RHBA-2019:2816 - Bug Fix Advisory

Topic

Red Hat OpenShift Container Platform release 3.11.146 is now available with
updates to packages and images that fix several bugs.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container
Platform 3.11.146. See the following advisory for the container images for
this release:

https://access.redhat.com/errata/RHBA-2019:2824

This update fixes the following bugs:

• kuryr-controller could not access the OpenShift API LoadBalancer members with OVN if kuryr-controller was running on master nodes. Now, kuryr-controller is forced to be on infrastructure nodes. As a result, kuryr-controller can now access the OpenShift API LoadBalancers. (BZ#1641647)
• In rare cases, the cluster console would not display a projects list when the user logged in. This was due to a race condition that would cause the project list to fail after logging into the admin console. The user would need to refresh the page to see the list of projects. This race condition has been addressed, and projects now load successfully after logging in. (BZ#1703777)
• Image tags were not provided for some ose-pod image pulls. As a result, multiple image versions could be pulled from the ose-pod image. Now, image tags have been added to the registry_auth and only a single image version for ose-pod is pulled. (BZ#1725938)
• Clusters with large numbers of unidled services could see extended wait times applying endpoint changes to cluster IP addresses. Iptables access is now better coordinated and synchronization of firewall rules occurs in less time. (BZ#1734009)
• Egress IP addresses did not operate correctly in namespaces with restrictive NetworkPolicies. Pods that accepted traffic only from specific sources would not be able to send egress traffic via egress IP addresses because the response from the external server would be mistakenly rejected by their NetworkPolicies. Now, replies from egress traffic are correctly recognized as replies rather than as new connections. (BZ#1741477)
• Metrics-server-certs did not remove secrets if the server was uninstalled. The metrics serving cert label has been corrected and metrics serving certs are removed completely. (BZ#1746212)
• Outgoing connections would sometimes be dropped if a minimum kernel version was not installed. A check has been added to ensure that the installed kernel meets the required minimum version to avoid network issues. This check is run during prerequisites, scale-up, and upgrade. (BZ#1749024)
• Upgrade playbooks were not respecting the openshift_docker_additional_registries variable. The registries.conf has been updated to observe inventory variables that have been set or changes since the last upgrade. (BZ#1749341)

All OpenShift Container Platform 3.11 users are advised to upgrade to these
updated packages and images.

Solution

Before applying this update, ensure all previously released errata
relevant to your system have been applied.

For OpenShift Container Platform 3.11 see the following documentation,
which will be updated shortly for release 3.11.146, for important
instructions on how to upgrade your cluster and fully apply this
asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258.

Affected Products

• Red Hat OpenShift Container Platform 3.11 x86_64
• Red Hat OpenShift Container Platform for Power 3.11 ppc64le

Fixes

• BZ - 1432875 - Unable to deploy postgresql
• BZ - 1641647 - kuryr-controller cannot access OpenShift API LB members with OVN if running on master nodes
• BZ - 1661447 - No way to respect existing PVC when upgrading Metrics with standard playbook
• BZ - 1703777 - sometimes cluster console is not showing projects list when user logged in
• BZ - 1720172 - Openshift-on-OpenStack installation playbook fails when namespace isolation is enabled
• BZ - 1733327 - redeploy-certificates crashes service catalog controllers and fails if metrics-server is installed
• BZ - 1733429 - [3.11 backport]cannot access to the service's externalIP with egressIP in openshift-ovs-multitenant environment
• BZ - 1734009 - [3.11 backport] Synchronization firewall rules takes up to 90min
• BZ - 1735502 - [3.11] Some pods lost default gateway route after restarting docker
• BZ - 1741477 - [3.11] EgressIP doesn't work with NetworkPolicy unless traffic from default project is allowed
• BZ - 1743950 - full chain in custom CA causes controllers to crashloopback
• BZ - 1746212 - [3.11] metrics-server-certs secret does not be removed after metrics-server uninstall due to incorrect label
• BZ - 1748982 - [3.11]redeploy-certificates playbook redeploys service signer certificate - causing internal apps not working
• BZ - 1749024 - [3.11] Ensure minimum kernel version during upgrade
• BZ - 1749341 - During upgrade playbook is not respecting `openshift_docker_additional_registries` varisble
• BZ - 1752853 - There should be more index pattern in kibana

CVEs

• CVE-2019-11247
• CVE-2019-11249

References

(none)