Synopsis

OpenShift Container Platform 3.9 bug fix update

Type/Severity

Bug Fix Advisory

Topic

Red Hat OpenShift Container Platform release 3.9.41 is now available with updates to packages and images that fix several bugs.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud ddeployments.

This advisory contains the RPM packages for Red Hat OpenShift Container Platform 3.9.41. See the following advisory for the container images for this release:

https://access.redhat.com/errata/RHBA-2018:2548

This update fixes the following bugs:

• This bug fix adds tasks to the upgrade playbooks to correctly upgrade the CRI-O RPMS. (BZ#1553213)
  
• Previously, groups associated with a user were not checked when performing access checks to look up the readiness of objects created by the templates. This resulted in a readiness failure at the template instance level. This bug fix passes the user's groups when performing the readiness check operation, not just when performing the object creation. (BZ#1562527)
  
• If CRI-O was enabled and /var/lib/docker was a mount point rather than a directory, the installation would fail with the error `Device or resource busy: '/var/lib/docker'`. The installation playbooks have been fixed to account for /var/lib/docker as a mount point. (BZ#1574887)
  
• If the Prometheus service account did not have the required permissions to access the metrics endpoint of the router, then Prometheus failed to scrape the router's metrics. This bug fix grants an additional role with permissions to access the metrics endpoint to the Prometheus service account. (BZ#1588010)
  
• Previously, the Ansible template did not quote the value in the selector. This created an invalid JSON file. This bug fix quotes the selector value, which allows the PVC with the selector to be created. (BZ#1601605)
  
• The 9100 port was previously blocked on all nodes by default. Prometheus could not scrape the node_exporter service running on the other nodes, which listen on port 9100. This bug fix modifies the firewall configurations to allow incoming TCP traffic for the 9000 - 1000 port range. (BZ#1603144)
  
• Previously, the underlying library that Fluentd used for reading in journal files did not correctly handle rolled over files. When a journal file was rolled over, Fluentd would hold these files even after it was done reading from them. This bug fix updated the code in the underlying fluent-plugin-systemd plugin and updated the version in the Fluentd Dockerfile. (BZ#1610678)
  
• This bug fix removed the `openshift_crio_use_rpm` variable and updated the installer tasks to only install CRI-O using RPMS. (BZ1614916)
  
• Previously, older versions of dnsmasq used privileged, lower-numbered source ports for outbound DNS queries. This caused outbound DNS queries to potentially be dropped. This bug fix configures dnsmasq using its `min-port` setting to set the minimum port number for outbound queries to 1024. (BZ#1614983)
  

All OpenShift Container Platform 3.9 users are advised to upgrade to these updated packages.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

See the following documentation, which will be updated shortly for release 3.9.41, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.9/release_notes/ocp_3_9_release_notes.html

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258.

Affected Products

• Red Hat OpenShift Container Platform 3.9 x86_64

Fixes

• BZ - 1553213 - Add CRI-O RPM upgrade to node upgrade playbooks in 3.9.z
• BZ - 1556773 - Deprecated env option DROP_SYN_DURING_RESTART for router
• BZ - 1562527 - [3.9] Provision call failed: deploymentconfigs is forbidden: User cannot get deploymentconfigs in project
• BZ - 1574887 - ansible instalation prerequisite.yml fails with FAILED! => {"changed": false, "msg": "rmtree failed: [Errno 16] Device or resource busy: '/var/lib/docker'"}
• BZ - 1588010 - Prometheus can't access router metrics
• BZ - 1599241 - Add securty content for hawkular-cassandra before openshift was updated to v3.10
• BZ - 1600041 - Process EventRouter template failed with default value
• BZ - 1601605 - openshift logging Ansible playbook installation while defining PVC manifest a match label selector should use value 'true' in quotes to avoid it to understandable as a Boolean value.
• BZ - 1602054 - Number of NVMe disks attachable is lower than max predefined count for EBS
• BZ - 1603144 - Installing prometheus should update iptable rules for node-exporter
• BZ - 1605152 - [3.9]failed to create fsnotify watcher: too many open files
• BZ - 1607538 - [3.9] IP failover doesn't react on router's pod being scaled down
• BZ - 1608092 - [3.9] Nodes losing IP address information in aws
• BZ - 1610678 - [3.9] Looks like fluentd is keeping open deleted journal files that have been rotated
• BZ - 1614916 - [3.9] Need to make crio installs rpm installs by default
• BZ - 1614983 - Intermittent dnsmasq outages
• BZ - 1617937 - [APB] mariadb-apb can not sync data to pv when using prod plan
• BZ - 1618525 - [3.9] Router pod image upgrade fails when disconnected registry url doesn't match openshift3/ose-

CVEs

(none)

References

(none)

Red Hat OpenShift Container Platform 3.9

SRPM
atomic-openshift-3.9.41-1.git.0.67432b0.el7.src.rpm	SHA-256: e32cfa11ed18a10b3c7ce2281b0bfb088f9cc226189ac1379f11d2cb8fc80c7b
atomic-openshift-web-console-3.9.41-1.git.256.9e431bd.el7.src.rpm	SHA-256: 55d2ff6a43eac74b4a32f8190f0acaeda40ae96044d9ca34c7cf8edc35398690
fluentd-0.12.43-2.el7.src.rpm	SHA-256: 8b9575fe3779372faae7bb69ef253ae7ee92b5552169ddaa7ffb5031247f10f9
golang-github-prometheus-node_exporter-3.9.41-1.git.1054.156de1a.el7.src.rpm	SHA-256: 118422977da39c4bff4a360d3aa0cc80c67dcd6b3a20e7c3554606f076ead68a
mariadb-apb-role-1.1.11-1.el7.src.rpm	SHA-256: bb79d9773cb0ed97d4ba59c2d63f97218a20095421a002755173a00c3dbb108d
openshift-ansible-3.9.41-1.git.0.4c55974.el7.src.rpm	SHA-256: 5a960991321488a94c3d9aed9f2846e694f1298f7444c3d8211a128ee8208b84
python-requests-2.14.2-1.el7ost.src.rpm	SHA-256: 38ec4541f9a8f9775962931f3b7a5c517375d9f05595ca12eea7599e98101be1
rubygem-domain_name-0.5.20180417-1.el7.src.rpm	SHA-256: f3851ccbdca2c3e21072c357f21f54ae993e5b536802798131e5cfaee6bbe18d
rubygem-excon-0.62.0-1.el7.src.rpm	SHA-256: d2e31fee1f903d616875ddce2404ffd9609b056d165712d2832d0a82ae1f4cf8
rubygem-faraday-0.15.2-1.el7.src.rpm	SHA-256: cd68239874de9207f7e587c335215f0c3d003d35a9ef29dfc1ac0bf0362c0322
rubygem-ffi-1.9.25-2.el7.src.rpm	SHA-256: fec9627ab6bd91d761d80641fd7f9f8a2311a2de88ee47957977f4035c7ce42d
rubygem-fluent-plugin-elasticsearch-1.17.2-1.el7.src.rpm	SHA-256: 8a9bf275c4baac4c128df97bcaa9a15a2eddd2416a10d3f4fb46083f750acee5
rubygem-fluent-plugin-systemd-0.0.11-1.el7.src.rpm	SHA-256: 8a85a689a6ad07d660ac5ea21a50e84d72a6279b3ac3e0468bc9b82f8e116872
rubygem-mime-types-3.2.2-2.el7.src.rpm	SHA-256: 2c4dc60c7d171e23915737b853ec0cadbf9efd4a6e70f75210a45d77ef6e3de5
rubygem-mime-types-data-3.2018.0812-2.el7.src.rpm	SHA-256: 69f3b5c760ab35edcb82eb571e6bda9b934b9af22981b51715f717d7a2f5e4ed
rubygem-systemd-journal-1.3.3-2.el7.src.rpm	SHA-256: 24b8cfdce8ec89a24d3619b09eddf302234e3cdbb87a6141d169d7eb31c025b8
rubygem-yajl-ruby-1.4.1-1.el7.src.rpm	SHA-256: d8997ccc4e52dde63c5cf8cd4742e5b9d4ac03eb81a6b2e31e057cd1615dca6a
x86_64
atomic-openshift-3.9.41-1.git.0.67432b0.el7.x86_64.rpm	SHA-256: b2498843509daf4c7c23a6bdd65b2b02bec8545107e7a3ea8dc126752117c788
atomic-openshift-clients-3.9.41-1.git.0.67432b0.el7.x86_64.rpm	SHA-256: 3a64cde1eb6c62f28e58c153aa80792af52985cd71aa378cf0b80ba12c1010cd
atomic-openshift-clients-redistributable-3.9.41-1.git.0.67432b0.el7.x86_64.rpm	SHA-256: 62b51d327d79affb652c1b00841825b2ba2f4a83da09402360b4eca3c27854ca
atomic-openshift-cluster-capacity-3.9.41-1.git.0.67432b0.el7.x86_64.rpm	SHA-256: 2d0219ee8721ae34a25865087d40343f7c0ce6e351b88883d8bd3a199f69e388
atomic-openshift-docker-excluder-3.9.41-1.git.0.67432b0.el7.noarch.rpm	SHA-256: da9b414bf2ec3a2a2933b77f88c8325501e6fc0acbc67f138c19f0aeb9328f4e
atomic-openshift-dockerregistry-3.9.41-1.git.351.84a91c0.el7.x86_64.rpm	SHA-256: fa057bf01c136300155d66c5e2127f065a20ee4411680fc0cf5c020fd5660dc6
atomic-openshift-excluder-3.9.41-1.git.0.67432b0.el7.noarch.rpm	SHA-256: 11c8c0010f73a975fb0beb3d56661c21dc7e0868825aec0ad2f61f238ad86137
atomic-openshift-federation-services-3.9.41-1.git.0.67432b0.el7.x86_64.rpm	SHA-256: 3c556a388bbedb216de61196ed475e3a4720709bf0cec3e8d8be8c6f82aa242a
atomic-openshift-master-3.9.41-1.git.0.67432b0.el7.x86_64.rpm	SHA-256: 6b4e15fcb1d0f69f70ee49fdbdf974a27b9e50ffd60e5f676ec3bbcd0ddfbfa6
atomic-openshift-node-3.9.41-1.git.0.67432b0.el7.x86_64.rpm	SHA-256: 3cccefcdfc8c6c05515701230cd5a25756c0b5fc394146635bd401c58e601e8b
atomic-openshift-pod-3.9.41-1.git.0.67432b0.el7.x86_64.rpm	SHA-256: 48ef260f10ba97232fbd79d95e572a55537cba988e19914050a8eb4832352899
atomic-openshift-sdn-ovs-3.9.41-1.git.0.67432b0.el7.x86_64.rpm	SHA-256: 555b4db99b2fd40390d82088f8a85586d77238bfe55e38f5b47abd571c12bc31
atomic-openshift-service-catalog-3.9.41-1.git.0.67432b0.el7.x86_64.rpm	SHA-256: 13a87021360f358404db0c55761ca650f454233f737e6ca8cbadd014f2d4f364
atomic-openshift-template-service-broker-3.9.41-1.git.0.67432b0.el7.x86_64.rpm	SHA-256: aa53c046a887d401bf9c97090051b094224279a692223acb37d67fcba8fee6bd
atomic-openshift-tests-3.9.41-1.git.0.67432b0.el7.x86_64.rpm	SHA-256: 128670824e6b3244d9f30d59a47e80e896dc319f57a39cc3ea706ed17f1f2041
atomic-openshift-utils-3.9.41-1.git.0.4c55974.el7.noarch.rpm	SHA-256: 3b6d02f8eae8d571ee0510c656594b782dcf42f42b2f6662f1aebd6dfdd5ffdd
atomic-openshift-web-console-3.9.41-1.git.256.9e431bd.el7.x86_64.rpm	SHA-256: be922b76866224bfe51115708593ba66043c842f16dfa0fdbd79a7f6857a40db
fluentd-0.12.43-2.el7.x86_64.rpm	SHA-256: a15374521f891e1e8177cfd767ea0423f7da09c7a5d1902bc5cdc91240e39864
fluentd-debuginfo-0.12.43-2.el7.x86_64.rpm	SHA-256: 0e2546645745c5bdf34b9607aeebf5a65012548dc3cf62eee9218ef31964ae71
fluentd-doc-0.12.43-2.el7.noarch.rpm	SHA-256: c8b477e75715bb11c1818cf09468c3ad4ee866680b152666162000b8ff39b583
mariadb-apb-role-1.1.11-1.el7.noarch.rpm	SHA-256: f543c1f637fda63b7fef1f9a16b8468e31abbab451dff1cd21ecf1347a0d5599
openshift-ansible-3.9.41-1.git.0.4c55974.el7.noarch.rpm	SHA-256: ab6e14ea59b25163a0b3c4ee8d044b17f20ad5de14753a97f4d82e95118575ba
openshift-ansible-docs-3.9.41-1.git.0.4c55974.el7.noarch.rpm	SHA-256: 04495ced8816b334715560fa9b76c06f5def8f7b721b5aeebf126b04aa4f6e39
openshift-ansible-playbooks-3.9.41-1.git.0.4c55974.el7.noarch.rpm	SHA-256: 93b2df094746f033e4fcf4f64245910a0412b4e628898d99643e1557101dc6f1
openshift-ansible-roles-3.9.41-1.git.0.4c55974.el7.noarch.rpm	SHA-256: b400515bc31348662764f0fed0b2e7f092c91ec8b3191d332b7356c98f5e404f
prometheus-node-exporter-3.9.41-1.git.1054.156de1a.el7.x86_64.rpm	SHA-256: 8fd5a3cd4cec9918a2edda4692a5910c00eccbc3fe2bb90bca7034ca81807c1d
python2-requests-2.14.2-1.el7ost.noarch.rpm	SHA-256: 7c024c073ed5dd72ce70cd11c164a6c553a0d8494b3d4cf553b070e411282315
rubygem-domain_name-0.5.20180417-1.el7.noarch.rpm	SHA-256: fa3f37d9be84b02016c8b1ff416c0267cf670cb7643ffc96ff38feab5f2a4e14
rubygem-domain_name-doc-0.5.20180417-1.el7.noarch.rpm	SHA-256: 6a4b5fed7616a0419ba5e54ca5ee93ae42284391bda1fd23f1e9da9bec47b941
rubygem-excon-0.62.0-1.el7.noarch.rpm	SHA-256: 2dd155b7da7ba88bbbcbe54fd8d8b3065d74c23373f35c8010b6d633296fed20
rubygem-excon-doc-0.62.0-1.el7.noarch.rpm	SHA-256: a669d621d3b79695697df2c3c7612e165ea1f75307038b0fd0bc1905e3040763
rubygem-faraday-0.15.2-1.el7.noarch.rpm	SHA-256: fc2d9183f301bfce09c01042b78feaf87ea36f16e44286fe6afa21878474dce3
rubygem-faraday-doc-0.15.2-1.el7.noarch.rpm	SHA-256: 4e71ad305b2d0cf4fbacc9caf7ca713b96e2efc7e77374bb092d68b6702681f6
rubygem-ffi-1.9.25-2.el7.x86_64.rpm	SHA-256: b37eb2126e84f4368fdd49f5c557c43e09b1b4fecabc4e01520bb8deb04e8ac1
rubygem-ffi-debuginfo-1.9.25-2.el7.x86_64.rpm	SHA-256: ae5348158cd67f6f79194498914f1a218407554ef23fcbcaaf016c889ce6a3ec
rubygem-fluent-plugin-elasticsearch-1.17.2-1.el7.noarch.rpm	SHA-256: 6c69859254d94498dd203a63c56c3751f516423fbbcfefe99e816efc0ca647c9
rubygem-fluent-plugin-elasticsearch-doc-1.17.2-1.el7.noarch.rpm	SHA-256: 9b08ef29df545f7bd16c3dbaf90d8c2a06805863e7fbde38ee80b806bd902b6b
rubygem-fluent-plugin-systemd-0.0.11-1.el7.noarch.rpm	SHA-256: d56f547748efbfbd07f3391c3145fd591722b5ba0999a1e5420d3ffa453c70ce
rubygem-fluent-plugin-systemd-doc-0.0.11-1.el7.noarch.rpm	SHA-256: c4b26d90ab3b442509a9426041430e3cde7dbd581ec9842afe0d6d4c68eb20c8
rubygem-mime-types-3.2.2-2.el7.noarch.rpm	SHA-256: 7c253ca535a30b91d72018e4b50a8b8653622a93360735ac8d786a6a52d12efb
rubygem-mime-types-data-3.2018.0812-2.el7.noarch.rpm	SHA-256: cc69aebf2b05a5361c634c008d9b1295d30a594d409d754dfc3a2be3cda54ab6
rubygem-mime-types-data-doc-3.2018.0812-2.el7.noarch.rpm	SHA-256: 0e158e4dce19608720d412730b6b93fe89ea52f54521e8e36ecb7fa1742a7909
rubygem-mime-types-doc-3.2.2-2.el7.noarch.rpm	SHA-256: d272d684482096cab12105d6f3cdbb7d37de2b930eb5acb8cc28c14ba3668752
rubygem-systemd-journal-1.3.3-2.el7.noarch.rpm	SHA-256: 257e3c4af1b9eb88e8cea821e4b4d7474d864001d1f7d4db5e6737880c502935
rubygem-systemd-journal-doc-1.3.3-2.el7.noarch.rpm	SHA-256: f2f15bf527741f87d3ef2447ad146db85651b4e42db3e6ab4a296174c31afe58
rubygem-yajl-ruby-1.4.1-1.el7.x86_64.rpm	SHA-256: f4a2f3ba2410c94b9c9413464f75268dc701b4ebf10e970ca5deb88bc1a8966e
rubygem-yajl-ruby-debuginfo-1.4.1-1.el7.x86_64.rpm	SHA-256: f4eeacaff73d0905209f014715717b0ed8e57644a34854b751cd6491efd926f2
rubygem-yajl-ruby-doc-1.4.1-1.el7.noarch.rpm	SHA-256: ae5332bc8805c45f0572841581a3107d35a19c746bce68e4f19bfb5951458fcc