RHBA-2020:0402 - Bug Fix Advisory

Topic

Red Hat OpenShift Container Platform release 3.11.170 is now available with
updates to packages and images that fix several bugs.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container
Platform 3.11.170. See the following advisory for the container images for
this release:

https://access.redhat.com/errata/RHBA-2020:0403

This release fixes the following bugs:

• The Cluster Monitoring Operator playbook would reset the CMO ConfigMap every time it was executed, and manual changes to the ConfigMap were lost. Now, etcd monitoring can be configured with Ansible and changes made to the ConfigMap are now persistent when the playbook is executed. (BZ#1703032)
• Prometheeus metrics for ElasticSearch were unavailable to users because the authentication class was instantiated multiple times and without the correct configuration. Now, SAR configuration has been added to the authentication_backend and the multi-tenant plugin executes SARs and allows access to metrics. (BZ#1728856)
• The installer was picking the incorrect version of etcd, reverting to an older package version. Now, the install has been updated to use etcd v3.2.26. (BZ#1744900)
• Redirection for ConfigMap was incorrect, leading to the console page instead of the ConfigMap details page. Now, the navigateResourceURL filter has been supplied with the namespace in the ConfigMap list page. Redirects will apply to the details page of the selected ConfigMap. (BZ#1782695)
• Unexpected iptables rules were saved on the first master host. This was due to the cockpit role operations performed after openshift_sdn roles. Now, the cockpit role runs before the openshift_sdn role and unnecessary sdn rules are not saved during installation. (BZ#1783764)
• Due to an incorrect statement in the heketi-template.yml.j2 template,the HEKETI_LVMWRAPPER environment variable was only included in deployments where Gluster runs on an external cluster, and not in the case where Gluster wass deployed on OpenShift in containers. The environment variable wass needed to specify a wrapper for LVM commands so that the commands can be run on the container node, outside the container. The missing variable results in less stability of the LVM configuration. Now, the statement in the heketi-template.yml.j2 template has been corrected and the HEKETI_LVMWRAPPER environment variable is now configured in the DeploymentConfig for the Heketi container. (BZ#1791667)

All OpenShift Container Platform 3.11 users are advised to upgrade to these
updated packages and images.

Solution

Before applying this update, ensure all previously released errata relevant
to your system is applied.

See the following documentation, which will be updated shortly for release
3.11.170, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258.

Affected Products

• Red Hat OpenShift Container Platform 3.11 x86_64
• Red Hat OpenShift Container Platform for Power 3.11 ppc64le

Fixes

• BZ - 1670380 - Alertmanager triggers error when updating the image
• BZ - 1670587 - ES pod deployment timeout can corrupt logging indices
• BZ - 1728856 - Prometheus metrics for ES are unavailable after plugin update to 5.6.13.6
• BZ - 1744900 - OpenShift 3.11 ETCD version (3.2.22) is lower than in 3.9 (3.2.26)
• BZ - 1749765 - oauth-proxy - backport various fixes from 4.1 to 3.11
• BZ - 1757314 - [OCPv3.11] kibana-proxy container OOM killed
• BZ - 1757938 - When launching jenkins-ephemeral or jenkins- persistent on OpenShift v3.11.104 the container fails to start and states that java is not available
• BZ - 1782695 - Redirection for config map is not happening correctly
• BZ - 1783764 - Unexpected iptables rules are saved to "/etc/sysconfig/iptables" on first master host
• BZ - 1791667 - env var "HEKETI_LVM_WRAPPER" is required in heketi container.
• BZ - 1793628 - User with cluster -reader role can't access metrics using `oc adm top <nodes>`
• BZ - 1795930 - Web console vulnerable to CVE-2019-11358 (moderate d impact) [openshift-3.11]
• BZ - 1798365 - [OCS] Deployment of OCS independent mode is failing because of the unknown parameter name HEKETI_LVMWRAPPER

CVEs

• CVE-2019-11358
• CVE-2020-2099
• CVE-2020-2100
• CVE-2020-2101
• CVE-2020-2102
• CVE-2020-2103
• CVE-2020-2104
• CVE-2020-2105

References

(none)