RHBA-2019:0024 - Bug Fix Advisory

Topic

Red Hat OpenShift Container Platform release 3.11.59 is now available with
updates to packages and images that fix several bugs and add enhancements.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container
Platform 3.11.59. See the following advisory for the container images for
this release:

https://access.redhat.com/errata/RHBA-2019:0023

Space precludes documenting all of the bug fixes and enhancements in this
advisory. See the following Release Notes documentation, which will be
updated shortly for this release, for details about these changes:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

All OpenShift Container Platform 3.11 users are advised to upgrade to these
updated packages and images.

Solution

Before applying this update, ensure all previously released errata
relevant to your system have been applied.

See the following documentation, which will be updated shortly for release 3.11.59, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258.

Affected Products

• Red Hat OpenShift Container Platform 3.11 x86_64
• Red Hat OpenShift Container Platform for Power 3.11 ppc64le

Fixes

• BZ - 1503735 - [RFE] Allow replacing specific nodes in an Openshift-on-OpenStack deployment
• BZ - 1514487 - The installer should delete etcd2 kube data if platform is using etcd3
• BZ - 1553070 - [RFE] Support multi driver pools for hybrid deployments
• BZ - 1566424 - [RFE] Scale out Overcloud VM-based OCP on OSP with Ansible
• BZ - 1568472 - OpenShift on OpenStack install fails on OSP versions older than Pike
• BZ - 1568833 - [RFE] Support to use Ceph RadosGW for the OCP registry
• BZ - 1573128 - Openshift-on-OpenStack playbook support for kuryr pool driver selection
• BZ - 1605160 - [Ansible-2.6.1] Create VPC failed where ansible module "ec2_vpc_net" raise exception of "does not exist: vpc_exists"
• BZ - 1611248 - Multiple webhook links appear if set more than once
• BZ - 1612776 - The ARP cache size did not been set in nodes except master node
• BZ - 1613438 - OpenShift on OpenStack Ansible Installer creates CNS security group when openshift_openstack_num_cns is set to zero
• BZ - 1614650 - Upgrade fails at "Set node schedulability"
• BZ - 1623333 - [3.11] swap is not disabled when running 3.10 -> 3.11 upgrade
• BZ - 1624673 - No image automation-broker-apb in aws downstream registry
• BZ - 1624998 - Unit test flake in cidr allocation
• BZ - 1625534 - Fail to upgrade ocp with standalone etcd_container due to wrong etcd command used
• BZ - 1626988 - LDAPS can't connect to AD - connection reset by peer
• BZ - 1628201 - OCP 3.11: etcd scaleup on CRI-O HA cluster fails with dict object has no attribute etcd_ip error
• BZ - 1629716 - Remove deprecated prometheus install from openshift-ansible installer
• BZ - 1631481 - Upgarde fails due to monitoring fails to deploy
• BZ - 1632155 - Cannot see basic audit log but just advanced log
• BZ - 1632869 - Add support for only installing and running the schema installer job
• BZ - 1633504 - node-problem-detector fails to install in disconnected install
• BZ - 1634227 - cluster-monitoring-operator pods in CrashLoopBackOff, image wrongly packaged 4.0 Telemeter client
• BZ - 1634303 - Filter for non-critical namespaces needs to be tighter; [criticalprefix]-.* vs [criticalprefix].*
• BZ - 1635462 - sync daemonset should tolerate taints
• BZ - 1636914 - timeout for "Wait for sync DS to set annotations on all nodes" task
• BZ - 1638140 - Long deployments terminated due to closed watch
• BZ - 1638699 - ansible 2.7: v3.11 installation fails due to missing etcd certificate
• BZ - 1639137 - oc cluster up-3.11 not able to provision when proxy is specified.
• BZ - 1639201 - Images are not prepulled when CRIO runtime is used
• BZ - 1640791 - Vsphere volumes should not support multiattach
• BZ - 1641397 - [3.11] upgrade failed on RHEL AH, at TASK [Install registry_auth dependencies]
• BZ - 1641752 - OpenShift Container Platform 3.11.z image refresh
• BZ - 1643417 - OCP on OSP provisioning of separate etcd hosts do not work
• BZ - 1644416 - calico roles overwrite etcd_cert_config_dir causing issues with OpenShift management playbooks
• BZ - 1645164 - Upgrade to 3.11 failed - node is removed and can't be attached back to the cluster
• BZ - 1647288 - Images prepull is broken due to CRIO service is restart during the prepulling process
• BZ - 1647793 - No CA copied for github or github enterprise IdentityProvider
• BZ - 1648453 - [3.11] Curator5 fails to start in 3.11 - missing package
• BZ - 1648832 - Installation failed due to invalid local-ipv4 value configured as hostname in OpenStack
• BZ - 1649074 - Node label `type=upgrade` is ignored when upgrading OCP
• BZ - 1652224 - After upgrade 3.10 to 3.11 cluster-admin can't browse Elasticsearch logs from kibana
• BZ - 1652453 - Master has a duplicate domain name
• BZ - 1653380 - [3.11] firewalld reload causes namespace wide egress IP to stop working
• BZ - 1654948 - Asb version in stage registry v3.11.43-2 is not right
• BZ - 1655675 - Define Elasticsearch DC recreate timeout to avoid premature rollbacks
• BZ - 1656086 - Users unable to access Kibana after upgrade to 3.11
• BZ - 1657252 - OSEv3 vars overwritten at dynamic inventory when kuryr is enabled
• BZ - 1658632 - Old Searchguard indices are not cleaned up

CVEs

• CVE-2018-1000861
• CVE-2018-1000862
• CVE-2018-1000863
• CVE-2018-1000864

References

(none)