Issued:

2019-03-14

Updated:

2019-03-14

RHBA-2019:0407 - OpenShift Container Platform 3.11 bug fix update

Synopsis

OpenShift Container Platform 3.11 bug fix update

Type/Severity

Bug Fix Advisory None

Topic

Red Hat OpenShift Container Platform release 3.11.88 is now available with updates to packages and images that fix several bugs.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container Platform 3.11.88. See the following advisory for the container images for this release:

https://access.redhat.com/errata/RHBA-2019:0406

This update fixes the following bugs:

• The build version was not allowed to be specified when requesting logs. As a result, users were not able to view logs of specific build revisions. Now, revision numbers can be specified because the validation was removed. oc logs can be invoked for a specific build version. (BZ#1612021)

• When processing resources, empty files were not omitted. oc set could cause a panic when encountered by an empty file. Now, oc set will not panic when presented an empty file. (BZ#1612023)

• The console created resources synchronously, which does not work when there is a dependency between resources such as role and role binding, resulting in a failure to create the dependent resource. Now, the console has been changed so that resources are created asynchronously and it not longer fails on creation. (BZ#1673109)

• Default journald configurations had the SystemKeepFree parameter set to percentages. journald does not accept percentage values, so this setting had no effect and and could cause the disk to be filled up. This parameter is now removed from default settings. Users need to update journald_vars_to_replace with the absolute value in SystemKeepFree to prevent the disk filling up. (BZ#1676565)

• The permissions on the vsphere cloud configuration file were restricted, preventing access from other users. This is now resolved and access is now available to users. (BZ#1678433)

• The environment variable that controlled client trust configuration was incorrectly named. As a result, the client was unable to communicate with the Kubernetes API cluster, and subsequently the ElastiSearch nodes were unable to be accessed from a cluster. The environment variable is now named correctly and access is restored. (BZ#1678441)

• DNS records were being removed before kuryr-related cleanup tasks were executed and these tasks needed access to the OpenShift API. Thus, the connection to the API was not successful due to the missing DNS record pointing to it. This led to non-deleted resources, like subnets, that were created by kuryr and caused delete tasks to fail. With this bug fix, the DNS records are only deleted after the kuryr stack is deleted. (BZ#1679323)

• logging-curator was changed to be scheduled by a cronjob, and times were based on the timezone of the master node, where the job is initiated. As a result, the openshift_logging_curator_run_timezone variable could not configure the timezone. openshift_logging_curator_run_timezone does not work, and the variable naming may cause confusion. Now, openshift_logging_curator_run_timezoneis removed from related playbooks and documentation and will not be used anymore. (BZ#1680271)

All OpenShift Container Platform 3.11 users are advised to upgrade to these updated packages.

Solution

Before applying this update, ensure all previously released errata relevant to your system have been applied.

See the following documentation, which will be updated shortly for release 3.11.88, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

This page is not included, but the link has been rewritten to point to the nearest parent document.https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at This content is not included.https://access.redhat.com/articles/11258.

Affected Products

Updated Packages

• atomic-openshift-template-service-broker-3.11.88-1.git.0.47f4e98.el7.ppc64le.rpm
• atomic-openshift-clients-3.11.88-1.git.0.47f4e98.el7.x86_64.rpm
• ansible-service-broker-selinux-1.3.22-1.el7.noarch.rpm
• atomic-openshift-metrics-server-3.11.88-1.git.2.7e1566f.el7.x86_64.rpm
• atomic-openshift-dockerregistry-3.11.88-1.git.1.aaf5156.el7.x86_64.rpm
• atomic-openshift-master-3.11.88-1.git.0.47f4e98.el7.ppc64le.rpm
• automation-broker-apb-role-1.3.22-1.el7.noarch.rpm
• atomic-openshift-hypershift-3.11.88-1.git.0.47f4e98.el7.x86_64.rpm
• atomic-openshift-node-3.11.88-1.git.0.47f4e98.el7.x86_64.rpm
• prometheus-alertmanager-3.11.88-1.git.2.0001551.el7.x86_64.rpm
• prometheus-node-exporter-3.11.88-1.git.2.c7b22aa.el7.ppc64le.rpm
• golang-github-openshift-oauth-proxy-3.11.88-1.git.2.31f54b1.el7.src.rpm
• atomic-openshift-cluster-autoscaler-3.11.88-1.git.2.4edd147.el7.ppc64le.rpm
• prometheus-3.11.88-1.git.2.b24c7f3.el7.ppc64le.rpm
• atomic-openshift-node-3.11.88-1.git.0.47f4e98.el7.ppc64le.rpm
• golang-github-openshift-oauth-proxy-3.11.88-1.git.2.31f54b1.el7.x86_64.rpm
• openshift-ansible-playbooks-3.11.92-1.git.0.f2fade7.el7.noarch.rpm
• atomic-openshift-docker-excluder-3.11.88-1.git.0.47f4e98.el7.noarch.rpm
• atomic-openshift-node-problem-detector-3.11.88-1.git.2.3c1c933.el7.ppc64le.rpm
• openshift-enterprise-autoheal-3.11.88-1.git.2.b6f03e9.el7.ppc64le.rpm
• atomic-openshift-cluster-autoscaler-3.11.88-1.git.2.4edd147.el7.src.rpm
• atomic-openshift-node-problem-detector-3.11.88-1.git.2.3c1c933.el7.x86_64.rpm
• atomic-enterprise-service-catalog-svcat-3.11.88-1.git.2.6ae7b24.el7.ppc64le.rpm
• ansible-service-broker-container-scripts-1.3.22-1.el7.noarch.rpm
• atomic-openshift-web-console-3.11.88-1.git.1.f57298a.el7.src.rpm
• atomic-enterprise-service-catalog-svcat-3.11.88-1.git.2.6ae7b24.el7.x86_64.rpm
• atomic-openshift-hyperkube-3.11.88-1.git.0.47f4e98.el7.ppc64le.rpm
• golang-github-openshift-oauth-proxy-3.11.88-1.git.2.31f54b1.el7.ppc64le.rpm
• atomic-openshift-service-idler-3.11.88-1.git.2.d5797ae.el7.src.rpm
• atomic-openshift-clients-redistributable-3.11.88-1.git.0.47f4e98.el7.x86_64.rpm
• atomic-openshift-pod-3.11.88-1.git.0.47f4e98.el7.x86_64.rpm
• atomic-openshift-tests-3.11.88-1.git.0.47f4e98.el7.x86_64.rpm
• openshift-enterprise-autoheal-3.11.88-1.git.2.b6f03e9.el7.src.rpm
• atomic-openshift-3.11.88-1.git.0.47f4e98.el7.x86_64.rpm
• atomic-openshift-excluder-3.11.88-1.git.0.47f4e98.el7.noarch.rpm
• openshift-ansible-roles-3.11.92-1.git.0.f2fade7.el7.noarch.rpm
• atomic-openshift-3.11.88-1.git.0.47f4e98.el7.src.rpm
• atomic-openshift-dockerregistry-3.11.88-1.git.1.aaf5156.el7.src.rpm
• atomic-openshift-hyperkube-3.11.88-1.git.0.47f4e98.el7.x86_64.rpm
• atomic-openshift-metrics-server-3.11.88-1.git.2.7e1566f.el7.src.rpm
• atomic-openshift-service-idler-3.11.88-1.git.2.d5797ae.el7.ppc64le.rpm
• ansible-service-broker-1.3.22-1.el7.src.rpm
• prometheus-node-exporter-3.11.88-1.git.2.c7b22aa.el7.x86_64.rpm
• atomic-openshift-dockerregistry-3.11.88-1.git.1.aaf5156.el7.ppc64le.rpm
• atomic-openshift-tests-3.11.88-1.git.0.47f4e98.el7.ppc64le.rpm
• atomic-openshift-web-console-3.11.88-1.git.1.f57298a.el7.ppc64le.rpm
• openshift-ansible-test-3.11.92-1.git.0.f2fade7.el7.noarch.rpm
• atomic-openshift-master-3.11.88-1.git.0.47f4e98.el7.x86_64.rpm
• atomic-openshift-3.11.88-1.git.0.47f4e98.el7.ppc64le.rpm
• atomic-openshift-metrics-server-3.11.88-1.git.2.7e1566f.el7.ppc64le.rpm
• atomic-enterprise-service-catalog-3.11.88-1.git.2.6ae7b24.el7.x86_64.rpm
• ansible-service-broker-1.3.22-1.el7.ppc64le.rpm
• atomic-openshift-cluster-autoscaler-3.11.88-1.git.2.4edd147.el7.x86_64.rpm
• atomic-openshift-hypershift-3.11.88-1.git.0.47f4e98.el7.ppc64le.rpm
• prometheus-alertmanager-3.11.88-1.git.2.0001551.el7.ppc64le.rpm
• atomic-openshift-clients-3.11.88-1.git.0.47f4e98.el7.ppc64le.rpm
• atomic-openshift-service-idler-3.11.88-1.git.2.d5797ae.el7.x86_64.rpm
• openshift-enterprise-cluster-capacity-3.11.88-1.git.2.5cacee5.el7.x86_64.rpm
• atomic-enterprise-service-catalog-3.11.88-1.git.2.6ae7b24.el7.src.rpm
• atomic-openshift-template-service-broker-3.11.88-1.git.0.47f4e98.el7.x86_64.rpm
• openshift-enterprise-cluster-capacity-3.11.88-1.git.2.5cacee5.el7.src.rpm
• atomic-openshift-descheduler-3.11.88-1.git.2.9a679e1.el7.ppc64le.rpm
• ansible-service-broker-1.3.22-1.el7.x86_64.rpm
• golang-github-prometheus-node_exporter-3.11.88-1.git.2.c7b22aa.el7.src.rpm
• atomic-openshift-sdn-ovs-3.11.88-1.git.0.47f4e98.el7.ppc64le.rpm
• openshift-enterprise-cluster-capacity-3.11.88-1.git.2.5cacee5.el7.ppc64le.rpm
• atomic-openshift-sdn-ovs-3.11.88-1.git.0.47f4e98.el7.x86_64.rpm
• atomic-enterprise-service-catalog-3.11.88-1.git.2.6ae7b24.el7.ppc64le.rpm
• openshift-ansible-3.11.92-1.git.0.f2fade7.el7.src.rpm
• openshift-enterprise-autoheal-3.11.88-1.git.2.b6f03e9.el7.x86_64.rpm
• atomic-openshift-descheduler-3.11.88-1.git.2.9a679e1.el7.x86_64.rpm
• prometheus-3.11.88-1.git.2.b24c7f3.el7.x86_64.rpm
• atomic-openshift-descheduler-3.11.88-1.git.2.9a679e1.el7.src.rpm
• atomic-openshift-web-console-3.11.88-1.git.1.f57298a.el7.x86_64.rpm
• atomic-openshift-node-problem-detector-3.11.88-1.git.2.3c1c933.el7.src.rpm
• openshift-ansible-docs-3.11.92-1.git.0.f2fade7.el7.noarch.rpm
• openshift-ansible-3.11.92-1.git.0.f2fade7.el7.noarch.rpm
• atomic-openshift-pod-3.11.88-1.git.0.47f4e98.el7.ppc64le.rpm
• golang-github-prometheus-alertmanager-3.11.88-1.git.2.0001551.el7.src.rpm
• golang-github-prometheus-prometheus-3.11.88-1.git.2.b24c7f3.el7.src.rpm

Fixes

• This content is not included.BZ - 1612021
• This content is not included.BZ - 1612023
• This content is not included.BZ - 1633570
• This content is not included.BZ - 1635802
• This content is not included.BZ - 1636493
• This content is not included.BZ - 1661916
• This content is not included.BZ - 1663268
• This content is not included.BZ - 1667185
• This content is not included.BZ - 1669080
• This content is not included.BZ - 1671820
• This content is not included.BZ - 1673109
• This content is not included.BZ - 1676565
• This content is not included.BZ - 1677454
• This content is not included.BZ - 1678433
• This content is not included.BZ - 1678441
• This content is not included.BZ - 1679323
• This content is not included.BZ - 1679760
• This content is not included.BZ - 1680271
• This content is not included.BZ - 1684742

CVEs

(none)

References

(none)

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.