RHBA-2020:4170 - Bug Fix Advisory

Topic

Red Hat OpenShift Container Platform release 3.11.306 is now available with
updates to packages and images that fix several bugs and add enhancements.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container
Platform 3.11.306. See the following advisory for the container images for
this release:

https://access.redhat.com/errata/RHBA-2020:4171

This release fixes the following bugs:

• Previously, the master/admin.kubeconfig was updated during master certificate redeployment, but the node/bootstrap.kubeconfig was not. When master was rebootstrapped, the node could not connect to the API due to the outdated kubeconfig. With this release, the node/bootstrap.kubeconfig on masters is updated when recreating the master/admin.kubeconfig and the node service on masters can bootstrap and access the API when rebootstrapping. (BZ#1772580)
• Previously, during SDN restart, the network policy cache was not initialized if a project had a previously created deny all rule in it, and rules created after the SDN pod was restarted were not detected. With this release, the issue is resolved by setting the networkPolicy initialization to npNameSpace.inUse=true. (BZ#1790407)
• When redeploying master certificates, the master/admin.kubeconfig is updated. The master node requires the updated node.kubeconfig to prevent issues with pods using the node.kubeconfig, such as the sync pod, from failing to authenticate to the API. The issue is resolved in this release. (BZ#1791160)
• Previously, the way that Elasticsearch checked for system call support at startup was only supported on x86_64 architectures. As a result, Cluster Logging failed to deploy on IBM Power with the following error message:

unable to install syscall filter:
java.lang.UnsupportedOperationException: seccomp unavailable: 'ppc64le'
architecture unsupported
Now, the OpenShift Ansible playbook, which handles deployment of Elasticsearch, sets an option to override the startup test on applicable
architectures and Cluster Logging successfully deploys on IBM Power systems. (BZ#1807201)

• This release adds a check of the master-config.yaml file to determine if the client.CA has been reverted. If not, the play will fail and indicate that openshift_redeploy_openshift_ca=true must be set in the inventory. This check prevents inadvertent certificate redeploy when the OpenShift CA has been updated and not rolled out. (BZ#1837123)
• Previously, a missing check for the matching number of Elasticsearch DCs, PVCs and indices caused Ansible pads missing elements with Nones and lead to cryptic Cluster Logging playbook failure. This release adds the missing check so that the Cluster Logging playbook issues a diagnostic if the number of Elasticsearch DCs, PVCs and indices do not match. (BZ#1848454)
• The 3.10 version of oc does not have the --field-selector flag that the 3.11 version includes. As a result, upgrades from 3.10 could fail. The issue has been resolved in this release. (BZ#1852753)
• With this release, the base image is updated to use the Ansible 2.9 repo. (BZ#1855743)
• Previously, the hashes of locally cached compressed layers were not deleted when deleting images. As a result, images could not be downloaded again if another image with the same layer but a different compression was pulled. Hashes are now cleared from the cache when deleting corresponding layers. (BZ#1867463)
• Previously, internal changes to Ansible 2.11 caused compatibility issues with how OpenShift Ansible uses the execute_module Ansible call. Now, the call is switched to the public module call which is more reliable and safe. (BZ#1870123)
• Previously, the only way to update a named certificate was to redeploy the master certificate. This release adds a playbook for updating named certificates so that they can be updated independently without additional risk. (BZ#1882203)

All OpenShift Container Platform 3.11 users are advised to upgrade to these updated packages and images.

Solution

Before applying this update, ensure all previously released errata relevant
to your system is applied.

See the following documentation, which will be updated shortly for release
3.11.306, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258.

Affected Products

• Red Hat OpenShift Container Platform 3.11 x86_64
• Red Hat OpenShift Container Platform for Power 3.11 ppc64le

Fixes

• BZ - 1772580 - Redeploy-certificates do not set proper bootstrap.kubeconfig on masters
• BZ - 1790407 - [3.11] No new ovs flows add to table 80 after restart sdn pod and create a allow-all networkpolicy
• BZ - 1791160 - Redeploy CA and cert breaks sync pod
• BZ - 1807201 - Elasticsearch shows UnsupportedOperationException seccomp unavailable ppc64le architecture unsupported
• BZ - 1837123 - redeploy-certificates.yaml did not update certificates properly
• BZ - 1848454 - OpenShift logging upgrade from 3.11.161 to 3.11.219 fails
• BZ - 1852753 - Upgrade from 3.10 to 3.11 failing with error: Error: unknown flag: --field-selector\n\n\n
• BZ - 1855743 - openshift3/ose-ansible:v3.11.232 contains old ansible version (2.8) and not the recommended one (2.9)
• BZ - 1857824 - Pods networking is broken after openvswitch is crashed
• BZ - 1867463 - crictl pull fails due to different sizes of the image layers
• BZ - 1870123 - Deployment of OCP is failing at the check "docker_storage"
• BZ - 1878796 - [3.11] fix flaky unit test
• BZ - 1879855 - [Kuryr] Install playbook fails waiting for CRD creation due to kuryr-controller crashloop
• BZ - 1881529 - bump EgressNetworkPolicy maxItems to 1000
• BZ - 1882203 - [3.11] - missing named certificate separate playbook

CVEs

(none)

References

(none)