Synopsis

OpenShift Container Platform 3.4.1.12, 3.3.1.17-4, and 3.2.1.30 bug fix update

Type/Severity

Bug Fix Advisory

Topic

Red Hat OpenShift Container Platform releases 3.4.1.12, 3.3.1.17, and 3.2.1.30 are now available with updates to packages and images that fix several bugs.

Description

Red Hat OpenShift Container Platform is the company's cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container Platform 3.4.1.12, 3.3.1.17-4, and 3.2.1.30. See the following advisory for the container images for this release:

https://access.redhat.com/errata/RHBA-2017:0866

This update fixes the following bugs:

• When updating the atomic-openshift-docker-excluder RPM, the new RPM was not running the unexclude script of the old RPM. This caused the old excludes in the yum.conf file to not be cleaned up if there was any differences between the old and new excluders. This bug fix ensures the new RPM runs the old RPM's unexclude script before it touches anything. As a result, all of the old excludes in yum.conf are cleaned up when there is an update. (BZ#1430929)
  
• The index used by the Search Guard plug-in was not seeding properly. This caused the Elasticsearch node to get in a waiting state for the Search Guard ACLs and not service any requests. This bug fix moves the initial seeding logic to when the server starts in its run.sh. As a result, the initial Search Guard documents are seeded and the plug-in services requests.
  (BZ#1431551, BZ#1432250)
  
• The Search Guard plug-in was trying to seed an index that did not exist yet, which generated an error. This bug fix catches the exception and returns silently. As a result, the plug-in will continue to try and seed index without generating exception. (BZ#1430913)
  
• Nodes initialized some of their data structures incorrectly at startup. After restarting a node, pods on that node would be unable to access some service IP addresses until a change was made to that service or a resync occurred. This bug fix updates the initialization code, and as a result all services should be accessible as expected after restarting a node.
  (BZ#1380167)
  
• Quickly and repeatedly adding and deleting a route with same name in a namespace could cause the router pod to panic with a "invalid state transition: DELETED -> ADDED" message. This bug fix adds the objects UID to the event queue key generation function, and as a result this panic no longer occurs. (BZ#1419771)
  
• OpenShift Container Platform (OCP) 3.3 uses Cassandra 2.2.7, which does not ship with TimeWindowCompactionStrategy (TWCS). TWCS was previously backported to OCP 3.3 to address some compaction related problems. OCP 3.4 uses Cassandra 3.0.9 which does ship with TWCS; however, class names have changed. When Cassandra starts, it cannot find the TWCS classes that were being used in OCP 3.3. This caused Cassandra to fail to start after upgrading from OCP 3.3 to 3.4. This bug fix ensures that the older version of TWCS is now packaged with Cassandra in OCP 3.4. As a result, Cassandra starts up, and Hawkular Metrics is able to apply schema updates as expected. (BZ#1435706)
  

All OpenShift Container Platform 3 users are advised to upgrade to these updated packages and images.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For OpenShift Container Platform 3.4, see the following documentation, which will be updated shortly for release 3.4.1.12, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.4/release_notes/ocp_3_4_release_notes.html

For OpenShift Container Platform 3.3, see the following documentation, which will be updated shortly for release 3.3.1.17-4, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.3/release_notes/ocp_3_3_release_notes.html

For OpenShift Container Platform 3.2, see the following documentation, which will be updated shortly for release 3.2.1.30, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/enterprise/3.2/release_notes/ose_3_2_release_notes.html

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258.

Affected Products

• Red Hat OpenShift Container Platform 3.4 x86_64
• Red Hat OpenShift Container Platform 3.3 x86_64
• Red Hat OpenShift Container Platform 3.2 x86_64

Fixes

• BZ - 1380167 - Latency on iptables rules update after atomic-openshift-node service restart
• BZ - 1419771 - [3.4] Observed a panic: "Invalid state transition: DELETED -> ADDED" (Invalid state transition: DELETED -> ADDED) in router logs
• BZ - 1429827 - searchguard index needs manual recreation
• BZ - 1430929 - exclude list stays the same after atomic-openshift-docker-excluder pkg update
• BZ - 1431551 - OpenShift Logging not stable - does not survive node outage
• BZ - 1432250 - Kibana Unable to Connect to ElasticSearch
• BZ - 1434574 - [3.4] [networking_public_407] the router configuration not reloaded after the namespace label changed
• BZ - 1435695 - etcd cache in kube api server with large fixed size causing high memory usage
• BZ - 1435706 - Unable to Upgrade Metrics due to missging compaction strategy class's

CVEs

(none)

References

(none)

Red Hat OpenShift Container Platform 3.4

SRPM
atomic-openshift-3.4.1.12-1.git.0.57d7e1d.el7.src.rpm	SHA-256: c624ffa6dd87e16af573670e23a77ea90c1207a1fcd43d5af54ce76e39b25c6b
nodejs-accepts-1.3.3-1.el7.src.rpm	SHA-256: c5c09c8cb44d348af342b3c7ab265269c8551c742072b85a0817a07764c57037
nodejs-express-4.13.3-4.el7.src.rpm	SHA-256: 9f7bd05aa577ad3b32ff9fb352556d3cbb906719f20497114ac5403bdb460252
nodejs-mime-db-1.23.0-1.el7.src.rpm	SHA-256: 62e044b7736e437ff65509c4762ef5f760889195402b64feefa4bb27c4e85999
nodejs-mime-types-2.1.11-1.el7.src.rpm	SHA-256: ec472aecdc250b15864f245a385fc4dd6967aa06acfd9dfbb30ac81efe89a3c9
nodejs-minimatch-3.0.2-1.el7.src.rpm	SHA-256: a201b4e46c5af2b16d3828a43d871e85fd4476f5d1a209ab51b6b2234d64b471
nodejs-negotiator-0.6.1-1.el7.src.rpm	SHA-256: ba57f54ab916c8575c15d6354acc87c7da681c66c7368042529913731cf41bd2
openshift-elasticsearch-plugin-2.4.1.5__redhat_1-1.el7.src.rpm	SHA-256: 6308d55cff420e16bdc9ceba941b2e65288db81091324adf7ab34a58d18c2706
search-guard-2-2.4.1.8_redhat_1-2.el7.src.rpm	SHA-256: 1f5b25d07cd7737dcd3a0af52e71f873b1ab03de4eecf4354213912e25665a64
x86_64
atomic-openshift-3.4.1.12-1.git.0.57d7e1d.el7.x86_64.rpm	SHA-256: 0af24d21e6aaa5f4db696428097db6879a6a095485b4b0dc0a8fd4fc8574dc99
atomic-openshift-clients-3.4.1.12-1.git.0.57d7e1d.el7.x86_64.rpm	SHA-256: 082b06799b0b0573324587c677c642d58e67e6b365d4df78c8530b229b4258dd
atomic-openshift-clients-redistributable-3.4.1.12-1.git.0.57d7e1d.el7.x86_64.rpm	SHA-256: 25eea6bce1e989865953af05106194925a23d0ac19e84b44b81cdf9d04e933f3
atomic-openshift-docker-excluder-3.4.1.12-1.git.0.57d7e1d.el7.noarch.rpm	SHA-256: 0b7f060daf63eb68e2c9375e00cdff356c7ffe07a54650d77b11341be139f305
atomic-openshift-dockerregistry-3.4.1.12-1.git.0.57d7e1d.el7.x86_64.rpm	SHA-256: 6a31ffba7df25d820ca07f670b71ac3e9a967640f9c0583880201781fd463ff3
atomic-openshift-excluder-3.4.1.12-1.git.0.57d7e1d.el7.noarch.rpm	SHA-256: 996c181116e05515ef0c8592579a724af3aa774f52607a95135e24af5d19d87d
atomic-openshift-master-3.4.1.12-1.git.0.57d7e1d.el7.x86_64.rpm	SHA-256: 2b5011969fe1ab22672169327602d83838907d3c2c45fde3da60ce0b9a469557
atomic-openshift-node-3.4.1.12-1.git.0.57d7e1d.el7.x86_64.rpm	SHA-256: 0001b319d98c5f70ea9fafdf22ab4293a698bd89110699374b0f87822015490d
atomic-openshift-pod-3.4.1.12-1.git.0.57d7e1d.el7.x86_64.rpm	SHA-256: c903f7b8c23439ee8ee364ed79e15ba9e14775df63eac7a30df000071758ef6b
atomic-openshift-sdn-ovs-3.4.1.12-1.git.0.57d7e1d.el7.x86_64.rpm	SHA-256: efc73c1d1605eb5361ebb6424265ac02a2ff6471e74c8407dce08d10e3228e39
atomic-openshift-tests-3.4.1.12-1.git.0.57d7e1d.el7.x86_64.rpm	SHA-256: 3140c095bc7b1d2d6e836f52b0e6f074eb42f6b5b6dfcbe0387babfe702173ce
nodejs-accepts-1.3.3-1.el7.noarch.rpm	SHA-256: c73adee1bbf6988cfcda9021ac28006d323745a9e421b2575fb26763e4a60aa1
nodejs-express-4.13.3-4.el7.noarch.rpm	SHA-256: a7f15baff439bfa629932b420159080b101e329599a6a086115bc8ce2acc1576
nodejs-mime-db-1.23.0-1.el7.noarch.rpm	SHA-256: 6a3fde4e8e19295d9d22ca65c8ce6b70fb6cd89299b395459414ad2ec019f5b3
nodejs-mime-types-2.1.11-1.el7.noarch.rpm	SHA-256: 704ee6050d1e12263ee1bf91cd15127ab508fc220f80c44e11b09ce2dd61bd80
nodejs-minimatch-3.0.2-1.el7.noarch.rpm	SHA-256: 88e62aa9b8f9ed34891faea0a7060d6c3305fcf02ad4bc8ea5a2661a239d83ae
nodejs-negotiator-0.6.1-1.el7.noarch.rpm	SHA-256: ab0a12c3d7ff1048a9f29863b422a2bc38896a68ecc42c6fdb91f5f69029664c
openshift-elasticsearch-plugin-2.4.1.5__redhat_1-1.el7.noarch.rpm	SHA-256: 99fdae32b79b7a2e3ab64c94588f8b370ac99566c60648fac8e1e8bdab1d8f08
search-guard-2-2.4.1.8_redhat_1-2.el7.noarch.rpm	SHA-256: 3757896cde064da0fe6b6253f529e659956c02e98402f589267b9092b63a75d3
tuned-profiles-atomic-openshift-node-3.4.1.12-1.git.0.57d7e1d.el7.x86_64.rpm	SHA-256: c0e194ffbc84d7981188a341c5c6e79fd2252e07f6a58357ca38f6b1619b1983

Red Hat OpenShift Container Platform 3.3

SRPM
nodejs-accepts-1.3.3-1.el7.src.rpm	SHA-256: c5c09c8cb44d348af342b3c7ab265269c8551c742072b85a0817a07764c57037
nodejs-express-4.13.3-4.el7.src.rpm	SHA-256: 9f7bd05aa577ad3b32ff9fb352556d3cbb906719f20497114ac5403bdb460252
nodejs-mime-db-1.23.0-1.el7.src.rpm	SHA-256: 62e044b7736e437ff65509c4762ef5f760889195402b64feefa4bb27c4e85999
nodejs-mime-types-2.1.11-1.el7.src.rpm	SHA-256: ec472aecdc250b15864f245a385fc4dd6967aa06acfd9dfbb30ac81efe89a3c9
nodejs-minimatch-3.0.2-1.el7.src.rpm	SHA-256: a201b4e46c5af2b16d3828a43d871e85fd4476f5d1a209ab51b6b2234d64b471
nodejs-negotiator-0.6.1-1.el7.src.rpm	SHA-256: ba57f54ab916c8575c15d6354acc87c7da681c66c7368042529913731cf41bd2
openshift-elasticsearch-plugin-0.18.0.redhat_1-1.el7.src.rpm	SHA-256: 372d8ac3506b5b6783f73ae197d03fbdb9bc5d774c0719bec4896f0c665b26b1
x86_64
nodejs-accepts-1.3.3-1.el7.noarch.rpm	SHA-256: c73adee1bbf6988cfcda9021ac28006d323745a9e421b2575fb26763e4a60aa1
nodejs-express-4.13.3-4.el7.noarch.rpm	SHA-256: a7f15baff439bfa629932b420159080b101e329599a6a086115bc8ce2acc1576
nodejs-mime-db-1.23.0-1.el7.noarch.rpm	SHA-256: 6a3fde4e8e19295d9d22ca65c8ce6b70fb6cd89299b395459414ad2ec019f5b3
nodejs-mime-types-2.1.11-1.el7.noarch.rpm	SHA-256: 704ee6050d1e12263ee1bf91cd15127ab508fc220f80c44e11b09ce2dd61bd80
nodejs-minimatch-3.0.2-1.el7.noarch.rpm	SHA-256: 88e62aa9b8f9ed34891faea0a7060d6c3305fcf02ad4bc8ea5a2661a239d83ae
nodejs-negotiator-0.6.1-1.el7.noarch.rpm	SHA-256: ab0a12c3d7ff1048a9f29863b422a2bc38896a68ecc42c6fdb91f5f69029664c
openshift-elasticsearch-plugin-0.18.0.redhat_1-1.el7.noarch.rpm	SHA-256: 51b627e318dab9d811769ad6d824b801f83a04535e848417b0f280267641c572

Red Hat OpenShift Container Platform 3.2

SRPM
atomic-openshift-3.2.1.30-1.git.0.b245a46.el7.src.rpm	SHA-256: 2fdb9508149cb6fd7c1918921b26f14dd2baea470cfbeab67491a6c5de02d816
nodejs-accepts-1.3.3-1.el7.src.rpm	SHA-256: c5c09c8cb44d348af342b3c7ab265269c8551c742072b85a0817a07764c57037
nodejs-express-4.13.3-4.el7.src.rpm	SHA-256: 9f7bd05aa577ad3b32ff9fb352556d3cbb906719f20497114ac5403bdb460252
nodejs-mime-db-1.23.0-1.el7.src.rpm	SHA-256: 62e044b7736e437ff65509c4762ef5f760889195402b64feefa4bb27c4e85999
nodejs-mime-types-2.1.11-1.el7.src.rpm	SHA-256: ec472aecdc250b15864f245a385fc4dd6967aa06acfd9dfbb30ac81efe89a3c9
nodejs-minimatch-3.0.2-1.el7.src.rpm	SHA-256: a201b4e46c5af2b16d3828a43d871e85fd4476f5d1a209ab51b6b2234d64b471
nodejs-negotiator-0.6.1-1.el7.src.rpm	SHA-256: ba57f54ab916c8575c15d6354acc87c7da681c66c7368042529913731cf41bd2
x86_64
atomic-openshift-3.2.1.30-1.git.0.b245a46.el7.x86_64.rpm	SHA-256: 24b69b168fbfe04a60ca0d7951fd5e9b6000146745d7459eb944c4f970f802d8
atomic-openshift-clients-3.2.1.30-1.git.0.b245a46.el7.x86_64.rpm	SHA-256: 15d844facf5e924754eb00b96964d18ca3fedc05f5ea1d862322fece2df7b484
atomic-openshift-clients-redistributable-3.2.1.30-1.git.0.b245a46.el7.x86_64.rpm	SHA-256: 385538dbc90b80d7b041a68ea32e5ca7abbffa206a62076d57147b743ecfc8ab
atomic-openshift-docker-excluder-3.2.1.30-1.git.0.b245a46.el7.noarch.rpm	SHA-256: e468d65da7052335bcf54a49e729dbba1540fcb31a7e883038d61a482d84fb8c
atomic-openshift-dockerregistry-3.2.1.30-1.git.0.b245a46.el7.x86_64.rpm	SHA-256: e9b22e0f27a8aab4b773baf2a18c300dd543d35c77bc0b57177720e9f1e9996b
atomic-openshift-excluder-3.2.1.30-1.git.0.b245a46.el7.noarch.rpm	SHA-256: 795d410b2db95b02a6192f4853c65e2fe5b388be7db658006d18002e3278eb38
atomic-openshift-master-3.2.1.30-1.git.0.b245a46.el7.x86_64.rpm	SHA-256: 154e6518c7b026eb33070143e322b61eaadd8cf8339d24d093d115f23675629d
atomic-openshift-node-3.2.1.30-1.git.0.b245a46.el7.x86_64.rpm	SHA-256: 8be64bd329333cac89fc99ae59c1685ae3f38e644400a1817126f24de0fcc04f
atomic-openshift-pod-3.2.1.30-1.git.0.b245a46.el7.x86_64.rpm	SHA-256: 968d8f08a8dd7b08802ccd31a1d07f623741f0361d5b2c8337cf33bc02dc5d50
atomic-openshift-recycle-3.2.1.30-1.git.0.b245a46.el7.x86_64.rpm	SHA-256: 596befc38771b8694b907cf9e5ad00556f8fe9edd8d9bfe5189241c56b00a40b
atomic-openshift-sdn-ovs-3.2.1.30-1.git.0.b245a46.el7.x86_64.rpm	SHA-256: 1be44177bb74acc79711e94e593e758dfb3866f9b49c9bfd29c11cdfd14ac6c6
atomic-openshift-tests-3.2.1.30-1.git.0.b245a46.el7.x86_64.rpm	SHA-256: a132061be457d46b85ecc78ce014fc022c32accc07c3dac26705f5c999bf7f6b
nodejs-accepts-1.3.3-1.el7.noarch.rpm	SHA-256: c73adee1bbf6988cfcda9021ac28006d323745a9e421b2575fb26763e4a60aa1
nodejs-express-4.13.3-4.el7.noarch.rpm	SHA-256: a7f15baff439bfa629932b420159080b101e329599a6a086115bc8ce2acc1576
nodejs-mime-db-1.23.0-1.el7.noarch.rpm	SHA-256: 6a3fde4e8e19295d9d22ca65c8ce6b70fb6cd89299b395459414ad2ec019f5b3
nodejs-mime-types-2.1.11-1.el7.noarch.rpm	SHA-256: 704ee6050d1e12263ee1bf91cd15127ab508fc220f80c44e11b09ce2dd61bd80
nodejs-minimatch-3.0.2-1.el7.noarch.rpm	SHA-256: 88e62aa9b8f9ed34891faea0a7060d6c3305fcf02ad4bc8ea5a2661a239d83ae
nodejs-negotiator-0.6.1-1.el7.noarch.rpm	SHA-256: ab0a12c3d7ff1048a9f29863b422a2bc38896a68ecc42c6fdb91f5f69029664c
tuned-profiles-atomic-openshift-node-3.2.1.30-1.git.0.b245a46.el7.x86_64.rpm	SHA-256: 792f0262e8c76aeaf8328ba50b3e917f4eb090f046b93f58f02a0ede6152d63e