RHBA-2020:2990 - Bug Fix Advisory

Topic

Red Hat OpenShift Container Platform release 3.11.248 is now available with
updates to packages and images that fix several bugs and add enhancements.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container
Platform 3.11.248. See the following advisory for the container images for
this release:

https://access.redhat.com/errata/RHBA-2020:2991

This release fixes the following bugs among others:

• Previously, the egress IP tracker had methods that locked `eit.mutex` and had methods that called EVM functions that locked `evm.mutex`. Because `evm.mutex` had to write to the `evm.updates` channel, which was not buffered and was blocked until `eit.setNodeOffline ran, this function also locked `eit.mutex`. This caused a deadlock when there was a large amount of egress IPs. This bug fix removes the deadlock by buffering the updates channel so that it only serves as a notification system rather than containing actual data. (BZ#1824243)
• Previously, the conditional set on a task checking the `openshift_master_cluster_hostname` variable expected the `masters` group in the inventory to be set. This caused the `masters` group to fail if it was not defined. This bug fix adds a conditional to check if `masters` is defined; if `masters` is not defined, the task is skipped instead of failing on an undefined variable. (BZ#1828484)
• Previously, when providing a custom `openshift_node_groups` list, not a ConfigMaps were created. This was caused by new ConfigMap creation code that only created ConfigMaps if they were assigned to an active host. This code has been reverted, so all ConfigMaps specified in a `openshift_node_groups` list are created. (BZ#1845676)
• Previously, Prometheus counters that show the number of active sessions were preserved across router restarts and increased indefinitely. With this update, `haproxy_frontend_current_session` and `haproxy_server_current_session` now accurately depict the number of active sessions. The value of these counters are now reset upon router restart. (BZ#1847478)
• Previously, nodes in CI for GCP assigned masters and infra nodes were assigned to the same group. This caused all nodes to be labeled as masters and none as infra nodes. The node group mapping has been changed to allow infra and compute nodes to be assigned to the same group and apply the proper infra and compute labels. Now the CI cluster is built properly with all nodes labeled appropriately. (BZ#1848723)

All OpenShift Container Platform 3.11 users are advised to upgrade to these
updated packages and images.

Solution

Before applying this update, ensure all previously released errata relevant
to your system is applied.

See the following documentation, which will be updated shortly for release
3.11.248, for important instructions on how to upgrade your cluster and fully
apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258.

Affected Products

• Red Hat OpenShift Container Platform 3.11 x86_64
• Red Hat OpenShift Container Platform for Power 3.11 ppc64le

Fixes

• BZ - 1741138 - Cluster loader not working as expected
• BZ - 1746144 - Port 10250 incorrectly configured in OSP Security Group Heat template
• BZ - 1753649 - 3.11: Recreating recently deleted NodePort service results in 'port is already allocated' error
• BZ - 1763610 - Failed to run network diags test pods in NetworkCheck with "provided options object is not a PodLogOptions" on Disconnected OCP
• BZ - 1773406 - cri-o is unable to handle termination of containers and moves the node to NotReady
• BZ - 1791837 - Kibana user indices continue to need to be deleted and restored due to permissions errors
• BZ - 1795393 - Backport request for 3.11 re: BZ 1748478
• BZ - 1807822 - [3.11] Unable to get pod metrics from some of the nodes
• BZ - 1824243 - [3.11] openshift-sdn does not update egress IPs on the node due to deadlock
• BZ - 1828484 - e2e-gcp fails in ci due to groups.oo_masters_to_config conditional check
• BZ - 1841439 - logging-curator ConfigMap is overwritten during logging stack upgrades
• BZ - 1845676 - Provisioning on AWS with autoscaling groups omits openshift-node configmaps
• BZ - 1846126 - Release image builds of elasticsearch are broken
• BZ - 1847478 - Back port request for OCP 3.11 haproxy router metrics.
• BZ - 1848492 - Button to log out from Grafana and Prometheus web UI
• BZ - 1848723 - CI failing on: FailedScheduling: 0/4 nodes are available: 4 node(s) didn't match node selector.
• BZ - 1856250 - OpenShift router is failing readiness probe regularly

CVEs

• CVE-2020-2181
• CVE-2020-2182

References

(none)