RHBA-2017:2639 - Bug Fix Advisory

Topic

Updated atomic-openshift-utils and openshift-ansible packages that fix several bugs and add enhancements are now available for OpenShift Container Platform 3.5, 3.4, and 3.3.

Description

Red Hat OpenShift Container Platform (OCP) is the company's cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments.

The atomic-openshift-utils and openshift-ansible packages contain the installation utility and Ansible requirements for installing and upgrading OpenShift Container Platform 3.

This update fixes the following bugs:

• If the master scaleup playbook was run without hosts in the new_masters group, the playbooks could have reconfigured certain master configuration variables. The playbooks have been updated to fail immediately if there are no hosts in the new_masters group. (BZ#1449911)
• Previously, the quick installer did not specify which generated configuration file should be edited to make changes. Edits to the host file were overwritten when rerunning the installer. The quick installer now indicates which configuration file it created so that you may update it in the future. (BZ#1460353)
• When conditions for creating PVCs within the logging role were incorrect, dynamic PVCs were created even if they were explicitly set as `false` for generating them. This bug fix updates the when conditions within the logging role and dynamic PVCs are no longer incorrectly created. (BZ#1463081)
• Masters in an HA environment with a configured proxy could not reach etcd hosts by DNS. As a result, an error of "etcd cluster is unavailable or misconfigured" was received. The Openshift Ansible installer was updated to collect the IP of all etcd hosts and insert them into the NO_PROXY settings for the HA masters. (BZ#1466783)
• Previously, the containerized load balancer did not properly use openshift_image_tag. This error is now corrected, ensuring proper containerized installation of the API load balancer host. (BZ#1467252)
• Previously, if the ansible_ssh_user did not have /sbin in their path, then the playbooks may have failed to execute the excluder scripts during installation and upgrade. The full path is now used, resolving this issue. (BZ#1474246)
• The key for the caCert was incorrectly capitalized. Therefore, the specified caCert value was not persisted to the created object. The capitalization is now corrected and the specified caCert is correctly persisted to the object. (BZ#1475004)
• After a migration to etcdv3, one OpenShift API server in the HA configuration returned old data. The results of this can vary from a user being unable to access their project sporadically to builds randomly being unable to push to the docker registry. With this bug fix, the issue is addressed. (BZ#1475351)
• If a PVC already existed, the playbook would fail trying to recreate it. With this bug fix, a PVC object is no longer created if it already exists and the playbook correctly completes without error. (BZ#1475761)
• The default image tag for the Ansible service now defaults to `v3.6` rather than `latest`, ensuring that the appropriate release is deployed. (BZ#1479165)
• When the nameservers were specified directly in /etc/resolv.conf, the node DNS configuration scripts failed to determine the correct nameservers. The configuration scripts are now updated to pull the nameservers from /etc/resolv.conf when they are not specified via other means. (BZ#1480438)
• .NET Core 2.0 image streams have been added to the install and upgrade playbooks for OCP 3.5 and 3.6. (BZ#1480606)
• Previously, only openvswitch 2.6 was marked as appropriate for OCP 3.6, which blocked installation of 2.7. This error is corrected. (BZ#1481721)
• When users set openshift_dns_ip, it was not properly configuring the node-config.yaml file to use this value, which resulted in a broken DNS configuration. This error is corrected. (BZ#1483387)
• With this bug fix, the metrics deployer template was updated to point at images labeled v3.4, which ensures that the latest builds are deployed. (BZ#1484398)

All OpenShift Container Platform users are advised to upgrade to these updated packages.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

To apply this update, run the following on all hosts where you intend to initiate Ansible-based installation or upgrade procedures:

# yum update atomic-openshift-utils

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenShift Container Platform 3.6 x86_64
• Red Hat OpenShift Container Platform 3.5 x86_64
• Red Hat OpenShift Container Platform 3.4 x86_64
• Red Hat OpenShift Container Platform 3.3 x86_64

Fixes

• BZ - 1449911 - [3.6] Master configuration not persistent after running scaleup playbook
• BZ - 1460353 - [3.6] Quick Installer should specify which config file to edit
• BZ - 1463081 - [3.6] Running logging deployer with openshift_logging_es_pvc_dynamic=false still creates a dynamic pvc
• BZ - 1466783 - [3.6] NO_PROXY of etcd IPs need to be configured in master-controllers
• BZ - 1467252 - [3.6] haproxy lb containerized install failed due to 'openshift_image_tag' is undefined
• BZ - 1474246 - [3.6] Installer doesn't always use absolute path for excluders
• BZ - 1474339 - [3.5] Installer doesn't always use absolute path for excluders
• BZ - 1474341 - [3.4] Installer doesn't always use absolute path for excluders
• BZ - 1475004 - [3.6] hawkular-metrics route does not properly create the caCertificate
• BZ - 1475351 - [3.6] API server results inconsistent after migration to etcdv3
• BZ - 1475761 - [3.6] Installer failed on logging deployment on the second run
• BZ - 1479165 - [3.6] ansible_service_broker_image_tag should be set to 3.6 by default instead of latest
• BZ - 1479204 - [3.6] The image tag for container-engine should follow OpenShift version instead of hard coded "latest"
• BZ - 1480438 - [3.6] Installer fails due to missing /etc/origin/node/resolv.conf
• BZ - 1480606 - New .NET Core 2.0 imagestreams/templates for OpenShift Container Platform
• BZ - 1481721 - [3.6] Post Install the health_check Playbook Throws Errors on Incorrect openvswitch Version
• BZ - 1483387 - [3.6] Installation by openshift-ansible failed at task openshift_node_dnsmasq : Install dnsmasq configuration
• BZ - 1484398 - [3.4] Metrics and Logging deployer templates should use v3.x
• BZ - 1484403 - [3.3] Metrics and Logging deployer templates should use v3.x

CVEs

(none)

References

(none)