Cisco Openstack h.3

h.3 is a maintenance release that includes miscellaneous Puppet fixes as well as 2013.2.3 patches from upstream.

Milestone information

Cisco Openstack
Mark T. Voelker
Release registered:
No. Drivers cannot target bugs and blueprints to this milestone.  

Download RDF metadata


Assigned to you:
No blueprints or bugs assigned to you.
4 Chris Ricker, 1 Don Talton, 8 Mark T. Voelker, 3 Pradeep Kilambi
No blueprints are targeted to this milestone.
16 Fix Released

Download files for this release

File Description Downloads

Release notes 

This release contains all upstream stable branch patches for OpenStack core components including Nova, Neutron, Cinder, Glance, Keystone, Horizon, Heat, Ceilometer, and Swift as of 2013.2.3 and selected stable branch fixes thereafter. This release also features Puppet automation updates from StackForge.

Getting the Source and Installing the Release
Information about how to install Cisco OpenStack Edition - Havana can be found here:

Note that the instructions provided will install the latest stable maintenance patches for Havana, which may be newer than those in the h.3 release. If you need to specifically install the versions of the packages released in h.3 even though newer maintenance updates are available, you can modify your apt configuration to point to our h.3 snapshot repository. Execute these steps:

1.) Edit /etc/apt/sources.list.d/cisco-openstack-mirror_havana.list and change the following lines:

deb havana main
deb-src havana main


deb havana/snapshots/h.3 main
deb-src havana/snapshots/h.3 main

2.) Run "apt-get update" as root or via sudo. You may see a harmless warning of the form "Conflicting distribution: havana/snapshots/h.3 Release (expected havana/snapshots but got havana)". The warning is simply informational and lets you know that you are using a snapshot repository.

3.) To ensure changes are propagated by Puppet, modify data/hiera_data/vendor/cisco_coi_common.yaml and change line 24 from:

pocket: ''


pocket: '/snapshots/h.3'

Then modify install_scripts/ and change lines 18-19 from:

deb havana main
deb-src havana main


deb havana/snapshots/h.3 main
deb-src havana/snapshots/h.3 main

Then proceed with your installation as usual.

Note that you may also choose to run bleeding-edge (and not fully vetted) code by using "-proposed" in place of "/snapshots/h.3" in the above instructions. This is recommended only for developers who expect things to be broken occasionally and is strongly discouraged for production environments.

The source code for this release has been posted to GitHub. Look for the "h.3" tag in the repositories listed here:

We do not support Trove, Marconi, Savanna, Ironic, or other incubated projects in this release although relevant repositories may be made available for customers to experiment with on their own.

Questions may be addressed to or and Cisco engineers will respond on a best effort basis.

Some known limitations and caveats are provided in the installer documentation here:

Customers deploying Ceph should take note of deployment considerations here:

Ceph RBD can be used as a backend for Glance and/or Cinder in this release and is now the default block storage backend for Cinder in Full HA deployments. The module used to deploy Ceph in Grizzly release of Cisco OpenStack Installer has been replaced with a new module based on ceph-deploy, which dramatically speeds up deployment times and doesn't require multiple catalog runs. However, the ceph-deploy tool uses hostname information (e.g. via DNS) to accomplish it's tasks. Customers should therefore ensure that the IP address that the hostname of the initial mon node resolves to is also be configured in user.common.yaml as the inital mon, and the ceph networks should be on the same subnet as that IP address. Otherwise, cephdeploy may fail to set up the cluster properly.

Compressed Active/Active HA Deployments
This release features a "compressed" HA model in which a full high availability model can be achieved on as little as 3 physical nodes. Swift is currently not included in the 3-node HA model (though this could be changed by the user with some changes to the YAML files in /etc/puppet/data). Glance and Cinder are backed by Ceph.

The traditional 13-node "Full HA" model is also available in this release.

All-in-One Deployment Model
The h.3 release includes an "all in one" deployment model that allows users to combine compute and control functions on a single server. The AIO model in h.3 differs from the model provided in g.3 in that it now includes support for Swift Proxy and Storage node roles as well. The all-in-one deployment model can be used in place of a traditional control node to add additional compute/storage capacity to a multi-node cloud by allowing instances to be launched on control nodes.

Load Balancing as a Service, Firewall as a Service, and VPN as a Service
This release of the Cisco OpenStack Installer provides support for deploying Neutron's Load Balancer as a Service (backended by HAProxy), Firewall as a Service (backed by IPTables), and VPN as a Service (backed by OpenSwan). All are enabled by default. Customers deploying these services may wish to take note of some known issues with these implementations described here:

SSL Encryption for Keystone API Endpoint
This release features support for configuring Keystone to use SSL, allowing users to provide their own CA-signed certificates and keys. Please note that automatic generation of certificates and keys is not supported in this release due to apparent issues with Keystone's ssl_setup feature. More information can be found in /etc/puppet/data/hiera_data/user.common.yaml.

Limited Live Migration Support
This release of the Cisco OpenStack Installer provides limited support for live migration, including live migration on NFS shared storage.

Cisco Plugin Support for Neutron
This release provides users with several options for networking, including the use of the OVS and/or Cisco Nexus plugins. Information on configuring the Cisco Nexus plugin can be found in /etc/puppet/data/hiera_data/user.common.yaml.

Change in Database HA Model
The OpenStack community recently discovered that the "select ... for update" used in Neutron, parts of Nova, and possibly other components may produce undefined results manifesting as an apparent database deadlock when used with Galera. Although the community is working to rectify the problem in Juno, in the meantime the configuration for the HAProxy load balancers front-ending Galera writes has been changed to avoid the deadlock issue. In the new model, all writes are performed on one node and the other two database nodes function as sequential backups. This change ensures data is still replicated, but writes are performed on a single node instead of being balanced among three nodes (which may cause a performance drop in large-scale deployments).

Please refer to the following URL for more information, caveats, and installation instructions:


View the full changelog

A list of defects fixed in this release can be found at:

This release includes selected OpenStack core component patches from stable branch, plus updates to client libraries and updated Puppet deployment code from StackForge and Cisco.

0 blueprints and 16 bugs targeted

Bug report Importance Assignee Status
1301418 #1301418 VPNaaS Missing Required Entries in Config Files 3 High Pradeep Kilambi  10 Fix Released
1307536 #1307536 Not able to start haproxy service on H.2 beacuse of novnc port bind issue 3 High Pradeep Kilambi  10 Fix Released
1307537 #1307537 HA Proxy not able to start in H.2 due to Apache listening on 3 High Pradeep Kilambi  10 Fix Released
1321734 #1321734 select ... for update breaks with multi-writer galera 3 High Chris Ricker  10 Fix Released
1329775 #1329775 haproxy not starting in compressed_ha 3 High Chris Ricker  10 Fix Released
1201971 #1201971 Cinder Volume can't attach to Instance on different host 4 Medium Don Talton  10 Fix Released
1292772 #1292772 Duplicate resource error in coe::base 4 Medium Mark T. Voelker  10 Fix Released
1308366 #1308366 Region Data not inserting correctly for all services 4 Medium Mark T. Voelker  10 Fix Released
1314462 #1314462 OSSAs needed for h.3 4 Medium Chris Ricker  10 Fix Released
1289187 #1289187 Bad logic in pipeline check causes spurious warning 5 Low Mark T. Voelker  10 Fix Released
1290508 #1290508 add support for trusty to cobbler 5 Low Chris Ricker  10 Fix Released
1291068 #1291068 Host is declared twice in AIO mode with cobbler enabled 5 Low Mark T. Voelker  10 Fix Released
1292152 #1292152 HA scenarios set wrong openstck_repo_location value 5 Low Mark T. Voelker  10 Fix Released
1304179 #1304179 Removing collectd, graphite from class_groups does not stop it from being installed 5 Low Mark T. Voelker  10 Fix Released
1305261 #1305261 Install doc has wrong path to repo in user.yaml 5 Low Mark T. Voelker  10 Fix Released
1308257 #1308257 Duplicate resource conflict when cobbler enabled on AIO 5 Low Mark T. Voelker  10 Fix Released
This milestone contains Public information
Everyone can see this information.