RHBA-2019:0407 - Bug Fix Advisory

Topic

Red Hat OpenShift Container Platform release 3.11.88 is now available with
updates to packages and images that fix several bugs.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container
Platform 3.11.88. See the following advisory for the container images for
this release:

https://access.redhat.com/errata/RHBA-2019:0406

This update fixes the following bugs:

• The build version was not allowed to be specified when requesting logs. As a result, users were not able to view logs of specific build revisions. Now, revision numbers can be specified because the validation was removed. `oc logs` can be invoked for a specific build version. (BZ#1612021)
• When processing resources, empty files were not omitted. `oc set` could cause a panic when encountered by an empty file. Now, `oc set` will not panic when presented an empty file. (BZ#1612023)
• The console created resources synchronously, which does not work when there is a dependency between resources such as `role` and `role binding`, resulting in a failure to create the dependent resource. Now, the console has been changed so that resources are created asynchronously and it not longer fails on creation. (BZ#1673109)
• Default `journald` configurations had the `SystemKeepFree` parameter set to percentages. `journald` does not accept percentage values, so this setting had no effect and and could cause the disk to be filled up. This parameter is now removed from default settings. Users need to update `journald_vars_to_replace` with the absolute value in `SystemKeepFree` to prevent the disk filling up. (BZ#1676565)
• The permissions on the `vsphere` cloud configuration file were restricted, preventing access from other users. This is now resolved and access is now available to users. (BZ#1678433)
• The environment variable that controlled client trust configuration was incorrectly named. As a result, the client was unable to communicate with the Kubernetes API cluster, and subsequently the `ElastiSearch` nodes were unable to be accessed from a cluster. The environment variable is now named correctly and access is restored. (BZ#1678441)
• DNS records were being removed before `kuryr`-related cleanup tasks were executed and these tasks needed access to the OpenShift API. Thus, the connection to the API was not successful due to the missing DNS record pointing to it. This led to non-deleted resources, like subnets, that were created by `kuryr` and caused delete tasks to fail. With this bug fix, the DNS records are only deleted after the `kuryr` stack is deleted. (BZ#1679323)
• `logging-curator` was changed to be scheduled by a `cronjob`, and times were based on the timezone of the master node, where the job is initiated. As a result, the `openshift_logging_curator_run_timezone` variable could not configure the timezone. `openshift_logging_curator_run_timezone` does not work, and the variable naming may cause confusion. Now, `openshift_logging_curator_run_timezone`is removed from related playbooks and documentation and will not be used anymore. (BZ#1680271)

All OpenShift Container Platform 3.11 users are advised to upgrade to these
updated packages.

Solution

Before applying this update, ensure all previously released errata
relevant to your system have been applied.

See the following documentation, which will be updated shortly for release 3.11.88, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258.

Affected Products

• Red Hat OpenShift Container Platform 3.11 x86_64
• Red Hat OpenShift Container Platform for Power 3.11 ppc64le

Fixes

• BZ - 1612021 - Can't view the logs of a particular build by version
• BZ - 1612023 - Met panic when set build hook with a empty file
• BZ - 1633570 - cluster with crio runtime upgrade failed at [openshift_node : Approve node certificates when bootstrapping] due to missing connection to etcd hostname.
• BZ - 1635802 - prometheus & alertmanager pods should use anti-affinity
• BZ - 1636493 - failed to find plugin "bridge" in path [/opt/cni/bin]
• BZ - 1661916 - uninstall playbook umounts /var/lib/origin/openshift.local.volumes
• BZ - 1663268 - Enabling router metrics browser page cause "Readiness probe failed: HTTP probe failed with statuscode: 401"
• BZ - 1667185 - [3.11] More consistent modification of journald.conf.
• BZ - 1669080 - CNS installation failed with "Unable to add device: Device /dev/vsda not found."
• BZ - 1671820 - A ovs process gets killed when oom-killer is invoked, leaving it in bad state.
• BZ - 1673109 - Not able to create new role and new rolebinding in single operation using template
• BZ - 1676565 - openshift_node/defaults/main.yml using a wrong journald value
• BZ - 1677454 - "openshift_logging_curator_run_timezone" is not implemented in CronJob template of Curator5 on v3.11
• BZ - 1678433 - Installer does not secure vsphere.conf
• BZ - 1678441 - While deploying logging in openshift cluster we are getting error while elasticsearch is initiating
• BZ - 1679323 - Cleanup fails when running when running OSP on OCP
• BZ - 1679760 - [3.10] uninstall playbook umounts /var/lib/origin/openshift.local.volumes
• BZ - 1680271 - Remove the deprecated "openshift_logging_curator_run_timezone" variable on v3.11
• BZ - 1684742 - [3.11] Installation failed on RHEL Atomic Host

CVEs

(none)

References

(none)