RHBA-2025:3032 - Bug Fix Advisory

Topic

OpenShift Operators are available for the control plane of Red Hat OpenStack Services on OpenShift (RHOSO) 18.0.6 (Feature Release 2).

Description

Red Hat OpenShift Operators automate the creation, configuration, and management of instances of Kubernetes-native applications. The Operators in this release automate the creation, configuration, and management of OpenStack services in a RHOSO deployment.

Solution

Before applying this update, make sure all previously released errata relevant
to your system have been applied.

For details on how to apply this update as a new RHOSO 18.0 deployment, see
“Deploying Red Hat OpenStack Services on OpenShift” at https://docs.redhat.com/en/documentation/red_hat_openstack_services_on_openshift/18.0/html/deploying_red_hat_openstack_services_on_openshift/index

For details on how to apply this update to an existing RHOSO 18.0 deployment,
see "Updating your environment to the latest maintenance release" at https://docs.redhat.com/en/documentation/red_hat_openstack_services_on_openshift/18.0/html/updating_your_environment_to_the_latest_maintenance_release/index

Affected Products

• Red Hat OpenStack Services on OpenShift Podifed Operators 1.0 x86_64

Fixes

• OSPRH-14114 - Use custom hosted kube-rbac-proxy image until we can update to the new WithAuthenticationAndAuthorization
• OSPRH-14450 - test-operator images use RELATED_IMAGE interface... but we aren't releasing them downstream
• OSPRH-10965 - [heat-operator] Make httpd Timeout Configurable
• OSPRH-11017 - Telemetry Operator does not create NetworkAttachment for Prometheus
• OSPRH-11066 - telemetry-power-monitoring role in edpm-ansible does not open the 8888 port in the firewall for Kepler
• OSPRH-11755 - Kepler dashboard should list compute hostnames rather than uuids
• OSPRH-11890 - Add /lib/modules mount to kepler to capture GPU metrics
• OSPRH-12147 - OpenShift Logging 6.0 changed the API completely and there are no rsyslog examples
• OSPRH-13151 - missing [] around IPv6 IP addresses
• OSPRH-13152 - Connection refused on rabbitmq metrics in IPv6
• OSPRH-13840 - telemetry-power-monitoring dataplane service fails to pull kepler image
• OSPRH-14494 - Improve TopologyRef envTests
• OSPRH-14637 - Glance services not deployed properly when using Cinder as a backend
• OSPRH-14569 - openstack-operator-bundle: kube-rbac-proxy is missing from relatedImages
• OSPRH-11211 - Allow to Plug/Unplug PVCs to Glance API
• OSPRH-14715 - bindata has hard coded kube-rbac-proxy URLs
• OSPRH-10960 - [keystone-operator] Make httpd Timeout Configurable
• OSPRH-10964 - [barbican-operator] Make httpd Timeout Configurable
• OSPRH-11927 - Unregister VM metrics when VM is moved away from the compute node
• OSPRH-12378 - [telemetry-operator] Fix httpd config X-Forwarded-Proto
• OSPRH-13223 - Expose prometheus connection information in a secret
• OSPRH-12359 - Node Exporter scraping fails on TLS errors
• OSPRH-11016 - Swift adoption fails due to rbac permission error
• OSPRH-11140 - Swift storage does not become ready with 0 replicas
• OSPRH-11240 - extraMounts propagation to instance not working when uniquePodNames is true
• OSPRH-11935 - OpenStack APIs take a long time to recover when one of the memcached pods goes down
• OSPRH-12774 - Creating multiple nodesets in the same namespace using baremetal provisioning fails with error
• OSPRH-13320 - Rabbitmq crashing (dual stack OCP cluster network)
• OSPRH-13951 - octavia-operator unstable when using DCN network settings
• OSPRH-14085 - octavia rsyslog endpoints drop logs from remote AZs
• OSPRH-10294 - Configurable Affinity/TopologySpreadConstraints to control pod AZ placement
• OSPRH-10705 - Octavia-operator doesn't enable anti affinity
• OSPRH-10913 - Deploy Manila for Ceph Distributed Zones
• OSPRH-11018 - Glance S3 backend support
• OSPRH-11241 - Deploy Cinder for Ceph Distributed Zones
• OSPRH-11244 - rework our use of OLM bundle's to support v2 of OpenStackControlplane
• OSPRH-12302 - ctlplaneNetmask should be set based on IPAM
• OSPRH-13075 - offline/airgapped broken on 'main' (for FR2)
• OSPRH-14462 - Correct web console label for new OpenStack initialization resource
• OSPRH-13948 - As a cloud operator, I want to be able to replace faulty dataplane nodes without scale-in/out
• OSPRH-12384 - Manage pod secondary interface IP announcements via a controller
• OSPRH-13100 - Provide a way to customize httpd vhost config in a templated way
• OSPRH-10756 - Ceilometer's Prometheus exporter duplicates resource_name in certain cases
• OSPRH-10047 - OpenStackDataPlaneNodeSet does not report SetupReady status in short output
• OSPRH-10126 - Allow vlan tagging of ctlplane network
• OSPRH-12225 - [heat-operator][ipv6][notls] Fix default cache config
• OSPRH-12301 - ctlplaneNetmask should be set based on IPAM
• OSPRH-12709 - Refactor openstack-baremetal-operator CRDs for use with OpenStackDataplaneNodeset
• OSPRH-12712 - Excessive reflector.go failures related to watching ImageContentSourcePolicy objects
• OSPRH-13765 - Multiple BMH nodes consumed by single NodeSet with only 1 node in each
• OSPRH-13796 - Heat API and CFN should use health check endpoint for probes
• OSPRH-12243 - Default DatabaseInstance not provided for octavia
• OSPRH-10083 - Run Cinder pod components at minimum privilege escalation level
• OSPRH-3107 - [Networking] Build octavia-operator correctly for OCP with FIPS enabled
• OSPRH-14705 - Tech Preview - Improved TLS cipher and protocol support
• OSPRH-13530 - Init container in "octavia-rsyslog" daemonset is using upstream image with a tag
• OSPRH-10105 - Reintroduce redis in designate-operator
• OSPRH-3300 - Federation Support for the keystone-operator
• OSPRH-10286 - Run Octavia pod components at minimum privilege escalation level
• OSPRH-6928 - Refactor ring rebalance script to add hardware node-awareness
• OSPRH-11780 - OpenStackProvisionServer Port should be within a range
• OSPRH-10481 - Fill the metrics gap with VMWare for FR2
• OSPRH-10808 - Visualize hardware sensor metrics with Ceilometer IPMI
• OSPRH-13048 - [telemetry] Fix httpd RequestHeader setting X-Forwarded-Proto for non tls deployment
• OSPRH-7341 - Get ceilometer compute poller to expose prometheus metrics
• OSPRH-10124 - TP - Support multiple OSP dataplanes using different namespaces
• OSPRH-5504 - Pure L3 spine&leaf
• OSPRH-5853 - Update controller IPs in existing amphorae
• OSPRH-5854 - Update network configuration for Octavia amphorae (DPA)
• OSPRH-10744 - Disable instance_info networking cache interval by default
• OSPRH-12073 - Support adoption for hugepages nodes
• OSPRH-5332 - Designate - TLS support
• OSPRH-7305 - Build designate-operator correctly for OCP with FIPS enabled
• OSPRH-2564 - Octavia: Reduce the visibility of sensitive configuration
• OSPRH-417 - The designate operator should create and manage an unbound pod
• OSPRH-8109 - Generate basic backend related configurations for relevant designate services
• OSPRH-8123 - make bind9 and unbound accessible as necessary.
• OSPRH-8128 - Implement bind pool management for podified control plane
• OSPRH-8133 - Implement predicable IPs for designate miniDNS and bind9 pods
• OSPRH-8817 - Fix Designate services deployment types
• OSPRH-8336 - Tech Preview - Octavia support for DCN deployments

CVEs

• CVE-2020-11023
• CVE-2022-49043
• CVE-2024-56171
• CVE-2025-24928

References

(none)