RHBA-2024:11522 - Bug Fix Advisory

Topic

Red Hat OpenShift Container Platform release 4.17.10 is now available with updates to packages and images that fix several bugs.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container Platform 4.17.10. See the following advisory for the RPM packages for this release:

https://access.redhat.com/errata/RHBA-2024:11525

Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.openshift.com/container-platform/4.17/release_notes/ocp-4-17-release-notes.html

Solution

For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.17/release_notes/ocp-4-17-release-notes.html

You can download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests can be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

(For x86_64 architecture)
The image digest is sha256:4c8cc149a8e4ef2f9ea2c43cde4f197faf3f58c26b1f3954871fd1c59f2bc1fa

(For s390x architecture)
The image digest is sha256:4bdd24369f02d17582114e2b91455f10fea9e7998aab9e8ca2b7b4d41a6a3fc8

(For ppc64le architecture)
The image digest is sha256:733402f6ea6889cd9e40628b39eb551cc4953d5d6cc8166acd215cb09e41e5a2

(For aarch64 architecture)
The image digest is sha256:b38ff78463a9f1ba956a662a6184d2512b59de4936ee6655a13ad404b84c1656

All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.17/updating/updating_a_cluster/updating-cluster-cli.html

Affected Products

• Red Hat OpenShift Container Platform 4.17 for RHEL 9 x86_64
• Red Hat OpenShift Container Platform 4.17 for RHEL 8 x86_64
• Red Hat OpenShift Container Platform for Power 4.17 for RHEL 9 ppc64le
• Red Hat OpenShift Container Platform for Power 4.17 for RHEL 8 ppc64le
• Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.17 for RHEL 9 s390x
• Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.17 for RHEL 8 s390x
• Red Hat OpenShift Container Platform for ARM 64 4.17 for RHEL 9 aarch64
• Red Hat OpenShift Container Platform for ARM 64 4.17 for RHEL 8 aarch64

Fixes

• OCPBUGS-38658 - ART requests updates to 4.17 image ose-alibaba-machine-controllers-container
• OCPBUGS-39200 - [4.17] Bump OVS to 3.4 in ovn-k containerr for OCP 4.17
• OCPBUGS-43664 - CPU architecture/vendor detection in NTO (4.17)
• OCPBUGS-43714 - [4.17 IPSEC] pod to pod communication is degraded
• OCPBUGS-44114 - HostedCluster failing when a cluster wide proxy is used in the HostedCluster manifest.
• OCPBUGS-44270 - [4.17] FRR-K8s default hold time and keepalive time different from metallb's one
• OCPBUGS-44644 - [release-4.17] PPC: false negative reporting while comparing the topologies of affected compute nodes
• OCPBUGS-45202 - [release-4.17] Gather LokiStack resources to enable an Advisor recommendation
• OCPBUGS-45236 - [release-4.17] Unable to set the operatorLogLevel to Debug/Trace/TraceAll for insightsoperator object
• OCPBUGS-45484 - PowerVS: Listen to machineNetwork
• OCPBUGS-45517 - Create command fails with "image can't be pulled" error
• OCPBUGS-45667 - After upgrading the cluster to 4.15 the Prometheus Operator?s "Prometheus" tab does not show the Prometheuses
• OCPBUGS-45938 - aws-sdk-go-v2 fails to authenticate AssumeRoleWithWebIdentity on AWS STS clusters
• OCPBUGS-45953 - Bump OVS to 3.4.0-18.el9fdp for OCP 4.17
• OCPBUGS-46002 - Bump to kubernetes 1.30.7
• OCPBUGS-46054 - IBM Fusion operator upgrade is blocked with the error: "error validating existing CRs against new CRD's schema"
• OCPBUGS-46146 - [release-4.17] IPsec state not cleaned up on the cluster
• OCPBUGS-46281 - [4.17] Libreswan and xfrm information and logs are not getting collected in sos-reports
• OCPBUGS-46390 - When the webhook token authenticator is enabled, the console is in crashloopback
• OCPBUGS-46484 - Add python script to handle test result from 4.17 to 4.12
• OCPBUGS-45186 - AWS installation fails when AssociatePublicIpAddress value is set to false in SCP.
• OCPBUGS-45688 - [release-4.17]Too many NMEA messages in WPC T-GM
• OCPBUGS-45948 - ImagePullSecret getting duplicated when editing DeploymentConfig in Form View
• OCPBUGS-45949 - ReRun of Resolver based PipelineRuns fails from UI
• OCPBUGS-46071 - BareMetalHost CR fails to delete on cluster cleanup
• OCPBUGS-46521 - [release-4.17] Too many nmea messages on E810 card T-GM

CVEs

• CVE-2021-47384
• CVE-2024-8508
• CVE-2024-9287
• CVE-2024-38627
• CVE-2024-39499
• CVE-2024-40989
• CVE-2024-50602

References

(none)