Synopsis

OpenShift Container Platform 3.9 bug fix and enhancement update

Type/Severity

Bug Fix Advisory

Topic

Red Hat OpenShift Container Platform release 3.9.27 is now available with updates to packages and images that fix several bugs and add enhancements.

Description

Red Hat OpenShift Container Platform is the company's cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container Platform 3.9.27. See the following advisory for the container images for this release:

https://access.redhat.com/errata/RHBA-2018:1567

Space precludes documenting all of the bug fixes and enhancements in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.openshift.com/container-platform/3.9/release_notes/ocp_3_9_release_notes.html

All OpenShift Container Platform 3.9 users are advised to upgrade to these updated packages and images.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For OpenShift Container Platform 3.9 see the following documentation, which will be updated shortly for release 3.9.27, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.9/release_notes/ocp_3_9_release_notes.html

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258.

Affected Products

• Red Hat OpenShift Container Platform 3.9 x86_64

Fixes

• BZ - 1455680 - Volume stuck in attaching state for 15 minutes
• BZ - 1502028 - Updating Docker registry reverts HTTPS/TLS to HTTP
• BZ - 1508828 - [CRI-O] Can't show image digests info on node
• BZ - 1519522 - Admin user should be able to see orphaned index in kibana
• BZ - 1529496 - [3.8]master-api and master-controllers are not restarted when deploy metrics along with OCP
• BZ - 1542135 - PVC stat metrics from kubelet are persistent.
• BZ - 1542867 - local-storage-provisioner log message for regular file is not clear
• BZ - 1543647 - Remove hawkular-alerts from hawkular-metrics
• BZ - 1547226 - heketi-storage-copy-job fails during cns-deploy as it trying to pull a wrong image "heketi/heketi:dev"
• BZ - 1550018 - The ServiceAccount 'aggregated-logging-fluentd' is not a cluster-reader in the 'logging' project
• BZ - 1550372 - NFS volume recycle failed for ErrImagePull
• BZ - 1550797 - Should remove 'loading..' when browser non-existent image
• BZ - 1551499 - DNS resolution failed inside pod when using flannel
• BZ - 1551904 - Network Policy shows up twice under Other Resources in different api groups
• BZ - 1553034 - ansible playbook to uninstall glusterfs doesn't remove gluster-block provisioner pod
• BZ - 1553186 - Add RPM support to CRI-O installation
• BZ - 1553260 - Openshift-on-OpenStack depends on python2-shade version bump in OSP 13
• BZ - 1553576 - Change the self_hostname to ${hostname} in openshift-ansible
• BZ - 1554379 - [vSphere] Sometimes PVC dynamic provision failed with error: NotAuthenticated
• BZ - 1554878 - [3.9] Provide external hostname for Elasticsearch server cert
• BZ - 1554885 - Fluentd logs entire response when unexpected error from Elasticsearch
• BZ - 1555220 - registry url for registry-console image is not modified when openshift_examples_modify_imagestreams=true
• BZ - 1555426 - yedit module should generate uniquely named backup files
• BZ - 1556739 - Fail to upgrade ocp with service catalog deployed using an external etcd
• BZ - 1556757 - Subpath volume mount does not receive setgid by fsGroup
• BZ - 1557036 - Environments upgraded to 3.9 and running external etcd hosts cannot install service catalog
• BZ - 1557909 - Changes needed for cfme-46 fully support
• BZ - 1558155 - Limit ranges are being applied with cpu-cfs-quota set to false
• BZ - 1558422 - do not delete node in openstack, if those still exist in cloudprovider
• BZ - 1558472 - [ASB] Regression - The openshift type registry of ASB work failed
• BZ - 1558564 - Mounting socket files from subPaths fail
• BZ - 1558863 - Cannot create configmap without key on web and "Add Item" on cm editing page does not work
• BZ - 1558900 - Example cert-check jobs using container image not work well
• BZ - 1559404 - Change the fluentd request timeout to be essentially infinite
• BZ - 1559675 - Jenkins readinessProbe initialDelaySeconds: 3 is too short and spamming events
• BZ - 1560659 - [3.9] Binary build with --from-file not working
• BZ - 1560916 - It is better to set default value for openshift_prometheus_node_exporter_image_version to OCP version
• BZ - 1561196 - Update the logging role to use facts from current deployment in lieu of role defaults for ES memory limits
• BZ - 1561247 - [starter-us-east-1b] Unable to apply auto-approver resource definitions: no kind \"ClusterRoleBinding\" is registered for version \"rbac.authorization.k8s.io/v1\"
• BZ - 1563230 - [RFE] Limit the Kibana index-patterns for cluster admins
• BZ - 1564076 - prerequiste playbook fails when using openshift_docker_disable_push_dockerhub=True
• BZ - 1564179 - first master's docker-daemon has higher debug level than the rest of the cluster
• BZ - 1564944 - Ensure pods from default, openshift-infra, and logging namespaces are spread evenly across infra structure nodes
• BZ - 1564949 - [3.9] No directory /var/lib/containers/overlay2
• BZ - 1564978 - [3.9] Master api hang when 1 of master/etcd down
• BZ - 1565909 - prevent log record update which causes deletions
• BZ - 1566559 - [3.9] logspam : CONTAINER_EXITED errors in node logs
• BZ - 1567028 - [3.9]Pods pending due to node does not have label "node-role.kubernetes.io/compute=true" in all-in-one cluster
• BZ - 1567827 - [3.9]hawkular metrics pod failed at liveness check, pod can not be started up
• BZ - 1570394 - [3.9] openshift-sdn partially deletes openflow rules leading to "no route to host" for service
• BZ - 1570398 - [3.9] DNS to local node vs. static egress IP
• BZ - 1570859 - [3.9] cluster registries have unnecessary environment values
• BZ - 1571093 - One single daemonset controller is responsible for 1/2 of all write workload on the cluster
• BZ - 1571430 - [3.9] Update of Egress Network Policy causes temporary egress failure when using dnsName
• BZ - 1572419 - 3.9.27: logging-curator pod crash looping - run.sh not found

CVEs

(none)

References

(none)

Red Hat OpenShift Container Platform 3.9

SRPM
ansible-service-broker-1.1.17-1.el7.src.rpm	SHA-256: c46c69cf3fc2c53a7ad41deccfb3991a242d66d0bee260c4360b3510f9030447
apb-1.1.16-1.el7.src.rpm	SHA-256: 9aefc20960a28cbe901f38981fa5158e64521ac7a81f5e685622e9cc1eae3fd5
atomic-openshift-3.9.27-1.git.0.964617d.el7.src.rpm	SHA-256: 3786740136d99db1482105f0843693f41519813cb73f749cbfe76264095aa95d
atomic-openshift-web-console-3.9.27-1.git.242.0fcf673.el7.src.rpm	SHA-256: 7579a5180ec8135379728b2db2defda6cd1c670eaea7a9ee7ac48fdd69f14f30
cri-o-1.9.11-1.gitbc3d2f7.el7.src.rpm	SHA-256: 9168315a25ee323ca3cc4084197654c4e994548ac0e6435c18d7845f3ec518bd
cri-tools-1.0.0-3.git8e6013a.el7.src.rpm	SHA-256: df7bcfc3b6d0ff56fb12f123967547346380a46275b88c5e4fe229e8b7a2636c
golang-github-prometheus-node_exporter-3.9.27-1.git.887.8969372.el7.src.rpm	SHA-256: 64ade91e390a1265ac30fe4a883d889b4ba478cd60d86fcb0c25a2c4e854a826
golang-github-prometheus-prometheus-2.2.1-1.gitbc6058c.el7.src.rpm	SHA-256: bde0e2ae82c9396487b8745ad4236cbee52d2a4a687dca3172b41acab9308ebb
haproxy-1.8.8-1.el7.src.rpm	SHA-256: e46c04ad8f54897c7d80263db574993b0af503690bf02d91c342a43e56bb250b
openshift-ansible-3.9.27-1.git.0.52e35b5.el7.src.rpm	SHA-256: d35b8ba721ed697cee2ef603ed092fed85dda404924c0a0ef9a97f52523bb75c
openshift-elasticsearch-plugin-2.4.4.22__redhat_1-1.el7.src.rpm	SHA-256: 9614d8eb32302c15e2bdf0af422e43b870d9ecd510b583c0750201c3121497ad
rubygem-fluent-plugin-elasticsearch-1.15.2-1.el7.src.rpm	SHA-256: 1a62cf79b62d8849741cf18a90bf4896920abde99a8936861504523b13f83bcd
x86_64
ansible-service-broker-1.1.17-1.el7.x86_64.rpm	SHA-256: eafa83892d24b9d2b36cc99c9cfa77c1ebd0dec4efb91ac0a5d487f136b2e03c
ansible-service-broker-container-scripts-1.1.17-1.el7.noarch.rpm	SHA-256: 5ac614f1d6b4fb9b35f76d4d4a4d3c4be07d9091a4c11bbb61d73b25e045cf25
ansible-service-broker-selinux-1.1.17-1.el7.noarch.rpm	SHA-256: 4b6beb4a5eb0cb48f7e54ea0ac25f6a95e4d652e355e664124861686945dbfbd
apb-1.1.16-1.el7.noarch.rpm	SHA-256: b1a524a3e4a69825c4b11be59a233548029b78c1c6746e607be0bb0d0302ef1f
apb-container-scripts-1.1.16-1.el7.noarch.rpm	SHA-256: e1b741bd6d05d45e3df8edb9546f1a6e2f33aa4c90c1fc6226f561e6f1cbec47
atomic-openshift-3.9.27-1.git.0.964617d.el7.x86_64.rpm	SHA-256: 1ad6b7df3c428d25f569402edae58454ae7745dd7676fdb75b2fff9e8f0b9777
atomic-openshift-clients-3.9.27-1.git.0.964617d.el7.x86_64.rpm	SHA-256: 2fe9b63d512be2b9fe9991239f79b229cf32300f011d468644e41c0cd9016ccb
atomic-openshift-clients-redistributable-3.9.27-1.git.0.964617d.el7.x86_64.rpm	SHA-256: 1b8754ae3cffb1ec2e90d69202e38e91094211e332f8745f90a8c3bf6c0a7413
atomic-openshift-cluster-capacity-3.9.27-1.git.0.964617d.el7.x86_64.rpm	SHA-256: 4351e42d2d1b71ebd94d4f672c0e729abbb28c78a14e044287121a8fc44b582e
atomic-openshift-docker-excluder-3.9.27-1.git.0.964617d.el7.noarch.rpm	SHA-256: 0d80c4b1043d56fac47035b574af71075e3a0a2955830d1f4660100064d52885
atomic-openshift-dockerregistry-3.9.27-1.git.349.fbf9721.el7.x86_64.rpm	SHA-256: bbc26c11af97d37f2edc1222d1e9d3da59bfa942ca2eb49bdf1ee9b82ac94992
atomic-openshift-excluder-3.9.27-1.git.0.964617d.el7.noarch.rpm	SHA-256: 5a25c2bccbe4fe48615d2b82a683bab02184ddfc6e12fd3e23f52f8c8d648cb9
atomic-openshift-federation-services-3.9.27-1.git.0.964617d.el7.x86_64.rpm	SHA-256: 9a1917653150ba0431677e38f056a4d030f07666c552388a9eae43082293fb75
atomic-openshift-master-3.9.27-1.git.0.964617d.el7.x86_64.rpm	SHA-256: 43b3b802b2bda91174509022a312d9a1f2b9c85c2248563ccf89d895bc0e0c3d
atomic-openshift-node-3.9.27-1.git.0.964617d.el7.x86_64.rpm	SHA-256: 798316c4b3cdacbbd2859b0a1e189ba46771fa69e8d25925cb827dc75bd8e565
atomic-openshift-pod-3.9.27-1.git.0.964617d.el7.x86_64.rpm	SHA-256: 2abb4aa3ec858f611955e6bbb5cac6e8663a30f2fd88ad2c9c55df7ca8fc312a
atomic-openshift-sdn-ovs-3.9.27-1.git.0.964617d.el7.x86_64.rpm	SHA-256: c972055517ea302aae2aa34ad9a9117ac5e73e7034e122caa62cd1c9f2e0bb90
atomic-openshift-service-catalog-3.9.27-1.git.0.964617d.el7.x86_64.rpm	SHA-256: 30d702ef492a15e1c8c772cccf78d28f77b531538c41cdc0f344cd05e0fbae65
atomic-openshift-template-service-broker-3.9.27-1.git.0.964617d.el7.x86_64.rpm	SHA-256: 8f58a02247689f34ef0fb2e2eb41a08747365b9857884f18818589ec94dd254f
atomic-openshift-tests-3.9.27-1.git.0.964617d.el7.x86_64.rpm	SHA-256: ada0bcce3a1d899b3e28c34e8e161f3d439a118bfba6bd8dd35fa0e98e38a495
atomic-openshift-utils-3.9.27-1.git.0.52e35b5.el7.noarch.rpm	SHA-256: d4a1667f2ee2b80626a68eb7f832f824998a0e8a232aec5ab96c3e5bf14ce4a6
atomic-openshift-web-console-3.9.27-1.git.242.0fcf673.el7.x86_64.rpm	SHA-256: effa9f3406d13e2e62733b2589026510463f8268000adf801042b2c5376c35d8
cri-o-1.9.11-1.gitbc3d2f7.el7.x86_64.rpm	SHA-256: 09053e4eff2d10919c68f4c90ac0f4a1a376c21571c76f08d19146e393605110
cri-o-debuginfo-1.9.11-1.gitbc3d2f7.el7.x86_64.rpm	SHA-256: ed2a1b5ab4fa4d071c5baf4b685dd82ce368583a155a26f1910b52ad265ace89
cri-tools-1.0.0-3.git8e6013a.el7.x86_64.rpm	SHA-256: 501bafc5feed93ca7cda9124c9a33e3a0792c83f260d52fc4fc50d78e6105337
cri-tools-debuginfo-1.0.0-3.git8e6013a.el7.x86_64.rpm	SHA-256: f86c698be4a4a6e39d0ecc2897bf61f4f254fafa9a4fc6a2ed287e79be2e1f75
haproxy-debuginfo-1.8.8-1.el7.x86_64.rpm	SHA-256: f34312194feeb6195f3f45ba14539433101373cb42729c0699ac838846046bbb
haproxy18-1.8.8-1.el7.x86_64.rpm	SHA-256: 2c5a10f4ff94d3f9383b02ac80a5888d65b3209de312b09d491a3716b9f36d95
openshift-ansible-3.9.27-1.git.0.52e35b5.el7.noarch.rpm	SHA-256: 0f158079e4beb6f6871ae90869a671f1a6f03de981e6b5361508487eea9fad2d
openshift-ansible-docs-3.9.27-1.git.0.52e35b5.el7.noarch.rpm	SHA-256: ee6aa274786f2211246772f8ee2bf45e6ce7edbe378370fcc1c5909e2e02671a
openshift-ansible-playbooks-3.9.27-1.git.0.52e35b5.el7.noarch.rpm	SHA-256: 5d84814ef78ab8ccff2d54aeff0fb2455760d99201ee1d6ef06784802ed6cc6b
openshift-ansible-roles-3.9.27-1.git.0.52e35b5.el7.noarch.rpm	SHA-256: b061bbfcba1713d1fd363d3b88ff2cfc0973c338c056381b4424b8e8ea957aa4
openshift-elasticsearch-plugin-2.4.4.22__redhat_1-1.el7.noarch.rpm	SHA-256: c8f899b5924b9ac5807bc32ca5749cabd29907fe7b0934051a684fac9ca82861
prometheus-2.2.1-1.gitbc6058c.el7.x86_64.rpm	SHA-256: 3e6f77ff701bb70b2f1193d1655b92a4c039c23870ffe1bff47cba232434bd93
prometheus-node_exporter-3.9.27-1.git.887.8969372.el7.x86_64.rpm	SHA-256: 05dfb3d5b8942d956a30d7a784dc519fee2f2e2bd2bc968dc71e6fe82049563a
rubygem-fluent-plugin-elasticsearch-1.15.2-1.el7.noarch.rpm	SHA-256: 33c00413b53ff1895595bab8889eef06674162f95b3aefce6c4ba8ab3e4f75f7
rubygem-fluent-plugin-elasticsearch-doc-1.15.2-1.el7.noarch.rpm	SHA-256: 1ebd2e2facc38cbd08116fa94a0c81d6aea85b08912891ceef3d76f711fa5669