Synopsis

OpenShift Container Platform 3.9 bug fix and enhancement update

Type/Severity

Bug Fix Advisory

Topic

Red Hat OpenShift Container Platform release 3.9.27 is now available with updates to packages and images that fix several bugs and add enhancements.

Description

Red Hat OpenShift Container Platform is the company's cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container Platform 3.9.27. See the following advisory for the container images for this release:

https://access.redhat.com/errata/RHBA-2018:1567

Space precludes documenting all of the bug fixes and enhancements in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.openshift.com/container-platform/3.9/release_notes/ocp_3_9_release_notes.html

All OpenShift Container Platform 3.9 users are advised to upgrade to these updated packages and images.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For OpenShift Container Platform 3.9 see the following documentation, which will be updated shortly for release 3.9.27, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.9/release_notes/ocp_3_9_release_notes.html

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258.

Affected Products

• Red Hat OpenShift Container Platform 3.9 x86_64

Fixes

• BZ - 1455680 - Volume stuck in attaching state for 15 minutes
• BZ - 1502028 - Updating Docker registry reverts HTTPS/TLS to HTTP
• BZ - 1508828 - [CRI-O] Can't show image digests info on node
• BZ - 1519522 - Admin user should be able to see orphaned index in kibana
• BZ - 1529496 - [3.8]master-api and master-controllers are not restarted when deploy metrics along with OCP
• BZ - 1542135 - PVC stat metrics from kubelet are persistent.
• BZ - 1542867 - local-storage-provisioner log message for regular file is not clear
• BZ - 1543647 - Remove hawkular-alerts from hawkular-metrics
• BZ - 1547226 - heketi-storage-copy-job fails during cns-deploy as it trying to pull a wrong image "heketi/heketi:dev"
• BZ - 1550018 - The ServiceAccount 'aggregated-logging-fluentd' is not a cluster-reader in the 'logging' project
• BZ - 1550372 - NFS volume recycle failed for ErrImagePull
• BZ - 1550797 - Should remove 'loading..' when browser non-existent image
• BZ - 1551499 - DNS resolution failed inside pod when using flannel
• BZ - 1551904 - Network Policy shows up twice under Other Resources in different api groups
• BZ - 1553034 - ansible playbook to uninstall glusterfs doesn't remove gluster-block provisioner pod
• BZ - 1553186 - Add RPM support to CRI-O installation
• BZ - 1553260 - Openshift-on-OpenStack depends on python2-shade version bump in OSP 13
• BZ - 1553576 - Change the self_hostname to ${hostname} in openshift-ansible
• BZ - 1554379 - [vSphere] Sometimes PVC dynamic provision failed with error: NotAuthenticated
• BZ - 1554878 - [3.9] Provide external hostname for Elasticsearch server cert
• BZ - 1554885 - Fluentd logs entire response when unexpected error from Elasticsearch
• BZ - 1555220 - registry url for registry-console image is not modified when openshift_examples_modify_imagestreams=true
• BZ - 1555426 - yedit module should generate uniquely named backup files
• BZ - 1556739 - Fail to upgrade ocp with service catalog deployed using an external etcd
• BZ - 1556757 - Subpath volume mount does not receive setgid by fsGroup
• BZ - 1557036 - Environments upgraded to 3.9 and running external etcd hosts cannot install service catalog
• BZ - 1557909 - Changes needed for cfme-46 fully support
• BZ - 1558155 - Limit ranges are being applied with cpu-cfs-quota set to false
• BZ - 1558422 - do not delete node in openstack, if those still exist in cloudprovider
• BZ - 1558472 - [ASB] Regression - The openshift type registry of ASB work failed
• BZ - 1558564 - Mounting socket files from subPaths fail
• BZ - 1558863 - Cannot create configmap without key on web and "Add Item" on cm editing page does not work
• BZ - 1558900 - Example cert-check jobs using container image not work well
• BZ - 1559404 - Change the fluentd request timeout to be essentially infinite
• BZ - 1559675 - Jenkins readinessProbe initialDelaySeconds: 3 is too short and spamming events
• BZ - 1560659 - [3.9] Binary build with --from-file not working
• BZ - 1560916 - It is better to set default value for openshift_prometheus_node_exporter_image_version to OCP version
• BZ - 1561196 - Update the logging role to use facts from current deployment in lieu of role defaults for ES memory limits
• BZ - 1561247 - [starter-us-east-1b] Unable to apply auto-approver resource definitions: no kind \"ClusterRoleBinding\" is registered for version \"rbac.authorization.k8s.io/v1\"
• BZ - 1563230 - [RFE] Limit the Kibana index-patterns for cluster admins
• BZ - 1564076 - prerequiste playbook fails when using openshift_docker_disable_push_dockerhub=True
• BZ - 1564179 - first master's docker-daemon has higher debug level than the rest of the cluster
• BZ - 1564944 - Ensure pods from default, openshift-infra, and logging namespaces are spread evenly across infra structure nodes
• BZ - 1564949 - [3.9] No directory /var/lib/containers/overlay2
• BZ - 1564978 - [3.9] Master api hang when 1 of master/etcd down
• BZ - 1565909 - prevent log record update which causes deletions
• BZ - 1566559 - [3.9] logspam : CONTAINER_EXITED errors in node logs
• BZ - 1567028 - [3.9]Pods pending due to node does not have label "node-role.kubernetes.io/compute=true" in all-in-one cluster
• BZ - 1567827 - [3.9]hawkular metrics pod failed at liveness check, pod can not be started up
• BZ - 1570394 - [3.9] openshift-sdn partially deletes openflow rules leading to "no route to host" for service
• BZ - 1570398 - [3.9] DNS to local node vs. static egress IP
• BZ - 1570859 - [3.9] cluster registries have unnecessary environment values
• BZ - 1571093 - One single daemonset controller is responsible for 1/2 of all write workload on the cluster
• BZ - 1571430 - [3.9] Update of Egress Network Policy causes temporary egress failure when using dnsName
• BZ - 1572419 - 3.9.27: logging-curator pod crash looping - run.sh not found

CVEs

• CVE-2018-10184

References

(none)