ELBA-2022-9349

ELBA-2022-9349 - olcne bug fix update

Type:	BUG
Impact:	NA
Release Date:	2022-05-03

Description

olcne
[1.5.0-2]
- Upgrade Helm to 3.7.1-2

[1.5.0-2]
- fix null pointer exception in systemd service state validation

[1.5.0-1]
- Introduce support for compact Kubernetes clusters
- Introduce MetalLB
- Introduce Oracle Cloud Infrastructure Cloud Controller Manager
- Improved log messages in Platform API Server and Platform Agent
- Upgrade Kubernetes to 1.22.8
- Upgrade Istio to 1.13.2
- Renamed the oci-csi module to oci-ccm

[1.5.0-20.alpha]
- Update istio-1.13.2 grafana to 7.5.15

[1.5.0-14.alpha]
- Metallb fix

[1.5.0-11.alpha]
- Remove module directories when olcne rpm is uninstalled

[1.5.0-10.alpha]
- OCI CCM 0.13.0

[1.5.0-9.alpha]
- Reworked log messages

[1.5.0-8.alpha]
- Update Istio to 1.13.2(prometheus-2.31.1, grafana-8.4.6)

[1.5.0-7.alpha]
- Update Istio to 1.12.6(prometheus-2.30.1, grafana-7.5.15)

[1.5.0-6.alpha]
- Update to k8s 1.22 with golang 1.17

[1.5.0-5.alpha]
- Update internal docs for oci-ccm module

[1.5.0-4.alpha]
- Extend oci-ccm module to support load balancer

[1.5.0-3.alpha]
- Firewall pre-req

[1.5.0-2.alpha]
- Ensure that config map settings needed by metallb is preserved during k8s upgrade

[1.5.0-1.alpha]
- Metallb module

[1.4.1-14]
- Added 1.4 extra images to registry-image-helper.sh script

[1.4.1-13]
- Update sudoers file and changed its permissions to '0440'

[1.4.1-12]
- Update olcne-kubernetes.md file for 'compact' flag

[1.4.1-11]
- Ensure that the order of items in an upgraded config file is stable with respect to the original file

[1.4.1-10]
- Ensure that old olcnectl config files are upgraded

[1.4.1-9]
- Rename oci-csi module to oci-ccm and add support for oci-ccm loadbalancer creation

[1.4.1-8]
- Make 'compact' flag updatable

[1.4.1-7]
- Introduce 'compact' that enables control-plane nodes to run any workloads

[1.4.1-6]
- Ability to label 1 or more kubernetes nodes

[1.4.1-5]
- Fixed a bug where specifying a port in the container-registry argument
to the Kubernetes module would result in pods not being able to start.

[1.4.1-4]
- Update helm to 3.7.1

[1.4.1-3]
- Update versions to Istio-1.12.2, prometheus-2.31.1 and grafana-7.5.11

[1.4.1-2]
- Allow loadbalancer to be configured regardless of security list mode

[1.4.0-4]
- Fix bug in initialising certs manager when environment name not mentioned

[1.4.0-3]
- Fix bug in fetching report for multi-environment

[1.4.0-2]
- Pause image is 3.4.1

[1.4.0-1]
- CSI plugin
- Reports feature
- Kubernetes-1.20.6 to Kubernetes-1.21.6 upgrade
- Istio-1.9.4 to Istio-1.11.4 upgrade
- Component upgrades
- Config file feature

[1.3.0-13]
- Fix iptables issue when running on OL7 host using OL8 image

[1.3.0-12]
- Address CVE's ISTIO-SECURITY-2021-003, ISTIO-SECURITY-2021-005, ISTIO-SECURITY-2021-006, ISTIO-SECURITY-2021-007

[1.3.0-11]
- Fixed yaml file to stop olcne-nginx and keepalived services at uninstall [Orabug: 32296282]

[1.3.0-10]
- Fixed missing double semicolon in registry image helper

[1.3.0-9]
istio
[1.12.6-1]
- Addresses CVE-2022-24726, CVE-2022-24921

istio
[1.13.2-1]
- Added Oracle specific files for 1.13.2-1

olcne-selinux
kubernetes
[1.22.8-1]
- Added Oracle specific build files for Kubernetes

coredns
[1.8.4-1]
- Added Oracle specific build files

etcd
[3.4.13-3]
- Updated THIRD_PARTY_LICENSES.txt generated using pls attribution-helper

[3.4.13-2]
- Added buildhost variable
- updated golang version

[3.4.13-1]
- Added Oracle specific build files

kubernetes-cni-plugins
[1.0.1-3]
- Updated THIRD_PARTY_LICENSES.txt generated using pls attribution-helper

[1.0.1-2]
- Add flannel-cni-plugins as a dependency

[1.0.1-1]
- Added Oracle specific build files for Kubernetes CNI Plugins

flannel-cni-plugin
[1.0.1-1]
- Added Oracle specific build files for Flannel CNI Plugins

kubernetes-cni
[1.0.1-2]
- Updated THIRD_PARTY_LICENSES.txt generated using pls attribution-helper

[1.0.1-1]
- Added Oracle specific build files for Kubernetes CNI

conmon
[3:2.0.26-2]
- updated golang version
- added buildhost variable

[3:2.0.26-1]
- Added build scripts

cri-o
[1.22.3-2]
- Updated THIRD_PARTY_LICENSES.txt generated using pls attribution-helper

[1.22.3-1]
- Added Oracle Specifile Files for cri-o

cri-tools
[1.22.0-2]
- Updated THIRD_PARTY_LICENSES.txt generated using pls attribution-helper

[1.22.0-1]
- Added Oracle Specific Build Files for cri-tools

kata-proxy
[1.12.1-4]
- Updated THIRD_PARTY_LICENSES.txt generated using pls attribution-helper

[1.12.1-3]
- updated golang version
- added buildhost variable

[1.12.1-2]
- Golang 1.15.9

[1.12.1-1]
- Added Oracle Specific Build Files for kata-proxy

kata-runtime
[1.12.1-4]
- Updated THIRD_PARTY_LICENSES.txt generated using pls attribution-helper

[1.12.1-3]
- updated golang version
- added buildhost variable

[1.12.1-2]
- Golang 1.15.9

[1.12.1-1]
- Added Oracle Specific Files For kata-runtime

kata-shim
[1.12.1-4]
- Updated THIRD_PARTY_LICENSES.txt generated using pls attribution-helper

[1.12.1-3]
- updated golang version
- added buildhost variable

[1.12.1-2]
- Golang 1.15.9

[1.12.1-1]
- Added Oracle Specific Build Files for kata-shim

kata-ksm-throttler
[1.12.1-4]
- Updated THIRD_PARTY_LICENSES.txt generated using pls attribution-helper

[1.12.1-3]
- updated golang version
- added buildhost variable

[1.12.1-2]
- Golang 1.15.9

[1.12.1-1]
- Added Oracle Specific Build Files for kata-ksm-throttler

kata-agent
[1.12.1-4]
- Updated THIRD_PARTY_LICENSES.txt generated using pls attribution-helper

[1.12.1-3]
- updated golang version
- added buildhost variable

[1.12.1-2]
- Golang 1.15.9

[1.12.1-1]
- Added Oracle Specific Build Files for kata-agent

kata-image
[1.12.1-3]
- updated golang version
- added buildhost variable

[1.12.1-2]
- Golang 1.15.9

[1.12.1-1]
- Added Oracle Specific Build Files for kata-image

yq
[3.4.0-3]
- updated golang version
- added buildhost variable

[3.4.0-2]
- Address CVE-2021-27918

[3.4.0-1]
- Added Oracle specific build files

kata
[1.12.1-4]
- update kata-image versions
- update kernel-uek-container version to kernel-uek-container-5.4.17-2136.306.1.3

[1.21.1-3]
- Support k8s 1.21.6
- updated kernel-uek-container version
- updated kata-image versions
- added buildhost variable

[1.12.1-2]
- Golang 1.15.9

[1.12.1-1]
- Updated to kata 1.12.1
- Updated guest kernel (kernel-uek-container) minimum version to UEK6U2 (5.4.17-2102.200.7)

helm
[3.7.1-2]
- Updated THIRD_PARTY_LICENSES.txt generated using pls attribution-helper

[3.7.1-1]
- Added Oracle Specific build Files

container-selinux
[2:2.119.2-1.911c772]
- fix #1811759

[2:2.119.1-2.c57a6f9]
- update to 2.119.1 RHEL7 branch
- Related: RHELPLAN-26239

[2:2.107-3]
- use 2.107 in RHEL7u7
- add build.sh script

[2:2.107-2]
- Resolves: #1626215

[2:2.107-1]
- bump to v2.107

[2:2.99-1]
- built commit b13d03b

[2:2.95-2]
- rebase

[2:2.84-2]
- rebase

[2.77-1]
- backported fixes from upstream

[2.76-1]
- Allow containers to use fuse file systems by default
- Allow containers to sendto dgram socket of container runtimes
- Needed to run container runtimes in notify socket unit files.

[2.74-1]
- Allow containers to setexec themselves

[2:2.73-3]
- tweak macro for fedora - applies to rhel8 as well

[2:2.73-2]
- moved changelog entries:
- Define spc_t as a container_domain, so that container_runtime will transition
to spc_t even when setup with nosuid.
- Allow container_runtimes to setattr on callers fifo_files
- Fix restorecon to not error on missing directory

[2.69-3]
- Make sure we pull in the latest selinux-policy

[2.69-2]
- Add map support to container-selinux for RHEL 7.5
- Dontudit attempts to write to kernel_sysctl_t

[2.68-1]
- Add label for /var/lib/origin
- Add customizable_file_t to customizable_types

[2.67-1]
- Add policy for container_logreader_t

[2.66-1]
- Allow dnsmasq to dbus chat with spc_t

[2.64-1]
- Allow containers to create all socket classes

[2.62-1]
- Label overlay directories under /var/lib/containers/ correctly

[2.61-1]
- Allow spc_t to load kernel modules from inside of container

[2.60-1]
- Allow containers to list cgroup directories
- Transition for unconfined_service_t to container_runtime_t when executing container_runtime_exec_t.

[2.58-2]
- Run restorecon /usr/bin/podman in postinstall

[2.58-1]
- Add labels to allow podman to be run from a systemd unit file

[2.57-1]
- Set the version of SELinux policy required to the latest to fix build issues.

[2.56-1]
- Allow container_runtime_t to transition to spc_t over unlabeled files

[2.55-1]
Allow iptables to read container state
Dontaudit attempts from containers to write to /proc/self
Allow spc_t to change attributes on container_runtime_t fifo files

[2.52-1]
- Add better support for writing custom selinux policy for customer container domains.

[2.51-1]
- Allow shell_exec_t as a container_runtime_t entrypoint

[2.50-1]
- Allow bin_t as a container_runtime_t entrypoint

[2.49-1]
- Add support for MLS running container runtimes
- Add missing allow rules for running systemd in a container

[2.48-1]
- Update policy to match master branch
- Remove typebounds and replace with nnp_transition and nosuid_transition calls

[2.41-1]
- Add support to nnp_transition for container domains
- Eliminates need for typebounds.

[2.40-1]
- Allow container_runtime_t to use user ttys
- Fixes bounds check for container_t

[2.39-1]
- Allow container runtimes to use interited terminals. This helps
satisfy the bounds check of container_t versus container_runtime_t.

[2.38-1]
- Allow container runtimes to mmap container_file_t devices
- Add labeling for rhel push plugin

[2.37-1]
- Allow containers to use inherited ttys
- Allow ostree to handle labels under /var/lib/containers/ostree

[2.36-1]
- Allow containers to relabelto/from all file types to container_file_t

[2.35-1]
- Allow container to map chr_files labeled container_file_t

[2.34-1]
- Dontaudit container processes getattr on kernel file systems

[2.33-1]
- Allow containers to read /etc/resolv.conf and /etc/hosts if volume
- mounted into container.

[2.32-1]
- Make sure users creating content in /var/lib with right labels

[2.31-1]
- Allow the container runtime to dbus chat with dnsmasq
- add dontaudit rules for container trying to write to /proc

[2.29-1]
- Add support for lxcd
- Add support for labeling of tmpfs storage created within a container.

[2.28-1]
- Allow a container to umount a container_file_t filesystem

[2.27-1]
- Allow container runtimes to work with the netfilter sockets
- Allow container_file_t to be an entrypoint for VM's
- Allow spc_t domains to transition to svirt_t

[2.24-1]
- Make sure container_runtime_t has all access of container_t

[2.23-1]
- Allow container runtimes to create sockets in tmp dirs

[2.22-1]
- Add additonal support for crio labeling.

[2.21-3]
- Fixup spec file conditionals

[2:2.21-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

[2.21-1]
- Allow containers to execmod on container_share_t files.

[2.20-2]
- Relabel runc and crio executables

[2.20-1]
- Allow container processes to getsession

[2:2.19-2.1]
- update release tag to isolate from 7.3

[2:2.19-1]
- Fix mcs transition problem on stdin/stdout/stderr
- Add labels for CRI-O
- Allow containers to use tunnel sockets

[2:2.15-1.1]
- Resolves: #1451289
- rebase to v2.15
- built @origin/RHEL-1.12 commit 583ca40

[2:2.10-2.1]
- Make sure we have a late enough version of policycoreutils

[2:2.10-1]
- Update to the latest container-selinux patch from upstream
- Label files under /usr/libexec/lxc as container_runtime_exec_t
- Give container_t access to XFRM sockets
- Allow spc_t to dbus chat with init system
- Allow containers to read cgroup configuration mounted into a container

[2:2.9-4]
- Resolves: #1425574
- built commit 79a6d70

[2:2.9-3]
- Resolves: #1420591
- built @origin/RHEL-1.12 commit 8f876c4

[2:2.9-2]
- built @origin/RHEL-1.12 commit 33cb78b

[2:2.8-2]
-

[2:2.7-1]
- built origin/RHEL-1.12 commit 21dd37b

[2:2.4-2]
- correct version-release in changelog entries

[2:2.4-1]
- Add typebounds statement for container_t from container_runtime_t
- We should only label runc not runc*

[2:2.3-1]
- Fix labeling on /usr/bin/runc.*
- Add sandbox_net_domain access to container.te
- Remove containers ability to look at /etc content

[2:2.2-4]
- use upstream's RHEL-1.12 branch, commit 56c32da for CentOS 7

[2:2.2-3]
- properly disable docker module in %post

[2:2.2-2]
- depend on selinux-policy-targeted
- relabel docker-latest* files as well

[2:2.2-1]
- bump to v2.2
- additional labeling for ocid

[2:2.0-2]
- install policy at level 200
- From: Dan Walsh

[2:2.0-1]
- Resolves: #1406517 - bump to v2.0 (first upload to Fedora as a
standalone package)
- include projectatomic/RHEL-1.12 branch commit for building on centos/rhel

[2:1.12.4-29]
- new package (separated from docker)

Updated Packages

Release/Architecture

Filename

sha256

Superseded By Advisory

Channel Label

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team