RHBA-2024:5474 - Bug Fix Advisory

Topic

Updated images are now available for Red Hat Advanced Cluster Security (RHACS). The updated image includes changes and bug fixes.

Description

RHACS 4.5.1 provides these changes and bug fixes:

Changes:

• The network graph and the network policy generator in the RHACS portal were updated to clarify that AdminNetworkPolicy and BaselineAdminNetworkPolicy resources are not taken into consideration in the network graph or during network policy generation.
• RHACS components were updated to versions that include a fix for CVE-2024-41110: Vulnerability in authorization plugins in Docker Engine (AuthZ).

Bug fixes:

• When upgrading to RHACS 4.5.0, in some situations, the upgrade failed with a central-db error for the uni_compliance_integrations_clusterid constraint. This problem has been fixed.
• After upgrading to RHACS 4.5.0, for nodes with more than 64 cores, Collector displayed an error about the ring buffer size not being allowed. This problem has been fixed.
• The network graph was broken for users with clusters running Google Kubernetes Engine (GKE) version 1.29 and later due to a change from Google to use the managed public IP address range 34.118.224.0/20 for default networking services. The network graph marked this IP address range as external. This problem has been fixed.

Solution

To take advantage of these changes and bug fixes, upgrade to RHACS 4.5.1.

Affected Products

• Red Hat Advanced Cluster Security for Kubernetes 4 x86_64
• Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4 s390x
• Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4 ppc64le

Fixes

• ROX-24747 - Add banner to top of network graph to indicate ANP/BANP incompatibility
• ROX-24951 - [UI] Link scanner error description to docs
• ROX-25218 - Service IPs are marked as external in GKE versions >= 1.29
• ROX-25435 - Upgrade to 4.5.x shows ALTER TABLE "compliance_integrations" DROP CONSTRAINT
• ROX-25477 - the specified per-CPU ring buffer dimension (3145728) is not allowed!

CVEs

(none)

References

• https://docs.openshift.com/acs/4.5/release_notes/45-release-notes.html