RHBA-2017:1810 - Bug Fix Advisory

Topic

Updated atomic-openshift-utils and openshift-ansible packages that fix several bugs and add enhancements are now available for OpenShift Container Platform 3.5, 3.4, and 3.3.

Description

Red Hat OpenShift Container Platform is the company's cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments.

The atomic-openshift-utils and openshift-ansible packages contain the installation utility and Ansible requirements for installing and upgrading OpenShift Container Platform 3.

This update fixes the following bugs:

• Due to a YAML library wrapping long lines, LDAP configuration parameters were parsed incorrectly. This bug fix configure YAML library dumper with a longer line length. As a result, LDAP configuration parameters are written without line wraps and can be parsed correctly. (BZ#1450007)
• When `openshift_image_tag` was specified in an inventory in the format `3.x` instead of a full tag of `3.x.x.x`, the evaluation of `openshift_image_tag >= LooseVersion('3.x.0.0')` would result in "False". This caused the condition to be improperly applied to logic elsewhere in the code, resulting in invalid evaluation of version specific facts. This bug fix updates the version comparisons to compare against the terse minimum version of `3.x`. (BZ#1443416, BZ#1466770)
• A property was missing from a logging configuration file, causing Elasticsearch to fail to start, generating a large stack trace. This bug fix modifies the installer to create the configuration with the required property. As a result, Elasticsearch now starts as expected. (BZ#1466626)
• Previously, the upgrade playbooks used the default `kubeconfig` file, which may have been modified since creation to use a non-administrator user. With this bug fix, the upgrade playbooks use the system:admin user's `kubeconfig`, which avoids this problem. (BZ#1470338)
• The fact `etcd_is_atomic` was detected incorrectly due to the role ordering of some fact-setting operations. RHEL Atomic Host systems do not support `yum`, `repoquery`, or `rpm` commands, but they would attempt to run commands specific to managing and inspecting repositories and packages when they should not. This bug fix changes the ordering of role calls and fact updates and wraps them in a meta-role to ensure they stay in the correct order. As a result, these systems no longer attempt to run these unsupported commands because the `etcd_is_atomic` fact is correctly detected. (BZ#1442009, BZ#1442010)
• In some mixed-node environments, it was possible that host facts were not collected for containerized hosts, causing a conditional to fail. This bug fix adds a conditional to allow the check to complete correctly. (BZ#1466501)

In addition, this update adds the following enhancements:

• Containerized masters now mount `/etc/pki` from the host, enabling the master process to make use of the host's CA trust store and certificates. (BZ#1465120, BZ#1465121)
• The CloudForms Management Engine (CFME) templates have been updated to support CFME 4.5. (BZ#1468502)

All OpenShift Container Platform users are advised to upgrade to these updated packages.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

To apply this update, run the following on all hosts where you intend to initiate Ansible-based installation or upgrade procedures:

# yum update atomic-openshift-utils

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenShift Container Platform 3.5 x86_64
• Red Hat OpenShift Container Platform 3.4 x86_64
• Red Hat OpenShift Container Platform 3.3 x86_64

Fixes

• BZ - 1442009 - [3.4]Failed to redeploy CA certificates on Atomic Hosts
• BZ - 1442010 - [3.3]Failed to redeploy CA certificates on Atomic Hosts
• BZ - 1443416 - [3.5] Running the config.yml playbook fails on the second run
• BZ - 1450007 - Long DN string for LDAP authentication provider in ansible hosts file causes incorrect master-config.yaml to be created
• BZ - 1466501 - [3.4] Failed to install v3.4 on mix env rpm master plus atomic node
• BZ - 1466626 - Unable to load index mapping for io.fabric8.elasticsearch.kibana.mapping.empty.
• BZ - 1466770 - [3.4] Running the config.yml playbook fails on the second run
• BZ - 1468502 - Image-streams for cloudforms 4.2 are incorrect in Openshift 3.4
• BZ - 1470338 - [3.5] Error upgrading control_plane

CVEs

(none)

References

(none)