RHBA-2019:1607 - Bug Fix Advisory

Topic

Red Hat OpenShift Container Platform release 3.10.149 is now available with
updates to packages and images that fix several bugs.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container
Platform 3.10.149. See the following advisory for the container images for
this release:

https://access.redhat.com/errata/RHBA-2019:1608

This update includes the following bugs:

• The openssh-clients package was missing from the ose-f5-router images. The correct RPM has been added to the latest release. (BZ#1645755)
• Slow build progression through a build's init container steps could result in builds marked as `Running`, and the build controller would attempt to set the build back to `Pending`. As a result, excessive warning messages were presented to the user. Now, the build controller prevents the erroneous transitions and logs more useful diagnostic data. (BZ#1685322)
• A task was inserted early in the upgrade playbooks to install client packages, but the task does not specify explicit versions for all dependencies. As a result, circular dependencies within the packages would cause all packages to be updated to the latest version. Now, the problematic client install task has been removed and the task is completed in another fashion. Install now completes with packages installed to the specified version. (BZ#1692730)
• Non-master `etcd` nodes were previously excluded from upgrades. This has now been changed to exclude only non-master non-node etcd instances. Now non-master `etcd` nodes are upgraded successfully. (BZ#1693524)
• The `openshift_set_node_ip` variable was deprecated, but still included in inventory example files. This has now been removed from example files and code for the `openshift_set_node_ip` variable has been cleaned up. (BZ#1694814)
• Undesired DNS IP addresses were selected by the OpenShift service if multiple network cards were present. As a result, DNS requests failed to work from pods. Now, there are sane defaults present for DNS and it follows a similar pattern used by kubelet to fetch routable node IP addresses. (BZ#1696394)
• Long running Jenkins agent and slave pods would experience defunct process errors, causing a high number of processes to appear in process listings until the pod is terminated. Now, `dumb-init` is deployed to clean up these defunct processes. (BZ#1707447)
• The environment variable JOURNAL_READ_FROM_HEAD was set to an empty string. This caused the default value of `read_from_head` for the journald input to be true. When Fluentd starts up for the first time on a node, it reads in the entire journal. This could result in hours of delays for system messages to show up in ElasticSearch and Kibana. Now, Fluentd will check if the value is set and is not empty, or will use the default value of false. Fluentd will read from the tail of the journal when it starts on a new node. (BZ#1707556)
• There was a missing `@` for an instance variable in the Fluentd remote syslog plugin code. In some cases, systemd-journald logged errant values. This resulted in rsyslog forwarding failures. Now, the variable has been corrected remote logging completes successfully. (BZ#1707899)
• The script 99-origin-dns.sh had a debug flag set to enabled, which would log debug level messages by default. This has been resolved and debug is now set to false. (BZ#1708393)

All OpenShift Container Platform 3.10 users are advised to upgrade to these
updated packages and images.

Solution

Before applying this update, ensure all previously released errata
relevant to your system have been applied.

For OpenShift Container Platform 3.10 see the following documentation,
which will be updated shortly for release 3.10.149, for important
instructions on how to upgrade your cluster and fully apply this
asynchronous errata update:

https://docs.openshift.com/container-platform/3.10/release_notes/ocp_3_10_release_notes.html

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258.

Affected Products

• Red Hat OpenShift Container Platform 3.10 x86_64
• Red Hat OpenShift Container Platform for Power 3.10 ppc64le

Fixes

• BZ - 1645755 - openssh-clients package missing from ose-f5-router:v3.10 images
• BZ - 1685322 - Builds delayed with multiple occurrences of the error "build_controller.go:1289] Giving up retrying <build name>: invalid phase transition <build name> (Running) -> Pending"
• BZ - 1690200 - logging fluentd daemonset should tolerate all taints (3.10)
• BZ - 1692730 - Fail to upgrade ocp to non latest version
• BZ - 1693524 - Packages in dedicated ETCD nodes are not upgraded
• BZ - 1694814 - Variable openshift_set_node_ip is deprecated in v3.10+ but this is not mentioned in inventory examples
• BZ - 1696394 - [3.10] Pod /etc/resolv.conf populated with incorrect nameserver possibly with an IP read from the wrong interface
• BZ - 1707447 - jenkins-slave produce process defunct [ Jenkins "SLAVE" ]
• BZ - 1707556 - JOURNAL_READ_FROM_HEAD defaults to true
• BZ - 1707899 - [release-3.10] Fix typo of random_string that prevents forwarding to SYSLOG via UDP to fail
• BZ - 1708393 - the script 99-origin-dns.sh has the debug flag '-x' set to on
• BZ - 1709422 - sdn daemonset should tolerate taints (3.10)

CVEs

(none)

References

(none)