What's new in OpenStack Ocata

OpenStack Ocata has now been out for a little over a month and we're about to see the first milestone of the Pike release. Past cycles show that now's about the time when people start looking at the new release to see if they should consider moving to it. So here's a quick overview of what's new in this release.

First, it's important to remember that the Ocata cycle was very short. We usually do a release every six months, but with the rescheduling of the OpenStack Summit and OpenStack PTG (Project Team Gathering) events, Ocata was squeezed into 4 months to realign the releases with these events. So, while some projects squeezed a surprising amount of work into that time, most projects spent the time on smaller features and finishing up tasks leftover from the previous release.

At a high level, the Ocata release was all about upgrades and containers, themes that I heard from almost every team I interviewed. Developers spoke of how we can make upgrades smoother, and how we can deploy bits of the infrastructure in containers. These two things are closely related, and there seems to be more cross-project collaboration this time around than I've noticed in the past.

And the themes of upgrades and containers will continue to be prominent in the Pike cycle. Some of the other highlights in the Ocata cycle include:

• Auto-healing: Work was done in Heat to make it easier to recover from a service failure. When an outage is detected, you can have Heat automatically spin up a replacement service, and swap it out without any intervention on the part of the operator.
• Composability: Composable roles are a feature whereby you can specify details of how things are deployed, rather than allowing OpenStack to choose. You can, for example, specify that a particular hardware configuration be used for particular services. This is termed Composable Roles. Work was done in Ocata to expand this to composable upgrades, so that these roles are respected across upgrades as well.
• Multi-factor authentication in Keystone: Work was done in Keystone to improve support of MFA, including OTP (One Time Password) support, and per-user token expiration rules.
• NFV: Network Function Virtualization continues to be an area where we're seeing a lot of activity, and so a lot of the work in Nova, Neutron, and various other projects focus on these developments. NFV has become more stable in this release and is more fully integrated into TripleO for ease of deployment. This effort is happening under the Apex project.
• Upgrades: Upgrades were a common theme across all projects, with the emphasis being the ability to upgrade from one release to the next with as close to zero downtime as possible. Much of this work centers around TripleO, Heat, and Mistral, for orchestration and automation of the process.
• Containers: While centered around the Kolla project, containerization was a theme in many of the projects this cycle. The eventual goal, at least according to some, is that OpenStack services will be deployed in containers by default by the Pike release. This, of course, poses a real challenge for the Ocata -> Pike upgrade path (migrating from non-container to container in the course of the upgrade), and that's something that the TripleO people are working hard on.
• Security: TLS-everywhere made strides forward in Ocata, with connections between services moving to TLS. This involves changes to Barbican as well, for key management for the shared keys between services, to ensure that your traffic is secure between components of your cloud, which may be located in different data centers around the world.
• Collaboration: Something I heard more this year than in previous years was talk of collaboration between projects. This has, of course, always been happening. However, at the PTG in Atlanta, it was a major focus, with time set aside for cross-project meetings focusing on the interface between one service and another. I also heard from several people that the PTG allowed a focus, and a camaraderie, that was not possible when the design summit was part of OpenStack Summit. This resulted in fewer interpersonal tensions, and a lot more work getting done.

The difficulty with OpenStack is that it's just so big. While these are the things that stood out to me, someone else is likely to pull out different highlights, depending on their interests. So I encourage you to look at some of the other "What's new in Ocata" articles out there, including especially "53 new things to look for in OpenStack Ocata" and, if you have a lot of time, or have an interest in a particular project, check out the official release notes. And be sure to take a moment to watch my interviews with various OpenStack engineers, from the Atlanta PTG, here.