RHBA-2019:3817 - Bug Fix Advisory

Topic

Red Hat OpenShift Container Platform release 3.11.154 is now available with
updates to packages and images that fix several bugs.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container
Platform 3.11.154. See the following advisory for the container images for
this release:

https://access.redhat.com/errata/RHBA-2019:3818

This update fixes the following bugs:

• Satellite registration would fail in OpenShift installation instances with openshift-ansible. Required packages were not installed for Satellite registration to complete successfully. As a result, registration would fail and OpenShift packages were not available. Now, the install of required packages are performed earlier in the subscription process to ensure the Satellite subscription succeeds. (BZ#1643397)
• During installation, the timeout for waiting for cluster services to start could be too short for some environments. The cluster deploy could fail prematurely. The timeout has been increased from five minutes to six minutes. Cluster service availability checks now pass as expected during the installation process. (BZ#1726450)
• Disconnected installations would fail because the ose image was used for testing registry authentication. Since the ose image is no longer used in release 3.11, the test would fail consistently. Now, the registry has been updated to use ose-pod, and registry authorization tests complete successfully. (BZ#1729994)
• During an upgrade with openshift_pkg_version specified, the latest available version was being installed. The openshift-clients package was being upgraded during an unrelated master upgrade step. Due to package dependencies, this resulted in all dependent openshift packages being updated to the latest version. This change removes the openshift_cli role as the clients are installed and upgraded as part of the openshift_node role. The upgrade of the client binaries on Atomic Host were moved to the openshift_node role for consistency. (BZ#1758744)
• The openshift_metrics_server_install had incomplete default value. As a result, the redeploy certificates playbook would fail due to a missing value for openshift_metrics_server_install. Now, the openshift_metrics_server_install defaults in all locations. Redeployment completes successfully whether openshift-metrics is installed or not. (BZ#1759835)
• Certificates were only backed up on the first master. If the redeploy-certificates playbook failed during execution, it could happen that certificates were deleted on all masters which would result in the playbook failing when run again.  To recover, certificates would have to be restored from backup. Now, all certificates are backed up on all master nodes. If certificates need to be recovered, they are available in a locally generated file archive. (BZ#1762932)

All OpenShift Container Platform 3.11 users are advised to upgrade to these
updated packages and images.

Solution

Before applying this update, ensure all previously released errata
relevant to your system have been applied.

For OpenShift Container Platform 3.11 see the following documentation,
which will be updated shortly for release 3.11.154, for important
instructions on how to upgrade your cluster and fully apply this
asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258.

Affected Products

• Red Hat OpenShift Container Platform 3.11 x86_64
• Red Hat OpenShift Container Platform for Power 3.11 ppc64le

Fixes

• BZ - 1643397 - Satellite registration fails for OCP 3.10 and OCP 3.11 installation with openshift-ansible
• BZ - 1694014 - Custom fact file /etc/ansible/facts.d/openshift.fact not updated with inventory changes
• BZ - 1708630 - Deployment rollback triggered from web console does not rollback image used
• BZ - 1726450 - Installation fails - control plane pods don't come up
• BZ - 1729994 - [disconnected] prerequisites.yml fail pulling openshift/ose
• BZ - 1744248 - redefining openshift_metrics_project from default openshift-infra will cause installation to fail
• BZ - 1746143 - update-ca-trust required on 3.11 post install with custom CA cert but included in 3.9 install process per openshift_node_certificates playbook
• BZ - 1748814 - Backport request of BZ#1579729 haproxy log shows warning message: 'option tcplog' directive is ignored in backends
• BZ - 1749649 - Router ignores non-server records when serverThreshold is reached
• BZ - 1756123 - Project admin can't access metrics - no RBAC policy matched
• BZ - 1756230 - Configmaps not loading from web-console
• BZ - 1757180 - ACL documents are _always_ reseeded
• BZ - 1757501 - when redeploying logging using no_proxy and generate_no_proxy_hosts = true, kibana proxy container does not include the master nodes in no_proxy env variable
• BZ - 1758375 - EXTENDED_VALIDATION doesn't capture certificate / key mismatch, causing the router to misbehave [3.11]
• BZ - 1758744 - Not respecting "openshift_pkg_version" when running 3.10 -> 3.11 upgrade
• BZ - 1759835 - "openshift-ansible/playbooks/redeploy-certificates.yml" fails with default "openshift_metrics_install_metrics" values
• BZ - 1762932 - Backup on only 1 master causing issues in - openshift_certificate_expiry : Check cert expirys on host task
• BZ - 1763046 - cluster-monitoring-operator is killed by oom-killer
• BZ - 1764314 - Eventrouter pod in CrashLoopBackOff status: "runtime error: invalid memory address or nil pointer dereference"
• BZ - 1767111 - logging - expose undefined field, multiline parameters
• BZ - 1768702 - DNS names at egressnetworkpolicies causing heavily querying DNS servers
• BZ - 1769222 - Fail to intall due to a wrong test image in TASK [container_runtime : Create for any additional registries]

CVEs

(none)

References

(none)