RHBA-2020:3330 - Bug Fix Advisory

Topic

Red Hat OpenShift Container Platform release 4.5.6 is now available with
updates to packages and images that fix several bugs.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container
Platform 4.5.6. See the following advisory for the RPM packages for this
release:

https://access.redhat.com/errata/RHBA-2020:3331

Space precludes documenting all of the container images in this advisory.
See the following Release Notes documentation, which will be updated
shortly for this release, for details about these changes:

https://docs.openshift.com/container-platform/4.5/release_notes/ocp-4-5-release-notes.html

This update fixes the following bugs among others:

• Previously, if the *replicas* field on a MachineSet was set to a nil value, the autoscaler could not determine the current number of replicas within the MachineSet and therefore could not perform scaling operations. With this release, the autoscaler uses the last number of observed replicas in the MachineSet as reported by the *replicas* field in the status if a nil value is set. (BZ#1820654)
• Previously, a dropdown list on the *Create EtcdBackup* screen displayed a loading icon until the user selected an item. The dropdown list now only shows a loading icon if it is in a loading state. (BZ#1848530)
• Previously, multiple correctly formatted, space-delimited values could be pasted into the *Labels* field of the *Create Namespace* modal. However, individual complex values that contain spaces were interpreted as multiple incorrectly formatted values, and could not be pasted into the field. With this release, it is no longer possible to paste multiple values in to the labels field, and the web console validates the pasted input and displays invalid pasted input in red text. (BZ#1850292)
• Previously, some available networks were not shown during cluster installation because of an `ovirt-engine-sdk-go` API error that affected oVirt network parsing. The issue is resolved in this release. (BZ#1852722)
• Previously, a Kubelet failed to start if a soft eviction threshold and grace period were not specified. With this release, the presence of these values is verified during Kubelet configuration. (BZ#1852787)
• With this release, Kuryr-Kubernetes now attempts to detect the bridge interface for Pod subports on the Container Network Interface (CNI) level, instead of using a value set in `kuryr.conf`. This approach supports cases when VMs call the interface without using a value set in `kuryr.conf`. (BZ#1855773)
• Previously, when a machine tried to get the `resourcePoolPath`, it found multiple resource pools and was unable to resolve the correct one. With this release, a property added to the machine sets with the `resourcePoolPath` information helps resolve the correct one. (BZ#1866539)

You may download the oc tool and use it to inspect release image metadata
as follows:

(For x86_64 architecture)

$ oc adm release info
quay.io/openshift-release-dev/ocp-release:4.5.6-x86_64

The image digest is
sha256:0147ab7622969c1cde71e8e5eb8796e8245137fdbf3a5cae63017189a9060f86

(For s390x architecture)

$ oc adm release info
quay.io/openshift-release-dev/ocp-release:4.5.6-s390x

The image digest is
sha256:4b53fa09598ff4c5824b70dd3e880dc42a0ae04ee6918c370939f520467f9046

(For ppc64le architecture)

$ oc adm release info
quay.io/openshift-release-dev/ocp-release:4.5.6-ppc64le

The image digest is
sha256:8f517d0f228755d348dafbab63aa47a07797c5379e90fe060eb86bb7ab76a4eb

All OpenShift Container Platform 4.5 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift Console
or the CLI oc command. Instructions for upgrading a cluster are available
at
https://docs.openshift.com/container-platform/4.5/updating/updating-cluster-between-minor.html#understanding-upgrade-channels_updating-cluster-between-minor.

Solution

For OpenShift Container Platform 4.5 see the following documentation, which
will be updated shortly for release 4.5.6, for important instructions on
how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.5/release_notes/ocp-4-5-release-notes.html

Details on how to access this content are available at
https://docs.openshift.com/container-platform/4.5/updating/updating-cluster-cli.html.

Affected Products

• Red Hat OpenShift Container Platform 4.5 for RHEL 8 x86_64
• Red Hat OpenShift Container Platform 4.5 for RHEL 7 x86_64
• Red Hat OpenShift Container Platform for Power 4.5 for RHEL 8 ppc64le
• Red Hat OpenShift Container Platform for Power 4.5 for RHEL 7 ppc64le
• Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.5 for RHEL 8 s390x
• Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.5 for RHEL 7 s390x

Fixes

• BZ - 1820654 - MachineSets: missing replicas in spec breaks autoscaler
• BZ - 1822637 - License file is needed when `oc` is re-distributed on existing cluster
• BZ - 1840183 - DNS config event generated every couple of seconds
• BZ - 1845345 - Unable to build multi-stage image that has a --from=X that matches FROM X
• BZ - 1845664 - Conntrack rule for UDP traffic should be removed when the pod exposed to Nodeport svc gets deleted
• BZ - 1846453 - Backport upstream CPU Manager fix 90377
• BZ - 1847523 - "downloads" pod does not work on the node which is disabled IPv6
• BZ - 1848530 - It always shows a loading icon for AWS Secret field
• BZ - 1849340 - OCP 4.5 metadata.managedFields.fieldsType Invalid Value. Must be FieldsV1
• BZ - 1850237 - subscription_sync_total metric potentially not getting removed
• BZ - 1850292 - Cannot paste into Namespaces > Create Namespace "Labels" field
• BZ - 1850446 - Insights operator should collect information about all nodes
• BZ - 1851492 - Limit collected log size
• BZ - 1852443 - RH-Operator e2e test should not fail fast
• BZ - 1852722 - openshift-installer can't find on RHV dedicated network
• BZ - 1852787 - Should forbidden to create the KubeletConfig object if lack of the evictionSoftGracePeriod when using the soft eviction
• BZ - 1853496 - thanos-ruler route is not removed after disabled techPreviewUserWorkload
• BZ - 1854504 - Multus whereabouts assign network address to the pod
• BZ - 1855741 - validate GIT url w/ server as the user types
• BZ - 1855773 - hardcoded ens3 in cluster-network-operator kuryr config causes failure on ppc64le
• BZ - 1855844 - vSphere IPI - Need validation on IP inputs
• BZ - 1856867 - Form view for creating Operands does not allow creating empty JSON objects
• BZ - 1857021 - Creating faulty(bad formatted cert&key) route makes other existing routes inaccessible
• BZ - 1858498 - Haproxy 9443 port conflicts with KCM causing KCM in crashloopbackoff state (vSphere, RHV)
• BZ - 1862112 - [4.5.z] update boot images to address CVE-2020-10713
• BZ - 1862407 - Upgrade to new OCS version is not starting cause of issue on OLM side
• BZ - 1866098 - CI: make sure GCP UPI is using steps for PRs
• BZ - 1866330 - OCS 4.5 StorageCluster Creation Page: Make the Node Labelling Note more generic to accomodate LSO and dynamic prov. cluster
• BZ - 1866539 - VSphere IPI fails to bootstrap workers: default resource pool resolves to multiple instances, please specify

CVEs

• CVE-2019-11756
• CVE-2019-17006
• CVE-2019-17023
• CVE-2020-12402

References

(none)