RHBA-2017:3049 - Bug Fix Advisory

Topic

Red Hat OpenShift Container Platform releases 3.6.173.0.49, 3.5.5.31.36, and 3.4.1.44.26 are now available with updates to packages and images that fix several bugs and add enhancements.

Description

Red Hat OpenShift Container Platform is the company's cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container Platform 3.6.173.0.49, 3.5.5.31.36, and 3.4.1.44.26 See the following advisory for the container images for this release:

https://access.redhat.com/errata/RHBA-2017:3050

Space precludes documenting all of the bug fixes and enhancements in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.openshift.com/container-platform/3.6/release_notes/ocp_3_6_release_notes.html

https://docs.openshift.com/container-platform/3.5/release_notes/ocp_3_5_release_notes.html

https://docs.openshift.com/container-platform/3.4/release_notes/ocp_3_4_release_notes.html

All OpenShift Container Platform 3 users are advised to upgrade to these updated packages and images.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For OpenShift Container Platform 3.6, see the following documentation, which will be updated shortly for release 3.6.173.0.49, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.6/release_notes/ocp_3_6_release_notes.html

For OpenShift Container Platform 3.5, see the following documentation, which will be updated shortly for release 3.5.5.31.36, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.5/release_notes/ocp_3_5_release_notes.html

For OpenShift Container Platform 3.4, see the following documentation, which will be updated shortly for release 3.4.1.44.26, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/enterprise/3.4/release_notes/ose_3_4_release_notes.html

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258.

Affected Products

• Red Hat OpenShift Container Platform 3.6 x86_64
• Red Hat OpenShift Container Platform 3.5 x86_64
• Red Hat OpenShift Container Platform 3.4 x86_64

Fixes

• BZ - 1345852 - kibana pod crashes repeatedly: Request Timeout after 5000ms\n at null.<anonymous> (/usr/share/kibana/src/node_modules/elasticsearch/src/lib/transport.js:282:15
• BZ - 1414640 - [IntService_public_324]Unable to establish ssh connection for ansible user while gathering openShift logging facts
• BZ - 1415057 - [IntService_public_324]jks-cert-gen pod failed by FileNotFoundException for /etc/origin/logging/system.admin.jks
• BZ - 1416629 - [IntService_public_324]Deploy logging with ansible, failed to create es pod for invalid INSTANCE_RAM env value
• BZ - 1416786 - [IntService_public_324]Deploy logging with ansible, failed TASK [openshift_logging : start fluentd]
• BZ - 1417234 - Proxier and Docker Daemon - iptables: Resource temporarily unavailable. (exit status 4)
• BZ - 1418911 - [IntService_public_324] TASK [lib_openshift : lib_openshift ensure python-ruamel-yaml package is on target] failed
• BZ - 1420256 - [intservice_public_324] ES is in pending status if deploy logging with dynamic PV enabled
• BZ - 1420618 - [intservice_public_324]Deploy logging stack with --check flag, failed to generate signing.conf
• BZ - 1420625 - [intservice_public_324] Logging deployment will fail if openshift_logging_fluentd_nodeselector is specified in inventory file
• BZ - 1430667 - Roll over log entries are visible when openshift_logging_fluentd_journal_read_from_head is default to empty on journald log driver envs
• BZ - 1430910 - Change shard and replica defaults for ES/Logging
• BZ - 1435083 - openshift users encountered confirmation "Apply these filters?" when switching between index list populated in the left panel on kibana
• BZ - 1439504 - Kibana show raw json in "message" field for pods messages in json format
• BZ - 1440855 - Missing aliases after upgrade
• BZ - 1442855 - layers have zero size in imagestreams
• BZ - 1443350 - Openshift logging - upgrade from 3.4.0 to 3.4.1.12
• BZ - 1445694 - [trello:yH9l0ouV] openflow won't be updated after changing dnsName in egressnetworkpolicy
• BZ - 1449373 - Completed build pod has no IP address
• BZ - 1452010 - Need have the admission controller PodPreset enabled
• BZ - 1455479 - Command 'oc import-image' don't respect para 'maxImagesBulkImportedPerRepository' set in master-config
• BZ - 1457043 - Unable to pull through to registry.access.redhat.com
• BZ - 1457232 - NullPointerException - Error getting default index for <user>
• BZ - 1459008 - 'oc rollout pause' operation will erase 'Running' pods
• BZ - 1460388 - AWS getInstancesByNodeNames is broken for large clusters
• BZ - 1463436 - Kibana: ACL error when attempting "Export All" saved searches/dashboards/visualizations
• BZ - 1463576 - oc get/describe could not work when using 3.5 client to login 3.6 server
• BZ - 1463594 - The 'minReadySeconds' does not work in the deploymentconfig
• BZ - 1464024 - [trello 1qpV9jcS] fluentd pods still connecting to master api servers after deploying with openshift_logging_use_mux=true
• BZ - 1466620 - logging services were not deleted after undeploying logging via ansible
• BZ - 1467423 - A query to the Hawkular Metrics pod returns 'Status Code:500 Kubernetes client request failure'
• BZ - 1469711 - Kibana container grows in memory till out of memory
• BZ - 1469859 - Starting 30 fluentd pods with mux service enabled and 3 logging-mux pods running pegs logging-mux pod CPU
• BZ - 1470862 - Fluentd logs filling with "Could not push log to Elasticsearch" errors, status=429 when starting 100-150 fluentd pods
• BZ - 1472370 - [3.5] Restart of atomic-openshift-node service terminates pod glusterfs mount
• BZ - 1472372 - [3.4] Restart of atomic-openshift-node service terminates pod glusterfs mount
• BZ - 1472976 - [3.6] X-Forwarded-For and related headers send the IPv6 form of the source IPv4 address
• BZ - 1473153 - Need to refresh kibana UI page to show .all index
• BZ - 1473788 - fluentd drops records when using journal or json and output queue is full
• BZ - 1474429 - controller-manager panic/crash on volume verification
• BZ - 1474446 - [3.5][Backport] oadm prune command fails with TLS issues after adding --confirm
• BZ - 1474689 - Failed to start ES pod, "Could not resolve placeholder 'DC_NAME'" in ES pod log
• BZ - 1475306 - [3.4]oadm prune command fails with TLS issues after adding --confirm
• BZ - 1476062 - kibana index field list being reset after some period of time
• BZ - 1476779 - [3.6][Backport] oadm prune command fails with TLS issues after adding --confirm
• BZ - 1476982 - data is added to elasticsearch before index templates are loaded
• BZ - 1477513 - [3.4] Data loss of logs can occur if fluentd pod is terminated/restarted when Elasticsearch is unavailable
• BZ - 1477515 - [3.5] Data loss of logs can occur if fluentd pod is terminated/restarted when Elasticsearch is unavailable
• BZ - 1477673 - [3.6] X-Forwarded-For and related headers send the IPv6 form of the source IPv4 address
• BZ - 1477847 - Jenkins slave images missing 32bit JVM
• BZ - 1478821 - Fluentd log is filled up with warnings about "log unreadable. It is excluded and would be examined next time." when using json-file log driver
• BZ - 1479340 - [3.6][Backport][Registry][Pruning] Orphaned blobs cannot be pruned
• BZ - 1479645 - failed to parse [collectd.processes.ps_vm] Numeric value (4298063872) out of range of int
• BZ - 1480988 - View archive link for ops projects does not take to kibana-ops
• BZ - 1481603 - [online-stg][starter-us-east-2][starter-us-west-2]The endpoints value always be delayed
• BZ - 1482002 - Can't collect log entries due to fluentd error
• BZ - 1483114 - Data loss of logs can occur if fluentd pod is terminated/restarted when Elasticsearch is unavailable
• BZ - 1483119 - Node affinity alpha feature can cause scheduling failures across the cluster.
• BZ - 1484272 - Openshift node service doesn't start when iptables-based proxy is disabled
• BZ - 1485892 - Web console hangs on project overview if Deployment Config name is just digits
• BZ - 1485969 - During 3.5 to 3.6 upgrade, playbook aborts with "field is immutable after creation"
• BZ - 1486775 - oc adm create-bootstrap-project-template creates an invalid project template
• BZ - 1488059 - ClusterRegistry health check fails after installation
• BZ - 1489039 - [3.5][Backport] exposing docker-registry with a non tls-passthrough route does not work
• BZ - 1489042 - [3.6][Backport] exposing docker-registry with a non tls-passthrough route does not work
• BZ - 1489181 - Support for quotas on number of jobs
• BZ - 1489976 - logging-fluentd unable to process more than 1000 messages per second
• BZ - 1490395 - logging-fluentd fails to start in 3.6.173.0.32 - "Unknown filter plugin 'k8s_meta_filter_for_mux_client'"
• BZ - 1490427 - [3.6.z] Stopping etcd leader can cause authentication failures due to OpenShift Master caching and using etcd leader IP address.
• BZ - 1490428 - [3.5.z] Stopping etcd leader can cause authentication failures due to OpenShift Master caching and using etcd leader IP address.
• BZ - 1491040 - After openshift node process was restarted, pods with init-containers show in pending state
• BZ - 1491227 - Kibana login problem with usernames having backslash
• BZ - 1491765 - after deleting all resources (dc's, services, pods, etc.), and then deleting pvc's, pvc's show in Lost state
• BZ - 1492725 - controller attach and detach not working for fiber channel
• BZ - 1493188 - operations namespace logs not sent to .operations index
• BZ - 1494200 - controller attach and detach not working for fiber channel
• BZ - 1494310 - operations namespace logs not sent to .operations index
• BZ - 1496271 - Preserve Security Context in logging container
• BZ - 1497767 - [3.6] Conntrack table entry is not removed when UDP service is added after single pod was removed and added back
• BZ - 1497768 - [3.5] Conntrack table entry is not removed when UDP service is added after single pod was removed and added back
• BZ - 1498123 - [3.5] Prune Deleted Layer of a Valid Image due to minimum aging
• BZ - 1498124 - [3.6] Prune Deleted Layer of a Valid Image due to minimum aging
• BZ - 1499174 - [3.6] Deleted in use PVCs can break the scheduler
• BZ - 1499175 - [3.5] Deleted in use PVCs can break the scheduler
• BZ - 1499640 - [3.4] Image pruning fails due to conflicts on imagestream updates
• BZ - 1499643 - [3.5] Image pruning fails due to conflicts on imagestream updates
• BZ - 1503448 - hawkular-metrics pod failed to start up, "Invalid option 'DISABLE_NAMESPACE_FILTER=true'" in hawkular-metrics pod log

CVEs

(none)

References

(none)