Issued:

2020-05-28

Updated:

2020-05-28

RHBA-2020:2215 - OpenShift Container Platform 3.11 bug fix and enhancement update

Synopsis

OpenShift Container Platform 3.11 bug fix and enhancement update

Type/Severity

Bug Fix Advisory None

Topic

Red Hat OpenShift Container Platform release 3.11.219 is now available with updates to packages and images that fix several bugs and add enhancements.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container Platform 3.11.219. See the following advisory for the container images for this release:

https://access.redhat.com/errata/RHBA-2020:2216

This release fixes the following bugs among others:

• Previously, DNS names were queried every time they occurred in an EgressNetworkPolicy. Records were queried regardless of whether a particular DNS record had been refreshed by a previous query, resulting in slow network performance. DNS records are now queried based on unique names rather than per each EgressNetworkPolicy. As a result, DNS query performance has been significantly improved. (BZ#1772594)

• Previously, the PKI directory was not properly mounted to the sync Pod. This caused the openshift-ca.crt to be inaccessible, and as a result, was recreated. The missing mounts and volumes have been added to the sync Pod, so the openshift-ca.crt is available and is not incorrectly recreated. (BZ#1808068)

• The Google Cloud Storage (GCS) driver was not reporting all errors due to a variable shadowing issue. This issue has been resolved, allowing all errors to be reported by the registry. (BZ#1814722)

• The image registry was using repository names in metrics labels. This caused Prometheus to have problems with reporting many metrics. This bug fix removes repository names from labels, resulting in less generated metrics and better performance. (BZ#1827744)

• The variable openshift_certificate_expiry_warning_days was hard-coded in an area of {product-title}'s underlying code calling the openshift_certificate_expiry role during upgrades. This prevented the openshift_certificate_expiry_warning_days variable from being overridden in the inventory. This bug fix replaces the hard-coded value with a task to set a value of six months if the variable has not been defined by the user. (BZ#1829492)

• When redeploying certificates, the certificate expiry check provided little value because the expectation was that the certificates would be replaced. Additionally, there were situations where certificates were invalid and redeployment was blocked by the check. This bug fix removes the checks, allowing certificate redeployment to proceed without requiring additional inventory variables to override expiry days or invalid/missing certificates. (BZ#1832379)

All OpenShift Container Platform 3.11 users are advised to upgrade to these updated packages and images.

Solution

Before applying this update, ensure all previously released errata relevant to your system is applied.

See the following documentation, which will be updated shortly for release 3.11.219, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

This page is not included, but the link has been rewritten to point to the nearest parent document.https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at This content is not included.https://access.redhat.com/articles/11258.

Affected Products

Updated Packages

• atomic-openshift-clients-3.11.219-1.git.0.0c21387.el7.x86_64.rpm
• atomic-openshift-descheduler-3.11.219-1.git.1.7e5b9ee.el7.x86_64.rpm
• prometheus-3.11.219-1.git.1.3f6e657.el7.x86_64.rpm
• atomic-openshift-cluster-autoscaler-3.11.219-1.git.1.1ad3e34.el7.ppc64le.rpm
• openshift-ansible-3.11.219-1.git.0.8845382.el7.src.rpm
• golang-github-prometheus-node_exporter-3.11.219-1.git.1.7fa9674.el7.src.rpm
• openshift-ansible-roles-3.11.219-1.git.0.8845382.el7.noarch.rpm
• atomic-enterprise-service-catalog-3.11.219-1.git.1.717017c.el7.src.rpm
• atomic-openshift-template-service-broker-3.11.219-1.git.0.0c21387.el7.x86_64.rpm
• prometheus-alertmanager-3.11.219-1.git.1.9a593f8.el7.x86_64.rpm
• atomic-openshift-metrics-server-3.11.219-1.git.1.6fe54fb.el7.x86_64.rpm
• atomic-openshift-hypershift-3.11.219-1.git.0.0c21387.el7.x86_64.rpm
• atomic-openshift-clients-3.11.219-1.git.0.0c21387.el7.ppc64le.rpm
• atomic-openshift-service-idler-3.11.219-1.git.1.958cdae.el7.x86_64.rpm
• atomic-openshift-sdn-ovs-3.11.219-1.git.0.0c21387.el7.ppc64le.rpm
• atomic-openshift-tests-3.11.219-1.git.0.0c21387.el7.x86_64.rpm
• prometheus-node-exporter-3.11.219-1.git.1.7fa9674.el7.ppc64le.rpm
• atomic-openshift-3.11.219-1.git.0.0c21387.el7.ppc64le.rpm
• golang-github-prometheus-alertmanager-3.11.219-1.git.1.9a593f8.el7.src.rpm
• golang-github-openshift-oauth-proxy-3.11.219-1.git.1.076ae14.el7.x86_64.rpm
• atomic-openshift-cluster-autoscaler-3.11.219-1.git.1.1ad3e34.el7.x86_64.rpm
• atomic-openshift-node-3.11.219-1.git.0.0c21387.el7.ppc64le.rpm
• atomic-openshift-descheduler-3.11.219-1.git.1.7e5b9ee.el7.src.rpm
• openshift-ansible-3.11.219-1.git.0.8845382.el7.noarch.rpm
• python2-kuryr-kubernetes-3.11.219-1.git.1.717d59f.el7.noarch.rpm
• atomic-openshift-sdn-ovs-3.11.219-1.git.0.0c21387.el7.x86_64.rpm
• atomic-openshift-node-problem-detector-3.11.219-1.git.1.5ae8753.el7.ppc64le.rpm
• golang-github-openshift-oauth-proxy-3.11.219-1.git.1.076ae14.el7.src.rpm
• openshift-enterprise-cluster-capacity-3.11.219-1.git.1.ca1ee51.el7.ppc64le.rpm
• openshift-ansible-test-3.11.219-1.git.0.8845382.el7.noarch.rpm
• atomic-enterprise-service-catalog-svcat-3.11.219-1.git.1.717017c.el7.x86_64.rpm
• openshift-kuryr-3.11.219-1.git.1.717d59f.el7.src.rpm
• atomic-openshift-hypershift-3.11.219-1.git.0.0c21387.el7.ppc64le.rpm
• atomic-openshift-3.11.219-1.git.0.0c21387.el7.x86_64.rpm
• atomic-openshift-metrics-server-3.11.219-1.git.1.6fe54fb.el7.src.rpm
• atomic-openshift-cluster-autoscaler-3.11.219-1.git.1.1ad3e34.el7.src.rpm
• atomic-openshift-service-idler-3.11.219-1.git.1.958cdae.el7.ppc64le.rpm
• atomic-openshift-descheduler-3.11.219-1.git.1.7e5b9ee.el7.ppc64le.rpm
• prometheus-alertmanager-3.11.219-1.git.1.9a593f8.el7.ppc64le.rpm
• atomic-openshift-master-3.11.219-1.git.0.0c21387.el7.ppc64le.rpm
• atomic-enterprise-service-catalog-3.11.219-1.git.1.717017c.el7.x86_64.rpm
• openshift-kuryr-cni-3.11.219-1.git.1.717d59f.el7.noarch.rpm
• atomic-openshift-template-service-broker-3.11.219-1.git.0.0c21387.el7.ppc64le.rpm
• atomic-openshift-excluder-3.11.219-1.git.0.0c21387.el7.noarch.rpm
• openshift-kuryr-controller-3.11.219-1.git.1.717d59f.el7.noarch.rpm
• prometheus-3.11.219-1.git.1.3f6e657.el7.ppc64le.rpm
• openshift-kuryr-common-3.11.219-1.git.1.717d59f.el7.noarch.rpm
• atomic-enterprise-service-catalog-svcat-3.11.219-1.git.1.717017c.el7.ppc64le.rpm
• prometheus-node-exporter-3.11.219-1.git.1.7fa9674.el7.x86_64.rpm
• golang-github-openshift-oauth-proxy-3.11.219-1.git.1.076ae14.el7.ppc64le.rpm
• atomic-openshift-node-problem-detector-3.11.219-1.git.1.5ae8753.el7.x86_64.rpm
• atomic-openshift-dockerregistry-3.11.219-1.git.1.8323991.el7.x86_64.rpm
• openshift-enterprise-autoheal-3.11.219-1.git.1.c544df9.el7.src.rpm
• openshift-enterprise-autoheal-3.11.219-1.git.1.c544df9.el7.ppc64le.rpm
• atomic-openshift-node-3.11.219-1.git.0.0c21387.el7.x86_64.rpm
• atomic-openshift-master-3.11.219-1.git.0.0c21387.el7.x86_64.rpm
• atomic-openshift-hyperkube-3.11.219-1.git.0.0c21387.el7.x86_64.rpm
• atomic-openshift-pod-3.11.219-1.git.0.0c21387.el7.x86_64.rpm
• atomic-openshift-metrics-server-3.11.219-1.git.1.6fe54fb.el7.ppc64le.rpm
• atomic-openshift-service-idler-3.11.219-1.git.1.958cdae.el7.src.rpm
• openshift-enterprise-cluster-capacity-3.11.219-1.git.1.ca1ee51.el7.src.rpm
• atomic-openshift-docker-excluder-3.11.219-1.git.0.0c21387.el7.noarch.rpm
• atomic-enterprise-service-catalog-3.11.219-1.git.1.717017c.el7.ppc64le.rpm
• openshift-ansible-playbooks-3.11.219-1.git.0.8845382.el7.noarch.rpm
• golang-github-prometheus-prometheus-3.11.219-1.git.1.3f6e657.el7.src.rpm
• atomic-openshift-dockerregistry-3.11.219-1.git.1.8323991.el7.src.rpm
• atomic-openshift-clients-redistributable-3.11.219-1.git.0.0c21387.el7.x86_64.rpm
• atomic-openshift-pod-3.11.219-1.git.0.0c21387.el7.ppc64le.rpm
• openshift-ansible-docs-3.11.219-1.git.0.8845382.el7.noarch.rpm
• atomic-openshift-3.11.219-1.git.0.0c21387.el7.src.rpm
• atomic-openshift-node-problem-detector-3.11.219-1.git.1.5ae8753.el7.src.rpm
• atomic-openshift-tests-3.11.219-1.git.0.0c21387.el7.ppc64le.rpm
• openshift-enterprise-cluster-capacity-3.11.219-1.git.1.ca1ee51.el7.x86_64.rpm
• openshift-enterprise-autoheal-3.11.219-1.git.1.c544df9.el7.x86_64.rpm
• atomic-openshift-hyperkube-3.11.219-1.git.0.0c21387.el7.ppc64le.rpm

Fixes

• This content is not included.BZ - 1633506
• This content is not included.BZ - 1691678
• This content is not included.BZ - 1745898
• This content is not included.BZ - 1772594
• This content is not included.BZ - 1774184
• This content is not included.BZ - 1803090
• This content is not included.BZ - 1803616
• This content is not included.BZ - 1808068
• This content is not included.BZ - 1814722
• This content is not included.BZ - 1814804
• This content is not included.BZ - 1824056
• This content is not included.BZ - 1827744
• This content is not included.BZ - 1829492
• This content is not included.BZ - 1830158
• This content is not included.BZ - 1832379
• This content is not included.BZ - 1838001

CVEs

• CVE-2020-8552

References

(none)

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.