 . 
> > > So this workaround is no longer needed since
> > > openstack-tripleo-heat-templates-5.3.0-2.el7ost.
> > > 
> > > Martin, is that ok or do we still need the doc workaround ?
> > 
> > What we did:
> > 1) performed a minor update of the OSP10 env to latest at Sep 20th. Since the
> >    mentioned errata got released on the 6th Sept we should have had this. I
> >    do not have logs to check that now.
> 
> Hum, starting from osp10 is too late for this patch as it does not get
> applied during update but only during upgrade.

For customers which are already on OSP10 with a version before we released
the fix, like we were here, don't we still need then the documentation to
either state the workaround we have at the moment, just at the correct step
of the doc or just make sure to copy the rpmnew :

cp /etc/cinder/paste-ini.conf.rpmnew /etc/cinder/paste-ini.conf

> 
> > 2) update to OSP11 with openstack-tripleo-heat-templates-6.2.0-3.el7ost.
> > This 
> >    should also have the fix, but we still have seen the issue and had to fix 
> >    /etc/cinder/api-paste.ini .
> 
> So the working path is osp9 (the above patch in osp10) -> upgrade to 10. 
> Anything else won't work.  It doesn't do anything in osp10->11 upgrade.
> 
> > 
> > We realized it in step 3.6.3 to update the computes, and as the workaround
> > is mentioned in the 3.7 Post-Upgrade Notes it was/is too late in the
> > process. 
> > 
> > So not sure why we have seen the issue even with the fix in place. Might be 
> > better to keep the workaround and add move it before the upgrade of the
> > computes?
> 
> The fix is only applied during osp9->10 upgrade, that's why.  The "good"
> workaround for osp9->10 upgrade is the one in that diff:
> https://review.openstack.org/#/c/459271/6/extraconfig/tasks/
> major_upgrade_controller_pacemaker_2.sh
> 
> Applying this will enable you to not have to constantly patch this file. 
> Basically to end this you have to:
> 
>  cp /etc/cinder/api-paste.ini.rpmnew /etc/cinder/api-paste.ini
> 
> As soon as you are in line with rpm then it gets updated.
> 
> So I would say that the workaround in the documentation is just asking for
> trouble.  This file will never be updated by rpm as it detects a
> modification (an added newline is enough).  For each upgrade you'll have an
> api-paste.ini.rpmnew file and you'll have to make some adjustment manually.
> 
> So back to the fix.  What it does is that it revert the deprecated way of
> setting up tls in OSP9 so that it looks like the original api-paste.ini from
> the package.  The normal rpm upgrade can kick in instead of having any
> rpmnew file created.
> 
> So back to documentation.  The best way to get this out manually is:
> 
>   diff /etc/cinder/paste-ini.conf.rpmnew /etc/cinder/paste-ini.conf
> 
> check that there is no user site modification. Then
> 
>   cp /etc/cinder/paste-ini.conf.rpmnew /etc/cinder/paste-ini.conf
> 
> And you won't be bothered anymore.

Hi Dan,

so in "3.7. POST-UPGRADE NOTES FOR THE OVERCLOUD" of osp10 documentation could we have a note saying that cinder configuration need to be checked because of an issue before openstack-tripleo-heat-templates-5.3.0-2.el7ost.

The check being:

   diff /etc/cinder/paste-ini.conf.rpmnew /etc/cinder/paste-ini.conf

if anything appears that the user did not set up explicitly, then it has to overwrite this file to get the latest changes:

   cp /etc/cinder/paste-ini.conf.rpmnew /etc/cinder/paste-ini.conf

ACK

OSP11 is now retired, see details at https://access.redhat.com/errata/product/191/ver=11/rhel---7/x86_64/RHBA-2018:1828