RHBA-2019:1642 - Bug Fix Advisory

Topic

Red Hat OpenShift Container Platform release 3.9.85 is now available with
updates to packages and images that fix several bugs.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container
Platform 3.9.85. See the following advisory for the container images for
this release:

https://access.redhat.com/errata/RHBA-2019:1643

This update fixes the following bugs:

• During an upgrade from Red Hat OpenShift Enterprise 3.7 to 3.9, the `tuned-profiles-atomic-openshift-node` rpm was removed, as well as all tuned profiles. The `tuned` role was not being applied during an upgrade, but only during a fresh install. The `tuned` role is now applied during upgrades to ensure `tuned` profiles are applied appropriately. (BZ#1626558)
• When using CRI-O, Docker-based pods were stopped during the re-certification process. A check has been added to only restart Docker when `openshift_use_crio_only` is marked as `false`. As a result, Docker is not restarted if CRI-O is in use.
• Long running Jenkins agents and slave pods would experience defunct process errors, causing a high number of processes to appear in process listings until the pod is terminated. Now, dumb-init is deployed to clean up these defunct processes. (BZ#1700314)
• The environment variable `JOURNAL_READ_FROM_HEAD` was set to an empty string. This caused the default value of `read_from_head` for the journald input to be true. When Fluentd starts up for the first time on a node, it reads in the entire journal. This could result in hours of delays for system messages to show up in ElasticSearch and Kibana. Now, Fluentd will check if the value is set and is not empty, or will use the default value of false. Fluentd will read from the tail of the journal when it starts on a new node. (BZ#1707557)
• There was a missing `@` for an instance variable in the Fluentd remote syslog plugin code. In some cases, systemd-journald logged errant values. This resulted in rsyslog forwarding failures. Now, the variable has been corrected and remote logging completes successfully. (BZ#1707901)
• The script `99-origin-dns.sh` had a debug flag set to enabled, which would log debug level messages by default. This has been resolved and debug is now set to false. (BZ#178394)
• Playbooks were incorrectly checking `all-in-one` variables when labeling nodes, causing newly scaled up masters to be labelled as compute nodes. The node role playbook has been fixed to check for scaled up masters when adding compute labels. (BZ#1709004)
• IPtables rules were applied with an incorrect key name for conditional firewall configurations. As a result, firewall rules were not applied correctly. The key name was changed from `condition` to `cond` and firewall rules are now applied correctly based on conditions. (BZ#1715048)
• Updating metrics to include a node drain used incorrect variables and playbooks would fail with `l_kubelet_node_name` errors. Now, the `l_init_fact_hosts` variable has been replaced with the `oo_nodes_to_config` option. As a result, `l_kubelet_node_name` exists for all nodes. (BZ#1725002)

All OpenShift Container Platform 3.9 users are advised to upgrade to these
updated packages and images.

Solution

Before applying this update, ensure all previously released errata
relevant to your system have been applied.

For OpenShift Container Platform 3.9 see the following documentation, which
will be updated shortly for release 3.9.85, for important instructions on
how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/3.9/release_notes/ocp_3_9_release_notes.html

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258.

Affected Products

• Red Hat OpenShift Container Platform 3.9 x86_64

Fixes

• BZ - 1508378 - Can't deploy Node.js + MongoDB app
• BZ - 1626558 - Tuned profiles are not applied to OpenShift clusters that get upgraded from 3.6
• BZ - 1637389 - Connectivity problems from pod to pod : Network is unreachable
• BZ - 1666198 - [CRIO] crioctl inconsistent number of pods
• BZ - 1678372 - redeploy_certificates does not drain nodes and restart automatically docker
• BZ - 1700314 - jenkins-slave produce process defunct [ Jenkins "SLAVE" ]
• BZ - 1707557 - JOURNAL_READ_FROM_HEAD defaults to true
• BZ - 1707901 - [release-3.9] Fix typo of random_string that prevents forwarding to SYSLOG via UDP to fail
• BZ - 1708394 - the script 99-origin-dns.sh has the debug flag '-x' set to on
• BZ - 1709004 - Labeled "compute" role badly to new master added after scaleup.yml
• BZ - 1715048 - Contrail iptables rules are applied even though openshift_node_use_contrail is not set
• BZ - 1725002 - [3.9] Install metrics failed at TASK [Mark node unschedulable] when cri-o enabled

CVEs

(none)

References

(none)