Synopsis

OpenShift Container Platform 3.9 bug fix and enhancement update

Type/Severity

Bug Fix Advisory

Topic

Red Hat OpenShift Container Platform release 3.9.30 is now available with updates to packages and images that fix several bugs and add enhancements.

Description

Red Hat OpenShift Container Platform is the company's cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container Platform 3.9.30. See the following advisory for the container images for this release:

https://access.redhat.com/errata/RHBA-2018:1797

This update fixes the following bugs:

• Jenkins no_proxy processing could not handle suffixes like ".svc". As a result, communication between a Jenkins k8s agent pod and the Jenkins master would attempt to go through a configured http_proxy and fail.

With this bug fix, the OpenShift Container Platform jenkins agent images are updated to automatically include the jenkins master and jnlp hosts in the no_proxy list. The Jenkins limitation for no_proxy processing is now circumvented.(BZ#1578989)

• When creating the Elasticsearch server certificate, the external Elasticsearch host names were unconditionally added to the subjectAltName. Installation would fail because only host name components beginning with a letter are allowed in the subjectAltName, so hostnames like es.0xdeadbeef.com were disallowed and would cause an error. A warning is now issued if the Elasticsearch host name contains a component which does not begin with a letter, and it is not added to the subjectAltName. Logging installation now completes successfully. (BZ#1567767)
• The plug-in only caught the KubeException, but not more general exceptions. Therefore, consumers were stuck cycling until the API server could be contacted. Metadata fetch is now more relaxed and gracefully catches the exception, returning no metadata, and subsequently the record is orphaned. (BZ#1560170)
• logging-elasticsearch-ops was missing in the delete configmaps list in the openshift-ansible delete_logging role. The logging-elasticsearch-ops configmap still exists after running uninstall ansible playbook for logging. logging-elasticsearch-ops is added to the delete configmaps list. All of the logging configmaps including logging-elasticsearch-ops are now uninstalled by running the uninstall ansible playbook for logging. (BZ#1549220)
• The Create Project button was incorrectly displayed to users when they had no projects and self-provisioning had been disabled on the projects list page of the web console. The action would always fail, so the button should have been hidden. The bug is now fixed, and Create Project is now correctly hidden in the console when self-provisioning is disabled. (BZ#1577359)
• This bug fix addresses an issue pulling images from a private docker hub registry. (BZ#1578088)
• This bug fix addresseswhere cfs_quota might still be set on a pod even when cpu-cfs-quota is set to false on the node. (BZ#1581860)

This update includes the following enhancement:

• Users are now allowed to disable JSON payload parsing. Parsing each log message into JSON and attaching it to the final payload is an expensive operation. Fluentd can now be configured to disable parsing of message payloads. This is the initial configuration change to deprecating the feature from the fluent-plugin-kubernetes_metadata_filter. (BZ#1569825)

All OpenShift Container Platform 3.9 users are advised to upgrade to these updated packages and images.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For OpenShift Container Platform 3.9 see the following documentation, which will be updated shortly for release 3.9.30, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.9/release_notes/ocp_3_9_release_notes.html

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258.

Affected Products

• Red Hat OpenShift Container Platform 3.9 x86_64

Fixes

• BZ - 1549220 - configmap still exist after running uninstall playbook for logging
• BZ - 1550847 - s3 deployment via ansible fails as pvc doesn't get created
• BZ - 1554407 - [CRI-O] logging-fluentd throughput lower with CRI-O runtime vs Docker runtime
• BZ - 1557290 - Cannot allocate memory when redeploy logging
• BZ - 1559443 - Hawkular Metrics crashes with OutOfMemoryError under moderate load
• BZ - 1560170 - Fluentd unable to send logs to Elasticsearch with socket errors talking to Kube
• BZ - 1564847 - The image tag of cri-o should be v3.9 instead of 3.9 while openshift_release is specified
• BZ - 1565372 - The ES fluentd plugin appears to direct the elasticsearch-api to retry a failed request 5 times before bubbling up an error causing ES bulk queue overflows
• BZ - 1567250 - Metrics Casandra PV running out of space due to snapshots
• BZ - 1567767 - [3.9] openshift_logging : Run JKS generation script failed
• BZ - 1568361 - Rotate Elasticsearch log files on persistent volume, keeping a configured maximum
• BZ - 1569825 - JSON payload processing of the log message payload if abused can cause logging to slow to a crawl
• BZ - 1570540 - Vmware persistent volumes do not work because of missing clusterrolebinding with vsphere-cloud-provider service account.
• BZ - 1570982 - Large number of data_temp tables cause request timeouts and other performance problems
• BZ - 1572192 - [CRI-O] Containers created with cri-o allow non-privileged user to modify filesystem.
• BZ - 1577357 - [3.9] oadm prune images fails on invalid image reference
• BZ - 1577359 - Create Project button shows up on project listing even if you do not have permissions to create a project
• BZ - 1577877 - [3.9] .all alias not being updated with new indices after a certain date
• BZ - 1578088 - Secret created by `oc create secret docker-registry` cannot pull image from external private registry
• BZ - 1578989 - jenkins slave does not respect no_proxy 3.9
• BZ - 1579898 - changes introduced by bz 1416639 not working for registry on NFS
• BZ - 1581860 - [3.9] Limit ranges are being applied with cpu-cfs-quota set to false
• BZ - 1582190 - master scaleup failed due to 'openshift_is_atomic' is undefined"

CVEs

• CVE-2018-1000400
• CVE-2018-1002100

References

(none)