RHBA-2020:0017 - Bug Fix Advisory

Topic

Red Hat OpenShift Container Platform release 3.11.161 is now available with
updates to packages and images that fix several bugs and add enhancements.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container
Platform 3.11.161. See the following advisory for the container images for
this release:

https://access.redhat.com/errata/RHBA-2020:0018

This release fixes the following bugs:

• In the openshift-logging update using Ansible, if a new value was set in the inventory file to apply the change to the existing cluster, the change was ignored. This occurred because the module logging_patch accidentally created a patch to change a new file into the original file. The patching direction was fixed and the changes made in an inventory file are now correctly applied. (BZ#1753593)
• When the SDN pod was restarted on a node, it did not clean up any old Egress IP addresses. If the set of Egress IP addresses assigned to a node changed while the SDN pod was not running, then the node might continue to claim that it owned the Egress IP even after the IP had been assigned to another node. This caused traffic to that IP to be delivered to the wrong node and be lost. The SDN pod now cleans up stale Egress IP addresses at startup. (BZ#1762235)
• SDN code would declare each node as READY before the SDN proxy was completely initialized. Some iptables rules would not be populated and the node is marked as ready. This caused some pods to not be able to communicate with the API while coming up. Now, all iptables rules exist before pods get schedules to the node, preventing issues where pod's cannot communicate with the API server. (BZ#1764150)

This release includes the following enhancements:

• The latest Kuryr images are now hosted in Red Hat's registry. (BZ#1652571)

All OpenShift Container Platform 3.11 users are advised to upgrade to these
updated packages and images.

Solution

Before applying this update, ensure all previously released errata relevant
to your system is applied.

See the following documentation, which will be updated shortly for release
3.11.161, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258.

Affected Products

• Red Hat OpenShift Container Platform 3.11 x86_64
• Red Hat OpenShift Container Platform for Power 3.11 ppc64le

Fixes

• BZ - 1652571 - [RFE][kuryr] Default kuryr images are hosted in docker.io instead redhat's registry (and using latest)
• BZ - 1668853 - Programmatically aggregated cluster roles block admin rolebinding
• BZ - 1753593 - [Reg] openshift_logging_elasticsearch_kibana_index_mode cannot be changed by inventory variable
• BZ - 1753601 - Not able to deploy template based on CRD from webconsole
• BZ - 1755120 - Approve any pending CSR requests from inventory nodes is failing
• BZ - 1761875 - Following security recommendations (OpenSCAP)
• BZ - 1762235 - [3.11 backport] Duplicated IPs on InfraNodes using automatic egress IP
• BZ - 1764150 - OpenShift Container Platform nodes become 'Ready' even when iptables NAT rules have not been populated by the openshift-snd pod(s) yet
• BZ - 1768612 - Copying images from registry to another fails with error: the manifest type *schema1.SignedManifest is not supported
• BZ - 1775782 - [3.10.z] Build tests fail using github.com/openshift/ruby-hello-world repo
• BZ - 1777062 - x509: unhandled critical extension when pulling from internal registry for images that pullthrough to the registry.redhat.io

CVEs

• CVE-2019-10401
• CVE-2019-10402
• CVE-2019-10403
• CVE-2019-10404
• CVE-2019-10405
• CVE-2019-10406

References

(none)