OpenShift Container Platform 4.7 release notes

GA: General Availability

DEP: Deprecated

REM: Removed

Previously, the openshift-service-ca namespace was labeled with openshift.io/run-level: 1, which caused the pods in this namespace to run with extra privileges. This label has been removed, and now the pods in this namespace run with the appropriate privileges. (BZ#1806915)

Previously, the openshift-service-ca-operator namespace was labeled with openshift.io/run-level: 1, which caused the pods in this namespace to run with extra privileges. This label has been removed for new installations, and now the pods in this namespace run with the appropriate privileges. For upgraded clusters, you can remove this label manually and restart the affected pods. (BZ#1806917)

Previously, the configuration to scrape the OAuth API server pods in the openshift-oauth-apiserver namespace was missing, and metrics for the OAuth API server pods could not be queried in Prometheus. The missing configuration has been added, and OAuth API server metrics are now available in Prometheus. (BZ#1887428)

Previously, a missed condition in the Cluster Authentication Operator code caused its log to be flooded with messages about updates to a deployment that did not occur. The logic for deciding whether to update the Operator status was updated and the Cluster Authentication Operator log no longer receives messages for a deployment update that did not occur. (BZ#1891758)

Previously, the Cluster Authentication Operator only watched configuration resources named cluster, which caused the Operator to ignore changes in ingress configuration, which was named default. This led to incorrectly assuming that there were no schedulable worker nodes when ingress was configured with a custom node selector. The Cluster Authentication Operator now watches all resources regardless of their name, and the Operator now properly observes ingress configuration changes and reconciles worker node availability. (BZ#1893386)

Previously on some systems, the installer would communicate with Ironic before it was ready and fail. This is now prevented. (BZ#1902653)

Previously, when using virtual media on a Dell system, if the virtual media was already attached before the deployment commenced it would fail. Ironic now retries if this occurs. (BZ#1910739)

Previously, master nodes were losing their IPv6 link-local address on the provisioning interface preventing provisioning from working with IPv6. A workaround has been added to toggle addr_gen_mode to prevent this from occurring. (BZ#1909682)

Previously the cluster-baremetal-operator used the incorrect logging library. This issue resulted in command line arguments not being consistent with other Operators and not all Kubernetes library logs were getting logged. Switching the logging library has fixed this issue. (BZ#1906143)

When using IPv6 on an interface, after a certain amount of time Network Manager removes the link-local IPv6 address. This issue led to PXE boot failures occurring for nodes after the IPv6 link-local address is removed. A workaround has been added to toggle the interface IPv6 addr_gen_mode which will cause the link-local address to be added back. (BZ#1901040)

Previously Supermicro nodes boot to PXE upon reboot after successful deployment to disk. This issue is now fixed by always setting BootSourceOverrideEnabled when setting BootSourceOverrideTarget. Supermicro nodes now boot to disk persistently after deployment. (BZ#1918558)

Service agent images shipped with baremetal IPI can now run on systems with UEFI secure boot enabled. Since network boot is not compatible with secure boot, using virtual media is required in this case. (BZ#1893648)

Node auto-discovery is no longer enabled in baremetal IPI. It was not handled correctly and caused duplicate bare metal hosts registration. (BZ#1898517)

Previously, the syslinux-nonlinux package was not included with bare metal provisioning images. As a result, virtual media installations on machines that used BIOS boot mode failed. The package is now included in the image. (BZ#1862608)

Previously, certain Dell firmware versions reported the Redfish PowerState inaccurately. Updating Dell iDRAC firmware to version 4.22.00.53 resolves the issue. (BZ#1873305)

Previously, Redfish was not present in the list of interfaces that can get and set BIOS configuration values. As a result, Redfish could not be used in BIOS configuration. Redfish is now included in the list, and it can be used in BIOS configuration. (BZ#1877105)

Previously, the Redfish interface that is used to set BIOS configurations was not implemented properly. As a result, Dell iDRACs could not set BIOS configuration values. The implementation error was corrected. Now, the Redfish interface can set BIOS configurations.(BZ#1877924)

Previously, differences in how Supermicro handles boot device settings through IPMI caused Supermicro nodes that use IPMI and UEFI to fail after an image was written to disk. Supermicro nodes are now passed an appropriate IPMI code to boot from disk. As a result, Supermicro nodes boot from disk correctly after deployment. (BZ#1885308)

Bare metal installations on installer-provisioned infrastructure no longer silently skip writing an image when invalid root device hints are provided. (BZ#1886327)

Previously, incomplete boot mode information for Supermicro nodes caused deployment by using Redfish to fail. That boot mode information is now included. As a result, Supermicro nodes can be deployed using Redfish. (BZ#1888072)

The Ironic API service that is embedded in bare-metal installer-provisioned infrastructure now uses four workers instead of eight workers. As a result, RAM usage is reduced. (BZ#1894146)

Previously, Dockerfile builds could not change permissions of the /etc/pki/ca-trust directory or create files inside it. This issue was caused by fixing BZ#1826183 in version 4.6, which added support for HTTPS proxies with CAs for builds and always mounted /etc/pki/ca-trust, which prevented builds that included their own CAs or modified the system trust store from working correctly at runtime. The current release fixes this issue by reverting Bug 1826183. Now, builder images that include their own CAs work again. (BZ#1891759)

Previously, after upgrading from OpenShift Container Platform version 4.5 to version 4.6, running git clone from a private repository failed because builds did not add proxy information to the Git configuration that was used to pull the source code. As a result, the source code could not be pulled if the cluster used a global proxy and the source was pulled from a private Git repository. Now, Git is configured correctly when the cluster uses a global proxy and the git clone command can pull source code from a private Git repository if the cluster uses a global proxy. (BZ#1896446)

Previously, the node pull secret feature did not work. Node pull secrets were not used if forcePull: true was set in the Source and Docker strategy builds. As a result, builds failed to pull images that required the cluster-wide pull secret. Now, node pull secrets are always merged with user-provided pull secrets. As a result, builds can pull images when forcePull: true is set, and the source registry requires the cluster-wide pull secret. (BZ#1883803)

Previously, OpenShift Container Platform builds failed on git clone when SCP-style SSH locations were specified because of Golang URL parsing, which does not accommodate Git SCP-styled SSH locations. As a result, OpenShift Container Platform builds and Source-to-Image (S2I) failed when those types of source URLs were supplied. Now, builds and S2I bypass Golang URL parsing and strip the ssh:// prefix to accommodate Git SCP-styled SSH locations (BZ#1884270)

Previously, build errors caused by invalid build pull secrets, whose auth keys were not base64-encoded, did not propagate through the build stack. As a result, determining the root cause of these errors was difficult. The current release fixes this issue, so these types of build errors propagate through the build stack. Now, determining the root cause of invalid build pull secret keys is easier for users. (BZ#1918879)

Previously, the Machine API did not provide feedback to users when their credentials secret was invalid, thus making it difficult to diagnose when there were issues with the cloud provider credentials. Users are now warned if there is an issue with their credentials when creating or updating machine sets, for example if the credential secret does not exist or is in the wrong format. (BZ#1805639)

Previously, the bare metal actuator deleted the underlying host by also deleting the Machine object, which is not the intended operation of the machine controller. This update sets the InsufficientResourcesMachineError error reason on machines when the search for a host is unsuccessful, and thus ensures that machines without a host are scaled down first. Machines are moved into the Failed phase if the host is deprovisioned. Now, a machine health check deletes failed machines and the Machine object is no longer automatically deleted. (BZ#1868104)

Previously, when a machine entered a Failed state, the state of the cloud provider no longer reconciled. Thus, the machine status reported the cloud VM state as Running after it was possible to remove the VM. The machine status now more accurately reflects the observed state of the cloud VM as Unknown if the machine is in a Failed state. (BZ#1875598)

Previously, several Machine API custom resource definitions contained broken links in the template schema description to corresponding reference documents. The links were updated to the correct upstream locations and are no longer broken. (BZ#1876469)

Previously, the command oc explain Provisioning did not return the custom resource definition (CRD) description because an older version of the CRD definition was in use. The CRD version was updated, thus oc explain for the Provisioning CRD now returns the expected information. (BZ#1880787)

Previously, when a user created or updated machines with a disk size less than the recommended minimum size, the machines failed to boot without warning when the disk size was too low. The disk size must be greater than the initial image size. The user is now notified with a warning that the disk size is low and that this might cause their machine or machine set to not start. (BZ#1882723)

Previously, the state of a machine did not persist across reconciliation, thus the Machine object instance-state annotation and providerStatus.instanceState occasionally showed different values. Now, the machine state is replicated on the reconciled machine, and the instance-state annotation is consistent with the providerStatus.instanceState value. (BZ#1886848)

Previously, machine sets running on Microsoft Azure in a disconnected environment failed to boot and scale if the publicIP option was set to true in the MachineSet resource object. Now, to prevent machines from failing, users cannot create machine sets in disconnected environments with this invalid publicIP configuration. (BZ#1889620)

Previously when creating a machine, only certain errors caused the mapi_instance_create_failed failure metric to update. Now, any error that occurs for machine creation appropriately increments the mapi_instance_create_failed metric. (BZ#1890456)

Previously, the cluster autoscaler used a template node for node scaling decisions in certain circumstances. Occasionally, the nodeAffinity predicate failed to scale up as intended, and pending pods could not be scheduled. With this update, the template node includes as many labels as possible to ensure that the cluster autoscaler can scale up and pass node affinity checks. (BZ#1891551)

Previously, the machine set default delete priority, which is random, did not prioritize nodes in the Ready state over nodes that were still building. As a result, especially when scaling a large number of machines, all nodes in the Ready state could potentially be deleted when scaling up a machine set and then immediately scaling down. This could also result in the cluster becoming unavailable. Now, a lower priority is assigned to machines that are not yet Ready. Thus, a large scale up of machines followed immediately by a scale down deletes machines that are still building before deleting machines that are running workloads. (BZ#1903733)

Previously, a message in the installation and upgrade processes showed that the current process was 100% complete before it completed. This incorrect message was due to a rounding error. Now, the percentage is no longer rounded up, and the message shows both the number of finished subprocesses and an accurate percent compelte value. (BZ#1768255)

Previously, the Cluster Version Operator (CVO) compared the pullspecs with the exact available-update and current-target values when it merged Cincinnati metadata like channel membership and errata URI. As a result, if you installed from or updated to mirrored release images that used valid alternative pullspecs, you did not receive Cincinnati metadata. Now, the CVO compares releases by digest and correctly associates Cincinnati metadata such as channel membership, regardless of which registry hosts the image. (BZ#1879976)

Previously, a race condition with the metrics-serving goroutine sometimes caused the CVO become stuck on shutdown. As a result, CVO behavior like managed-object reconciliation and monitoring was not possible, and updates and installs might freeze. Now, the CVO times out after a few minutes, abandons any stuck metrics goroutines, and shuts down as intended. (BZ#1891143)

Previously, some CVO log error messages did not render the variable for the type of changes that they were detecting correctly. Now, the variable is rendered correctly, and the error messages display as intended. (BZ#1921277)

Previously, performing the end-to-end tests for platform validation results in an error for the SCTP validation step when a machine config does not include a config specification. This bug fix skips the SCTP test when the config specification is not found. (BZ#1889275)

Previously, when the Performance Addon Operator ran the hugepages test on a host with two or more NUMA nodes and the performance profile requested huge pages distributed across the nodes, the test failed. This bug fix corrects how the hugepages test determines the number of huge pages for a NUMA node. (BZ#1889633)

Previously, the deprecated status.platformStatus field was not being populated during upgrade, in clusters upgraded since OpenShift Container Platform 4.1. As a consequence, the upgrade could fail. This fix modified the Cluster Config Operator to populate this field. As a result, the upgrade does not fail because of this field not being populated. (BZ#1890038)

Previously, the storage class was not propagating to the VM disk list from persistent volume claims for the DataVolume source. The storage class is now visible in the VM disk list of the web console. (BZ#1853352)

Previously, imported SR-IOV networks could be set to different network interface types. With this fix, imported SR-IOV networks are now set only to the SR-IOV network interface type. (BZ#1862918)

Previously, if a VM name was reused in the cluster, VM events displayed in the events screen were not correctly filtered and contained events mixed together from both VMs. Now, events are filtered properly and the events screen displays only the events belonging to the current VM. (BZ#1878701)

Previously, the V2VVMWare and OvirtProvider objects created by the VM Import wizard were not cleaned up properly. Now, the V2VVMWare and OvirtProvider objects are removed as expected. (BZ#1881347)

Previously, utilization data was not displayed for a Virtual Machine Interface (VMI) that did not have an associated VM. Now, if utilization data is available for a VMI, it is displayed. (BZ#1884654)

Previously, when a PVC was cloned, its VM state was reported as pending, but additional information was not displayed. Now, when a PVC is cloned, the VM state is reported as importing along with a progress bar and additional info which contains a link to the pod or PVC. (BZ#1885138)

Previously, the VM import status displayed an incorrect VM import provider. Now, the VM import status displays the correct VM import provider. (BZ#1886977)

Previously, the default pod network interface type was to set to the wrong value. Now, the default pod network interface type is set to masquerade. (BZ#1887797)

Previously, when the Local Storage Operator (LSO) was installed, the disks on a node were not displayed and there was no way to initiate a discovery of the disks on that node. Now, when the LSO is installed, the Disk tab is enabled and a Discover Disks option is available if a discovery is not already running. (BZ#1889724)

With this update, the Disk Mode option has been renamed Volume Mode. (BZ#1920367)

Previously, the user was denied access to pull images from other projects, due to insufficient user permissions. This bug fix removes all the user interface checks for role bindings and shows the oc command alert to help users use the command line. With this bug fix, the user is no longer blocked from creating images from different namespaces and is now able to deploy images from their other projects. (BZ#1894020)

The console used a prior version of the KafkaSource object that used the resources and service account fields in their specification. The latest v1beta1 version of the KafkaSource object removed these fields, due to which the user was unable to create the KafkaSource object with the v1beta1 version. This issue has been fixed now and the user is able to create the KafkaSource object with the v1beta1 version. (BZ#1892653)

Previously, when you created an application using source code from Git repositories with the .git suffix, and then clicked the edit source code link, a page not found error was displayed. This fix removes the .git suffix from the repository URL and transforms the SSH URL to an HTTPS URL. The generated link now leads to the correct repository page. (BZ#1896296)

Previously, the underlying SinkBinding resources were shown in the Topology view, along with the actual source created in the case of Container Source and KameletBinding resources, confusing users. This issue was fixed. Now, only the actual resource created for the event source is displayed in the Topology view, and the underlying SinkBinding resources, if created, are displayed in the sidebar. (BZ#1906685)

Previously, when you installed the Serverless Operator, without creating the eventing custom resource, a channel card was displayed. When you clicked the card, a confusing alert message was displayed. This issue has now been fixed. The channel card, with a proper alert message, is now displayed only if the channel custom resource definition is present. (BZ#1909092)

Previously, when you closed the web terminal connection, all the terminal output from that session disappeared. This issue has been fixed. The terminal output is now retained even after the session is closed. (BZ#1909067)

Technology preview badges were displayed on the Eventing user interface although it had its GA release with OpenShift Container Platform 4.6. The Technology preview badges are now removed and the changes were back-ported to the OpenShift Container Platform 4.6.9 version. (BZ#1894810)

Previously, volume mounts for deployments were not preserved if the deployment was edited using the console edit flows. The modified deployment YAML overwrote or removed the volume mounts in the pod template specification. This issue has been fixed. The volume mounts are now preserved even when the deployment is edited using the console edit flows. (BZ#1867965)

In case of multiple triggers, one subscribing to Knative service and another to In Memory Channel as subscriber, the Knative resources were not displayed on the Topology view. This issue has been fixed now, so that the Knative data model returns proper data, and the Knative resources are displayed on the Topology view. (BZ#1906683)

Previously, in a disconnected environment, the helm charts were not displayed in the Developer Catalog due to an invalid configuration while fetching code. This issue has been fixed by ensuring that proxy environment variables are considered and the helm charts are now displayed on the Developer Catalog. (BZ#1918748)

While running a Pipeline, the log tab of the TaskRun resource displayed the string as undefined after the command in the output. This was caused due to some edge cases where some internal string operations printed undefined to the log output. This issue has been fixed now, and the pipeline log output does not drop empty lines from the log stream and does not print the string undefined any longer. (BZ#1915898)

Previously, the Port list in the Add flow only provided options for exposed ports and did not allow you to specify a custom port. The list has now been replaced by a typeahead select menu, and now it is possible to specify a custom port while creating the application. (BZ#1881881)

Previously, when conditional tasks failed, the completed pipeline runs showed a permanent pending task for each failed conditional task. This issue has been fixed by disabling the failed conditional tasks and by adding skipped icons to them. This gives a better picture of the state of the pipeline run. (BZ#1880389)

Previously, the pod scale up or down buttons were available for a single pod resource, and the page crashed when the user pressed the scale button. This issue has been fixed by not showing the scale up or down buttons for a single pod resource. (BZ#1909678)

Previously, the chart URL for downloading the chart to instantiate a helm release was unreachable. This happened because the index.yaml file from the remote repository, referenced in the helm chart repository, was fetched and used as is. Some of these index files contained relative chart URLs. This issue has now been fixed by translating relative chart URLs to absolute URLs, which makes the chart URL reachable. (BZ#1912907)

With Serverless 0.10, the latest supported versions were updated for trigger, subscription, channel, and IMC. Static models corresponding to each showed an API version of beta. The API version for eventing resources is now updated to v1 and the UI now shows the latest supported version. (BZ#1890104)

Previously, when the user switched between workloads on the Monitoring Dashboard tab, for example, from a specific deployment to All workloads, the dashboard displayed a white canvas and no chart. This issue has been fixed; the dashboard now displays charts when the user switches between workloads. (BZ#1911129)

Previously, monitoring alerts with severity levels such as critical and warning were treated as info level alerts. As a result, the Monitoring Alert icon was not displayed on the workload in the Topology view for these alerts. This issue is now fixed; alerts like critical are treated as warning level alerts and a Monitoring Alert icon is displayed. (BZ#1925200)

Previously, in the YAML view of the helm installation form only the YAML code was shown. Now a Schema viewer is added in the YAML editor to show the schema and its description. (BZ#1886861)

Previously, all Pods were failing with the ErrImagePull and ImagePullBackOff errors, even after an Image Pull Secret was added to access the external private image container registry. This is because the image download failed as it had no permissions for the external image registry and the cluster tried to load the container image directly from the external URL without the provided secret. As a result, the deployment was stuck until the service account or deployment was updated manually. Now, the issue is fixed and new deployments can start pods from the internal private container registry and import a container image from an external private container registry without any additional changes to the service account or deployment. (BZ#1924955)

While creating a sample application, the Developer perspective creates multiple resources that depend on each other and must be completed in a specific order. Previously, the admission plug-in sometimes could not check one of these resources, preventing the Developer perspective from generating the sample application. This issue has been fixed. The code creates the resources in the required order, so creating a sample application is more stable. (BZ#1933665)

Previously, the API server sometimes failed to create a resource and returned a 409 conflict response status code due to a conflict while updating a resource quota resource. This issue has been fixed. Now, if it receives a 409 status code, the OpenShift web console retries the request up to three times. If it continues to receive the 409 status code, the console displays an error message. (BZ#1928228)

Previously, when the user navigated to the Topology view, an error occurred if there were no templates on the openshift namespace. If this error occurred, a blank page would display. This issue has been fixed by handling the edge case with respect to the templates not being present in the openshift namespace. The user can now navigate to the Topology view and it loads as expected. (BZ#1952293)

Technology preview badges were displayed on the OpenShift Pipelines workflows in the web console, though OpenShift Pipelines was GA. The Technology preview badges are now removed. (BZ#1945153)

Previously, pipelines created in the Git import flow for private repositories failed to run. This happened because the pipeline ServiceAccount object did not use secrets created by the Git import flow for private Git repositories. With this update, you can add a secret name to the annotations of the pipeline ServiceAccount object, and add pipeline-specific annotations to the provided secret. As a result, pipelines for private Git repositories run successfully. (BZ#1970485)

Previously, the Start Pipeline modal did not recognize an empty string as a valid entry, so you had to enter a value. This happened even though the OpenShift Pipelines Operator recognizes empty strings as a valid parameter default. With this update, you have the option to enter an empty string. (BZ#1966275)

Previously, annotations were passed to the specification of Knative services along with metadata. As a result, decorators were shown for associated revisions of Knative services in the topology. The current release fixes this issue by passing annotations only to the Knative service metadata. Now, decorators are shown only for Knative services in the topology and not for associated revisions. (BZ#1954962)

Previously, users were not able to create a Knative service as a private service from the Developer perspective. This issue has now been fixed, by updating the label 'networking.knative.dev/visibility': 'cluster-local'. (BZ#1970796)

Previously, a cluster might experience intermittent DNS resolution errors because the /etc/hosts file on some nodes included invalid entries. With this release, DNS resolution no longer fails because of an /etc/hosts file with invalid entries. (BZ#1882485)

Previously, the etcd readiness probe used lsof and grep commands, which could leave defunct processes. The etcd readiness probe now uses a TCP port probe, which is less expensive and does not create defunct processes. (BZ#1844727)

Previously, when an IP address was changed on a control plane node, which causes the certificates on disk to be invalid, the etcd error messages were not clear why etcd was failing to connect with peers. An IP address change on a control plane node is now detected, an event is reported, and EtcdCertSignerController is marked as Degraded. (BZ#1882176)

Previously, new static pod revisions could occur when the etcd cluster had less than three members, which caused temporary quorum loss. Static pod revisions are now avoided when all control plane nodes are not available, and these temporary quorum losses are avoided. (BZ#1892288)

Previously, etcd backups included a recovery YAML file that was specific to the control plane node where the backup was taken from, so backups taken from one control plane node could not be restored on another control plane node. The recovery YAML file is now more generic so that the etcd backup can be restored on any control plane node. (BZ#1895509)

Previously, the etcd backup script used the last modified timestamp to determine the latest revision, which caused the incorrect static pod resources to be stored in the etcd backup. The etcd backup script now uses the manifest file to determine the latest revision, and the correct static pod resources are now stored in the etcd backup. (BZ#1898954)

Previously, the bootstrap rendering logic failed to detect a usable machine network CIDR when using IPv6 dual stack mode unless the IPv4 CIDR was the first element in the install-config machine network CIDR array. The parsing logic was fixed to loop through all machine network CIDRs, so the IPv4 address is now correctly loaded among the machine network CIDRs in dual stack mode. (BZ#1907872)

Previously, if the openshift-etcd namespace was deleted, the etcd-endpoints config map was not recreated, and the cluster would not recover. The etcd-endpoints config map is now recreated if it is missing, allowing the cluster to recover. (BZ#1916853)

The last Kubernetes update enforced a timeout on APIs. This timeout results in every long standing request being dropped after 34 seconds. When importing large repositories, specifically ones with several tags, the timeout is reached, not allowing the import to succeed as in previous versions. There is a flag to set a different timeout on oc client but there was not an example provided, making it difficult for the client to understand how to bypass the API timeout. Providing an example of the flag usage on oc help made things clear for the client, now it is easier to find this option. (BZ#1878022)

Previously, using two distinct versions of the same logging package resulted in Operator logs being partially lost. This fix makes logging package versions equal, which means the upgraded logging package used by the Operator matches the one used by client-go. Now, logs are not lost. (BZ#1883502)

Previously the pruner was trying to detect the registry name using image streams, but when there were no image streams the pruner failed to detect the registry name. With this fix, the Image Registry Operator provides the pruner with the registry name. Now, the pruner does not depend on the existence of image streams to detect the registry name. (BZ#1887010)

Previously the Operator pod did not have memory requests, which in case of memory pressure on the node, the Operator could be killed because it was out of memory before other BestEffort containers. This fix added memory requests. Now, the Operator is not killed when it is out of memory if there are other BestEffort containers on the node. (BZ#1888118)

Previously the pruner was trying to detect the registry name using image streams, but when there were no image streams the pruner failed to detect the registry name. With this fix, the Image Registry Operator provides the pruner with the registry name if the registry is configured or disables registry pruning if the registry is not installed. (BZ#1888494)

Previously, there was a lack of analysis on Operand deployment status when defining the Operator status. This meant that in some scenarios the Image Registry Operator was presenting itself with two contradicting pieces of information. It was informing the user that it was not Available and at the same time not Degraded. These two conditions were still being presented even after the deployment stopped trying to get the image registry up and running. In this scenario the Degraded flag should be set by the Operator. By taking image registry deployment into account, the Operator now sets itself to Degraded if the Operand deployment reaches its progress deadline when trying to get the application running. Now, when the Deployment fails, after the progress deadline has been reached, the Operator sets itself to Degraded. The Operator still reports itself as Progressing while the Operator deployment is progressing. (BZ#1889921)

Previously the Image Registry Operator did not use its entrypoint because an explicit command was provided. So a cluster-wide trusted-ca was not used by the Operator and the Operator could not connect to storage providers that do not work without custom trusted-ca. This fix removed the explicit command from the pod spec. Now, the image entrypoint is used by the container that applies trusted-ca. (BZ#1892799)

Previously the default log level for the pruner was 2. So when an error happened, the pruner was dumping stack trace. This fix changed the default log level to 1. Now, only the error message is printed without stack traces. (BZ#1894677)

Previously the configs.imageregistry.operator.openshift.io status field did not update during the Operator sync, which meant the status field was not presenting the most up to date applied swift configuration. With this fix, the sync process updates the configs.imageregistry.operator.openshift.io status to the spec values. The spec and status fields are in sync with the status field, presenting the applied configuration. BZ#1907202)

Previously a lack of retries on a HTTP/2 protocol caused a related retryable error, which in turn caused mirroring to be cancelled with an error message. This fix added a retry when the error message corresponds to the HTTP/2 protocol related error. Now, for these errors, the mirror operation is cancelled after attempting multiple times. (BZ#1907421)

Previously the absence of explicit user and group IDs on the node-ca daemon set confused the interpretation of what user and group were in use in the node-ca pods. This fix explicitly provides the node-ca daemon set with runAsUser and runAsGroup configuration. Now, there is a clear definition of user and group when inspecting the node-ca DaemonSet YAML file. (BZ#1914407)

Previously, the image pruner did not account for images that were used by StatefulSet, Job, and Cronjob objects when it gathered lists of images that were in use. As a result, the wrong images could be pruned. The image pruner now accounts for images in use by these objects when it creates image lists. Images that are in use by these objects are no longer pruned. (BZ#1880068)

Previously, newly created image streams were not decorated with publicDockerImageRepository values. Watchers did not receive publicDockerImageRepository values for new objects. Image streams are now decorated with the correct values. As a result, watchers get image streams with publicDockerImageRepository values. (BZ#1912590)

Previously, due to incorrect error handling, the Operator would end its process ambiguously when a file that it observed changed. Error handling for the Operator is improved. Now, the Operator continues to run and no longer sends an ending process signal when an observed file changes. (BZ#1884221)

Previously, the Operator did not use the namespace of a resource while archiving reports. As a result, resources that had identical names in different namespaces were overwritten. The Operator now uses report paths in combination with namespaces while archiving data. As a result, all reports are collected for each namespace. (BZ#1886462)

Previously when virtual-media was used, fast-track mode would not work as expected as nodes were rebooted between operations. This issue is now fixed. (BZ#1893546)

Previously when using dual stack deployments, worker node host names did not match the name inspected before deployment causing nodes to need manual approval. This is now fixed. (BZ#1895909)

Bare metal provisioning now does not fail if there is a small, up to one hour, clock skew between the control plane and a host being deployed. (BZ#1906448)

When upper case letters were included in the vCenter host name, the OpenShift Container Platform installation program for VMware vSphere waited a long time for the cluster to complete before finally failing. The installation program now validates that the vCenter host name does not contain upper case letters early in the installation process, avoiding long wait times. (BZ#1874248)

Previously, the internal Terraform backend for the OpenShift Container Platform installation program did not support large inputs from Terraform core to the Terraform provider, like Amazon Web Services (AWS). When the bootstrap.ign file was passed to the AWS provider as a string, the input limit could be exceeded, causing the installation program to fail when creating a bootstrap Ignition S3 bucket. This bug fix modifies the Terraform backend to pass the bootstrap.ign as a path on disk, allowing the AWS provider to read the large file by circumventing the input size limit. Now, the installation program succeeds when performing a Calico installation that creates the bootstrap Ignition file larger than the input limits. (BZ#1877116)

Previously, pre-flight installer validation for Red Hat OpenStack Platform (RHOSP) was performed on the flavor metadata. This could prevent installations to flavors detected as baremetal, which might have the required capacity to complete the installation. This is usually caused by RHOSP administrators not setting the appropriate metadata on their bare metal flavors. Validations are now skipped on flavors detected as baremetal, to prevent incorrect failures from being reported. (BZ#1878900)

Previously, the installation program did not allow the Manual credentials mode for clusters being installed to GCP and Azure. Because of this, users could not install their clusters to GCP or Azure using manual credentials. The installation program can now validate manual credentials provided for GCP and Azure. (BZ#1884691)

Previously, the installation program could not verify that a resource group existed before destroying a cluster installed to Azure. This caused the installation program to continuously loop with errors. The installation program now verifies the resource group exists before destroying a cluster, allowing the cluster to be destroyed successfully. (BZ#1888378)

Previously, the installation program did not check to ensure AWS accounts had UnTagResources permissions when creating a cluster with shared resources. Because of this, when destroying a cluster, the installation program did not have permission to delete tags added to the pre-existing network. This bug fix adds a permission check for UnTagResources when creating cluster with shared network resources to make sure the account has proper permissions before finishing the installation process. (BZ#1888464)

For the openshift-install destroy cluster command to work properly, the cluster objects the installation program initially created must be removed. In some instances, the hosted zone object is already removed, causing the installation program to hang. The installation program now skips the removal of the object if the object has already been removed, allowing the cluster to successfully be destroyed. (BZ#1890228)

Previously, the control plane ports on Red Hat OpenStack Platform (RHOSP) were not assigned the additional user-defined security groups. This caused the additional user-defined security group rules to not be applied properly to control plane nodes. The additional user-defined security groups are now assigned to the control plane ports, allowing the security group rules to correctly apply to the control plane nodes. (BZ#1899853)

Previously, rules on the default AWS security group that sourced another security group prevented the installation program from deleting that other security group when destroying the cluster. This caused the cluster destroy process to never complete and left AWS resources remaining. The rules from the default security group are now deleted, unblocking the deletion of other security groups. This allows all AWS resources to be deleted from the cluster. (BZ#1903277)

A missing guard in Red Hat OpenStack Platform (RHOSP) validations could fetch the list of subnets with an empty subnet ID, and cause some non-RHOSP clouds to return unexpected values. The unexpected error code would fail validation and prevent OpenShift Container Platform from installing on these non-RHOSP clouds. This bug fix adds the missing guard against the empty subnet ID, allowing for proper validations. (BZ#1906517)

Previously, the reference load balancer for a user-provisioned infrastructure installation on VMware vSphere was configured for a simple TCP check, and the health checks did not consider the health of the api server. This configuration sometimes led to failed API requests whenever the API server restarted. Now, the health checks now verify API server health against the /readyz endpoint, and the reference API load balancer now handles requests during API server restarts gracefully. (BZ#1836017)

Previously, when you pressed CTRL+C while using the installation program, the program was not always interrupted and did not always exit as expected. Now, when you press CTRL+C while using the installation program, the program always interrupts and exits. BZ#1855351)

Previously, if you attempted to delete a cluster in Azure while using invalid credentials, such as when your service principal expired, and did not display the debug logs, it appeared that the cluster was deleted when it was not. In addition to not deleting the cluster, the locally stored cluster metadata was deleted, which made it impossible to remove the cluster by running the openshift-install destroy cluster command again. Now, if you attempt to delete a cluster while using invalid Azure credentials, the installation program exits with an error, and you can update your credentials and try again. (BZ#1866925)

Previously, the install-config.yaml file for the installer-provisioned infrastructure bare metal installation method incorrectly used the provisioningHostIP name instead of the clusterProvisioningIP name, which caused a disconnect between documentation and the actual field name used in the YAML file. Now, the provisioningHostIP field is deprecated in favor of clusterProvisioningIP, which removes the disconnect. (BZ#1868748)

Previously, the installation program did not check for expired certificates in the Ignition configuration files. The expired certificates caused installation to fail without explanation. Now, the installation program checks for expired certificates and prints warning if certificates are expired. (BZ#1870728)

Previously, the preserveUnknownFields field was set to true in v1beta1 CRDs, and there was no error when oc explain did not explain CRD fields. A validation condition was added, and the status of v1beta CRDs without the preserveUnknownFields field set to false will show an error of spec.preserveUnknownFields: Invalid value: true: must be false. (BZ#1848358)

Previously, the LocalStorageCapacityIsolation feature gate was disabled by default in OpenShift Container Platform on IBM Cloud clusters. When disabled, setting an ephemeral storage request or limit causes the pod to be unschedulable. This fix changed the code so that if the LocalStorageCapacityIsolation feature gate is disabled, ephemeral storage requests or limits are ignored and pods can be scheduled as expected. (BZ#1886294)

Previously, when deploying on Red Hat OpenStack Platform (RHOSP) and using an HTTP proxy with a host name, sometimes the installation process can fail to pull container images and report the error message unable to pull image. This bug fix corrects how the proxy is set in environment variables and nodes can pull container images from remote registries. (BZ#1873556)

Previously, during an upgrade, the Machine Config Controller (MCC) for the previous release could react to a configuration change from the newer Machine Config Operator (MCO). The MMC then introduced another change that resulted in an unnecessary reboot during the upgrade process. This bug fix prevents the MCC from reacting to a configuration change from a newer MCO and avoids an unnecessary reboot. (BZ#1879099)

Previously, the forward plugin for CoreDNS distributed queries randomly to all the configured DNS servers. Name resolution failed intermittently because CoreDNS would query a DNS server that was not functional. This bug fix sets the forward plugin to use the sequential policy so that queries are sent to the first DNS server that is responsive. (BZ#1882209)

Previously, the Machine Config Operator was reading enabled systemd target units only from the multi-user.target.wants directroy. As a consequence, any unit that does not target the multi-user.target.wats directory was changed to target that directory. This fix modified the MCO to use the systemd-preset file to create a preset file in the MCO. As a result, all systemd services are enabled and disabled as expected. (BZ#1885365)

Previously, when migrating a cluster to the OVN-Kubernetes default Container Network Interface (CNI), bond options on a pre-configured Linux bond interface. As a consequence, bonds are configured using round-robin instead of the mode specified and the bonds might not function. The ovs-configuration.service (configure-ovs.sh) was modified to copy all of the previous bond options on the Linux bond to ovs-if-phys0 Network Manager connection. As a result, all bonds should work as originally configured. (BZ#1899350)

In OpenShift Container Platform 4.6, a change was made to use the Budget Fair Queueing (BFQ) Linux I/O scheduler. As a consequence, there was an increased fsync I/O latency in etcd. This fix modified the I/O scheduler to use the mq-deadline scheduler, except for NVMe devices, which are configured to not use an I/O scheduler. For Red Hat Enterprise Linux CoreOS (RHCOS) updates, the BFQ scheduler is still used. As a result, latency times have been reduced to acceptable levels. (BZ#1899600)

Previously, an issue with a dependency resulted in the persistent unmounting and remounting of the YAML Editor in the OpenShift Container Platform web console. As a consequence, the YAML editor jumped to the top of the YAML file every few seconds This fix removed a default parameter value for the dependency. As a result, the YAML Editor behaves as expected. (BZ#1903164)

Previously, a link in the Operator description in the OpenShift Container Platform web console was rendered in a sandboxed iframe, which disables javascript within that iframe. As a consequence: when user clicked the link, the sandbox limitations are inherited by the new tab, so JavaScript did not run the linked page. The links were fixed by adding an allow-popups-to-escape-sandbox parameter to Operator description iframe sandbox attribute, which opens new tabs outside of the sandbox. As a result, the link from Operator descriptions now open and run normally. (BZ#1905416)

Previously, the scale pods function in the OpenShift Container Platform web console was not using the scale subresource, any custom role without the patch verb in the deployment config and deployment could not scale the pods in the web console. The fix changed the code so that the scale pods function is now using the scale subresource. As a result, users can scale pods in the web console without adding the patch verb. (BZ#1911307)

Previously, creating a custom resource in the OpenShift Container Platform web console where a fieldDependency description was applied to a schema property that used a control field with an identical name the getJSONSchemaPropertySortWeight helper function would recurse infinitely. As a consequence, the DynamicForm component would throw an exception and the web browser could crash. This fix modified the getJSONSchemaPropertySortWeight helper function to keep track of the current path and use the entire path to determine dependency relationship instead of just the field names. As a result, the DynamicForm component no longer throws an exception under the above condition. (BZ#1913969)

Previously, the SamplesTBRInaccessibleOnBoot alert description contained a misspelling of the word "bootstrapped". The alert description is now correct. (BZ#1914723)

Previously, the CPU and Memory specDescriptor fields added an empty string in the YAML editor. Now, these fields no longer add an empty string in the YAML editor. (BZ#1797766)

Previously, The Subscription and CSV objects were both displayed on the Installed Operators page during Operator installation. Now, this duplication has been fixed so that the Subscription Operator is not displayed on the Installed Operators page if a matching CSV object already exists. (BZ#1854567)

Previously, empty resource utilization charts were displayed on the Build details page when a build was started over an hour prior, but the default was set to display only the last hour. Now, the utilization charts on the Build details page shows data for the time that the build ran. (BZ#1856351)

Previously, OpenAPI definitions were only updated on the initial page load. The OpenAPI definitions are now updated on a 5-minute interval and whenever the models are fetched from the API. OpenAPI definitions stay up to date without a page refersh. (BZ#1856354)

In this release, the broken link to the cluster monitoring documentation has been fixed. (BZ#1856803)

Previously, the utm_source parameter was missing from Red Hat Marketplace URLs. In this release, the utm_source parameter was added to Red Hat Marketplace URLs for attribution. (BZ#1874901)

Previously, the project selection drop down could not be closed by using the Escape key. The handler for the Escape key is now updated and the user can exit and close the project selection drop down. (BZ#1874968)

Previously, the font colors used for Scheduling Status was not in compliance with accessibility. The font and font colors were updated to be accessible. The scheduling disabled node is displayed in a yellow warning icon (exclamation icon). (BZ#1875516)

Previously, the patch paths on some API calls were incorrect. This caused spec descriptor fields to not update resource properties. In this release, the logic for building a patch path from a descriptor was updated. (BZ#1876701)

Previously, the Unschedulable status field only appeared when it was set to True. In this release, a new UX design was implemented to display status information more clearly. (BZ#1878301)

Previously, subscriptions with an automatic approval strategy behave as if they have a manual approval strategy if another subscription in the same namespace has a manual approval strategy. In this release, an update was made to notify the user that a subscription with a manual approval strategy causes all subscriptions in the namespace to behave as manual. (BZ#1882653)

Previously, a manual install plan can affect more than one Operator. However, the UI did not clearly indicate that is the case when it is true and presents the UI requesting approval. As a result, a user could be approving the install plan for multiple Operators, but the UI did not clearly communicate that. In this release, the UI lists all Operators affected by the manual approval plan and it clearly indicates which Operators will be installed. (BZ#1882660)

Previously, creating a duplicate namepsace from the create namespace modal would result in a rejection error. In this release, we added an error handler for when you create projects and creating duplicate projects will not result in a rejection error. (BZ#1883563)

Previously, the Prometheus swagger definition contained a $ref property that could not be resolved, so a runtime error occurred on the Prometheus operand creation form. Now, the definitions property is added to the schema that was returned by the definitionFor helper function, so the $ref resolves and no runtime error occurs.(BZ#1884613)

Previously, users had to wait for the needed resources to load in the background before the install status page appears. Now, the install status page was updated so that it immediately appears once the user starts the Operator install. (BZ#1884664)

Previously, iOS did not support connecting via secured Websocket with self-signed certificate, so a white screen displayed on the console. Now, the connection falls back to https if the Websocket with self-assigned certificate is not successful, so the console loads properly. (BZ#1885343)

Previously, system roles are not present when users create a new role binding in the web console. Now, system roles appears in the Role name dropdown, so users can now select a system role when creating a new role binding. (BZ#1886154)

Previously, the terminal assumed all pods are Linux pods and did not account for Windows pods, so the terminal would not work with Windows pods as it defaulted to the sh command. Now, the terminal detects the pod type and changes the command as necessary. (BZ#1886524)

Previously, new provisioners names did not contain the kubernetes.io/ prefix, so users could select the RWX and RWO access mode when creating PVC by aws-ebs-csi-driver(gp2-csi) in the web-console. Now, additional provisioners have been added to the AccessMode mapping, so RWX and RWO access modes are not available when creating PVC by aws-ebs-csi-driver(gp2-csi) in the web-console. (BZ#1887380)

Previously, the logic for maintaining active Namespace didn’t account for deleting the currently active namespace, so a namespace that was recently deleted in the UI could remain set as the currently active Namespace. Now, the active namespace logic has been updated so that, in a current browser session, it defaults to "All namespaces" when a user deletes the currently active namespace. So now when the user deletes the currently active Namespace, the active namespace in that same browser session is automatically updated to "All Namespaces". (BZ#1887465)

Previously, the console vendor’s 'runc' module in v0.1.1 contained a potential security issue, so frog xray flags the 'runc' dependency as a potential vulnerability. Now, the 'runc' module is pinned to the v1.0.0-rc8 version, which contains the fix, so the 'runc' dependency is no longer flagged as a potential vulnerability. (BZ#1887864)

Previously, the CSV and PackageManifests listed every provided API version instead of just the latest version, so the CSV and PackageManifest pages could show duplicate APIs. Now, an update to the logic for retrieving APIs so that only the latest version of each provided API is displayed for each. (BZ#1888150)

Previously, the Install Operand Form description was missing the 'SynchMarkdownView' component, so it is not formatted with markdown. Now, the Install Operand Form is formatted with markdown, so the Install Operand Form description is properly formatted.(BZ#1888036)

Previously, the fieldDependency specDescriptor was not designed or tested with non-sibling dependencies. Consequently, non-sibling dependencies were not guaranteed to behave as expected. This update revises the logic to ensure that non-sibling dependencies behave as expected. (BZ#1890180)

Previously, an exception was thrown if a local ensureKind function did not properly handle null data argument. This update adds null coalescence when using data argument to ensure that no exceptions are thrown, which allows graceful handling of null data arguments. (BZ#1892198)

Previously, TLS secrets were not editable in the console. This update adds a type field so that TLS secrets can be updated in the console. (BZ#1893351)

This update fixes an issue where the web console displayed incorrect filesystem capacity and usage data. (BZ#1893601)

Previously, the web console was incorrectly granting permissions to the wrong service account, the Prometheus Operator, for scraping metrics for Operator Lifecycle Manager (OLM) Operators. The console now correctly grants permissions to the prometheus-k8s service account, allowing metrics to be scraped. (BZ#1893724)

Previously, the console pod’s TopologyKey was set to kubernetes.io/hostname, which created availability problems during updates and zone outages. This update sets the TopologyKey to topology.kubernetes.io/zone, which improves availability during updates and zone outages. (BZ#1894216)

Previously, an OperatorGroup with a missing status block in any namespace could cause a runtime error in the web console when installing a new Operator from OperatorHub. The problem has been resolved. (BZ#1895372)

Previously, the console filtered out Custom Resource Definitions (CRDs) from the Provided APIs list if the model for the CRD did not exist. Consequently, the Details tab did not present Provided API cards upon initial install, which gave the impression that the Operator offered no APIs. This update removes the filter from the API cards so that they appear even if the model has yet to exist. As a result, the Provided API cards and their corresponding tabs always match, and the UI will no longer present an empty state if the models are not yet available. (BZ#1897354)

In some cases, the lodash startCase function was being applied to the operand form descriptor field. Consequently, the field label would be formatted as Start Case, which would override the displayName property of the descriptor. This update applies startCase only when a descriptor displayName is not provided, which properly shows displayName on the operand form. (BZ#1898532)

Previously, the react-jsonschema-form did not properly handle array type schemas that were explicitly set to null. If the form data passed to the DynamicForm component contained an array type property set to null, a runtime exception would occur. This update adds a null check in the array fields, ensuring that exceptions are no longer thrown in this scenario. (BZ#1901531)

Previously, the prometheus-adapter did not implement an OpenAPI spec. As a result, the API server logged a message every 60 seconds that the OpenAPI did not exist while the Prometheus Adapter was deployed into the cluster. Additionally, the KubeAPIErrorsHigh alert might have fired due to the errors in the logs. This fix introduces the OpenAPI spec into prometheus-adapter, which complies with other core API resources within OpenShift Container Platform. (BZ#1819053)

Previously, certain scenarios that elevated security context constraints (SCCs) caused Prometheus stateful set deployments to fail. Now, the nonroot SCC is used for stateful set deployments for monitoring. This fix requires the following configuration of Kubernetes security context settings for all monitoring stateful set deployments, which are Alertmanager, Prometheus, and Thanos Ruler:

securityContext:
  fsGroup: 65534 (1)
  runAsNonRoot: true
  runAsUser: 65534 (2)

Previously, CPU steal time, which is the time that a virtual CPU waits for a real CPU while the hypervisor is servicing another virtual processor, impacted the metrics that reported CPU consumption. As a result, CPU usage could be reported as higher than the CPU count on a node. Now, the metrics that report CPU consumption do not take into account CPU steal time, and thus reported CPU usage accurately reflects the actual CPU usage. (BZ#1878766)

Previously, authenticated requests without elevated permissions could access the /api/v1/query and /api/v1/query_range endpoints of Prometheus in user-defined projects. Thus, users with access to the token for a regular service account could read metrics from any monitored target. Now, kube-rbac-proxy is configured to allow requests to only the /metrics endpoint. Authenticated requests without cluster-wide permissions for the /metrics endpoint receive an HTTP 404 status code in response to a query to the api/v1/query and /api/v1/query_range endpoints. (BZ#1913386)

The code in ovn-kube that detects the default gateway was not taking into consideration multipath environments. As a result, Kubernetes nodes failed to start because they could not find the default gateway. The logic has been modified to consider the first available gateway if multipath is present. OVN-Kubernetes now works in environments with multipath and multiple default gateways. (BZ#1914250)

When deploying a cluster in dual stack mode OVN-Kubernetes was using the wrong source of truth.

When creating an additional network by specifying the additionalNetworks stanza in the Cluster Network Operator (CNO) configuration object, the CNO manages the lifecycle for the NetworkAttachmentDefinition object that is created. However, that object was never deleted if the CNO configuration was updated to exclude the additional network from the additionalNetworks stanza. In this release, the CNO now deletes all objects related to the additional network. (BZ#1755586)

For the OVN-Kubernetes cluster network provider, if an egress IP address was configured and one of the nodes hosting the egress IP address became unreachable, any egress IP addresses assigned to the unreachable node were never reassigned to other nodes. In this release, if a node hosting an egress IP address is found to be unreachable, the egress IP address is assigned to another node. (BZ#1877273)

For the OVN-Kubernetes cluster network provider, the route priority of the br-ex bridge could be superseded by the default route for a secondary network interface added after installing the cluster. When the default route for the secondary device supersedes the br-ex bridge on a node, the cluster network no longer functions. In this release, the default route for br-ex bridge cannot be superseded. (BZ#1880259)

For clusters using the OVN-Kubernetes cluster network provider, when adding a Red Hat Enterprise Linux (RHEL) 7 worker node to the cluster, the new worker node was unable to connect to the cluster network. In this release, you can now add RHEL worker nodes successfully. (BZ#1882667)

For clusters using the OVN-Kubernetes cluster network provider, it was not possible to use a VLAN or bonded network device as the default gateway on a node. In this release, OVN-Kubernetes now works with these network devices. (BZ#1884628)

For clusters using the Kuryr cluster network provider, unnecessary Neutron ports were created for pods using on the host network. In this release, Neutron ports are no longer created for host network pods. (BZ#1886871)

For clusters using the OVN-Kubernetes cluster network provider, the br-ex bridge did not support the attachment of other interfaces, such as veth<N> pairs, and any interface added to the bridge did not function correctly. In this release, new interfaces can be attached to the br-ex interface and function correctly. (BZ#1887456)

For clusters using the OVN-Kubernetes cluster network provider, if an ExternalIP address was configured, any node in the cluster not configured to use that IP address did not route traffic sent to the externalIP correctly. Now, every node in the cluster is configured with the necessary routes for an ExternalIP. (BZ#1890270)

For clusters using the OpenShift SDN cluster network provider, the order in which a namespace and a network namespace were deleted mattered. If the NetNamespace object associated with a Namespace object were deleted first, it was not possible to recreate that network namespace again. In this release, a namespace and its associated network namespace may be deleted in any order. (BZ#1892376)

For clusters using the OpenShift SDN cluster network provider, previously the network provider logged the following message: unable to allocate netid 1. Because this message is harmless for any NETID less than 10, in this release OpenShift SDN no longer emits the message for any NETID less than 10. (BZ#1897073)

If the cluster is using the OVN-Kubernetes cluster network provider, all inbound ICMPv6 was erroneously sent to both the node and OVN. In this release, only ICMPv6 Neighbor Advertisements and Route Advertisements are sent to both the host and OVN. As a result, a ping sent to a node in the cluster no longer results in duplicate responses. (BZ#1897641)

Previously, in a cluster with a large number of nodes, excessive multicast DNS (mDNS) traffic was generated. As a result network switches might overflow. This release limits mDNS queries to once per second.

Previously, creating an additional network attachment that used IPv6, the Whereabouts CNI plug-in, and specified excluded subnet ranges would ignore the excluded subnet ranges. This bug fix corrects the plug-in so that subnet ranges can be excluded. (BZ#1900835)

Previously, under certain circumstances, pods did not terminate due to an error condition with Multus. Multus includes the message failed to destroy network for pod sandbox in logs when the problem occurs. This bug fix makes Multus tolerate a deleted cache file and pods can terminate. (BZ#1900835)

Previously, when using the OpenShift SDN network provider with network policies, it was possible for for pods to experience network connectivity problems even in namespaces that do not use network policies. This bug fix ensures that the underlying Open vSwitch (OVS) flows that implement the network policy are valid. (BZ#1914284)

Previously, when using the OVN-Kubernetes network provider and using multiple pods to serve as external gateways, scaling down the pods prevented other pods in the namespace from routing traffic to the remaining external gateways. Instead, traffic was routed to the default gateway of the node. This bug fix enables the pods to continue routing traffic to the remaining external gateways. (BZ#1917605)

Previously clusters under load can timeout if pod or container creation requests take too long. The kubelet attempts to re-request that resource even though CRI-O is still working on creating that resource, causing the requests to fail with the name is reserved error. After CRI-O finishes the original request, it notices the request timed out, and cleans up the failed pod/container, starting the process over. As a consequence, pod and container creation can stall and multiple name is reserved errors are reported by the kubelet. This also causes an already overloaded node to be further overloaded. This fix modified CRI-O to save the progress of any pod or container creation that timeout due to system load. CRI-O also stalls new requests from the kubelet so there are fewer name is reserved errors. As a result, when clusters are under load, CRI-O slows the kubelet and reduces the load on the cluster. The overall load on the node is reduced and Kubelet and CRI-O should reconcile more quickly. (BZ#1785399)

Previously, deep directories in volumes cause long SELinux relabeling times. As a consequence, container creation requests can timeout, and the kubelet attempts to re-request that resource, causing the error reserving ctr name or Kubelet may be retrying requests that are timing out in CRI-O due to system load error. This fix modified CRI-O to save the progress of any pod or container creation that timeout due to system load. As a result, the container request are fulfilled in a timely manner. (BZ#1806000)

Previously, CRI-O used only IPv4 iptables for managing the host port mapping. As a consequence: The host port does not work for IPv6. This fix modified CRI-O to support IPv6 host ports. As a result, host ports function with IPv6 as expected. (BZ#1872128)

Previously, HTTP/2 transports did not have the correct options attached to the connections that provide timeout logic, which caused VMWare network interfaces (and other scenarios) to blip for a few seconds causing connections to fail silently. As a consequence, connections lingered, which caused other related failures, such as nodes not being detected as down, API calls using stale connections and failing, and so forth. This fix added proper timeouts. As a result, HTTP/2 connections within the system are more reliable, and side-effects are mitigated. (BZ#1873114)

Previously, the Topology Manager end-to-end test (openshift-tests run-test) required the Machine Config Daemon (MCD) to be running on each worker node, which is the case for nodes deployed on Red Hat Enterprise Linux CoreOS (RHCOS) nodes but not for nodes deployed on Red Hat Enterprise Linux (RHEL). As a consequence, the Topology Manager end-to-end test incorrectly failed with a false-negative when running against clusters deployed on RHEL. This fix modified the test to skip any nodes where it does not detect an MCD. As a result, the false-negative failures are no longer reported. (BZ#1887509)

Previously, the Kubelet did not handle transitions properly when statuses were missing. As a consequence some terminated pods did not get restarted. This fix fix added a failed container status to allow the container to be restarted as needed. As a result, kubelet pod handling does not result in an invalid state transition. (BZ#1888041)

Previously, machine metrics from cAdvisor were missing in Kubernetes 1.19 and later. This fix modified the code to properly collect the CAdvisor machine metrics. As a result, the machine meterics are present. (BZ#1913096)

Previously, the Horizontal Pod Autoscaler (HPA) ignored pods with incomplete metrics, such as pods that have init containers. As a consequence, any pod with an init container would not be scaled. This fix makes the Prometheus Adapter send complete metrics for init containers. As a result, HPA can scale pods with init containers. (BZ#1867477)

Previously, the Vertical Pod Autoscaler (VPA) did not have access to monitor deployment configs. As a consequence, the VPA was unable to scale deployment config workloads. This fix added the appropriate permissions to the VPA to monitor deployment configs. As a result, the VPA can scale deployment config workloads. (BZ#1885213)

When an invalid Tuned profile is created, the openshift-tuned supervisor process may ignore future profile updates and fail to apply the updated profile. This bug fix keeps state information about Tuned profile application success or failure. Now, openshift-tuned recovers from profile application failures on receiving new valid profiles. (BZ#1919970)

Previously, there was legacy logging of a failed authentication check. Requests to services behind the oauth-proxy could cause a line written to the proxy log, which would cause log flood. This fix removed the uninformative log line from the proxy. Now, the proxy no longer experiences log spam. (BZ#1879878)

Previously, invalid option handling caused a nil dereference when incorrect option combinations were specified with the oauth-proxy command. This resulted in a segmentation fault stack trace being output at the end of the usage message. The option handling is now improved and nil dereferences do not occur when incorrect option combinations are specified. The usage message is output without a stack track when incorrect options are now specified. (BZ#1884565)

Previously, changes in logging libraries caused goroutine stack traces to be printed even at a low log level of 2, which made debugging more difficult. The log level for goroutine stack traces was increased, and now they will only be printed at log level 6 and above. (BZ#1867518)

Previously, users logging in with the OpenShift CLI (oc) to multiple clusters using the same user name had to log in to each cluster every time. The context name has been properly updated so that it is unique even when the user name is the same. Now, after logging in and switching context, it is not necessary to log in again. (BZ#1868384)

Previously, when a release was mirrored to disk using oc adm release mirror, the manifest file names did not contain the architecture extension, for example -x86_64. This did not allow for mirroring multiple architectures to the same repository without having tag name collisions. File names now contain the appropriate architecture extension, which prevents tag name collisions. (BZ#1878972)

Previously, an image verifier object was not set properly which could cause the OpenShift CLI (oc) to fail with a nil pointer exception when verifying images. The image verifier object is now set properly and the OpenShift CLI (oc) no longer fails with a nil pointer exception when verifying images. (BZ#1885170)

Previously, the wrong user name was used when verifying image signatures using oc adm verify-image-signature, and image signature verification failed. The proper user name is now used when verifying image signatures and image signature verification now works as expected. (BZ#1890671)

Previously, metadata providing version information was not produced during the build process and was not present on Windows binaries of the OpenShift CLI (oc). Proper Windows version information is now generated and available on Windows binaries. (BZ#1891555)

Previously, a missing nil check for a route condition could cause the OpenShift CLI (oc) to crash when describing a route. A nil check was added and describing a route now works properly. (BZ#1893645)

Previously, the OpenShift CLI (oc) had a low limit for client throttling, and the requests reaching for API discovery were limited by the client code. The client throttling limit was increased and client-side throttling should now appear less frequently. (BZ#1899575)

Previously, support for init containers was lost during changes to the oc debug command, and it was not possible to debug init containers. Support for init containers was added to the oc debug command, and it is now possible to debug init containers. (BZ#1909289)

The Marketplace Operator was written to report that the services it offered were degraded whenever the marketplace-operator pod exited gracefully, which would happen during routine cluster upgrades. This caused the pod to report as degraded during normal upgrades, which caused confusion. The Marketplace Operator no longer reports that it is degraded when it exits gracefully and is no longer flagged by the Telemeter client as degraded. (BZ#1838352)

Previously during an Operator upgrade, Operator Lifecycle Manager (OLM) deleted existing cluster service versions (CSVs) before the upgrade was completed. This caused the new CSV to be stuck in a "Pending" state. This bug fix updates OLM to check the ownership of the service account to ensure the new service account is created for the new CSV. As a result, existing CSVs are no longer deleted until the new CSV reaches the "Succeeded" state correctly. (BZ#1857877)

Previously, Operator Lifecycle Manager (OLM) would accept a Subscription object that specified a channel that did not exist. The subscription would appear to succeed, and no related error message was presented, which caused user confusion. This bug fix updates OLM to cause Subscription objects to fail in this scenario. Cluster administrators can review events in the default namespace for dependency resolution failure information, for example:

$ oc get event -n default

LAST SEEN   TYPE      REASON             OBJECT                    MESSAGE
6m22s       Warning   ResolutionFailed   namespace/my-namespace    constraints not satisfiable: my-operator is mandatory, my-operator has a dependency without any candidates to satisfy it

Previously, support for admission webhook configurations in Operator Lifecycle Manager (OLM) reused the CA certificate generation code used when deploying API servers. The mounting directory used by this code placed the certificate information at the following locations:

When deploying an Operator with an API service, conversion webhook, or an admission webhook, Operator Lifecycle Manager (OLM) should retrieve the CA from an existing resource to calculate a CA hash annotation. This annotation influences a deployment hash that OLM relies on to confirm that the deployment is installed correctly. OLM currently does not retrieve the CA from conversion webhooks, resulting in an invalid deployment hash, which causes OLM to attempt to reinstall the cluster service version (CSV).

In the opm command, the semver-skippatch mode previously allowed only bundles with later patch versions as valid replacements, ignoring any pre-release versions. Bundles with the same patch versions but later pre-release versions were not accepted as replacements. This bug fix updates the opm command to base the semver-skippatch check on the semantic versioning as a whole instead of just the patch version. As a result, later pre-release versions are now valid for the semver-skippatch mode. (BZ#1889721)

Previously, the Marketplace Operator did not clean stale services during a cluster upgrade, and Operator Lifecycle Manager (OLM) accepted the stale service without validating the service. This caused the stale service to direct traffic to a catalog source pod that contained outdated content. This bug fix updates OLM to add spec hash information to the service and check to ensure the service has the correct spec by comparing the hash information. OLM then deletes and recreates the service if it is stale. As a result, the service spec now directs traffic to the correct catalog source pod. (BZ#1891995)

After mirroring an Operator to a disconnected registry, the Operator install could fail due to a missing related bundle image. This issue was due to the bundle image not being present in the index.db database. This bug fix updates the opm command to ensure the bundle image is present in the related_images table of the database. (BZ#1895367)

Previously, Operator authors could create cluster service versions (CSVs) that defined webhooks with container ports set outside of the 1 to 65535 range. This prevented the ValidatingWebhookConfiguration or MutatingWebhookConfiguration objects from being created because of a validation failure; CSVs could be created that never successfully installed. The custom resource definition (CRD) validation for CSVs now includes the proper minimum and maximum values for the webhookDescription ContainerPort field. This now defaults to 443 if the container port is not defined. CSVs with invalid container ports now fail validation before the CSV is created. (BZ#1891898)

Stranded Operator image bundles that were not referenced by any channel entries remained after an opm index prune operation. This lead to unexpected index images being mirrored. Stranded image bundles are now removed when an index is pruned and the unexpected images are not included when the Operator catalog is later mirrored. (BZ#1904297)

Previously, Operator updates could result in Operator pods being deployed before a new service account was created. The pod could be deployed by using the existing service account and would fail to start with insufficient permissions. A check has been added to verify that a new service account exists before the cluster service version (CSV) is moved from a Pending to Installing state. If a new service account does not exist, the CSV remains in a Pending state which prevents the deployment from being updated. (BZ#1905299)

Previously, when Operator Lifecycle Manager (OLM) copied a ClusterServiceVersion (CSV) object to multiple target namespaces, the .status.lastUpdateTime field in the copied CSV was set to the current time. If the current time was later than the last update time of the original CSV, a synchronization race condition was triggered where the copied CSV never converged to match the original. This was more likely to occur when many namespaces were present in a cluster. Now, the original .status.lastUpdateTime timestamp is preserved in the copied CSVs and the synchronization race condition is not triggered by a difference between the .status.lastUpdateTime values. (BZ#1905599)

Previously, pod templates defined in the StrategyDetailsDeployment objects of a ClusterServiceVersion (CSV) object could include pod annotations that do not match those defined in the CSV. Operator Lifecycle Manager (OLM) would fail to install the Operator because the annotations in the CSV are expected to be present on the pods deployed as part of the CSV. The pod template annotations defined in the StrategyDetailsDeployment objects are now overwritten by those defined in the CSV. OLM no longer fails to deploy CSVs whose annotations conflict with those defined in the pod template. (BZ#1907381)

When a default catalog source in the openshift-marketplace namespace is disabled through the OperatorHub API, you can create a custom catalog source with the same name as that default. Previously, custom catalog sources with the same name as a default catalog source were deleted by the Marketplace Operator when the marketplace was restarted. An annotation has been added to the default catalog sources that are created by the Marketplace Operator. Now, the Operator only deletes the catalog sources that contain the annotation when the marketplace is restarted. Custom catalog sources created with the same name as the default catalog sources are not deleted. (BZ#1908431)

Previously, the oc adm catalog mirror command did not generate the proper mappings for Operator index images without namespaces. Additionally, the --filter-by-os option filtered the entire manifest list. This resulted in invalid references to the filtered images in the catalog. Index images without namespaces are now mapped correctly and an --index-filter-by-os option is added to filter only the index image that is pulled and unpacked. The oc adm catalog mirror command now generates valid mappings for index images without namespaces and the --index-filter-by-os option creates valid references to the filtered images. (BZ#1908565)

Previously, Operators could specify a skipRange in the cluster service version (CSV) replacement chain that would cause Operator Lifecycle Manager (OLM) to attempt to update the Operator with itself. This infinite loop would cause an increase in CPU usage. The CSV replacement chain is now updated so that Operators do not become stuck in an infinite loop due to an invalid skipRange. (BZ#1916021)

Previously, the csv.status.LastUpdateTime time comparison in the cluster service version (CSV) reconciliation loop always returned a false result. This caused the Operator Lifecycle Manager (OLM) Operator to continuously update the CSV object and trigger another reconciliation event. The time comparison is now improved and the CSV is no longer updated when there are no status changes. (BZ#1917537)

Catalog update pods with polling intervals that were multiples of 15 greater than the default 15 minute resynchronization period would be continuously reconciled by the Catalog Operator. This would continue until the next poll time was reached, causing increased CPU load. The reconciliation requeuing logic is now improved so that the continuous reconciliation and the associated CPU load increases do not occur. (BZ#1920526)

Previously, if no matching Operators were found during an attempt to create an Operator subscription, the constraints listed in the resolution failure event contained internal terminology. The subscription constraint strings did not describe the resolution failure reason from a user perspective. The constraint strings are now more meaningful. (BZ#1921954)

Previously, requests targeting the deploymentconfigs/<name>/instantiate subresource failed with no kind "DeploymentConfig" is registered for version apps.openshift.io/. The correct version for the DeploymentConfig is now set and these requests no longer fail. (BZ#1867380)

Previously, all operator-sdk subcommands attempted to read the PROJECT file, even if PROJECT was a directory. As a result, subcommands that did not require the PROJECT file failed. Now, subcommands that do not require the PROJECT file do not attempt to read it and succeed even if an invalid PROJECT file is present. (BZ#1873007)

Previously, running the operator-sdk cleanup command did not clean up Operators that were deployed with the operator-sdk run bundle command. Instead, an error message was displayed and the Operator was not cleaned up. Now, the operator-sdk cleanup command has been updated, and Operators deployed with run bundle can be cleaned up by using the cleanup command. (BZ#1883422)

Previously, incorrect wait in the must-gather logic resulted in early termination of log gathering. This issue resulted in, depending on timing, the log gathering operation being interrupted prematurely. This led to a partial log collection. This is now fixed by adding the correct wait in the must-gather logic. (BZ#1906355)

Previously, must-gather collected an unbounded amount of kubelet logs on all nodes. This issue resulted in an excessive amount of data being transferred and collected, with no clear benefit for the user.

Previously, when the machine config pool was degraded, the performance profile was not updated to display an accurate machine config pool state. Now, the performance profile node selector or machine config pool selector correctly watches the relevant machine config pools, and a degraded machine config pool reflects the correct status. (BZ#1903820)

Previously, configuring additional Azure disks during RHCOS installation caused a failure because the udev rules for Azure disks were missing from the RHCOS initramfs. The necessary udev rules have been added so that configuring additional disks during installation now works properly. (BZ#1756173)

Previously, the rhcos-growpart.service was being used in a way that was not a best practice. Now, the rhcos-growpart.service has been removed in favor of configuring disks via Ignition at installation time. To change disk configuration after initial RHCOS installation, you must reprovision your systems with the necessary disk configuration changes. (BZ#1851103)

Previously, the Machine Config Operator would attempt to rollback rpm-ostree changes when running rpm-ostree cleanup -p, causing a "System transaction in progress" error to occur. This fix improves rpm-ostree code related to D-Bus handling so that the error no longer occurs. (BZ#1865839)

Previously, there was no support in ppc64le or s390x for NVME emulation in KVM in RHEL 8.2, which caused the kola --basic-qemu-scenarios using NVME emulation to fail. The tests for NVME emulation on ppc64le and s390x have been disabled so that the tests now succeed. (BZ#1866445)

Previously, Ignition could not fetch a remote configuration over the network when the DHCP server took too long to respond to DHCP queries because NetworkManager would stop waiting for a DHCP answer and the network would not be configured in the initramfs. The new version of NetworkManager now understands the rd.net.timeout.dhcp=xyz and rd.net.dhcp.retry=xyz options when set as kernel parameters to increase the timeout and number of retries, allowing you to set those options to account for delayed DHCP answers. (BZ#1877740)

Previously, an incorrect networking configuration was created because multiple nameserver= entries on the kernel command line could create multiple NetworkManager connection profiles. A newer version of NetworkManager in RHCOS now correctly handles multiple nameserver= entries so that networking configuration is properly generated when multiple nameserver= entries are provided. (BZ#1882781)

Previously, a node process would seg fault due to a recursive call that was overflowing the stack. This logic error has been fixed so that there are no longer seg faults. (BZ#1884739)

Previously, network-related service units were not strictly ordered, which sometimes meant that network configurations copied using -copy-network did not take effect on the first reboot into the installed system. The ordering of the relevant service units has been fixed so that they now always take effect on the first reboot. (BZ#1895979)

Previously, when the coreos-installer command invoked fdasd to check for a valid DASD label on s390x, udev would reprobe the DASD device, causing the DASD formatting to fail because udev was still accessing the device. Now, after checking for a DASD label, coreos-installer waits for udev to finish processing the DASD to ensure that the DASD formatting is successful. (BZ#1900699)

Previously, it could be confusing to query and modify connection settings in NetworkManager when using DHCP because a single NetworkManager connection was created by default that matched all interfaces. The user experience has been improved so that when using DHCP, NetworkManager now creates a separate connection for each interface by default. (BZ#1901517)

Previously, failure to properly tear down network interfaces in the initrd before switching to the real root might cause static IP assignment to a VLAN interface to not be successfully activated in the real root. This fix changes how network interfaces are torn down in the initrd so that static IP assignments to VLAN interfaces are successfully activated in the real root. (BZ#1902584)

Previously, if you had configured RHCOS to use dhclient for DHCP operations, you were left with systems that could not properly acquire a DHCP address because the dhclient binary was removed from RHCOS when the switch to using NetworkManager in the initramfs was made. The dhsclient binary is now included in RHCOS so that RHCOS systems can successfully perform DHCP operations using dhclient. (BZ#1908462)

Previously, upgraded nodes would not receive uniquely generated initiator names because the service unit that regenerates the iSCSI initiator name only worked on first boot. With this fix, the service unit now runs on every boot so that upgraded nodes receive generated initiator names if one does not already exist. (BZ#1908830)

Previously, you could not create ext4 filesystems with Ignition because mkfs.ext4 failed when /etc/mke2fs.conf did not exist. With this fix, /etc/mke2fs.conf has been added to the initramfs so that Ignition successfully creates ext4 filesystems. (BZ#1916382)

Previously, it was possible to set the haproxy.router.openshift.io/timeout annotation on a route with a value that exceeded 25 days. Values greater than 25 days caused the ingress controller to fail. This bug fix sets an upper limit of 25 days for the timeout. (BZ#1861383)

Previously, an ingress controller would report a status of Available even if DNS was not provisioned or a required load balancer was not ready. This bug fix adds validation to the Ingress Operator to ensure that DNS is provisioned and the load balancer, if required, is ready before the ingress controller is reported as available. (BZ#1870373)

Previously, it was possible to set the default certificate for an ingress controller to a secret that does not exist, such as by entering a typographical error. This bug fix adds validation to ensure the secret exists before changing the default certificate. (BZ#1887441)

Previously, a route with a name that is longer than 63 characters could be created. However, after the route was created, it failed validation. This bug fix adds validation when the route is created. (BZ#1896977)

Previously, the admission plug-in would add a failover domain and region labels, even when they were not configured properly, causing pods that used statically provisioned persistent volumes (PVs) to fail to start on OpenStack clusters with an empty region in the configuration. With this fix, the tables are now added to the PV only when they contain a valid region and failure domain so that pods using statically provisioned PVs behave the same as dynamically provisioned PVs on OpenStack clusters that have been configured with an empty region or failure domain. (BZ#1877681)

Previously, the LocalVolumeDiscoveryResult object was displayed in the web console, implying that these could be manually defined. With this fix, the LocalVolumeDiscoveryResult type has been flagged as an internal object and is no longer displayed in the web console. To view local disks, navigate to Compute → Nodes → Select Nodes → Disks instead. (BZ#1886973)

Previously when creating snapshots that require credentials, force deletion would not work for snapshots if the VolumeSnapshotClass CRD was already deleted. Now, instead of relying on the VolumeSnapshotClass CRD to exist, the credentials are fetched from the VolumeSnapshotContent CRD so that volume snapshots and volume snapshot contents that use credentials can be deleted provided the secret containing these credentials continues to exist. (BZ#1893739)

Previously, the Kubernetes FibreChannel (FC) volume plug-in did not properly flush a multipath device before deleting it, and in rare cases, a filesystem on a multipath FC device was corrupted during pod destruction. Now, Kubernetes flushes data before deleting a FC multipath device to prevent filesystem corruption. (BZ#1903346)

The nosmt additional kernel argument that configures hyperthreading was previously undocumented for use with OpenShift Container Platform. To disable hyperthreading, create a performance profile that is appropriate for your hardware and topology, and then set nosmt as an additional kernel argument.

TP: Technology Preview

GA: General Availability

-: Not Available

In OpenShift Container Platform 4.1, anonymous users could access discovery endpoints. Later releases revoked this access to reduce the possible attack surface for security exploits because some discovery endpoints are forwarded to aggregated API servers. However, unauthenticated access is preserved in upgraded clusters so that existing use cases are not broken.

## Snippet to remove unauthenticated group from all the cluster role bindings
$ for clusterrolebinding in cluster-status-binding discovery system:basic-user system:discovery system:openshift:discovery ;
do
### Find the index of unauthenticated group in list of subjects
index=$(oc get clusterrolebinding ${clusterrolebinding} -o json | jq 'select(.subjects!=null) | .subjects | map(.name=="system:unauthenticated") | index(true)');
### Remove the element at index from subjects array
oc patch clusterrolebinding ${clusterrolebinding} --type=json --patch "[{'op': 'remove','path': '/subjects/$index'}]";
done

When powering on a virtual machine on vSphere with user-provisioned infrastructure, the process of scaling up a node might not work as expected. A known issue in the hypervisor configuration causes machines to be created within the hypervisor but not powered on. If a node appears to be stuck in the Provisioning state after scaling up a machine set, you can investigate the status of the virtual machine in the vSphere instance itself. Use the VMware commands govc tasks and govc events to determine the status of the virtual machine. Check for a similar error message to the following:

[Invalid memory setting: memory reservation (sched.mem.min) should be equal to memsize(8192). ]

If you are running a cluster on VMware that uses x86_64 architecture and has the platform: none field set in the install-config.yaml file, a fresh installation on OpenShift Container Platform cluster version 4.7 or an upgrade from cluster version 4.6 to version 4.7 might fail. This failure happens when a cluster uses virtual machines (VMs) that are configured with virtual hardware version 14 or greater. As a workaround, you can configure VMs to use virtual hardware version 13.

If you are running cluster monitoring with an attached PVC for Prometheus, you might experience OOM kills during upgrade to OpenShift Container Platform 4.7. When persistent storage is in use for Prometheus, Prometheus memory usage doubles during cluster upgrade and for several hours after upgrade is complete. To avoid the OOM kill issue, allow worker nodes with double the size of memory that was available prior to the upgrade. (BZ#1925061)

Starting and stopping pods rapidly can result in pods getting stuck in the Terminating state. As a workaround, you must remove the stuck pod by running the following command:

$ oc delete --force -n <project_name> <pod_name>

RHCOS real time (RT) kernels are currently only supported on compute nodes, not control plane nodes. Compact clusters are not supported with RT kernels in OpenShift Container Platform 4.7. (BZ#1887007)

It is currently not possible to use the AWS Secure Token Service (STS), which is a Technology Preview feature, in a cluster installed into the AWS C2S Secret Region due to current OpenShift Container Platform limitations. This will be fixed in a future release of OpenShift Container Platform. (BZ#1927157)

Installing a cluster into the AWS C2S Secret Region using your own infrastructure based on Red Hat’s recommended CloudFormation templates does not work due to issues with creating the bootstrap nodes during the installation process. (BZ#1924080)

Upgrading Performance Addon Operator from 4.6 to 4.7 fails with the error:

"Warning  TooManyOperatorGroups  11m   operator-lifecycle-manager  csv created in namespace with multiple operatorgroups, can't pick one automatically"

A reboot is sometimes required to enact SR-IOV changes on supported NICs. SR-IOV currently issues the reboot when it is ready. If this reboot coincides with changes in the Machine Config policy, the node can be left in an undetermined state. The Machine Config Operator assumes that the updated policy has been applied when it has not.

The stalld service triggers a bug in the kernel, which results in the node freezing. In order to work around this issue, the Performance Addon Operator disables stalld by default. The fix impacts latency associated with DPDK based workloads, however the functionality will be restored once the kernel bug (BZ#1912118) is fixed.

Fluentd pods with the ruby-kafka-1.1.0 and fluent-plugin-kafka-0.13.1 gems are not compatible with Apache Kafka version 0.10.1.0. For more information, see "Known issues" in the Red Hat OpenShift Logging 5.0 release notes.

Precision Time Protocol (PTP) faults are observed on the Mellanox MT27800 Family [ConnectX-5] of adapter cards. In the ptp4l log, errors are observed which disturb clock synchronization.

Previously, a bug in the OpenStack SDK caused a failure when requesting server group OSP16. Consequently, the UPI playbook control-plane.yaml fails during the task to create the control plane server. As a temporary workaround, you can request a hotfix to update the OpenStack SDK, which updates the OpenStack SDK on the bastion host to execute UPI Ansible tasks to at least python-openstacksdk-0.36.4-1.20201113235938.el8ost. With this hotfix, the playbook successfully runs. (BZ#1891816)

When attempting an IPI installation on bare metal using the latest Dell firmware (04.40.00.00) nodes will not be deployed and an error is displayed in their status. This is due to Dell Firmware (4.40.00.00) using eHTML5 as the Virtual Console Plug-in.

Installing a cluster on RHOSP that uses Kuryr times out with the following messages during bootstrapping:

INFO Waiting up to 20m0s for the Kubernetes API at https://api.ostest.shiftstack.com:6443...
INFO API v1.20.0+ba45583 up
INFO Waiting up to 30m0s for bootstrapping to complete...
ERROR Attempted to gather ClusterOperator status after wait failure: listing ClusterOperator objects: Get "https://api.ostest.shiftstack.com:6443/apis/config.openshift.io/v1/clusteroperators": dial tcp 10.46.44.166:6443: connect: connection refused
INFO Use the following commands to gather logs from the cluster
INFO openshift-install gather bootstrap --help
FATAL failed to wait for bootstrapping to complete: timed out waiting for the condition

$ rm -f openshift/99_openshift-cluster-api_master-machines-*.yaml openshift/99_openshift-cluster-api_worker-machineset-*.yaml

$ rm -f openshift/99_openshift-cluster-api_worker-machineset-*.yaml

In OpenShift Container Platform 4.3 and 4.4, if the user has the console open in multiple tabs, some sidebar links in the Developer perspective do not directly link to the project, and there is an unexpected shift in the selected project. This will be resolved in a future release. (BZ#1839101)

In OpenShift Container Platform 4.5, a user with scale permissions cannot scale a deployment or deployment config using the console if they do not have edit rights to the deployment or deployment config. This will be resolved in a future release. (BZ#1886888)

In OpenShift Container Platform 4.5, when there is minimal or no data in the Developer perspective, most of the monitoring charts or graphs (CPU consumption, memory usage, and bandwidth) show a range of -1 to 1. However, none of these values can ever go below zero. This will be resolved in a future release. (BZ#1904106)

Currently, the prerequisites in the web console quick start cards appear as a paragraph instead of a list. This will be resolved in a future release. (BZ#1905147)

Currently, in the Search Page, the Pipelines resources table is not immediately updated after the Name filter is applied or removed. However, if you refresh the page or close and expand the Pipelines section, the Name filter is applied. The same behavior is seen when you remove the Name filter. This will be resolved in a future release. (BZ#1901207).

The Operator SDK CLI tool supports running on macOS, however the macOS binary is currently missing from the OpenShift mirror site. The macOS binary will be added in a future update. (BZ#1930357)

Currently, on clusters with IPsec enabled, Red Hat Enterprise Linux (RHEL) 7.9 nodes cannot communicate with Red Hat Enterprise Linux CoreOS (RHCOS) nodes. (BZ#1925925)

If you have clusters that expose the default Ingress Controller through an administrator-provisioned external load balancer that redirects all HTTP traffic to HTTPS, you must patch the new clear-text Ingress Canary route to use edge termination during the 4.6 to 4.7 upgrade process.

$ oc patch route/canary -n openshift-ingress-canary -p '{"spec":{"tls":{"termination":"edge","insecureEdgeTerminationPolicy":"Redirect"}}}'

Updates to openvswitch ("net: openvswitch: reorder masks array based on usage") code causes the openvswitch et/openvswitch/flow_table::flow_lookup accessing per-cpu data condition on preemptible (and migratable) sections, leading to a real time kernel panic. As a result, the kernel-rt is unstable and will impact low latency applications.

The SR-IOV device plug-in does not allow VFIO devices on the nodes to be exposed as resources. This results in DPDK workloads being blocked on Intel devices.

In OpenShift Container Platform 4.7, ConfigInformers objects added to the Operator infrastructure code unsuccessfully start. As a result, the ConfigObserver object fails to sync the cache. When this happens, the oVirt CSI Driver Operator shuts down after a couple of minutes, which leads to continual restarts. As a workaround, you can perform the following procedure:

The oc annotate command does not work for LDAP group names that contain an equal sign (=), because the command uses the equal sign as a delimiter between the annotation name and value. As a workaround, use oc patch or oc edit to add the annotation. (BZ#1917280)

The OVN-Kubernetes network provider does not support the externalTrafficPolicy feature for NodePort- and LoadBalancer-type services. The service.spec.externalTrafficPolicy field determines whether traffic for a service is routed to node-local or cluster-wide endpoints. Currently, such traffic is routed by default to cluster-wide endpoints, and there is no way to limit traffic to node-local endpoints. This will be resolved in a future release. (BZ#1903408)

Currently, a Kubernetes port collision issue can cause a breakdown in pod-to-pod communication, even after pods are redeployed. For detailed information and a workaround, see the Red Hat Knowledge Base solution Port collisions between pod and cluster IPs on OpenShift 4 with OVN-Kubernetes. (BZ#1939676, BZ#1939045)

In OpenShift Container Platform 4.7, pod limits and requests do not appear in the web console. This feature cannot be implemented in this release without introducing a breaking change to monitoring. This feature is fixed in OpenShift Container Platform 4.8 release. For detailed information, see the Red Hat Knowledge Base solution OpenShift Container Platform 4.7 console no longer displays request or limit lines on CPU and Memory usage charts (BZ#1975147)