RHBA-2023:3742 - Bug Fix Advisory

Topic

Updated images that include numerous enhancements and bug fixes are now available in Red Hat Container Registry for Red Hat OpenShift Data Foundation 4.13.0 on Red Hat Enterprise Linux 9.

Description

Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Container Platform. Red Hat OpenShift Data Foundation is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. In addition to persistent storage, Red Hat OpenShift Data Foundation provisions a multicloud data management service with an S3 compatible API.

These updated images include numerous enhancements and bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release Notes for information on the most significant of these changes:

https://access.redhat.com/documentation/en-us/red_hat_openshift_data_foundation/4.13/html/4.13_release_notes/index

All Red Hat OpenShift Data Foundation users are advised to upgrade to these updated images that provide numerous bug fixes and enhancements.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat OpenShift Data Foundation 4 for RHEL 9 x86_64
• Red Hat OpenShift Data Foundation for IBM Power, little endian 4 for RHEL 9 ppc64le
• Red Hat OpenShift Data Foundation for IBM Z and LinuxONE 4 for RHEL 9 s390x
• Red Hat OpenShift Data Foundation for RHEL 9 ARM 4 aarch64

Fixes

• BZ - 1786696 - UI->Dashboards->Overview->Alerts shows MON components are at different versions, though they are NOT
• BZ - 1855339 - Wrong version of ocs-storagecluster
• BZ - 1943137 - [Tracker for BZ #1945618] rbd: Storage is not reclaimed after persistentvolumeclaim and job that utilized it are deleted
• BZ - 1944687 - [RFE] KMS server connection lost alert
• BZ - 1989088 - [4.8][Multus] UX experience issues and enhancements
• BZ - 2005040 - Uninstallation of ODF StorageSystem via OCP Console fails, gets stuck in Terminating state
• BZ - 2005830 - [DR] DRPolicy resource should not be editable after creation
• BZ - 2042914 - [Tracker for BZ #2013109] [UI] Refreshing web console from the pop-up is taking to Install Operator page.
• BZ - 2052252 - CVE-2021-44531 CVE-2021-44532 CVE-2021-44533 CVE-2022-21824 [CVE] nodejs: various flaws [openshift-data-foundation-4]
• BZ - 2101497 - ceph_mon_metadata metrics are not collected properly
• BZ - 2101916 - must-gather is not collecting ceph logs or coredumps
• BZ - 2102304 - [GSS] Remove the entry of removed node from Storagecluster under Node Topology
• BZ - 2104148 - route ocs-storagecluster-cephobjectstore misconfigured to use http and https on same http route in haproxy.config
• BZ - 2115020 - [RDR] Sync schedule is not removed from mirrorpeer yaml after DR Policy is deleted
• BZ - 2115616 - [GSS] failing to change ownership of the NFS based PVC for PostgreSQL pod by using kube_pv_chown utility
• BZ - 2120098 - [RDR] Even before an action gets fully completed, PeerReady and Available are reported as True in the DRPC yaml
• BZ - 2120944 - Large Omap objects found in pool 'ocs-storagecluster-cephfilesystem-metadata'
• BZ - 2139037 - [cee/sd]Unable to access s3 via RGW route ocs-storagecluster-cephobjectstore
• BZ - 2141095 - [RDR] Storage System page on ACM Hub is visible even when data observability is not enabled
• BZ - 2142651 - RFE: OSDs need ability to bind to a service IP instead of the pod IP to support RBD mirroring in OCP clusters
• BZ - 2142894 - Credentials are ignored when creating a Backing/Namespace store after prompted to enter a name for the resource
• BZ - 2142941 - RGW cloud Transition. HEAD/GET requests to MCG are failing with 403 error
• BZ - 2143944 - [GSS] unknown parameter name "FORCE_OSD_REMOVAL"
• BZ - 2144256 - [RDR] [UI] DR Application applied to a single DRPolicy starts showing connected to multiple policies due to console flickering
• BZ - 2151903 - [MCG] Azure bs/ns creation fails with target bucket does not exists
• BZ - 2152143 - [Noobaa Clone] Secrets are used in env variables
• BZ - 2154250 - NooBaa Bucket Quota alerts are not working
• BZ - 2155507 - RBD reclaimspace job fails when the PVC is not mounted
• BZ - 2155743 - ODF Dashboard fails to load
• BZ - 2156067 - [RDR] [UI] When Peer Ready isn't True, UI doesn't reset the error message even when no subscription group is selected
• BZ - 2156069 - [UI] Instances of OCS can be seen on BlockPool action modals
• BZ - 2156519 - 4.13: odf-csi-addons-operator failed with OwnNamespace InstallModeType not supported
• BZ - 2157876 - [OCP Tracker] [UI] When OCP and ODF are upgraded, refresh web console pop-up doesn't appear after ODF upgrade resulting in dashboard crash
• BZ - 2158922 - Namespace store fails to get created via the ODF UI
• BZ - 2159676 - rbd-mirror logs are rotated very frequently, increase the default maxlogsize for rbd-mirror
• BZ - 2161879 - logging issue when deleting webhook resources
• BZ - 2161937 - collect kernel and journal logs from all worker nodes
• BZ - 2162257 - [RDR][CEPHFS] sync/replication is getting stopped for some pvc
• BZ - 2164617 - Unable to expand ocs-storagecluster-ceph-rbd PVCs provisioned in Filesystem mode
• BZ - 2165495 - Placement scheduler is using too much resources
• BZ - 2165504 - Sizer sharing link is broken
• BZ - 2165929 - [RFE] ODF bluewash introduction in 4.12.x
• BZ - 2165938 - ocs-operator CSV is missing disconnected env annotation.
• BZ - 2165984 - [RDR] Replication stopped for images is represented with incorrect color
• BZ - 2166222 - CSV is missing disconnected env annotation and relatedImages spec
• BZ - 2166234 - Application user unable to invoke Failover and Relocate actions
• BZ - 2166869 - Match the version of consoleplugin to odf operator
• BZ - 2167299 - [RFE] ODF bluewash introduction in 4.12.x
• BZ - 2167308 - [mcg-clone] Security and VA issues with ODF operator
• BZ - 2167946 - CSV is missing disconnected env annotation and relatedImages spec
• BZ - 2168113 - [Ceph Tracker BZ #2141110] [cee/sd][Bluestore] Newly deployed bluestore OSD's showing high fragmentation score
• BZ - 2168635 - fix redirect link to operator details page (OCS dashboard)
• BZ - 2168840 - [Fusion-aaS][ODF 4.13]Within 'prometheus-ceph-rules' the namespace for 'rook-ceph-mgr' jobs should be configurable.
• BZ - 2168849 - Must-gather doesn't collect coredump logs crucial for OSD crash events
• BZ - 2169779 - [vSphere]: rook-ceph-mon-* pvc are in pending state
• BZ - 2170673 - [RDR] Different replication states of PVC images aren't correctly distinguished and representated on UI
• BZ - 2172089 - [Tracker for Ceph BZ 2174461] rook-ceph-nfs pod is stuck at status 'CreateContainerError' after enabling NFS in ODF 4.13
• BZ - 2172365 - [csi-addons] odf-csi-addons-operator oomkilled with fresh installation 4.12
• BZ - 2172521 - No OSD pods are created for 4.13 LSO deployment
• BZ - 2173161 - ODF-console can not start when you disable IPv6 on Node with kernel parameter.
• BZ - 2173528 - Creation of OCS operator tag automatically for verified commits
• BZ - 2173534 - When on StorageSystem details click on History back btn it shows blank body
• BZ - 2173926 - [RFE] Include changes in MCG for new Ceph RGW transition headers
• BZ - 2175612 - noobaa-core-0 crashing and storagecluster not getting to ready state during ODF deployment with FIPS enabled in 4.13cluster
• BZ - 2175685 - RGW OBC creation via the UI is blocked by "Address form errors to proceed" error
• BZ - 2175714 - UI fix- capitalization
• BZ - 2175867 - Rook sets cephfs kernel mount options even when mon is using v1 port
• BZ - 2176080 - odf must-gather should collect output of oc get hpa -n openshift-storage
• BZ - 2176456 - [RDR] ramen-hub-operator and ramen-dr-cluster-operator is going into CLBO post deployment
• BZ - 2176739 - [UI] CSI Addons operator icon is broken
• BZ - 2176776 - Enable save options only when the protected apps has labels for manage DRPolicy
• BZ - 2176798 - [IBM Z ] Multi Cluster Orchestrator operator is not available in the Operator Hub
• BZ - 2176809 - [IBM Z ] DR operator is not available in the Operator Hub
• BZ - 2177134 - Next button if disabled for storage system deployment flow for IBM Ceph Storage security and network step when there is no OCS installed already
• BZ - 2177221 - Enable DR dashboard only when ACM observability is enabled
• BZ - 2177325 - Noobaa-db pod is taking longer time to start up in ODF 4.13
• BZ - 2177695 - DR dashbaord showing incorrect RPO data
• BZ - 2178033 - node topology warnings tab doesn't show pod warnings
• BZ - 2178588 - No rack names on ODF Topology
• BZ - 2178619 - odf-operator failing to resolve its sub-dependencies leaving the ocs-consumer/provider addon in a failed and halted state
• BZ - 2178682 - [GSS] Add the valid AWS GovCloud regions in OCS UI.
• BZ - 2179133 - [UI] A blank page appears while selecting Storage Pool for creating Encrypted Storage Class
• BZ - 2179337 - Invalid storage system href link on the ODF multicluster dashboard
• BZ - 2179403 - (4.13) Mons are failing to start when msgr2 is required with RHCS 6.1
• BZ - 2179846 - [IBM Z] In RHCS external mode Cephobjectstore creation fails as it reports that the "object store name cannot be longer than 38 characters"
• BZ - 2179860 - [MCG] Bucket replication with deletion sync isn't complete
• BZ - 2179976 - [ODF 4.13] Missing the status-reporter binary causing pods "report-status-to-provider" remain in CreateContainerError on ODF to ODF cluster on ROSA
• BZ - 2179981 - ODF Topology search bar mistakes to find searched node/pod
• BZ - 2179997 - Topology. Exit full screen does not appear in Full screen mode
• BZ - 2180211 - StorageCluster stuck in progressing state for Thales KMS deployment
• BZ - 2180397 - Last sync time is missing on application set's disaster recovery status popover
• BZ - 2180440 - odf-monitoring-tool. YAML file misjudged as corrupted
• BZ - 2180921 - Deployment with external cluster in ODF 4.13 with unable to use cephfs as backing store for image_registry
• BZ - 2181112 - [RDR] [UI] Hide disable DR functionality as it would be un-tested in 4.13
• BZ - 2181133 - CI: backport E2E job improvements
• BZ - 2181446 - [KMS][UI] PVC provisioning failed in case of vault kubernetes authentication is configured.
• BZ - 2181535 - [GSS] Object storage in degraded state
• BZ - 2181551 - Build: move to 'dependencies' the ones required for running a build
• BZ - 2181832 - Create OBC via UI, placeholder on StorageClass dropped
• BZ - 2181949 - [ODF Tracker] [RFE] Catch MDS damage to the dentry's first snapid
• BZ - 2182041 - OCS-Operator expects NooBaa CRDs to be present on the cluster when installed directly without ODF Operator
• BZ - 2182296 - [Fusion-aaS][ODF 4.13]must-gather does not collect relevant logs when storage cluster is not in openshift-storage namespace
• BZ - 2182375 - [MDR] Not able to fence DR clusters
• BZ - 2182644 - [IBM Z] MDR policy creation fails unless the ocs-operator pod is restarted on the managed clusters
• BZ - 2182664 - Topology view should hide the sidebar when changing levels
• BZ - 2182703 - [RDR] After upgrading from 4.12.2 to 4.13.0 version.odf.openshift.io cr is not getting updated with latest ODF version
• BZ - 2183155 - failed to mount the the cephfs subvolume as subvolumegroup name is not sent in the GetStorageConfig RPC call
• BZ - 2183196 - [Fusion-aaS] Collect Must-gather logs from the managed-fusion agent namesapce
• BZ - 2183266 - [Fusion aaS Rook ODF 4.13]] Rook-ceph-operator pod should allow OBC CRDs to be optional instead of causing a crash when not present
• BZ - 2183457 - [RDR] when running any ceph cmd we see error 2023-03-31T08:25:31.844+0000 7f8deaffd640 -1 monclient(hunting): handle_auth_bad_method server allowed_methods [2] but i only support [2,1]
• BZ - 2183478 - [MDR][UI] Cannot relocate subscription based apps, Appset based apps are possible to relocate
• BZ - 2183520 - [Fusion-aaS] csi-cephfs-plugin pods are not created after installing ocs-client-operator
• BZ - 2184068 - [Fusion-aaS] Failed to mount CephFS volumes while creating pods
• BZ - 2184605 - [ODF 4.13][Fusion-aaS] OpenShift Data Foundation Client operator is listed in OperatorHub and installable from UI
• BZ - 2184769 - {Fusion-aaS][ODF 4.13]Remove storageclassclaim cr and create new cr storageclass request cr
• BZ - 2184773 - multicluster-orchestrator should not reset spec.network.multiClusterService.Enabled field added by user
• BZ - 2184892 - Don't pass encryption options to ceph cluster in odf external mode to provider/consumer cluster
• BZ - 2184984 - Topology Sidebar alerts panel: alerts accordion does not toggle when clicking on alert severity text
• BZ - 2185164 - [KMS][VAULT] PVC provisioning is failing when the Vault (HCP) Kubernetes authentication is set.
• BZ - 2185188 - Fix storagecluster watch request for OCSInitialization
• BZ - 2185757 - add NFS dashboard
• BZ - 2185871 - [MDR][ACM-Tracker] Deleting an Appset based application does not delete its placement
• BZ - 2186171 - [GSS] "disableLoadBalancerService: true" config is reconciled after modifying the number of NooBaa endpoints
• BZ - 2186225 - [RDR] when running any ceph cmd we see error 2023-03-31T08:25:31.844+0000 7f8deaffd640 -1 monclient(hunting): handle_auth_bad_method server allowed_methods [2] but i only support [2,1]
• BZ - 2186475 - handle different network connection spec & Pass appropriate options for all the cases of Network Spec
• BZ - 2186752 - [translations] add translations for 4.13
• BZ - 2187251 - sync ocs and odf with the latest rook
• BZ - 2187296 - [MCG] Can't opt out of deletions sync once log-based replication with deletions sync is set
• BZ - 2187736 - [RDR] Replication history graph is showing incorrect value
• BZ - 2187952 - When cluster controller is cancelled frequently, multiple simultaneous controllers cause issues since need to wait for shutdown before continuing new controller
• BZ - 2187969 - [ODFMS-Migration ] [OCS Client Operator] csi-rbdplugin stuck in ImagePullBackOff on consumer clusters after Migration
• BZ - 2187986 - [MDR] ramen-dr-cluster-operator pod is in CLBO after assigning dr policy to an appset based app
• BZ - 2188053 - ocs-metrics-exporter cannot list/watch StorageCluster, StorageClass, CephBlockPool and other resources
• BZ - 2188238 - [RDR] Avoid using the terminologies "SLA" in DR dashbaord
• BZ - 2188303 - [RDR] Maintenance mode is not enabled after initiating failover action
• BZ - 2188427 - [External mode upgrade]: Upgrade from 4.12 -> 4.13 external mode is failing because rook-ceph-operator is not reaching clean state
• BZ - 2188666 - wrong label in new storageclassrequest cr
• BZ - 2189483 - After upgrade noobaa-db-pg-0 pod using old image in one of container
• BZ - 2189929 - [RDR/MDR] [UI] Dashboard fon size are very uneven
• BZ - 2189982 - [RDR] ocs_rbd_client_blocklisted datapoints and the corresponding alert is not getting generated
• BZ - 2189984 - [KMS][VAULT] Storage cluster remains in 'Progressing' state during deployment with storage class encryption, despite all pods being up and running.
• BZ - 2190129 - OCS Provider Server logs are incorrect
• BZ - 2190241 - nfs metric details are unavailable and server health is displaying as "Degraded" under Network file system tab in UI
• BZ - 2192088 - [IBM P] rbd_default_map_options value not set to ms_mode=secure in in-transit encryption enabled ODF cluster
• BZ - 2192670 - Details tab for nodes inside Topology throws "Something went wrong" on IBM Power platform
• BZ - 2192824 - [4.13] Fix Multisite in external cluster
• BZ - 2192875 - Enable ceph-exporter in rook
• BZ - 2193114 - MCG replication is failing due to OC binary incompatible on Power platform
• BZ - 2193220 - [Stretch cluster] CephCluster is updated frequently due to changing ordering of zones
• BZ - 2196176 - MULTUS UI, There is no option to change the multus configuration after we configure the params
• BZ - 2196236 - [RDR] With ACM 2.8 User is not able to apply Drpolicy to subscription workload
• BZ - 2196298 - [RDR] DRPolicy doesn't show connected application when subscription based workloads are deployed via CLI
• BZ - 2203795 - ODF Monitoring is missing some of the ceph_* metric values
• BZ - 2208029 - nfs server health is always displaying as "Degraded" under Network file system tab in UI.
• BZ - 2208079 - rbd mirror daemon is commonly not upgraded
• BZ - 2208269 - [RHCS Tracker] After add capacity the rebalance does not complete, and we see 2 PGs in active+clean+scrubbing and 1 active+clean+scrubbing+deep
• BZ - 2208558 - [MDR] ramen-dr-cluster-operator pod crashes during failover
• BZ - 2208962 - [UI] ODF Topology. Degraded cluster don't show red canvas on cluster level
• BZ - 2209364 - ODF dashboard crashes when OCP and ODF are upgraded
• BZ - 2209643 - Multus, Cephobjectstore stuck on Progressing state because " failed to create or retrieve rgw admin ops user"
• BZ - 2209695 - When collecting Must-gather logs shows /usr/bin/gather_ceph_resources: line 341: jq: command not found
• BZ - 2210964 - [UI][MDR] After hub recovery in overview tab of data policies Application set apps count is not showing
• BZ - 2211334 - The replication history graph is very unclear
• BZ - 2211343 - [MCG-Only]: upgrade failed from 4.12 to 4.13 due to missing CSI_ENABLE_READ_AFFINITY in ConfigMap openshift-storage/ocs-operator-config
• BZ - 2211704 - Multipart uploads fail to a Azure namespace bucket when user MD is sent as part of the upload

CVEs

• CVE-2020-17049
• CVE-2021-4231
• CVE-2021-46848
• CVE-2022-0670
• CVE-2022-1271
• CVE-2022-1304
• CVE-2022-2309
• CVE-2022-2509
• CVE-2022-2795
• CVE-2022-3094
• CVE-2022-3358
• CVE-2022-3715
• CVE-2022-3736
• CVE-2022-3924
• CVE-2022-28805
• CVE-2022-31129
• CVE-2022-34903
• CVE-2022-35737
• CVE-2022-36227
• CVE-2022-40023
• CVE-2022-40303
• CVE-2022-40304
• CVE-2022-42010
• CVE-2022-42011
• CVE-2022-42012
• CVE-2022-47024
• CVE-2022-47629
• CVE-2022-48303
• CVE-2022-48337
• CVE-2022-48338
• CVE-2022-48339
• CVE-2023-2491
• CVE-2023-25136

References

• null