Synopsis

OpenShift Container Platform 3.5, 3.4, 3.3, and 3.1 bug fix update

Type/Severity

Bug Fix Advisory

Topic

Red Hat OpenShift Container Platform releases 3.5.5.15, 3.4.1.24, 3.3.1.25, and 3.1.1.11-2 are now available with updates to packages and images that fix several bugs.

Description

Red Hat OpenShift Container Platform is the company's cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container Platform 3.5.5.15, 3.4.1.24, 3.3.1.25, and 3.1.1.11-2. See the following advisory for the container images for this release:

https://access.redhat.com/errata/RHBA-2017:1236

This update fixes the following bugs:

• A library used in OpenShift Container Platform 3.1 contained an issue where some connections did not terminate cleanly. This issue lead to high memory usage. This bug fix properly terminates the connections, allowing the memory associated with the connection to be freed as expected. (BZ#1442802)
• When upgrading the logging stack, the minimum master configuration value was set to use an environment value that was never set. This bug fix replaces the minimum master environment variable with node quorum, which has been available since logging inception. As a result, Elasticsearch starts without generating a missing variable exception. (BZ#1439356)
• Template descriptions were not displayed in the web console catalog after clicking "Add to Project". Only the name was displayed. This bug fix ensures that template descriptions are correctly displayed in the tiles when browsing the catalog and in the page header when instantiating a template. (BZ#1444200)
• The EgressNetworkPolicy code in OpenShift Container Platform 3.3 mistakenly required you to specify "0.0.0.0/32" rather than "0.0.0.0/0" if you wanted to match all IPs, but the code that validated service endpoint IPs against EgressNetworkPolicy rules did not have the same bug. It was possible to bypass a "deny 0.0.0.0/32" EgressNetworkPolicy by creating a service pointing to an external IP and then connecting to the service. This bug fix updates the endpoint validation code to now treat "0.0.0.0/32" the same way the EgressNetworkPolicy code does. In addition, the correct value of "0.0.0.0/0" is now accepted in EgressNetworkPolicy. As a result, policy is now implemented as intended. (BZ#1440886)
• A panic could occur due to concurrent access shows in the logs. This bug fix adds the appropriate locking, and as a result the logs are clean and these panics no longer occur. (BZ#1445510)
• The code to set up multicast was not run when only one node was in the cluster. This caused multicast traffic to be dropped when on a single-node cluster. This bug fix changes the rules so the multicast setup is performed for a single-node. As a result, multicast works for single-node clusters. (BZ#1445502)
• The initialization order of the SDN plug-in set the event handler up too late. This caused early events to have no handler, so the SDN panicked. This bug fix re-orders the SDN initialization so the event handler is in place before it can ever be called. As a result, these panics no longer occur. (BZ#1445505)
• Quickly and repeatedly adding and deleting a route with same name in a namespace caused the router pod to panic with the error "invalid state transition: Deleted -> ADDED". This bug fix adds the objects UID to the event queue key generation function. As a result, these panics no longer occur. (BZ#1435721)
• Route matching logic changed, and trailing slashed inadvertently broke. This caused subpaths with trailing `/` characters to break. This bug fix corrects the matching code, and as a result the previous behavior is restored. (BZ#1448218)

All OpenShift Container Platform 3 users are advised to upgrade to these updated packages and images.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For OpenShift Container Platform 3.5, see the following documentation, which will be updated shortly for release 3.5.5.15, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.5/release_notes/ocp_3_5_release_notes.html

For OpenShift Container Platform 3.4, see the following documentation, which will be updated shortly for release 3.4.1.24, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.4/release_notes/ocp_3_4_release_notes.html

For OpenShift Container Platform 3.3, see the following documentation, which will be updated shortly for release 3.3.1.25, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.3/release_notes/ocp_3_3_release_notes.html

For OpenShift Container Platform 3.1, see the following documentation, which will be updated shortly for release 3.1.1.11-2, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/enterprise/3.1/release_notes/ose_3_1_release_notes.html

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258.

Affected Products

• Red Hat OpenShift Container Platform 3.5 x86_64
• Red Hat OpenShift Container Platform 3.4 x86_64
• Red Hat OpenShift Container Platform 3.3 x86_64
• Red Hat OpenShift Container Platform 3.1 x86_64

Fixes

• BZ - 1339888 - Recover EFK after CorruptIndexException of ElasticSearch
• BZ - 1371872 - [doc]The multizone setting in gce.conf is ignored by PersistentVolumeLabel
• BZ - 1380342 - Cannot deploy docker-registry "Readiness probe failed: HTTP probe failed with statuscode: 403"
• BZ - 1401688 - [DOCS] Kibana Fails Behind F-5 Loadbalancer with X-Forwarded-For enabled
• BZ - 1402355 - [GlusterFS Provisioner] Gid is not applied on provisioned volume
• BZ - 1434785 - Include the tag query feature of hawkular-alerts
• BZ - 1435721 - [3.3] Observed a panic: "Invalid state transition: DELETED -> ADDED" (Invalid state transition: DELETED -> ADDED) in router logs
• BZ - 1436767 - Alerting DefinitionsEvents might have a wrong order on import operations
• BZ - 1439356 - Attempts to upgrade logging to 3.4.1.12-1 failing
• BZ - 1439910 - Large partitions make Cassandra unstable and cause requests to fail in Hawkular Metric
• BZ - 1439912 - Large partitions make Cassandra unstable and cause requests to fail in Hawkular Metric
• BZ - 1441369 - Kibana does not limit its heap size
• BZ - 1442802 - [Backport] spdy fixes to 3.1
• BZ - 1444200 - Template descriptions not showing up in web console
• BZ - 1445502 - On a single-node cluster, multicast is never correctly set up.
• BZ - 1445505 - sentry: nil panic in pkg/sdn/plugin/pod.go", line 228, in UpdateLocalMulticastRules
• BZ - 1445510 - [3.5] panic in github.com/openshift/origin/pkg/proxy/hybrid
• BZ - 1446308 - Update Hawkular Metrics to provide an alternative path which is not blocked by the uBlockOrigin browser extension
• BZ - 1446360 - [3.5] Routes that specify a path ending in a / do not route to subpaths correctly
• BZ - 1448218 - Match subpaths correctly when path contains trailing slash

CVEs

(none)

References

(none)