Merge pull request openshift#9325 from ahardin-rh/RN-3-9-27

Update Release Notes for RHBA-2018:1566 - OCP 3.9.27 Bug Fix and Enhancements

Author: ahardin-rh

install_config/aggregate_logging.adoc

@@ -3,10 +3,10 @@
 {product-author}
 {product-version}
 ifdef::openshift-enterprise[]
-:latest-tag: v3.9.14
+:latest-tag: v3.9.27
 endif::[]
 ifdef::openshift-origin[]
-:latest-tag: v3.9.14
+:latest-tag: v3.9.27
 endif::[]
 :data-uri:
 :icons:

install_config/install/disconnected_install.adoc

@@ -2,9 +2,9 @@
 = Disconnected Installation
 {product-author}
 {product-version}
-:latest-tag: v3.9.14
-:latest-int-tag: v3.9.14
-:latest-registry-console-tag: v3.9.14
+:latest-tag: v3.9.27
+:latest-int-tag: v3.9.27
+:latest-registry-console-tag: v3.9.27
 :data-uri:
 :icons:
 :experimental:

release_notes/ocp_3_9_release_notes.adoc

@@ -1597,3 +1597,203 @@ detailed in subsections that follow.
 For any {product-title} release, always review the instructions on
 xref:../upgrading/index.adoc#install-config-upgrading-index[upgrading your cluster] properly.
 ====
+
+[[ocp-3-9-27]]
+=== RHBA-2018:1566 - {product-title} 3.9.27 Bug Fix and Enhancement Update
+
+Issued: 2018-05-16
+
+{product-title} release 3.9.27 is now available. The packages and bug fixes
+included in the update are documented in the
+link:https://access.redhat.com/errata/RHBA-2018:1566[RHBA-2018:1566] advisory.
+The container images included in the update are provided by the
+link:https://access.redhat.com/errata/RHBA-2018:1567[RHBA-2018:1567] advisory.
+
+Space precluded documenting all of the bug fixes and images for this release in
+the advisory. See the following sections for notes on upgrading and details on
+the bug fixes and images included in this release.
+
+[[ocp-3-9-27-upgrading]]
+==== Upgrading
+
+To upgrade an existing {product-title} 3.7 or 3.9 cluster to this latest
+release, use the automated upgrade playbook. See
+xref:../upgrading/automated_upgrades.adoc#running-the-upgrade-playbook-directly[Performing
+Automated In-place Cluster Upgrades] for instructions.
+
+[[ocp-3-9-rhba-2018-1566-bug-fixes]]
+==== Bug Fixes
+
+* Build pods use multiple containers. Binary builds need to specify which
+container to stream content into, and for custom builds the name of the
+container is different from non-custom builds. When streaming binary content
+into a custom build, the expected container, git-clone, does not exist and the
+build fails. The logic for streaming binary content into a custom build pod will
+be changed to reference the correct container name, custom-build. With this bug
+fix, binary content will successfully stream into the custom build container.
+(link:https://bugzilla.redhat.com/show_bug.cgi?id=1560659[*BZ#1560659*])
+
+* Resource constraints can lead to the readiness probe in the example Jenkins
+templates readiness probes citing failure prematurely. Jenkins deployments would
+fail unnecessarily. With this bug fix, the readiness probe was relaxed in the
+templates. As a result, there is a decrease in unnecessary Jenkins deployment
+failures due to the aggressive readiness probe.
+(link:https://bugzilla.redhat.com/show_bug.cgi?id=1559675[*BZ#1559675*])
+
+* The master *_admin.kubeconfig_* file was added to the `oc command` to allow the
+operation to have the proper authorization and access to the necessary
+resources.
+(link:https://bugzilla.redhat.com/show_bug.cgi?id=1561247[*BZ#1561247*])
+
+* The installer improperly tried to set the SELinux context on a path that may not
+exist. This task was meant to work around a problem in CRI-O that no longer
+exists and, as such, that task has been removed.
+(link:https://bugzilla.redhat.com/show_bug.cgi?id=1564949[*BZ#1564949*])
+
+* Service catalog pods had a high log verbosity set by default. Therefore, service
+catalog pods on the master node produced a large amount of log data. The default
+log verbosity is now reset to a lower level.
+(link:https://bugzilla.redhat.com/show_bug.cgi?id=1564179[*BZ#1564179*])
+
+* The Elasticsearch server TLS certificate does not have an external host name in
+the subject alt. name list. Clients accessing Elasticsearch externally cannot
+turn on the MITM server certificate validation. When configuring Elasticsearch
+to allow external access, add the external host name in the subject alt. name
+list. TLS clients can turn on server certificate validation.
+(link:https://bugzilla.redhat.com/show_bug.cgi?id=1554878[*BZ#1554878*])
+
+* The Fluentd plug-in logs the entire error response on failure, which fills up
+the on-disk logs. The entire response is now only logged when in debug mode and
+on-disk logs no logger consume the disk.
+(link:https://bugzilla.redhat.com/show_bug.cgi?id=1554885[*BZ#1554885*])
+
+* The default write operation for Fluentd to Elasticsearch is `index`. Writes can
+trigger unnecessary `delete` operations for Elasticsearch, causing extra load
+that affects performance. Use the `create` operation. Writes to elasticsearch
+will only create records or skip updates if the records are duplicates reducing
+the load on the server.
+(link:https://bugzilla.redhat.com/show_bug.cgi?id=1565909[*BZ#1565909*])
+
+* The curator pod was crash-looping because it was unable to find its entry point
+ script due to a bad merge from origin into downstream dist-git. The pod was not
+ functional and cycled crash-looping. With this bug fix, the code was synced
+ with upstream.
+(link:https://bugzilla.redhat.com/show_bug.cgi?id=1572419[*BZ#1572419*])
+
+* The Fluentd secure-forward plug-in supports the host name placeholder
+`${hostname}` in the configuration file. Although the value is case-sensitive,
+the upper case string `${HOSTNAME}` was set and it failed to pick up the correct
+hostname of the Fluentd container. The bug is now fixed.
+(link:https://bugzilla.redhat.com/show_bug.cgi?id=1553576[*BZ#1553576*])
+
+* After manually typing a URL with non-existing image, page load messaging would
+remain on the page, signaling that the page load is ongoing, even though it is
+done and the *The image stream details could not be loaded* alert is shown. Set
+the `loaded` scope variable when the image is or is not loaded and use it in the
+view to hide the *loading* messaging. After the attempt to load the image data,
+the *loading* messaging is now hidden, even if the image cannot be loaded.
+(link:https://bugzilla.redhat.com/show_bug.cgi?id=1550797[*BZ#1550797*])
+
+* Previously, the web console would not let you add new keys when editing a
+ConfigMap that was empty. Clicking *Add Item* in the editor would have no
+effect. With this bug fix, you can now correctly add items when editing a
+ConfigMap that has none.
+(link:https://bugzilla.redhat.com/show_bug.cgi?id=1558863[*BZ#1558863*])
+
+* Restricting DaemonSet nodes with the project's default node selector resulted in
+the deletion and creation of DaemonSet pods in a loop on those nodes that were
+restricted by adding project default node selector. With this bug fix, the
+upstream DaemonSet logic is now updated to be aware of the project's default
+node selector.
+(link:https://bugzilla.redhat.com/show_bug.cgi?id=1571093[*BZ#1571093*])
+
+* The Hawkular Alerts components has been removed from Hawkular Metrics. This
+change has no functional impact on Hawkular Metrics.
+(link:https://bugzilla.redhat.com/show_bug.cgi?id=1543647[*BZ#1543647*])
+
+* Previously there was incorrect management of OVS flows. If two nodes rebooted
+and swapped IP addresses when they came back up, then other nodes might not be
+able to send traffic to pods on one or both of those nodes. The code that
+manages OVS flows is now more careful to make the correct changes in cases of
+node IP reassignment. Pod-to-pod traffic should continue to work correctly even
+after nodes swap IP addresses.
+(link:https://bugzilla.redhat.com/show_bug.cgi?id=1570394[*BZ#1570394*])
+
+* The update Egress policy needed blocking outgoing traffic, patching OVS flows,
+and then re-enabling traffic. However, the OVS flow generation for DNS names was
+slow. This resulted in a few seconds of Egress traffic downtime, which may not
+be acceptable. With this bug fix, update Egress policy handling is updated to
+pre-populate all new OVS flows before blocking the outgoing traffic. This
+reduces the downtime during Egress policy updates.
+(link:https://bugzilla.redhat.com/show_bug.cgi?id=1571430[*BZ#1571430*])
+
+* When using per-namespace static egress IPs, all external traffic is routed
+through the egress IP. _External_ means all traffic, which is not directed to
+another pod, and so this includes traffic from the pod to the pod's node. When
+pods are told to use the node's IP address for DNS, and the pod is using a
+static egress IP, then DNS traffic will be routed to the egress node first, and
+then back to the original node, which might be configured to not accept DNS
+requests from other hosts, causing the pod to be unable to resolve DNS.
+Pod-to-node DNS requests now bypass the egress IP and go directly to the node
+and DNS works.
+(link:https://bugzilla.redhat.com/show_bug.cgi?id=1570398[*BZ#1570398*])
+
+* This bug fix addresses an issue on the node where setting disabling
+`cpu-cfs-quota` did not prevent CPU CFS limits from being set on pods when
+`cgroups-per-qos` was enabled.
+(link:https://bugzilla.redhat.com/show_bug.cgi?id=1558155[*BZ#1558155*])
+
+* This bug fix addresses an issue where clusters running with OpenStack cloud
+integration have nodes removed when the corresponding instance is stopped. Node
+resources whose instances are stopped are no longer removed from the cluster.
+(link:https://bugzilla.redhat.com/show_bug.cgi?id=1558422[*BZ#1558422*])
+
+* Nodes entered an impaired state when a volume is forcefully detached and not
+rebooted. Any new volume attached to the node is stuck in an attaching state.
+Any node that has a volume stuck in an attaching state for more than 21 minutes
+will be tainted and must be removed from cluster, then added back to remove the
+taint and fix the impaired state of the node. With this bug fix, impaired are
+removed from scheduling, giving the {product-title} administrator the ability to
+fix the node and bring it back.
+(link:https://bugzilla.redhat.com/show_bug.cgi?id=1455680[*BZ#1455680*])
+
+* Previous releases of {product-title} would improperly reconfigure `docker` to
+mark the internal registry as insecure when it should not have. This has been
+fixed in {product-title} 3.9 and should no longer happen.
+(link:https://bugzilla.redhat.com/show_bug.cgi?id=1502028[*BZ#1502028*])
+
+[[ocp-3-9-rhba-2018-1566-enhancements]]
+==== Enhancements
+
+* Use CRI-O as an RPM to use CRI-O as the container runtime. To install CRI-O as
+an RPM, set the following two options:
++
+----
+openshift_use_crio=True
+openshift_crio_use_rpm=True
+----
+(link:https://bugzilla.redhat.com/show_bug.cgi?id=1553186[*BZ#1553186*])
+
+* The yedit module now generates unique backup files. Previously, if changes were
+made to the same resource multiple times, only the latest diff would be saved.
+(link:https://bugzilla.redhat.com/show_bug.cgi?id=1555426[*BZ#1555426*])
+
+* Administrators can now see messages for which we are unable to determine the
+proper namespace to associate with them. Otherwise, messages appear to be
+missing and are not viewable for review. A Kibana Index pattern will be created
+for administrators if it does not exist.
+(link:https://bugzilla.redhat.com/show_bug.cgi?id=1519522[*BZ#1519522*])
+
+* In the absence of inventory values, reuse the values used for the current
+deployment to preserve tuned values. In the case of Elasticsearch, when a user
+had done tuning of the cluster but did not propagate those values into
+variables, upgrading logging would use role default values, which may put the
+cluster in a bad state and lead to loss of log data. Values are now honored in
+order for EFK: inventory -> existing environment -> role defaults.
+(link:https://bugzilla.redhat.com/show_bug.cgi?id=1561196[*BZ#1561196*])
+
+* The number of Kibana index-patterns for cluster administrators is now limited.
+Previously, the list was unmanageable and unneeded on large clusters with many
+namespaces. Cluster administrators now only see a limited subset of
+index-patterns.
+(link:https://bugzilla.redhat.com/show_bug.cgi?id=1563230[*BZ#1563230*])

upgrading/automated_upgrades.adoc

@@ -2,8 +2,8 @@
 = Performing Automated In-place Cluster Upgrades
 {product-author}
 {product-version}
-:latest-tag: v3.9.14
-:latest-int-tag: v3.9.14
+:latest-tag: v3.9.27
+:latest-int-tag: v3.9.27
 :data-uri:
 :icons:
 :experimental:

upgrading/manual_upgrades.adoc

@@ -2,8 +2,8 @@
 = Performing Manual In-place Cluster Upgrades
 {product-author}
 {product-version}
-:latest-tag: v3.9.14
-:latest-int-tag: v3.9.14
+:latest-tag: v3.9.27
+:latest-int-tag: v3.9.27
 :data-uri:
 :icons:
 :experimental: