RHBA-2020:2215 - Bug Fix Advisory

Topic

Red Hat OpenShift Container Platform release 3.11.219 is now available with
updates to packages and images that fix several bugs and add enhancements.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container
Platform 3.11.219. See the following advisory for the container images for
this release:

https://access.redhat.com/errata/RHBA-2020:2216

This release fixes the following bugs among others:

• Previously, DNS names were queried every time they occurred in an

EgressNetworkPolicy. Records were queried regardless of whether a particular DNS
record had been refreshed by a previous query, resulting in slow network
performance. DNS records are now queried based on unique names rather than per
each EgressNetworkPolicy. As a result, DNS query performance has been
significantly improved. (BZ#1772594)

• Previously, the PKI directory was not properly mounted to the sync Pod. This

caused the `openshift-ca.crt` to be inaccessible, and as a result, was
recreated. The missing mounts and volumes have been added to the sync Pod, so
the `openshift-ca.crt` is available and is not incorrectly recreated. (BZ#1808068)

• The Google Cloud Storage (GCS) driver was not reporting all errors due to a

variable shadowing issue. This issue has been resolved, allowing all errors to
be reported by the registry. (BZ#1814722)

• The image registry was using repository names in metrics labels. This caused

Prometheus to have problems with reporting many metrics. This bug fix removes
repository names from labels, resulting in less generated metrics and better
performance. (BZ#1827744)

• The variable `openshift_certificate_expiry_warning_days` was hard-coded in an

area of {product-title}'s underlying code calling the
`openshift_certificate_expiry` role during upgrades. This prevented the
`openshift_certificate_expiry_warning_days` variable from being overridden in
the inventory. This bug fix replaces the hard-coded value with a task to set a
value of six months if the variable has not been defined by the user. (BZ#1829492)

• When redeploying certificates, the certificate expiry check provided little

value because the expectation was that the certificates would be replaced.
Additionally, there were situations where certificates were invalid and
redeployment was blocked by the check. This bug fix removes the checks, allowing
certificate redeployment to proceed without requiring additional inventory
variables to override expiry days or invalid/missing certificates. (BZ#1832379)

All OpenShift Container Platform 3.11 users are advised to upgrade to these
updated packages and images.

Solution

Before applying this update, ensure all previously released errata relevant
to your system is applied.

See the following documentation, which will be updated shortly for release
3.11.219, for important instructions on how to upgrade your cluster and fully
apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258.

Affected Products

• Red Hat OpenShift Container Platform 3.11 x86_64
• Red Hat OpenShift Container Platform for Power 3.11 ppc64le

Fixes

• BZ - 1633506 - [RFE] Add a nodeSelector for hawkular-metrics-schema job
• BZ - 1691678 - OpenShift-metrics installation playbook failed at task generate htpasswd file for hawkular metrics
• BZ - 1745898 - [OCP][3.11][NetworkingPolicies] Pod to pod communication when using network policies
• BZ - 1772594 - [3.11] egressnetworkpolicy with dnsname has performance impact due to calling dig often
• BZ - 1774184 - [conmon] Liveness probes timeout unexpectedly
• BZ - 1803090 - kube-apiserver 3.11: Unbounded valuesets for metric labels
• BZ - 1803616 - Metrics installer fails when executing metrics playbook from a Bastion host (non-master) due to missing tmp directory
• BZ - 1808068 - openshift-ca.crt replaced during 3.11.104 to 3.11.157 upgrade
• BZ - 1814722 - [3.11] Possible error loss in GCS driver
• BZ - 1814804 - Pod service endpoints are getting dropped for healthy pods
• BZ - 1824056 - task name is not proper in openshift_cluster_monitoring_operator/tasks/remove.yaml
• BZ - 1827744 - Image registry metrics should use summaries instead of histograms
• BZ - 1829492 - Upgrade playbook fails if certificates are going to expire in less than 183 days and the openshift_certificate_expiry_warning_days has been set in the inventory file
• BZ - 1830158 - OpenShift 3.11 with Kuryr is missing a few security group rules to allow monitoring to work properly
• BZ - 1832379 - redeploy-openshift-ca.yml will fail if cert has an expiry less than 1 year
• BZ - 1838001 - Namespace isolation fails due to Sg remote_group_id usage

CVEs

• CVE-2020-8552

References

(none)