RHSA-2021:3262: Important: OpenShift Container Platform 4.7.28 security update

Red Hat OpenShift Container Platform is Red Hat's cloud computingKubernetes application platform solution designed for on-premise or privatecloud deployments.This advisory contains the container images for Red Hat OpenShift ContainerPlatform 4.7.28. See the following advisory for the RPM packages for thisrelease:https://access.redhat.com/errata/RHBA-2021:3263 Space precludes documenting all of the container images in this advisory.See the following Release Notes documentation for details about thesechanges:https://docs.openshift.com/container-platform/4.7/releasenotes/ocp-4-7-rel ease-notes.htmlSecurity Fix(es): gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation (CVE-2021-3121)For more details about the security issue(s), including the impact, a CVSSscore, acknowledgments, and other related information, refer to the CVEpage(s) listed in the References section.Bug Fix(es): Machine Config Operator degrades during cluster update with failed to convert Ignition config spec v2 to v3 (BZ#1956462) OCP IPI Publish Internal - GCP: Load Balancer service with External Traffic Policy as Local is not working (BZ#1971669) [4.7] Unable to attach Vsphere volume shows the error "failed to get canonical path" (BZ#1973766) oc logs doesn't work with piepeline builds (BZ#1974264) "provisioned registration errors" cannot be reported (BZ#1976924) AWS Elastic IP permissions are incorrectly required (BZ#1981553) Memory consumption (containermemoryrss) steadily growing for /system.slice/kubelet.service when FIPS enabled [ocp 4.7] (BZ#1981580) Problematic Deployment creates infinite number Replicasets causing etcd to reach quota limit (BZ#1981775) Size of the hostname was preventing proper DNS resolution of the worker node names (BZ#1983695) (release-4.7) Insights status card shows nothing when 0 issues found (BZ#1986724) drop-icmp pod blocks direct SSH access to cluster nodes (BZ#1988426) Editing a Deployment drops annotations (BZ#1989642) [Kuryr][4.7] Duplicated egress rule for service network in knp object (BZ#1990175) Update failed - ovn-nbctl: duplicate nexthop for the same ECMP route (BZ#1991445) Unable to install a zVM hosted OCP 4.7.24 on Z Cluster based on new RHCOS 47 RHEL 8.4 based build (BZ#1992240) alerts: SystemMemoryExceedsReservation triggers too quickly (BZ#1992687) failed to start cri-o service due to /usr/libexec/crio/conmon is missing (BZ#1993386) Thanos build failure: vendor/ ignored (BZ#1994123) Ipv6 IP addresses are not accepted for whitelisting (BZ#1994645) upgrade from 4.6 to 4.7 to 4.8 with mcp worker "paused=true", crio report "panic: close of closed channel" which lead to a master Node go intoRestart loop (BZ#1994729) linuxptp-daemon crash on 4.8 (BZ#1995579) long living clusters may fail to upgrade because of an invalid conmon path (BZ#1995810)For more details about the security issue(s), refer to the CVEpage(s) listed in the References section.You may download the oc tool and use it to inspect release image metadataas follows:(For x8664 architecture)$ oc adm release infoquay.io/openshift-release-dev/ocp-release:4.7.28-x8664The image digest issha256:b3f38d58057a12b0477bf28971390db3e3391ce1af8ac06e35d0aa9e8d8e5966(For s390x architecture)$ oc adm release infoquay.io/openshift-release-dev/ocp-release:4.7.28-s390xThe image digest issha256:30c2011f6d84b16960b981a07558f96a55e59a281449d25c5ccc778aaeb2f970(For ppc64le architecture)$ oc adm release infoquay.io/openshift-release-dev/ocp-release:4.7.28-ppc64leThe image digest issha256:52ebf0db5a36434357c24a64863025730d2159a94997333f15fbe1444fa88f4fInstructions for upgrading a cluster are availableathttps://docs.openshift.com/container-platform/4.7/updating/updating-cluster between-minor.html#understanding-upgrade-channelsupdating-cluster-between minor