RHBA-2018:1335 - Bug Fix Advisory

Topic

Updated atomic-openshift-utils and openshift-ansible packages that fix multiple bugs are now available for OpenShift Container Platform 3.6 and 3.7.

Description

Red Hat OpenShift Container Platform is the company's cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments.

The atomic-openshift-utils and openshift-ansible packages contain the installation utility and Ansible requirements for installing and upgrading OpenShift Container Platform 3.

This advisory contains the RPM packages for this release. See the following advisory for the container images for this release:

https://access.redhat.com/errata/RHBA-2018:1336

This update fixes the following bugs:

• etcd 3.2.15 is compiled with go 1.9, which tightens certificate security. This caused certificates created without a SAN entry to be treated as invalid in etcd 3.2.15. With this bug fix, certificates are now regenerated during OpenShift Container Platform 3.5 to 3.6 upgrades, ensuring that certificates are compatible with the new etcd. As a result, openshift-ansible now generates valid certificates for etcd 3.2.15. (BZ#1572377)
• etcd 3.2.15 is compiled with go 1.9, which tightens certificate security. This caused certificates created without a SAN entry to be treated as invalid in etcd 3.2.15. With this bug fix, certificates are now regenerated during OpenShift Container Platform 3.6 to 3.7 upgrades, ensuring that certificates are compatible with the new etcd. As a result, openshift-ansible now generates valid certificates for etcd 3.2.15. (BZ#1572763)

All OpenShift Container Platform 3.6 and 3.7 users are advised to upgrade to these updated packages.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

To apply this update, run the following on all hosts where you intend to initiate Ansible-based installation or upgrade procedures:

# yum update atomic-openshift-utils

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenShift Container Platform 3.7 x86_64
• Red Hat OpenShift Container Platform 3.6 x86_64

Fixes

• BZ - 1567857 - [3.6] Upgrade failed for validate_etcd_conf.yml not found
• BZ - 1572377 - 3.5->3.6 Upgrade fails: Error: client: etcd cluster is unavailable or misconfigured; error #0: x509: certificate is not valid for any names, but wanted to match <hostname>
• BZ - 1572763 - Need to validate etcd server certs have proper SAN prior to upgrading to etcd-3.2.15-2.el7

CVEs

(none)

References

(none)