RHBA-2019:1605 - Bug Fix Advisory

Topic

Red Hat OpenShift Container Platform release 3.11.117 is now available with
updates to packages and images that fix several bugs and add enhancements.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container
Platform 3.11.117. See the following advisory for the container images for
this release:

https://access.redhat.com/errata/RHBA-2019:1606

Space precludes documenting all of the bug fixes and enhancements in this
advisory. See the following Release Notes documentation, which will be
updated shortly for this release, for details about these changes:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

All OpenShift Container Platform 3.11 users are advised to upgrade to these
updated packages and images.

Solution

Before applying this update, ensure all previously released errata
relevant to your system have been applied.

For OpenShift Container Platform 3.11 see the following documentation,
which will be updated shortly for release 3.11.117, for important
instructions on how to upgrade your cluster and fully apply this
asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258.

Affected Products

• Red Hat OpenShift Container Platform 3.11 x86_64
• Red Hat OpenShift Container Platform for Power 3.11 ppc64le

Fixes

• BZ - 1418021 - oc create route dry-run -o yaml does not output a route object
• BZ - 1571190 - write kube-* namespace logs to .operations index in v3.10
• BZ - 1585070 - Node service will start failed if cpu_manager_state conflict with new value
• BZ - 1600741 - networkcheck diagnostics test pods die if test pod image is pulled from on-prem/disconnected registry (and work if pulled from registry.access.redhat.com)
• BZ - 1608260 - [WhnpxDH8] Learn more link on Expand PVC page should point to dev_guide/expanding_persistent_volumes.html
• BZ - 1624316 - oc cluster up doesn't work with dnsmasq running locally
• BZ - 1631687 - upgrade OCP on Atomic Host 7.4.5 failed
• BZ - 1639427 - OCS uninstall removes /var/log/glusterfs folder instead of clearing the contents of the same folder
• BZ - 1640382 - Director deployed OCP: replacing worker node fails during TASK [openshift_storage_glusterfs : Verify heketi service]
• BZ - 1645656 - Director deployed OCP 3.11: replacing an Infra node fails during TASK [openshift_storage_glusterfs : Verify heketi service]
• BZ - 1648973 - missed oauth_proxy environment variable
• BZ - 1651564 - 3.11.43 released but images not updated
• BZ - 1652746 - Running redeploy CA and openshift redeploy certificates , causes all nodes to become notready.
• BZ - 1656083 - oc rsh fails for all containers built from dockerfile
• BZ - 1656487 - ROUTER_SUBDOMAIN is set multiple times after running route-deploy playbook.
• BZ - 1661076 - Support node selector in metrics-server playbook
• BZ - 1667063 - After running redeploy-certificates.yml playbook in OCP 3.11 webconsole stop working
• BZ - 1667801 - .kibana.* index.number_of_replicas=0 when openshift_logging_es_number_of_replicas=1
• BZ - 1671315 - Kibana and Curator pods names are with ops
• BZ - 1671837 - Enable resize admission plugin by default
• BZ - 1676399 - upgrade failed due to can not pull image from an wrong registry address
• BZ - 1680059 - [3.11] Pod /etc/resolv.conf populated with incorrect nameserver possibly with an IP read from the wrong interface
• BZ - 1682924 - Slow Initialization During Upgrades
• BZ - 1688250 - oc_project fails when project already exist
• BZ - 1688318 - PVC resize fails from webconsole if limits are set
• BZ - 1689230 - openshift_docker_blocked_registries is not blocking registries
• BZ - 1689796 - "oreg_url" does not work on disconnected installation using Satellite
• BZ - 1690066 - [3.11] Evicted builds don't have a specific status reason, instead are GenericBuildFailure
• BZ - 1691023 - Node panics due to cadvisor index out-of-range
• BZ - 1694724 - [TSB] Ansible playbooks are overwriting the var 'template_service_broker_selector' making the deployment fail
• BZ - 1695903 - Could not monitor Elasticsearch with Prometheus with OCP 3.11
• BZ - 1696249 - pod metrics are available on CLI but not available in the UI
• BZ - 1698018 - Kibana does not default an index-pattern for cluster logging
• BZ - 1698922 - [ovirt] Deployment of OCP nodes fails in setup_dns.yaml playbook during multi-node setup
• BZ - 1699533 - CronJobs failing due to timezone mismatch
• BZ - 1699696 - [3.11] Upgrade from 3.9 to 3.10 fails on openshift_control_plane: verify API server. Using wrong API port.
• BZ - 1700875 - [3.11.82] Node exporter ds is not running on nodes.
• BZ - 1701806 - sdn pod CrashLoopBackOff after running sometime
• BZ - 1702544 - Elasticsearch failed to start due to invalid cert date if hosts have non-UTC timezone
• BZ - 1702693 - error: no kind "CustomResourceDefinition" is registered for version "apiextensions.k8s.io/v1beta1" in scheme "k8s.io/kubernetes/pkg/kubectl/scheme/scheme.go:28"
• BZ - 1703136 - Per indice metrics missing in elasticsearch exporter
• BZ - 1703558 - [3.11] Provide statically linked client binary for Linux (non-portable libcrypto)
• BZ - 1703749 - status are CrashLoopBackOff for node-exporter and kube-state-metrics pods
• BZ - 1703904 - [release-3.11] Fix typo of random_string that prevents forwarding to SYSLOG via UDP to fail
• BZ - 1703947 - Using remote_group_id affects the subports attachment to the trunks
• BZ - 1705243 - [ci] cli image flake affecting *-images jobs
• BZ - 1707448 - jenkins-slave produce process defunct [ Jenkins "SLAVE" ]
• BZ - 1707524 - JOURNAL_READ_FROM_HEAD defaults to true
• BZ - 1707799 - the script 99-origin-dns.sh has the debug flag '-x' set to on
• BZ - 1708187 - CI Operator template e2e AWS could not determine if template instance was ready
• BZ - 1708442 - [3.11] Symlinks under /var/lib/containers/storage/overlay/l are lost on reboot
• BZ - 1708552 - Cisco ACI support in 3.11
• BZ - 1709254 - The EgressIps of project would not be auto assigned to the node when multiple Ips from are given in the project netnamespace.
• BZ - 1709626 - [3.11.z] Kubernetes Pod Template is randomly removed
• BZ - 1710424 - There is no separate playbook to just perform logging cert rotation
• BZ - 1710723 - If Advanced Audit is configured during initial installation, Control plane pods didn't come up
• BZ - 1712488 - Variable openshift_set_node_ip is deprecated in v3.10+ but this is not mentioned in inventory examples
• BZ - 1713211 - Stateful set donut does not update on overview when stateful set is scaled
• BZ - 1717028 - Networking details are missing for some deployment configs in web console overview
• BZ - 1718458 - [3.11] Extend cluster-autoscaler RBAC rules to allow to access pods/eviction resource
• BZ - 1718542 - [3.11] Random outages with egressIP
• BZ - 1720466 - Install metrics failed at TASK [Mark node unschedulable] when cri-o enabled
• BZ - 1720581 - [3.11] installation fails when service-catalog enabled, on RHEL AH, multi-zone, GCP

CVEs

• CVE-2019-10320
• CVE-2019-10328
• CVE-2019-1003049
• CVE-2019-1003050

References

(none)