We need a script to migrate bad data created by v3.4.0.40 to the new prefixed keys in etcd as a remediation for clusters that previously ran v3.4.0.39. See https://bugzilla.redhat.com/show_bug.cgi?id=1415570 for additional information. Test Scenarios: no data that needs migrating (top-level directories don't exist) non-conflicting data that needs migrating (dry-run and applying) conflicting data that needs migrating (dry-run and applying)
Comment 0 has a typo, the bad data was created by v3.4.0.39 and v3.4.0.40 fixed the issue but did not migrate data.
Verification test: =======3.4.0.39:========== - # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xxx.2.xxx:2379 ls /openshift.io/ /openshift.io/authorization /openshift.io/ranges /openshift.io/images /openshift.io/routes /openshift.io/builds /openshift.io/identities /openshift.io/oauth /openshift.io/registry /openshift.io/imagestreams /openshift.io/templates /openshift.io/deploymentconfigs /openshift.io/buildconfigs /openshift.io/users 1).- # oc create -f old-object.json egressnetworkpolicy "a" created egressnetworkpolicy "b" created identity "x:a" created identity "x:b" created - # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xxx.2.xxx:2379 ls /openshift.io/identities /openshift.io/identities/htpasswd_auth:weshi /openshift.io/identities/x:a /openshift.io/identities/x:b - # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xxx.2.xxx:2379 ls /openshift.io/egressnetworkpolicies /openshift.io/egressnetworkpolicies/default - # oc get egressnetworkpolicies NAME a b - # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xxx.2.xxx:2379 ls /openshift.io/registry /openshift.io/registry/sdnnetworks /openshift.io/registry/sdnsubnets - # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xxx.2.xxx:2379 ls /openshift.io/ /openshift.io/deploymentconfigs /openshift.io/oauth /openshift.io/registry /openshift.io/authorization /openshift.io/builds /openshift.io/buildconfigs /openshift.io/users /openshift.io/imagestreams /openshift.io/templates /openshift.io/routes /openshift.io/identities /openshift.io/egressnetworkpolicies /openshift.io/ranges /openshift.io/images =============3.4.0.40============ dry-run: - # ./fix-3.4-paths.sh -c /etc/origin/master/ https://192.xxx.2.xxx:2379 Running in dry-run mode. Use -a option to apply changes. Migrating Users dry-run: copying /openshift.io/identities/htpasswd_auth:weshi to /openshift.io/useridentities/htpasswd_auth:weshi dry-run: copying /openshift.io/identities/x:a to /openshift.io/useridentities/x:a dry-run: copying /openshift.io/identities/x:b to /openshift.io/useridentities/x:b Migrating Egress Policies dry-run: copying /openshift.io/egressnetworkpolicies/default/a to /openshift.io/registry/egressnetworkpolicy/default/a dry-run: copying /openshift.io/egressnetworkpolicies/default/b to /openshift.io/registry/egressnetworkpolicy/default/b - # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xxx.2.xxx:2379 ls /openshift.io /openshift.io/authorization /openshift.io/builds /openshift.io/imagestreams /openshift.io/templates /openshift.io/buildconfigs /openshift.io/users /openshift.io/egressnetworkpolicies /openshift.io/ranges /openshift.io/images /openshift.io/routes /openshift.io/identities /openshift.io/oauth /openshift.io/registry /openshift.io/deploymentconfigs Applying: - # ./fix-3.4-paths.sh -a -c /etc/origin/master/ https://192.xxx.2.xxx:2379Migrating Users copying /openshift.io/identities/htpasswd_auth:weshi to /openshift.io/useridentities/htpasswd_auth:weshi copying /openshift.io/identities/x:a to /openshift.io/useridentities/x:a copying /openshift.io/identities/x:b to /openshift.io/useridentities/x:b Migrating Egress Policies copying /openshift.io/egressnetworkpolicies/default/a to /openshift.io/registry/egressnetworkpolicy/default/a copying /openshift.io/egressnetworkpolicies/default/b to /openshift.io/registry/egressnetworkpolicy/default/b - # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xxx.2.xxx:2379 ls /openshift.io /openshift.io/authorization /openshift.io/builds /openshift.io/imagestreams /openshift.io/templates /openshift.io/buildconfigs /openshift.io/users /openshift.io/ranges /openshift.io/images /openshift.io/routes /openshift.io/identities /openshift.io/egressnetworkpolicies /openshift.io/useridentities /openshift.io/oauth /openshift.io/registry /openshift.io/deploymentconfigs - # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xxx.2.xxx:2379 ls /openshift.io/useridentities /openshift.io/useridentities/htpasswd_auth:weshi /openshift.io/useridentities/x:a /openshift.io/useridentities/x:b - # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xxx.2.xxx:2379 ls /openshift.io/registry/egressnetworkpolicy/default /openshift.io/registry/egressnetworkpolicy/default/a /openshift.io/registry/egressnetworkpolicy/default/b - # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xxx.2.xxx:2379 ls /openshift.io/identities /openshift.io/identities/htpasswd_auth:weshi /openshift.io/identities/x:a /openshift.io/identities/x:b - #.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xxx.2.xxx:2379 ls /openshift.io/egressnetworkpolicies/default /openshift.io/egressnetworkpolicies/default/b /openshift.io/egressnetworkpolicies/default/a
------------------------------------ Test Scenarios: no data that needs migrating (top-level directories don't exist) ---------------------------------- 3.4.0.39: # oc whoami system:admin # oc get identity No resources found. # oc get egressnetworkpolicy No resources found. # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xx.2.xx:2379 ls /openshift.io /openshift.io/authorization /openshift.io/registry /openshift.io/templates /openshift.io/routes /openshift.io/buildconfigs /openshift.io/oauth /openshift.io/imagestreams /openshift.io/images /openshift.io/deploymentconfigs /openshift.io/builds /openshift.io/ranges # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xxx.2.xx:2379 ls /openshift.io/registry /openshift.io/registry/sdnnetworks /openshift.io/registry/sdnsubnets upgrade to 3.4.0.40: # ./fix-3.4-paths.sh -c /etc/origin/master/ https://192.xxx.2.xx:2379 Running in dry-run mode. Use -a option to apply changes. Migrating Users Error: 100: Key not found (/openshift.io/identities) [2594] Migrating Egress Policies Error: 100: Key not found (/openshift.io/egressnetworkpolicies) [2594] # ./fix-3.4-paths.sh -a -c /etc/origin/master/ https://192.xx.2.xx:2379 Migrating Users Error: 100: Key not found (/openshift.io/identities) [2661] Migrating Egress Policies Error: 100: Key not found (/openshift.io/egressnetworkpolicies) [2661] notes: the migrate script will not be executed as expected, but the error msg looks like not friendly enough, is it possible to improve it? thanks
----------------------------- Test Scenarios: conflicting data that needs migrating (dry-run and applying) ------------------------------- 3.3.1.11: # oc create -f old-object.json egressnetworkpolicy "a" created egressnetworkpolicy "b" created identity "x:a" created identity "x:b" created # oc get identity x:b -o yaml|grep source source: original resourceVersion: "1653" # oc get egressnetworkpolicy b -o yaml|grep source source: original resourceVersion: "1651" # oc get identity x:a -o yaml|grep source source: original resourceVersion: "1652" upgrade to 3.4.0.39: # oc get identity No resources found. # oc get egressnetworkpolicies No resources found. # oc create -f new-object.json egressnetworkpolicy "b" created egressnetworkpolicy "c" created identity "x:b" created identity "x:c" created # oc get egressnetworkpolicy b -o yaml |grep source source: new resourceVersion: "2267" [root@openshift-123 tmp]# oc get identity x:b -o yaml |grep source source: new resourceVersion: "2269" upgrade to 3.4.0.40: # oc get identity NAME IDP NAME IDP USER NAME USER NAME USER UID htpasswd_auth:geliu htpasswd_auth geliu geliu 33a2a7d5-e3b6-11e6-851f-fa163e53e53d x:a x a x:b x b # oc get identity x:b -o yaml |grep source source: original resourceVersion: "1653" # oc get egressnetworkpolicy b -o yaml |grep source source: original resourceVersion: "1651" # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xx.2.xx:2379 ls /openshift.io /openshift.io/egressnetworkpolicies /openshift.io/authorization /openshift.io/registry /openshift.io/deploymentconfigs /openshift.io/routes /openshift.io/builds /openshift.io/buildconfigs /openshift.io/identities /openshift.io/useridentities /openshift.io/oauth /openshift.io/ranges /openshift.io/imagestreams /openshift.io/templates /openshift.io/images /openshift.io/users # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xx.2.xxx:2379 ls /openshift.io/useridentities /openshift.io/useridentities/x:b /openshift.io/useridentities/htpasswd_auth:geliu /openshift.io/useridentities/x:a # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xxx.2.xxx:2379 ls /openshift.io/registry /openshift.io/registry/sdnsubnets /openshift.io/registry/egressnetworkpolicy /openshift.io/registry/sdnnetworks # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xxx.2.xxx:2379 ls /openshift.io/registry/egressnetworkpolicy/default /openshift.io/registry/egressnetworkpolicy/default/a /openshift.io/registry/egressnetworkpolicy/default/b Execute migrate script: 1). dry-run: # ./fix-3.4-paths.sh -c /etc/origin/master https://192.xxx.2.xxx:2379 Running in dry-run mode. Use -a option to apply changes. Migrating Users dry-run: copying /openshift.io/identities/x:c to /openshift.io/useridentities/x:c dry-run: copying /openshift.io/identities/htpasswd_auth:geliu to /openshift.io/useridentities/htpasswd_auth:geliu dry-run: overwriting existing key /openshift.io/useridentities/htpasswd_auth:geliu dry-run: copying /openshift.io/identities/x:b to /openshift.io/useridentities/x:b dry-run: overwriting existing key /openshift.io/useridentities/x:b Migrating Egress Policies dry-run: copying /openshift.io/egressnetworkpolicies/default/b to /openshift.io/registry/egressnetworkpolicy/default/b dry-run: overwriting existing key /openshift.io/registry/egressnetworkpolicy/default/b dry-run: copying /openshift.io/egressnetworkpolicies/default/c to /openshift.io/registry/egressnetworkpolicy/default/c # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xx.2.xx:2379 ls /openshift.io/registry/egressnetworkpolicy/default /openshift.io/registry/egressnetworkpolicy/default/a /openshift.io/registry/egressnetworkpolicy/default/b 2). applying: # ./fix-3.4-paths.sh -a -c /etc/origin/master https://192.xx.2.xx:2379 Migrating Users copying /openshift.io/identities/x:b to /openshift.io/useridentities/x:b overwriting existing key /openshift.io/useridentities/x:b copying /openshift.io/identities/x:c to /openshift.io/useridentities/x:c copying /openshift.io/identities/htpasswd_auth:geliu to /openshift.io/useridentities/htpasswd_auth:geliu overwriting existing key /openshift.io/useridentities/htpasswd_auth:geliu Migrating Egress Policies copying /openshift.io/egressnetworkpolicies/default/b to /openshift.io/registry/egressnetworkpolicy/default/b overwriting existing key /openshift.io/registry/egressnetworkpolicy/default/b copying /openshift.io/egressnetworkpolicies/default/c to /openshift.io/registry/egressnetworkpolicy/default/c # oc get egressnetworkpolicy a -o yaml|grep source source: original resourceVersion: "1650" # oc get egressnetworkpolicy b -o yaml|grep source source: new resourceVersion: "2880" # oc get egressnetworkpolicy c -o yaml|grep source source: new resourceVersion: "2881" # oc get identity x:a -o yaml|grep source source: original resourceVersion: "1652" # oc get identity x:b -o yaml|grep source source: new resourceVersion: "2877" # oc get identity x:c -o yaml|grep source source: new resourceVersion: "2878" # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xx.2.xx:2379 ls /openshift.io/registry/egressnetworkpolicy/default /openshift.io/registry/egressnetworkpolicy/default/a /openshift.io/registry/egressnetworkpolicy/default/b /openshift.io/registry/egressnetworkpolicy/default/c # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xx.2.xx:2379 ls /openshift.io/useridentities /openshift.io/useridentities/x:c /openshift.io/useridentities/htpasswd_auth:geliu /openshift.io/useridentities/x:a /openshift.io/useridentities/x:b
QE verified this bug with the additional tests suggested by Seth. No issues found.
Verified the additional test scenarios: 1). backup dir specfifcatioin works well with -d option 2). verify the old key removed from etcd(/openshift.io/identities & /openshift.io/egressnetworkpolicies) 3). verify key with whitespace works well("/openshift.io/useridentities/x:c 1" & "/openshift.io/registry/egressnetworkpolicy/default/c 1") 3.4.0.39: # oc create -f object.json egressnetworkpolicy "b" created egressnetworkpolicy "c 1" created identity "x:b" created identity "x:c 1" created [root@openshift-203 tmp]# oc get identity NAME IDP NAME IDP USER NAME USER NAME USER UID allow_all:geliu allow_all geliu geliu bdeba941-ec32-11e6-a145-fa163e0251e6 x:b x b x:c 1 x c 1 [root@openshift-203 tmp]# oc get egressnetworkpolicy NAME b c 1 # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xx.1.xx5:2379 ls /openshift.io/useridentities /openshift.io/useridentities/allow_all:anli /openshift.io/useridentities/allow_all:anli2 /openshift.io/useridentities/allow_all:anli3 # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xx.1.xx:2379 ls /openshift.io/identities /openshift.io/identities/allow_all:geliu /openshift.io/identities/x:b /openshift.io/identities/x:c 1 # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.168.1.195:2379 ls /openshift.io/egressnetworkpolicies/default /openshift.io/egressnetworkpolicies/default/b /openshift.io/egressnetworkpolicies/default/c 1 # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.168.1.195:2379 ls /openshift.io/registry /openshift.io/registry/sdnnetworks /openshift.io/registry/sdnsubnets [root@openshift-203 tmp]# 3.4.0.40: # oc get egressnetworkpolicies No resources found. [root@openshift-203 tmp]# # oc get identity NAME IDP NAME IDP USER NAME USER NAME USER UID allow_all:anli allow_all anli anli 0328f663-ec2a-11e6-af39-fa163e0251e6 allow_all:anli2 allow_all anli2 anli2 05f847f1-ec2a-11e6-af39-fa163e0251e6 allow_all:anli3 allow_all anli3 anli3 0918108d-ec2a-11e6-af39-fa163e0251e6 Dry-run: [root@openshift-203 tmp]# ./fix-3.4-paths.sh -c /etc/origin/master/ https://192.xx.1.xx:2379 -b /tmp Running in dry-run mode. Use -a option to apply changes. dry-run: Migrating Users dry-run: copying /openshift.io/identities/allow_all:geliu to /openshift.io/useridentities/allow_all:geliu dry-run: copying /openshift.io/identities/x:b to /openshift.io/useridentities/x:b dry-run: copying /openshift.io/identities/x:c 1 to /openshift.io/useridentities/x:c 1 dry-run: Migrating Egress Policies dry-run: Project default dry-run: copying /openshift.io/egressnetworkpolicies/default/b to /openshift.io/registry/egressnetworkpolicy/default/b dry-run: copying /openshift.io/egressnetworkpolicies/default/c 1 to /openshift.io/registry/egressnetworkpolicy/default/c 1 # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xx.1.xx:2379 ls /openshift.io/registry /openshift.io/registry/sdnnetworks /openshift.io/registry/sdnsubnets # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xx.1.xx:2379 ls /openshift.io/useridentities /openshift.io/useridentities/allow_all:anli /openshift.io/useridentities/allow_all:anli2 /openshift.io/useridentities/allow_all:anli3 Applying: # ./fix-3.4-paths.sh -a -c /etc/origin/master/ https://192.xx.1.xx:2379 -b /tmp Migrating Users copying /openshift.io/identities/allow_all:geliu to /openshift.io/useridentities/allow_all:geliu copying /openshift.io/identities/x:b to /openshift.io/useridentities/x:b copying /openshift.io/identities/x:c 1 to /openshift.io/useridentities/x:c 1 Migrating Egress Policies Project default copying /openshift.io/egressnetworkpolicies/default/b to /openshift.io/registry/egressnetworkpolicy/default/b copying /openshift.io/egressnetworkpolicies/default/c 1 to /openshift.io/registry/egressnetworkpolicy/default/c 1 [root@openshift-203 tmp]# [root@openshift-203 tmp]# etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xx.1.xx:2379 ls /openshift.io/identities [root@openshift-203 tmp] [root@openshift-203 tmp]# etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xx.1.xx:2379 ls /openshift.io/egressnetworkpolicies/default [root@openshift-203 tmp]# # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xx.1.xx:2379 ls /openshift.io/useridentities /openshift.io/useridentities/allow_all:anli /openshift.io/useridentities/allow_all:anli2 /openshift.io/useridentities/allow_all:anli3 /openshift.io/useridentities/allow_all:geliu /openshift.io/useridentities/x:b /openshift.io/useridentities/x:c 1 # etcdctl --cert-file /etc/origin/master/master.etcd-client.crt --key-file=/etc/origin/master/master.etcd-client.key --ca-file /etc/origin/master/master.etcd-ca.crt --endpoint https://192.xx.1.xx:2379 ls /openshift.io/registry/egressnetworkpolicy/default /openshift.io/registry/egressnetworkpolicy/default/c 1 /openshift.io/registry/egressnetworkpolicy/default/b
Regard the backup dir: -b, if don't special '-b', the default dir is: /root/openshift-3.4-migration-backup # tree openshift-3.4-migration-backup openshift-3.4-migration-backup └── openshift.io ├── egressnetworkpolicies │ └── default │ ├── b │ └── c\ 1 └── identities ├── allow_all:geliu ├── x:b └── x:c\ 1 4 directories, 5 files if sepecal the '-b', it works well: # ./fix-3.4-paths.sh -a -c /etc/origin/master/ -b /tmp https://xx.xx.1.211:2379 Migrating Users copying /openshift.io/identities/x:b to /openshift.io/useridentities/x:b copying /openshift.io/identities/x:c 1 to /openshift.io/useridentities/x:c 1 Migrating Egress Policies Project default copying /openshift.io/egressnetworkpolicies/default/b to /openshift.io/registry/egressnetworkpolicy/default/b copying /openshift.io/egressnetworkpolicies/default/c 1 to /openshift.io/registry/egressnetworkpolicy/default/c 1 [root@openshift-200 tmp]# tree openshift.io openshift.io ├── egressnetworkpolicies │ └── default │ ├── b │ └── c\ 1 └── identities ├── x:b └── x:c\ 1 3 directories, 4 files
Regrading to script: 'fix-3.4-paths.sh', there is minor problem about the sequence of the parameters, if parameters behind "./fix-3.4-paths.sh" don't follow the giving sequence, then the parameters will be invalid. I filed another bug:https://bugzilla.redhat.com/show_bug.cgi?id=1419496 to trace this issue.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:0289