RHBA-2020:2477 - Bug Fix Advisory

Topic

Red Hat OpenShift Container Platform release 3.11.232 is now available with
updates to packages and images that fix several bugs and add enhancements.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container
Platform 3.11.232. See the following advisory for the container images for
this release:

https://access.redhat.com/errata/RHBA-2020:2434

This release fixes the following bugs (among others):

• Previously, the DeploymentConfig controller broke the adoption mechanism responsible for indentifying replicated controllers. This caused the `oc replace` command to incorrectly modify existing objects based on the specified configuration file unless the `--force` flag was specified. The adoption mechanism has been fixed and the `oc replace` command now correctly removes dependent objects. (BZ#1686838)
• An Ingress object specifies backends, where each backend specifies a target port name or number on some Service object. The Service's port, in turn, specifies a target port on a Pod object. Similarly to an Ingress backend, a Route object may specify a target port on a Service. When translating an Ingress backend to a Route, the ingress-to-route controller used the Service port's target port for the Route's target port when it should have used the Service port's name or number. This caused the ingress-to-route controller to sometimes produce an invalid Route object. When translating the target port of an Ingress backend to the target port for a Route, the ingress-to-route controller now uses the Service port's name rather than its target port, or omits the target port entirely if it is not needed, as in the case of a Service that has only one port. Ingress objects are now correctly translated to Route objects even if an Ingress backend targets a Service port that has a different name or number from the Service port's target port. (BZ#1763340)

All OpenShift Container Platform 3.11 users are advised to upgrade to these
updated packages and images.

Solution

Before applying this update, ensure all previously released errata relevant
to your system is applied.

See the following documentation, which will be updated shortly for release
3.11.232, for important instructions on how to upgrade your cluster and fully
apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258.

Affected Products

• Red Hat OpenShift Container Platform 3.11 x86_64
• Red Hat OpenShift Container Platform for Power 3.11 ppc64le

Fixes

• BZ - 1616184 - Man page of crictl does not display well for subcommands section and additional options section
• BZ - 1663306 - Check GlusterFS for cluster health fails when gluster nodes are SchedulingDisabled
• BZ - 1686838 - clarify behaviour of --force and --cascade in oc replace
• BZ - 1693798 - python2-openshift encoding error
• BZ - 1731236 - atomic-openshift-node.service keeps stopping and starting several times a day
• BZ - 1763340 - Incorrect reconciliation of OpenShift Route based on K8s Ingress
• BZ - 1797880 - Taint and Tolerations with BuildOverride not working as expected
• BZ - 1800489 - KubePersistentVolumeFullInFourDays is triggered multiple times on ElasticSearch storage
• BZ - 1805192 - Latest image nodejs10 for jenkins agent is available at quay.io but not in registry.redhat.io repository
• BZ - 1806454 - [RFE] Allow multiple toleration values with the same key
• BZ - 1812036 - ose-ansible image has Ansible 2.6 installed
• BZ - 1814451 - Certificate expiration playbooks do not report on aggregator-front-proxy.crt or front-proxy-ca.crt
• BZ - 1816966 - Cluster state does not manage to reach 100% during an upgrade from 3.11.117 to 3.11.157
• BZ - 1828433 - Update etcd to 3.2.28
• BZ - 1843039 - Add support for rescheduled pods with the same name in drain
• BZ - 1845517 - The upstream fluent image does not build because of the ffi version

CVEs

• CVE-2020-2160
• CVE-2020-2161
• CVE-2020-2162
• CVE-2020-2163

References

(none)