RHBA-2019:2816: OpenShift Container Platform 3.11 bug fix update

First published: Tue Sep 24 2019(Updated: )

Red Hat OpenShift Container Platform is Red Hat's cloud computing<br>Kubernetes application platform solution designed for on-premise or private<br>cloud deployments.<br>This advisory contains the RPM packages for Red Hat OpenShift Container<br>Platform 3.11.146. See the following advisory for the container images for<br>this release:<br><a href="https://access.redhat.com/errata/RHBA-2019:2824" target="_blank">https://access.redhat.com/errata/RHBA-2019:2824</a> This update fixes the following bugs: <br><li> kuryr-controller could not access the OpenShift API LoadBalancer members with OVN if kuryr-controller was running on master nodes. Now, kuryr-controller is forced to be on infrastructure nodes. As a result, kuryr-controller can now access the OpenShift API LoadBalancers. (BZ#1641647)</li> <li> In rare cases, the cluster console would not display a projects list when the user logged in. This was due to a race condition that would cause the project list to fail after logging into the admin console. The user would need to refresh the page to see the list of projects. This race condition has been addressed, and projects now load successfully after logging in. (BZ#1703777)</li> <li> Image tags were not provided for some ose-pod image pulls. As a result, multiple image versions could be pulled from the ose-pod image. Now, image tags have been added to the registry_auth and only a single image version for ose-pod is pulled. (BZ#1725938)</li> <li> Clusters with large numbers of unidled services could see extended wait times applying endpoint changes to cluster IP addresses. Iptables access is now better coordinated and synchronization of firewall rules occurs in less time. (BZ#1734009)</li> <li> Egress IP addresses did not operate correctly in namespaces with restrictive NetworkPolicies. Pods that accepted traffic only from specific sources would not be able to send egress traffic via egress IP addresses because the response from the external server would be mistakenly rejected by their NetworkPolicies. Now, replies from egress traffic are correctly recognized as replies rather than as new connections. (BZ#1741477)</li> <li> Metrics-server-certs did not remove secrets if the server was uninstalled. The metrics serving cert label has been corrected and metrics serving certs are removed completely. (BZ#1746212)</li> <li> Outgoing connections would sometimes be dropped if a minimum kernel version was not installed. A check has been added to ensure that the installed kernel meets the required minimum version to avoid network issues. This check is run during prerequisites, scale-up, and upgrade. (BZ#1749024)</li> <li> Upgrade playbooks were not respecting the openshift_docker_additional_registries variable. The registries.conf has been updated to observe inventory variables that have been set or changes since the last upgrade. (BZ#1749341)</li> All OpenShift Container Platform 3.11 users are advised to upgrade to these<br>updated packages and images.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/references
• agent/title
• agent/severity
• agent/weakness
• agent/type
• agent/event
• agent/description
• agent/remedy
• agent/last-modified-date
• agent/softwarecombine
• agent/first-publish-date
• agent/tags
• collector/redhat-errata
• source/Red Hat
• anchor-id/RHBA-2019:2816
• agent/software-canonical-lookup
• package-manager/redhat