Cisco Application Policy Infrastructure Controller OpenStack Plugins, Release 2.3(1), Release Notes

Cisco Application Policy Infrastructure Controller OpenStack Plugins, Release 2.3(1), Release Notes

This document describes the features, caveats, and limitations for the Cisco Application Policy Infrastructure Controller (APIC) OpenStack Plugins.

The Cisco APIC plugins are used to deploy and operate OpenStack instances on a Cisco ACI fabric. The plugins allow dynamic creation of networking constructs to be driven directly from OpenStack, while providing additional visibility and control from the Cisco APIC.

For the verified scalability limits (except the CLI limits), see the Verified Scalability Guide for this release. For the OpenStack Platform Scale Limits:

For the CLI verified scalability limits, see the Cisco NX-OS Style Command-Line Interface Configuration Guide for this release.

Release notes are sometimes updated with new information about restrictions and caveats. See the following website for the most recent version of this document:

https://www.cisco.com/c/en/us/support/cloud-systems-management/application-policy-infrastructure-controller-apic/tsd-products-support-series-home.html

Table 1 shows the online change history for this document.

Table 1 Online History Change

Contents

This document includes the following sections:

■      New and Changed Information

■      Cisco APIC and OpenStack Support Compatibility Matrix

■      Usage Guidelines

■      Caveats

■      Related Documentation

■      New Documentation

New and Changed Information

This section lists the new and changed features in this release and includes the following topics:

■      New Software Features

■      Changes in Behavior

New Software Features

The following are the new software features for the 2.3(1e) release:

Table 2 New Software Features

Changes in Behavior

This section lists changes in behavior in this release.

■      The OpFlex client is now authenticated through the SSL certificate. With a new installation of the Cisco APIC, this is now the default behavior. This behavior can be reverted back to no client authentication through the OpflexSettings object. Upon upgrading to a Cisco APIC installation of the 2.3(1) release, the default setting is to not authenticate clients. This behavior changes when the administrator posts OpflexSettings that specify for the Cisco APIC to authenticate clients.

Cisco APIC and OpenStack Support Compatibility Matrix

The following table details the Cisco APIC and OpenStack version compatibilities:

https://www.cisco.com/c/dam/en/us/td/docs/Website/datacenter/aci/virtualization/matrix/virtmatrix.html

Usage Guidelines

The following are known limitations in the 2.3(1) release.

■      Group-based Policy (GBP) and Modular Level 2 (ML2) Unified Mode does not have feature parity with the earlier non-unified mode. In particular, it does not support the following features for deployments that need some of these features, continue using the 2.2(1x) or earlier releases.

·       ESX hypervisor support

·       ASR1K edgeNAT support

·       GBP/NFP Service chaining

·       ML2 Network constraints

■      GBP and ML2 Unified Mode supports their coexistence on the same Openstack/ACI Fabric but they need to be running on different VRFs.

■      GBP and ML2 Unified Mode is a new mode of operation. So, while there can be a manual transition to this mode of usage, there is no automated upgrade from previous install to this mode.

■      Keystone configuration update.

With this version, the following configuration must be performed in neutron.conf:

[apic_aim_auth]

password=<admin_password>

auth_plugin=v3password

user_domain_name=default

project_domain_name=default

project_name=admin

username=admin

auth_url=http://:35357/v3

■      Unified model impact of the transaction Model Updates in Newton.

When GBP and ML2 co-exist, GBP implicitly created some neutron resources. In Newton, the neutron transaction model has been updated and added multiple checks. Some of these checks falsely see this nested transaction usage as an error and log and raise an exception. The exception is handled correctly by GBP and there is no functional impact but the neutron code logs some exceptions in neutron log file – leading to the impression that the action had failed.

While most such exceptions will be logged at the Debug level, occasionally you might see exceptions logged at the Error level. If such an exception log is followed by a log message that indicates the operation is being retried, the exception is being handled correctly. One such example is the following:

Delete of policy-target on a policy-target-group associated to a network-service-policy might raise the following exception:

2017-03-18 12:52:34.421 27767 ERROR neutron.api.v2.resource […] delete failed

2017-03-18 12:52:34.421 27767 ERROR neutron.api.v2.resource Traceback …:

2017-03-18 12:52:34.421 27767 ERROR neutron.api.v2.resource   File "/usr/lib/python2.7/site-packages/neutron/api/v2/resource.py", line 84, …

...

2017-03-18 12:52:34.421 27767 ERROR neutron.api.v2.resource     raise …

2017-03-18 12:52:34.421 27767 ERROR neutron.api.v2.resource ResourceClosedError: This transaction is closed

Note: We are working with the upstream community for further support on Error level logs.

■      If you use tempest to validate Openstack, the following tests are expected to fail and can be ignored:

·       tempest.api.network.test_networks.NetworksTest.test_external_network_visibility

·       tempest.scenario.test_network_basic_ops.TestNetworkBasicOps.test_update_router_admin_state

■      When a L2 Policy is deleted in GBP, some implicit artifacts related to it may not be deleted (resulting in unused BDs/subnets on Cisco APIC).

Note: If you encounter this, the workaround is to create a new empty L2Policy in the same context and deleting it.

■      The ASR1K for edge-NAT doesn't provide support to create instances attached to external networks.

■      If a defaultVRF is implicitly created for a tenant in ML2, it is not implicitly deleted until the tenant is deleted (even if it not being used anymore).

■      Dual stack operation requires that all IPv4 and IPv6 subnets - both for internal and external networks - use the same VRF in ACI. The one exception to this is when separate external networks are used for IPv4 and IPv6 traffic. In this workflow, the IPv4 and IPv6 subnets used for internal networks plus the IPv6 subnets used for external networks all belong to one VRF, while the subnets for the IPv4 external network belong to a different VRF. IPv4 NAT can then be used for external networking.

Caveats

This section contains lists of open and resolved caveats and known behaviors.

■      Open Caveats

■      Resolved Caveats

■      Known Behaviors

Open Caveats

This section lists the open caveats. Click the bug ID to access the Bug Search tool and see additional information about the bug. If a caveat is fixed in a patch of this release, the "Fixed In" column of the tables specifies the release.

Open Caveats in the 2.3(1) Release

There are no open caveats in the 2.3(1) release.

Resolved Caveats

This section lists the resolved caveats. Click the bug ID to access the Bug Search tool and see additional information about the bug.

Resolved Caveats in the 2.3(1) Release

The following table lists the resolved caveats in the 2.3(1) release.

Table 3 Resolved Caveats in the 2.3(1) Release

Known Behaviors

This section lists caveats that describe known behaviors. Click the Bug ID to access the Bug Search Tool and see additional information about the bug.

Known Behaviors in the 2.3(1) Release

There are no known behaviors in the 2.3(1) release.

Related Documentation

The Cisco Application Policy Infrastructure Controller (APIC) documentation can be accessed from the following website:

https://www.cisco.com/c/en/us/support/cloud-systems-management/application-policy-infrastructure-controller-apic/tsd-products-support-series-home.html

The documentation includes installation, upgrade, configuration, programming, and troubleshooting guides, technical references, release notes, and knowledge base (KB) articles, as well as other documentation. KB articles provide information about a specific use case or a specific topic.

By using the "Choose a topic" and "Choose a document type" fields of the APIC documentation website, you can narrow down the displayed documentation list to make it easier to find the desired document.

New Documentation

There are no new Cisco APIC product documents for this release.

 

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

© 2017-2018 Cisco Systems, Inc. All rights reserved.