What's New in OpenShift Container Platform 4.6

Please join our OpenShift product managers for an in-depth overview of OpenShift 4.6 through OpenShift.tv on October 7 @ 10AM - 11:30 AM EST.

OpenShift.tv sets out to provide unprecedented access and engagement with experts from throughout Red Hat and the community in these trying times.

This is an exciting opportunity to engage the developers and IT professionals within your customer accounts by inviting them to interact directly with our OpenShift community and learn about the latest updates for OpenShift 4.6.

Learn more at openshift.tv. Subscribe to the calendar at red.ht/streamcal.

Transcript

1. 1 • Please direct your Q&A into the Q&A forum within Primetime or openshift.tv comments • Any outstanding questions will be addressed at the end of the presentation or responses will be facilitated after the briefing • This call is being recorded. The slide deck, recording, and Q&A will be provided after the call What’s New in OpenShift 4.6 Field Briefing
2. Table of Contents • Introductory Content • OpenShift 4.6 Spotlight Features • Hosted OpenShift • A broad ecosystem of workloads • Cloud Native Development ◦ Service Mesh ◦ Serverless ◦ Helm ◦ Pipelines ◦ GitOps ◦ Code Ready / Dev Tools • OpenShift Console • Observability • Core Platform ◦ Install and upgrades ◦ Control plane ◦ RHEL CoreOS ◦ Networking and Routing ◦ Storage • Telco • Security and Compliance • Multi-arch and Windows Containers
3. 3 What’s New in OpenShift 4.6 OpenShift Product Management
4. What's new in OpenShift 4.6 NEW INSTALLER PLATFORMS WORKLOAD STABILITY CORE PLATFORM Bare Metal IPI AWS and Azure Gov Clouds Disconnected Update Intelligence Remote Worker Nodes Real Time and Low Latency OVN (GA) Compliance Operator (GA) User Workload Monitoring (GA) Log Forwarding API (GA) Serverless Eventing (GA) OpenShift 4.6 5
5. OpenShift Roadmap APP DEV PLATFORM APP DEV • OpenShift Pipelines (Tekton) GA • OpenShift Builds (v2) TP • Jenkins Operator TP • Argo CD GA • Schema based forms for Event Sources • Improvements to GitOps experience • Cluster Update Compatibility Checks • Hybrid Operators with Operator-SDK • Simplify Operator Lifecycle interactions • IPv6 (single/dual stack on control plane) • Enable user space pod int & API Library • Utilize cgroups v2 • Azure Stack Hub support • AWS C2S and China support • Equinox Packet support • IBM Cloud support • Assisted Installer • Network Enhancements derived from OVN • Local storage support in OCS • OpenShift Service Mesh Federation • RHV UPI support • GPU Sharing OpenShift 4.7/4.8 • OSD GCP CCS & private clusters • OSD CCS on-demand Marketplace billing • OSD cluster autoscaling • OSD custom domains, log forwarding • ACM integration • OSD / AMRO PCI Certification H1 2021 • Improved getting started experience for devs • OpenShift Serverless Eventing GA • OpenShift Pipelines (Tekton) TP • Jenkins Operator TP • Monitor application workloads (GA) • Operator dependency tools v2 • OpenShift Builds (v2) TP OpenShift 4.6 • Amazon Red Hat OpenShift • ARO Government (MAG) support • OSD / AMRO Upgrade Scheduling • OSD / AMRO Machine Pools • AMRO Auto Scaling, BYO VPC • BYOK disk encryption (AWS, Azure) Q4 2020 • OVN GA, OVN Egress Firewall/Router/IP • Bare metal (IPI) GA • Remote worker nodes for Edge • Realtime kernel (TP, RAN use-cases only) • AWS GovCloud support • Microsoft Azure Government (MAG) support • VMware vSphere 7.0 support • Improved cloud credential handling • Disconnected OpenShift Update Service • GCP & Azure spot instances • CSI resize/snapshot GA • Windows containers GA • OAuth secure storage & inactivity timeout • Enhanced RHCOS static networking UX • Compliance Operator PLATFORM OpenShift 4.Next APP DEV PLATFORM MANAGED H2 2021 • OpenShift Single node • Utilize cgroups v2 • Microsoft Hyper-V (UPI) support • Alibaba Cloud support • Network Enhancements derived from OVN • Local storage support in OCS • OpenShift Service Mesh Multi-Cluster • Next gen SmartNic architecture • OSD / AMRO FedRAMP Certification • Build, Operate, Transfer operational model • Windows containers • GPU optimized VMs • Workload Metrics Visualization • Operator SDK: Python and Java Support • Operators install/upgrade as a group • Serverless Streaming • Console integration with Tekton Hub • Pipelines Notifications • OpenShift Builds (v2) GA • Jenkins Operator GA MANAGED MANAGED 7
6. What's New in OpenShift 4.6 Extended Update Support OpenShift EUS and Layered Product and Add-ons 4.6 EUS 2020 2021 2022 MAY JUN JUL AUG SEP OCT NOV DEC JAN FEB MAR APR MAY JUN JUL AUG SEP OCT NOV DEC JAN FEB MAR APR MAY JUN JUL AUG Duration of the Platform EUS Add-ons have a version that is guaranteed to work for Platform EUS OpenShift Logging OpenShift Container Storage Advanced Cluster Manager OpenShift Serverless OpenShift Pipelines OpenShift Service Mesh 10 LAYERED UPGRADE LAYERED UPGRADE LAYERED UPGRADE LAYERED UPGRADE LAYERED UPGRADE
7. What's new in OpenShift 4.6 Kubernetes 1.19 Scheduling • Customize the behavior of the Kube-scheduler • Scheduler Profiles • Pod Topology Spread constraints Control Plane & Security • Automatically track and act on the features not making Stable • Warning mechanism for use of deprecated APIs • AppProtocol to Services and Endpoints • Kubelet Client TLS Certificate bootstrap and rotation • NodeRestriction admission controller Misc • Structured Logging proposal CRI-O 1.19 Kubernetes 1.19 OpenShift 4.6 Blog: https://www.openshift.com/blog/kubernetes-1.19-arrives 11 Storage • Immutable Secrets and ConfigMaps • CSI Storage Capacity management (alpha)
8. 12 OpenShift 4.6 Spotlight Features
9. What's new in OpenShift 4.6 13 *External Load Balancers (routing) and external DNS servers are provided by the user OpenShift install Bare Metal Nodes OpenShift Cluster ▸ Installer provisions • Networks • Internal load balancers * • Internal DNS * • Red Hat CoreOS installation • CoreOS ignition configs • OpenShift nodes • OpenShift cluster resources Full stack automation (IPI) installation on Bare Metal Deploying Red Hat OpenShift on Bare Metal on Installer-Provisioned Infrastructure (IPI) Product Manager: Ramon Acedo Rodriguez OpenShift on Bare Metal
10. What's new in OpenShift 4.6 14 OpenShift on Bare Metal Full stack automation (IPI) installation on Bare Metal Deploying Red Hat OpenShift on Bare Metal on Installer-Provisioned Infrastructure (IPI) apiVersion: v1 basedomain: <domain> metadata: name: <cluster-name> networking: machineCIDR: <public-cidr> networkType: OVNKubernetes compute: - name: worker replicas: 2 controlPlane: name: master replicas: 3 platform: baremetal: {} platform: baremetal: apiVIP: <api-ip> ingressVIP: <wildcard-ip> provisioningNetworkInterface: <NIC1> provisioningNetworkCIDR: <CIDR> hosts: - name: openshift-master-0 role: master bmc: address: ipmi://<out-of-band-ip> username: <user> password: <password> bootMACAddress: <NIC1-mac-address> hardwareProfile: default - name: openshift-master-1 role: master bmc: address: ipmi://<out-of-band-ip> username: <user> password: <password> bootMACAddress: <NIC1-mac-address> hardwareProfile: default Bare Metal Management Powered by Metal3 and OpenStack Ironic under the hood Host Power Management Redfish, IPMI, iDrac, iLo. Provisioning over the network Installation over DHCP/PXE or Virtual Media Disconnected Installations RHCOS image cache and disconnected registry Metal3 OpenStack Ironic Product Manager: Ramon Acedo Rodriguez
11. What's new in OpenShift 4.6 AWS GovCloud Deploy OpenShift to AWS GovCloud regions • Government customers and their Partners can now deploy OpenShift to the AWS GovCloud ‘US-East’ & ‘US-West’ regions. • AWS GovCloud (US) is specifically designed for US government agencies at the federal, state, and local level, as well as contractors, educational institutions, and other U.S. customers that need to run sensitive workloads in the cloud. • RHEL CoreOS AMI publishing is not available in the GovCloud regions, so users must upload their own prior to installing OpenShift via: ◦ ‘aws ec2 import-snapshot’ & ‘aws ec2 register-image’ • Installation of OpenShift on AWS GovCloud is similar to existing deployment methods for other AWS regions, but the AWS region and RHEL CoreOS AMI ID must be manually configured in install-config.yaml. Generally Available Product Manager: Katherine Dubé 15 % aws ec2 describe-regions --output text REGIONS ec2.us-gov-west-1.amazonaws.com opt-in-not-required us-gov-west-1 REGIONS ec2.us-gov-east-1.amazonaws.com opt-in-not-required us-gov-east-1 % grep -B 1 -A 2 "aws:" mycluster/install-config.yaml platform: aws: region: us-gov-west-1 amiID: ami-9dbf86fc % ./openshift-install create cluster --dir mycluster INFO Credentials loaded from default AWS environment variables INFO Consuming Common Manifests from target directory INFO Consuming Worker Machines from target directory INFO Consuming Openshift Manifests from target directory INFO Consuming OpenShift Install (Manifests) from target directory INFO Consuming Master Machines from target directory INFO Creating infrastructure resources… INFO Waiting up to 20m0s for the Kubernetes API at https://api.mycluster.example.com:6443... INFO API v1.19.0+f5121a6 up INFO Waiting up to 30m0s for bootstrapping to complete... INFO Destroying the bootstrap resources... INFO Waiting up to 40m0s for the cluster at https://api.mycluster.example.com:6443 to initialize... INFO Waiting up to 10m0s for the openshift-console route to be created... INFO Install complete! INFO To access the cluster as the system:admin user when using 'oc', run 'export KUBECONFIG=/Users/userid/openshift-install/mycluster/auth/kubeconfig' INFO Access the OpenShift web-console here: https://console-openshift-console.apps.mycluster.example.com INFO Login to the console with user: "kubeadmin", and password: "5char-5char-5char-5char" INFO Time elapsed: 40m10s
12. What's new in OpenShift 4.6 Microsoft Azure Government (MAG) Deploy OpenShift to Microsoft Azure Government • Government customers and their Partners can now deploy OpenShift to the Microsoft Azure Government (MAG) dedicated instance. • MAG is comprised of six government-only datacenter regions, all granted an Impacted Level 5 Provisional Authorization. • Installation of OpenShift to MAG is similar to existing deployment methods for other Azure regions, but the ‘cloudName’ field must be set to ‘AzureUSGovernmentCloud’ in the install-config. Generally Available Product Manager: Katherine Dubé % az cloud set --name AzureUSGovernment Switched active cloud to 'AzureUSGovernment'. Active subscription switched to 'Production (291bba3f-e0a5-47bc-a099-3bdcb2a50a05)'. % az account list-locations -o table DisplayName Name RegionalDisplayName -------------- ------------- --------------------- Global global Global USDoD Central usdodcentral (US) USDoD Central USDoD East usdodeast (US) USDoD East USGov Arizona usgovarizona (US) USGov Arizona USGov Iowa usgoviowa (US) USGov Iowa USGov Texas usgovtexas (US) USGov Texas USGov Virginia usgovvirginia (US) USGov Virginia % ./openshift-install explain installconfig.platform.azure.cloudName RESOURCE: <string> cloudName is the name of the Azure cloud environment which can be used to configure the Azure SDK with the appropriate Azure API endpoints. If empty, the value is equal to "AzurePublicCloud". % export AZURE_AUTH_LOCATION=/Users/userid/.azure/osServicePrincipal-mag.json ; ./openshift-install create cluster --dir mycluster INFO Credentials loaded from file "/Users/userid/.azure/osServicePrincipal-mag.json" INFO Consuming Common Manifests from target directory INFO Consuming Worker Machines from target directory INFO Consuming Openshift Manifests from target directory INFO Consuming OpenShift Install (Manifests) from target directory INFO Consuming Master Machines from target directory INFO Creating infrastructure resources… INFO Waiting up to 20m0s for the Kubernetes API at https://api.mycluster.example.com:6443... INFO API v1.19.0+f5121a6 up INFO Waiting up to 30m0s for bootstrapping to complete... INFO Destroying the bootstrap resources... INFO Waiting up to 40m0s for the cluster at https://api.mycluster.example.com:6443 to initialize... INFO Waiting up to 10m0s for the openshift-console route to be created... INFO Install complete! INFO To access the cluster as the system:admin user when using 'oc', run 'export KUBECONFIG=/Users/userid/openshift-install/mycluster/auth/kubeconfig' INFO Access the OpenShift web-console here: https://console-openshift-console.apps.mycluster.example.com INFO Login to the console with user: "kubeadmin", and password: "5char-5char-5char-5char" INFO Time elapsed: 40m10s 16
13. What's new in OpenShift 4.6 17 Update manager for your clusters in restricted or disconnected networks • OpenShift Update Service (OSUS) is the on-premise release of Red Hat’s hosted update service • Supports the publishing of upgrade graph information to clusters in restricted networks • Provides clusters with a list of next recommended update versions based on the current version installed on the cluster • Comprised of two services: ◦ Graph Builder: Fetches OpenShift release payload information (primary metadata) from any container registry (compatible with Docker registry V2 API) and builds a directed acyclic graph (DAG) representing valid upgrade edges ◦ Policy Engine: Responsible for selectively serving updates to every cluster by altering a client’s view of the graph with a set of filters • GA release planned for post-4.6 and will be distributed on Operator Hub as an optional add-on operator • Blog post announcing OpenShift Update Service OpenShift Update Service Local Container Registry in Restricted Network OpenShift Update Service Graph Builder Policy Engine OpenShift Cluster in Restricted Network Cluster Version Operator (CVO) Scrape Release Images from Registry Read graph data (secondary metadata) Edge Add/Remove Cluster Version Operator (CVO) OpenShift Cluster in Restricted Network Generally Available Product Manager: Katherine Dubé
14. Specifications for Remote Worker Nodes Zone-1 S Zone-2 W W Zone-3 W W W Red Hat OpenShift Supervisors reside in a central location, with reliably-connected workers distributed at edge sites sharing a control plane. SUPERVISORS WORKER Tolerant of disruption • Admin can configure status update frequency • Zones with disruption budget • Tolerations • DaemonSet & Static Pods stay running S W Product Manager: Tushar Katarki 18 W
15. What's new in OpenShift 4.6 Open Virtual Network (OVN) • Next-gen Kubernetes CNI plugin (ovn-kubernetes) • OCP 4.6 GA (non-default, default TBD) • Install-time option or post-install (bare metal only) migration Why? • Consolidates Red Hat SDN efforts across products • Advanced Telco and enterprise-grade features • Flexible SDN architecture for faster feature development • Large upstream community (Linux Foundation project) • Red Hat leadership in upstream OVS & OVN communities • Manages overlays and physical network connectivity • Flexible security policies via ACLs and security groups • Distributed L3 routing, L2/L3 Gateways to other networks • IPv4 and IPv6 capability • Integration with TOR and other "physical" gateways • Native support for NAT, load balancing and IPAM • Windows “Hybrid Overlay” service for pod-to-pod traffic between Windows and Linux cluster nodes. OpenShift SDN OVN Kubernetes veth pairs veth pairs OVS bridge OVS bridge Central controller / host-ipam Central controller / host-ipam VXLAN tunnels Geneve tunnels OVS flows for NetworkPolicy OVS flows for NetworkPolicy IPTables for services OVN LBs for services IPTables for NAT OVS for NAT Product Manager: Marc Curry 19 Goal: Develop and support a modern, maintainable, community-based, open-source Kubernetes CNI network plugin for OpenShift that complements the existing capabilities of OVS to add native support for virtual network abstractions. Technology Highlights Comparison
16. OpenShift Compliance Operator: Declarative Security Compliance = Install, upgrade, reconcile, config Describe intent with declarative config Monitor, scale, troubleshoot, backup Summarize Observe ComplianceSuite Scan (results) 1 A compliance profile is selected 2 The operator runs the scan for the profile against nodes, collect results, and (optionally) performs remeditations 3 Accreditors or Auditors can examine the scan results for compliance status, After review, if desired, remediations can be manually applied by the cluster-admin. ComplianceCheckResult ComplianceRemediations Security and Compliance Product Manager: Kirsten Newcomer With 4.6, a limited set of RHCOS checks will be implemented. Additional compliance checks will be delivered roughly every 2 months. 20
17. What's new in OpenShift 4.6 Leverage our existing Monitoring infrastructure to monitor your own workloads. • Enable a dedicated monitoring stack managed by us. • Configure monitoring for your custom services or infrastructure services not covered by the out-of-the-box cluster monitoring stack. • Access metrics and alert information through a single, multi-tenant interface. ◦ Note: You can explore and manage both from the developer perspective inside the OpenShift Console. • Not in scope for this release are things like adding your own dashboards to the console, creating new rules inside platform-specific namespaces (e.g. openshift-*), tenant-based routing configuration for Alertmanager, and a few more. • Monitoring your sample application Quick Start available to show users how to access basic monitoring features Product Manager: Christian Heidenreich 21 Monitor your own services Generally Available 1. Enable dedicated monitoring by setting ‘enableUserWorkload’ to ‘true’ inside the cluster-monitoring-config ConfigMap. apiVersion: v1 kind: ConfigMap metadata: name: cluster-monitoring-config namespace: openshift-monitoring data: config.yaml: | enableUserWorkload: true 2. Configure a ServiceMonitor CR inside a user-defined namespace where app is running that exposes a /metrics endpoint. 3. Go to the Developer Perspective, switch to your namespace and look for your metrics (it can take a bit time to have our infra picking up everything)
18. What's new in OpenShift 4.6 Abstract Fluentd configuration by introduce new log forwarding API to improve support and experience for customers. • Introduce a new, cluster-wide ClusterLogForwarder CRD (API) that replaces needs to configure log forwarding via Fluentd ConfigMap. • The API helps to reduce probability to misconfigure Fluentd and helps bringing in more stability into the Logging stack. • Features include: Audit log collection and forwarding, Kafka support, namespace- and source-based routing, tagging, as well as improvements to the existing log forwarding features (e.g. syslog RFC5424 support). • WARNING: We will not automagically migrate old Tech Preview CRs into a GA CR. Infra App Audit Forward logs to different systems based on their “inputSource”. inputSource=app inputSource=audit apiVersion: "logging.openshift.io/v1" kind: "ClusterLogForwarder" spec: outputs: - name: MyLogs type: Syslog syslog: Facility: Local0 url: localstore.example.com:9200 pipelines: - inputs: [Infrastructure, Application, Audit] outputs: [MyLogs] Product Manager: Christian Heidenreich Introduce new log forwarding API Generally Available 23
19. CONFIDENTIAL designator V0000000 What's new in OpenShift 4.6 Eventing ▪ Brokers ✓ Built-in Event Filtering ✓ Routing based on event types or attributes ✓ Multiple event types ✓ Multi-tenant ▪ Channels ✓ Event Fanout to multiple subscribers ✓ Same event type ✓ Single-tenant Generally Available Coming with OpenShift Serverless 1.11 24 Product Manager: William Markito & Naina Singh
20. CONFIDENTIAL designator V0000000 What's new in OpenShift 4.6 Eventing User Experience Generally Available 25 Camel-K Connectors • Connect your applications with AWS Kinesis, AWS SQS, Slack, JIRA, Telegram, SalesForce and more... Red Hat AMQ Streams • Integration with Apache Kafka for reliable event delivery with Channels and Broker support. Product Manager: William Markito & Naina Singh Coming with OpenShift Serverless 1.11
21. 26 Robust. Proven. Award-winning.
22. What's new in OpenShift 4.6 Red Hat Advanced Cluster Management for Kubernetes Multi-cluster lifecycle management Policy driven governance, risk, and compliance Advanced application lifecycle management Observability for your Clusters and Apps • GA provisioning of OpenShift on vSphere • GA provisioning of OpenShift on Bare Metal • Open Source Policy Repository • Enhanced OPA integration • Simplified Application Experience • Portfolio Integration with Ansible Automation Platform - • Cluster Health monitoring with Thanos • Multi-cluster health optimization with Grafana What’s new with 2.1 27
23. F18017-190601 RHACM Hub Managed Clusters 28 Integration Architecture Overview for Application Life Cycle Red Hat Openshift Platform RHACM Klusterlet Red Hat Openshift Platform Red Hat Ansible Automation Platform IT Systems Security Network Application CM APP A APP A Kubernetes resources Channel 1 2 3 4 2 Kubernetes Job 1 3 4 Managed Clusters install resources based on channel it subscribed ACM hub call Ansible Tower with Template Job ID define in Application Pre & Post Action Ansible Tower executes Job ACM hub receives feedback from Job execution and show all Kubernetes resources in topology including Ansible Job status Pre & Post +
24. 29 Managed OpenShift Get the best of OpenShift without being on call
25. What's new in OpenShift 4.6 31 31 New Managed OpenShift Pricing Product Managers: Patrick Strick, Jacob Lucky, Andrew Cathrow WORKER NODES MULTI-AZ SINGLE-AZ 4 vCPU SUBSCRIPTION PRICE On-demand (hourly) $0.171 1 Year $1,000 3 Year $2,000 4 vCPU 24x7 Premium Support 99.95% Uptime SLA $0.03 per hour New Minimum Cluster Size (OSD) vCPU Based Pricing Cluster Fee https://www.openshift.com/pricing/
26. What's new in OpenShift 4.6 32 New Feature Highlights • UI for cluster upgrade scheduling • Custom Machine Pools (AZ aware Machine Sets) • Customer notifications tied to Cluster History Log • BYOK Disk Encryption on AWS CCS 32 OpenShift Dedicated & Amazon Red Hat OpenShift Product Manager: Patrick Strick and Andrew Cathrow
27. What's new in OpenShift 4.6 Microsoft Azure Government (MAG) ◦ Deploy managed OpenShift clusters on Azure’s government cloud Egress lockdown ◦ Documented outbound IP/DNS requirements to secure outbound traffic via firewall BYOK disk encryption for PV’s and OS disk Larger VM sizes, including dedicated instances Cluster create GUI in Azure Portal Azure Red Hat OpenShift Product Manager: Jacob Lucky 33
28. 34 A broad ecosystem of workloads Services allow for a SaaS experience on your own infrastructure Relational DBs NoSQL DBs Storage Messaging Security Monitoring AL/ML Big Data DevOps
29. What's new in OpenShift 4.6 New Operator Bundle Format Product Manager: Daniel Messer The Bundle format uses standard container technology for shipping the metadata and allows developers to publish their own Operator update streams in catalogs. This is very similar to how OCI artifact spec plans to ship non-runnable image artifacts through registries. Changes to building custom catalogs • Using opm was optional, now it is mandatory • Much easier UX to add/remove/update catalog content OpenShift now has per-version Operator catalogs • Teams can ship to very intentional ranges of OCP versions • 4.1 to 4.5 will continue to share a single catalog 35 Operator objects: Deployment/STS, Roles, RoleBindings, ServiceAccount, CRDs Metadata: icon, channels, dependencies, related images, CR examples, links Operator Bundle Supplemental objects: ConfigMap, Secrets, HPA, PDBs SCCs, PriorityClass, ... Operator Lifecycle: Full OLM feature set Simplified Lifecycle: Create & Recreate Drives Resolution, Updates and Catalog UIs opm index add --bundles quay.io/username/my-bundle:0.0.1 # add this bundle --tag quay.io/username/my-index:1.0.0 # to this catalog
30. What's new in OpenShift 4.6 • Helm 3.3 GA • Support for multiple Helm repositories in Developer Catalog • Select chart version on install • Form-based values.yaml • Displays charts compatible with OpenShift version (kubeVersion) Product Manager: Karena Angell Helm 3 on OpenShift 4.6 36
31. CONFIDENTIAL designator V0000000 What's new in OpenShift 4.6 Red Hat Application Services 38 Red Hat Runtimes • Quarkus - GA of Native Compilation Support, OpenShift Extension GA and new Spring compatibilities • Data Grid 8.1 - Cross-site cluster support and auto-scaling on OpenShift • Red Hat Build of OpenJDK Support for the Java Flight Recorder - OpenJDK 8 • Spring Boot 2.2 - New AMQ Starters, GA of Reactive support and Kubernetes Java annotations. Red Hat Integration • 3scale API Management - Improved manageability with operator for Air-Gapped deployment, Monitoring & backup/restore. Accelerated API performance with content caching, and new policies for API Gateway. • Fuse - Air-Gapped deployment, OpenShift AuthN/AuthZ for Console, and Spring Boot 2 support for Fuse on OpenShift. • Camel K for Serverless (TP) - now integrated to OpenShift Developer Console to leverage the huge Camel connector catalog for apps based on Camel K and Knative Eventing. Red Hat Process Automation • OptaPlanner - Support for new rotation screen in Optaweb Employee Rostering • Dashboard Builder - Stand alone Dashbuilder: Support for multiple dashboards, Runtime REST api, React components Product Manager: Karena Angell (on behalf of the Red Hat Application Services team) Events APIs EIPs Data
32. CONFIDENTIAL designator V0000000 What's new in OpenShift 4.6 Migration Toolkit for Applications 39 • Review Java Apps - review source code or decompile binaries and find ways to make them more JEE compliant, and container friendly. • OpenJDK, Container and Linux rules - discover fixes to be applied to your app to increase its mobility • Camel 2 to 3 Rules - review your Camel 2 rules and find out how to convert them to Camel 3 (more container friendly). • Web,CLI, Maven and IDE - use the tool in any your preferred context, from CI/CD pipelines , to maven builds and in within your development environment. Easy to deploy on OpenShift. Product Manager: Miguel Pérez Colino MTA 5.0 Launched red.ht/mta
33. What's new in OpenShift 4.6 Modernized workloads, support mixed applications consisting of VMs, containers, and serverless VMs Containers Red Hat OpenShift Container Platform Red Hat Enterprise Linux CoreOS Physical machine OpenShift Virtualization 40 What’s new in OpenShift Virtualization (2.5) Core • Deploy CNV on a subset of cluster nodes • Import from VMware - cold or offline migration • Robust VM baseline performance Network • Support of bonding modes 2 (balance-xor) and 4 (802.3ad) • Added CNI certification test suite for VMs Storage • Improved dev workflow with default OS images & templates • Fast DataVolume CDI cloning via CSI Snapshots • Offline VM Snapshots • Import ContainerDisks to persistent storage more efficiently Product Manager: Peter Lauterbach, Rob Young
34. 41 Service Mesh
35. What's new in OpenShift 4.6 43 Product Manager: Jamie Longmuir and Mauricio "Maltron" Leal OpenShift Service Mesh 2.0 Key Features & Updates • Version 2.0 to GA in November 2020 • Upgrades Istio to version 1.6 • Simplifies architecture based on a single Istio daemon (“Istiod”) • Improves key and certificate rotation with Secret Discovery Service • Improves metrics collection with Telemetry V2 architecture. • Introduces WebAssembly extensions as a “Tech Preview” feature.
36. What's new in OpenShift 4.6 • Consolidates the Istio control plane components (Pilot, Galley, Citadel) into a single binary known as istiod. ◦ Simplifies installation, upgrades and management of the Control Plane. ◦ Reduces the Control Plane’s resource usage, startup time and improves performance. • Secret Discovery Service (SDS) provides a more secure and performant mechanism for delivering certificates to Envoy side car proxies. ◦ Removes the use of Kubernetes Secrets. ◦ Enables 3rd party cert manager integrations. • New Telemetry V2 architecture substantially reduces metrics collection latency. Product Manager: Jamie Longmuir and Mauricio "Maltron" Leal OpenShift Service Mesh 2.0 Istio 1.6 - Architectural Changes 44 Pilot Citadel Galley istiod Control Plane Service A Service B Envoy Envoy Data Plane Discovery Configuration Certificates Ingress Egress Mesh Traffic
37. What's new in OpenShift 4.6 • New ServiceMeshControlPlane resource (v2) to simplify configuration. • Kiali: ◦ Distributed traces are visualized and accessible in the service graph. ◦ New wizards make it easier to configure timeouts, retries and fault injection scenarios. • Jaeger: ◦ Support for external ElasticSearch clusters. ◦ OpenTelemetry collector in Tech Preview enabling vendor-neutral instrumentation. Product Manager: Jamie Longmuir and Mauricio "Maltron" Leal OpenShift Service Mesh 2.0 User Experience Enhancements 46
38. 47 Serverless
39. CONFIDENTIAL designator V0000000 OPENSHIFT SERVERLESS What's new in OpenShift 4.6 Serverless & the Portfolio ✓ OpenShift Service Mesh Support [doc] ▪ Support for JWT Auth [doc] ▪ Custom Domains for Knative Services [doc] ✓ OpenShift Pipelines Templates and Tasks ✓ CLI Commands for Eventing Service Mesh Serverless Pipelines 50 Serverless & Pipelines Experience
40. CONFIDENTIAL designator V0000000 What's new in OpenShift 4.6 51 Product Manager: William Markito & Naina Singh Powerful CLI experience ✓ Local Developer Experience ✓ Based on Buildpacks ✓ Deploy as Knative Service ✓ Project templates ✓ Support for Cloud Events/HTTP ✓ Runtimes: Functions $ kn faas help Usage: faas [command] Available Commands: build Build an existing Function project as an OCI image completion Generate bash/zsh completion scripts create Create a new Function, including initialization of local files and deployment delete Delete a Function deployment deploy Deploy an existing Function project to a cluster describe Describes the Function help Help about any command init Initialize a new Function project list Lists deployed Functions run Runs the Function locally update Update a deployed Function version Print version. With --verbose the build date stamp and commit hash are included if available. Developer Preview Coming with OpenShift Serverless 1.11
41. CONFIDENTIAL designator V0000000 What's new in OpenShift 4.6 52 Product Manager: William Markito & Naina Singh Functions Developer Preview Coming with OpenShift Serverless 1.11
42. 54 CI/CD & GitOps
43. What's new in OpenShift 4.6 • Pipeline templates for serverless when importing application (+Add) • Pipeline templates use workspaces instead of PipelineResources • Default workspace per PipelineRun or globally • Expanded Task library ◦ Helm tasks ◦ Skopeo tasks ◦ Trigger Jenkins jobs from Tekton • Support for disconnected clusters • Pipeline metrics in cluster monitoring • Pipeline Quick Start tours in Dev Console • Enhancements in Tekton CLI: workspaces, results, ... Tech Preview Product Manager: Siamak Sadeghianfar OpenShift Pipelines 1.2* 56 * Available through the OpenShift Pipelines operator “preview” channel
44. What's new in OpenShift 4.6 • Start pipeline wizard • Add trigger wizard • Open Tekton docs from YAML • Restart pipeline action Product Manager: Siamak Sadeghianfar Tekton Pipelines in IntelliJ & Visual Studio Code 57
45. What's new in OpenShift 4.6 OpenShift GitOps (new add-on) Product Manager: Siamak Sadeghianfar Tech Preview Q4CY20 • Enable teams to adopt a declarative GitOps approach to multi-cluster configuration and continuous delivery • OpenShift GitOps is complementary to OpenShift Pipelines and includes ◦ Argo CD ◦ GitOps Application Manager CLI ◦ Integrated into Dev Console (App Stages) • Included in OpenShift SKUs Desired State Cluster State Observe State Take Action OpenShift GitOps 58
46. What's new in OpenShift 4.6 Traditional and Kubernetes-native CI/CD OpenShift Builds Product Manager: Siamak Sadeghianfar OpenShift OpenShift Pipelines OpenShift GitOps Build container images from source code using Kubernetes tools A Comprehensive DevOps Platform for Hybrid Cloud Declarative GitOps for multi-cluster continuous delivery 61
47. 62 CodeReady / Dev Tools
48. What's new in OpenShift 4.6 kind: ServiceBinding metadata: name: binding-request spec: application: name: cool-app resource: deployments group: apps version: v1 services: - group: postgresql.baiju.dev version: v1alpha1 kind: Database name: cool-db Service Binding Operator Product Manager: Siamak Sadeghianfar Tech Preview • Automate configuring applications to find the coordinates of the backing service (database, mq, etc) ◦ Operator services ◦ Helm Charts ◦ Any k8s resource • Injects service coordinates into Deployments, DeploymentConfig, Knative Service and more • Requires services to advertise injectable configuration via annotation present on k8s resources Deployment: cool-app Database CR: cool-db application Service Inject env vars 63
49. CONFIDENTIAL designator V0000000 What's new in OpenShift 4.6 Targeted for Nov 4 • Support for IBM Z (v2.4)- run on OpenShift on IBM Z • Single host proxy - route ingress to all components from single host • Support OpenShift-trusted CA bundle (v2.4) • Experimental support for IntelliJ as IDE - community edition with steps to use customer’s licensed version Product Manager: Parag Dave CodeReady Workspaces 2.5 64
50. CONFIDENTIAL designator V0000000 What's new in OpenShift 4.6 Released September 24th! Product Manager: Serena Nichols odo 2.0 - OpenShift’s Dev-Focused CLI 65 $ odo create nodejs --starter Start quickly using linked samples $ odo catalog list components Odo Devfile Components: NAME DESCRIPTION REGISTRY java-maven Upstream Maven and OpenJDK 11 DefaultDevfileRegistry java-openliberty Open Liberty microservice in Java DefaultDevfileRegistry java-quarkus Upstream Quarkus with Java+GraalVM DefaultDevfileRegistry java-springboot Spring Boot® using Java DefaultDevfileRegistry nodejs Stack with NodeJS 12 DefaultDevfileRegistry Core language support via a common/shared model with Eclipse Che with devfile stack definitions $ odo catalog list services Operators available in the cluster NAME CRDs etcdoperator.v0.9.4 EtcdCluster, EtcdBackup, EtcdRestore $ odo service create etcdoperator.v0.9.4/EtcdCluster Works with core Kubernetes! - Creation of operands - Binding of services $ odo debug Easily connect for debugging
51. CONFIDENTIAL designator V0000000 What's new in OpenShift 4.6 OCP 4.6 update - Oct 22 • Regular releases to pick up 4.5 z-streams and fresh certs • Resource requirements - no changes for 4.6, worked on future improvements • VS Code OpenShift Connector extended to work with starting and using CodeReady Containers Product Manager: Steve Speicher CodeReady Containers: OpenShift on your Laptop 66
52. 68 OpenShift Console OpenShift = Kubernetes Managing Kubernetes Extending Kubernetes Learning Kubernetes Developing on Kubernetes
53. What's new in OpenShift 4.6 Guide users to recommended update paths and available channels. • Make it easier to find information on channels and versions • Provide recommended update paths Recommendation Alerts • Three new recommendation alerts were added to inform users when: ◦ a new patch becomes available ◦ a new minor release becomes available ◦ new channels become available Provide transparency into the update process with an in progress checklist • Inform on Operator and Node Progress • Surface conditions Over the air goodness! Product Manager: Ali Mobrem, Generally Available 69
54. What's new in OpenShift 4.6 Combine an “init custom resource” creation with Operator installation flow • Easily see the installation status with a new "Installing..." Operator screen. • A custom resource contains initialization setups to be created during the Operator installation. Show when a k8s resource “owned by” or “related to” an Operator / Operand • OLM managed Operator: Easily see if the resource is managed by the Operator or an Operand instance. • Cluster Operator: A list of resources associate with the Operator. Group Operand’s properties per CRD’s schema structure • Easily understand and see the spec/status properties of the CR instance. • Easily learn schema info on property’s popover directly on this UI. Managing Operators at ease 70 Product Manager: Ali Mobrem, Tony Wu
55. What's new in OpenShift 4.6 Default Perspective --and-- Guided Tour • Non privileged users are brought to Developer perspective by default upon initial login • A Guided Tour has been added to the Developer Perspective to help with discoverability Getting started with samples • Developer get started quickly with samples Quick Starts • Guides customers with interactive documentation tours • Helps customers to discover and enable value added services • Reduces the time it takes to get customers up and running • Educates users on how to maximize usage of the UI • Accessible on both the Administrator and Developer perspectives Getting started experience Product Manager: Ali Mobrem, Serena Nichols 72
56. What's new in OpenShift 4.6 Connectivity mode - Allows developers to focus on the composition of their application, both on how it’s managed as well as how things are connected. Parity between List & Graphical - Display Options - Filters - Find Admin’s Project-> Workload tab has an increased feature set Consumption mode - Allows developers to focus solely on components consuming resources. - Thus, no connectors are shown (Service Binding, Visual, Traffic, Triggers, etc), nor groupings. Pod count is shown by default. Application topology Product Manager: Serena Nichols 73
57. What's new in OpenShift 4.6 Empower developers with visibility of their application across all environments • Dedicated Application Stages view • View all app groupings • Drill into app grouping details to get visibility into the composition and status of the applications/workloads deployed across environments Product Manager: Serena Nichols Visibility of apps across environments 74 Dev Preview
58. 76 Observability
59. What's new in OpenShift 4.6 Expose selected Fluentd performance optimization parameters in the ClusterLogging API. • Not relevant to most users, default settings should give good general performance. • Ultimately we want great performance "out of the box" with no user intervention. However, today we can't always predict/detect the best settings; customers have had to adjust fluentd parameters to get good performance. • All possible settings relate to optimizing the forwarding process, meaning when logs leave Fluentd to either our internal storage or a configured 3rd party system. • Settings include retries, memory usage and the flushing output behaviour. Product Manager: Christian Heidenreich “Tune” Fluentd 77 1. After installing OpenShift Logging, apply the following YAML. apiVersion: logging.openshift.io/v1 kind: ClusterLogging metadata: name: instance namespace: openshift-logging spec: forwarder: fluentd: buffer: chunkLimitSize: 8m flushInterval: 5s flushMode: interval flushThreadCount: 3 overflowAction: throw_exception retryMaxInterval: "300s" retryType: periodic retryWait: 1s totalLimitSize: 32m
60. What's new in OpenShift 4.6 Improve our current Monitoring capabilities to better help admins to gain insights into OpenShift Logging. • Introduce dashboards into the OpenShift Console (admin perspective) that shows the most critical data points for admins to proactively research problems. ◦ Two new dashboards: OpenShift Logging (central overview look) and Elasticsearch. ◦ Access from Monitoring -> Dashboards and select either from the dropdown list. • Enrich and/or improve current alerting rules to cover "you must page me at 3am" scenarios. • Overhaul metrics where necessary. ◦ Note: Removed all index level metrics since they introduced an abnormal amount of metrics which ended up exploding our Monitoring solution. We will reintroduce some + improvements in a future release. Product Manager: Christian Heidenreich Logging “Observability” 78
61. 79 Install & Upgrades
62. What's new in OpenShift 4.6 4.6 Supported Providers Generally Available Full Stack Automation (IPI) Pre-existing Infrastructure (UPI) Bare Metal Product Manager(s): Katherine Dubé (AWS, Azure, GCP), Maria Bracho (VMware), Peter Lauterbach (RHV & OCP Virtualization), Ramon Acedo Rodriguez (OSP, BM), & Duncan Hardie (IBM Z & Power) IBM Power Systems 80 Bare Metal New addition in OCP 4.6 Now supports deploying to VMware vSphere 7.0
63. What's new in OpenShift 4.6 81 OpenShift on OpenStack Product Manager: Ramon Acedo Rodriguez Supported OSP releases with OCP 4.6 Red Hat OpenStack Platform 13 Red Hat OpenStack Platform 16.1 New with OCP 4.6 on OSP • OpenStack Bare Metal (Ironic) integration • Installer support for specifying OpenStack Availability Zones • Floating IPs no longer required OpenShift on OpenStack
64. What's new in OpenShift 4.6 Enhancements to RHV full stack installer What’s new in OCP 4.6 • Dynamically provision storage to OCP cluster with RHV CSI operator • Improved control of workloads and resources by auto-scaling workers nodes • Support for Disconnected / restricted installs Supported RHV releases with OCP 4.6 • RHV 4.4.2+ • Customers running OCP 4.5 on RHV 4.3 must upgrade to RHV 4.4.2+ before upgrading to OCP 4.6 Upcoming work in future releases • OCP on RHV UPI moved to OCP 4.7 Product Manager: Peter Lauterbach Generally Available $ ./openshift-install create cluster --dir ./demo ? SSH Public Key /home/user_id/.ssh/id_rsa.pub ? Platform ovirt ? Enter oVirt’s api endpoint URL admin:pw123 https://rhv-env.virtlab.example.com/ovirt-engine/api ? Is the installed oVirt certificate trusted? Yes ? Enter oVirt’s CA bundle xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx ? Enter ovirt-engine username admin@internal ? Enter passsword xxxxxxxxxxxxx ? Select oVirt cluster Default ? Select oVirt storage domain hosted_storage ? Select oVirt network ovirtmgmt ? Enter the internal API virtual IP 10.35.1.19 ? Enter the internal DNS virtual IP 10.35.1.21 ? Enter the ingress IP 10.35.1.20 ? Base Domain example.com ? Cluster Name demo ? Pull Secret [? for help] xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx INFO Creating infrastructure resources... INFO API v1.17.1 up INFO Install complete! INFO Access the OpenShift web-console here: https://console-openshift-console.apps.demo.example.com INFO Login to the console with user: kubeadmin, password: xxxxx-xxxxx-xxxxx-xxxxx 82
65. What's new in OpenShift 4.6 New Credential Modes for OpenShift Installation Specify how CredentialsRequests are satisfied • Allows users to define how CredentialsRequest are handled on behalf of OpenShift components requiring cloud API access. • Three new modes can now be specified for deployments on AWS, Azure, and GCP: ◦ Mint: Creates new credentials with a subset of the overall permissions as specified by the CredentialsRequest. ◦ Passthrough: Uses the provided credentials “as is” for each OpenShift component’s CredentialsRequest. ◦ Manual: CredentialsRequests must be manually handled by the user (useful for cases where access to the IAM endpoint has been restricted.) • If the field is set to any of the above values, then the installer will not attempt to check the credential permissions prior to installing OpenShift. ◦ Important for situations where the credential policy checking can’t adequately validate the user credentials (when using SCP on AWS.) Generally Available Product Manager: Maria Bracho / Katherine Dubé % ./openshift-install explain installconfig.credentialsMode KIND: InstallConfig VERSION: v1 RESOURCE: <string> CredentialsMode is used to explicitly set the mode with which CredentialRequests are satisfied. If this field is set, then the installer will not attempt to query the cloud permissions before attempting installation. If the field is not set or empty, then the installer will perform its normal verification that the credentials provided are sufficient to perform an installation. There are three possible values for this field, but the valid values are dependent upon the platform being used. "Mint": create new credentials with a subset of the overall permissions for each CredentialsRequest "Passthrough": copy the credentials with all of the overall permissions for each CredentialsRequest "Manual": CredentialsRequests must be handled manually by the user For each of the following platforms, the field can set to the specified values. For all other platforms, the field must not be set. 83
66. What's new in OpenShift 4.6 AWS Custom Endpoint Support Define custom API endpoints for private AWS regions • Adds a new field ‘serviceEndpoints’ in install-config.yaml, which contains a list of custom endpoints for overriding the default service endpoints of AWS services. • Custom API endpoints can be specified for EC2, S3, IAM, Elastic Load Balancing, Tagging, Route 53, and STS AWS services. • Only required for cases were alternative AWS endpoints (like FIPS) need to be used. ◦ Note: Not needed for deploying to known regions (which are found in the AWS SDK.) • List of AWS service endpoints can be found here: https://docs.aws.amazon.com/general/latest/gr/aws-service-information.html Generally Available Product Manager: Katherine Dubé apiVersion: v1 baseDomain: example.com compute: - architecture: amd64 hyperthreading: Enabled name: worker Platform: {} replicas: 3 controlPlane: architecture: amd64 hyperthreading: Enabled name: master platform: {} replicas: 3 metadata: creationTimestamp: null name: mycluster networking: clusterNetwork: - cidr: 10.18.0.0/14 hostPrefix: 23 machineNetwork: - cidr: 10.0.0.0/16 networkType: OpenShiftSDN serviceNetwork: - 172.30.0.0/16 platform: aws: Region: us-east-2 amiID: ami-0f4ecf819275850dd serviceEndpoints: - service: ec2 url: https://ec2-fips.us-east-2.amazonaws.com - service: s3 url: https://<account-id>.s3-control.us-east-2.amazonaws.com publish: External 84
67. What's new in OpenShift 4.6 User Defined Routing on Azure Define custom API endpoints for private Azure regions • Today, internal clusters on Azure always use Public Standard Load Balancers for Internet egress. This means public IPs and public load balancers are required, which many customers don’t want to use for internal clusters. • User Defined Routing allows the users to choose their own outbound routing for Internet access enabling them to leverage pre-existing setups instead of defaulting to the per-cluster OpenShift recommended way. • Users are only allowed to change the outbound type when using pre-existing networking since outbound routing needs to be setup by user prior to installing the cluster. • Adds a new egress strategy ‘UserDefinedRouting’ to the ‘outboundType’ field in the install-config Generally Available Product Manager: Katherine Dubé apiVersion: v1 baseDomain: example.com compute: - architecture: amd64 hyperthreading: Enabled name: worker platform: {} replicas: 3 controlPlane: architecture: amd64 hyperthreading: Enabled name: master platform: {} replicas: 3 metadata: creationTimestamp: null name: mycluster networking: clusterNetwork: - cidr: 10.128.0.0/14 hostPrefix: 23 machineNetwork: - cidr: 10.0.0.0/16 networkType: OpenShiftSDN serviceNetwork: - 172.30.0.0/16 platform: azure: baseDomainResourceGroupName: os4-common cloudName: AzurePublicCloud outboundType: UserDefinedRouting region: eastus publish: External pullSecret: <secret> 85
68. What's new in OpenShift 4.6 Specify Disk Type & Size for Control Plane & Compute Nodes on Azure & GCP Configure both disk type and size based on node requirements • Support for configuring disk type and size on control plane and compute nodes has been extended to Azure & GCP. • Introduces two new fields ‘osDisk.diskSizeGB’ & ‘osDisk.diskType’ in the install-config • For Azure, supported disk types include: "Standard_LRS","Premium_LRS", & "StandardSSD_LRS" ◦ Note: For control plane nodes only “Premium_LRS” & “StandardSSD_LR” can be configured. • For GCP, supported disk types include: "pd-ssd" & "pd-standard" ◦ Note: For control plane nodes only “pd-ssd” can be configured. Generally Available Product Manager: Katherine Dubé apiVersion: v1 baseDomain: example.com compute: - architecture: amd64 hyperthreading: Enabled name: worker platform: - osDisk: DiskSizeGB: 120 DiskType: pd-standard replicas: 3 controlPlane: architecture: amd64 hyperthreading: Enabled name: master platform: - osDisk: DiskSizeGB: 120 DiskType: pd-ssd replicas: 3 metadata: creationTimestamp: null name: mycluster networking: clusterNetwork: - cidr: 10.128.0.0/14 hostPrefix: 23 machineNetwork: - cidr: 10.0.0.0/16 networkType: OpenShiftSDN serviceNetwork: - 172.30.0.0/16 platform: gcp: projectID: openshift-production region: us-central1 publish: External 86
69. 87 Control Plane
70. What's new in OpenShift 4.6 Improved Recovery Time After Hard Shutdown of Master Node Product Manager: Marc Curry After a hard shutdown of a master node, the result of a failure or not, the OpenShift APIs would become unavailable for a lengthy period of time (15min+) while the endpoints were reconciled and the cluster detected and adapted to the loss of the node. For OpenShift 4.6, the recovery time of the control plane was dramatically improved, in most cases, to ~90s. 89
71. What's new in OpenShift 4.6 Pod Topology Spread Constraints kind: Pod apiVersion: v1 metadata: name: mypod labels: foo: bar spec: topologySpreadConstraints: - maxSkew: 1 topologyKey: zone whenUnsatisfiable: DoNotSchedule labelSelector: matchLabels: foo: bar Node 1 Node 2 Pod Pod Zone = Zone A Node 1 Node 2 Pod New Pod Zone = Zone B Control how Pods are spread across the cluster among failure-domains such as regions, zones, nodes, and other user-defined topology domains. Help to achieve high availability as well as efficient resource utilization Product Manager: Tushar Katarki 90
72. What's new in OpenShift 4.6 Cluster Infrastructure updates OCP CLUSTER INFRASTRUCTURE • Expanding Spot Instance support ◦ Azure: machine API support for spot instances ◦ GCP: machine API support for Preemptible VM instances • Security and Compliance ◦ AWS: Support for custom endpoints and air-gapped regions ◦ Azure: Support for GovCloud • Usability ◦ AWS Machine API Support of more than one block device ◦ Get validation/defaulting for providerSpec APIs apiVersion: machine.openshift.io/v1beta1 spec: metadata: creationTimestamp: null providerSpec: spotMarketOptions: maxPrice: "0.06" MachineSet Product Manager: Duncan Hardie Generally Available 91
73. 92 RHEL CoreOS
74. 93 Kube-Native Operating System Product Manager: Mark Russell RHCOS 4.6 EUS • Aligned for full life cycle with RHEL 8.2.z EUS stream • Stable 4.18 kernel ABI allowlist • Deploy /var on a separate disk • Extension system with usbguard
75. 94 Kube-Native Operating System Product Manager: Mark Russell Updated CoreOS Image & Installer Key Features • Hardware and interface name discovery • Preserve existing data partitions option • Automatic 4K-sector drive detection • Easily embed custom ignition configuration into custom ISOs for installation in environments with restricted networking • Live PXE and Live ISO environment Red Hat Enterprise Linux CoreOS 46.82.20200928174-0 (Ootpa) 4.6 SSH host key: SHA256:mmPpxnYfcrXsMng0c72dEm6GqoM5Bx/eOP3bm1DsuV4 (ECDSA) SSH host key: SHA256:Nb30rUtSbanzeLyT4quS1tnH1116aFFZGZrmNWJMidQ (ED25519) SSH host key: SHA256:u1wL1agK+UIGNLn5iBU8+bHBryk3QWGgNpZ8KfofZFa (RSA) enp1s0: 192.168.122.51 fw80::5054::ff:fe6a:add7 enp6s0: 192.168.122.145 fe80::5054::ff:fe78:befe localhost login: core (automatic login) ########################################################################### Welcome to the CoreOS live environment. This system is running completely from memory, making it a good candidate for hardware discovery and installing persistently to disk. Here is an example of running an install to disk via coreos—installer: sudo coreos—installer install /dev/sda \ —— ignition—url https://example.com/example.ign You may configure networking via ‘sudo nmcli’ or ‘sudo nmtui’ and have that configuration persist into the installed system by passing the ‘——copy—network’ argument to ‘coreos—installer install’. Please run ‘coreos—installer install ——help’ for more information on the possible install options. ########################################################################### [core@localhost ~]$
76. 95 Kube-Native Operating System Product Manager: Mark Russell Improved Networking UX For Bare Metal • Use nmtui or nmcli from the Live Installer environment • Pass your live config by invoking the RHCOS installer with the --copy-network argument For VMware • The new RHCOS VMware OVA file accepts static networking in the guestinfo fields • Pass dracut ip= syntax to configure static networking through the vSphere web console or API
77. 96 Networking and Routing
78. What's new in OpenShift 4.6 SR-IOV Enhancements Infiniband Support • High-throughput low-latency communication standard for high-perf internode message passing • Configured via SR-IOV Operator and is enabled on Mellanox CX-4/5/6 cards IPAM Plug-in: whereabouts • A CNI plug-in providing IPAM for other (Multus) CNI plugins, e.g. DHCP • Assigns IP addresses dynamically across the cluster, and without DHCP, and allows overlapping IP ranges • Stores IP address allocations via Kubernetes API Infiniband Configuration Overview 1. Install SR-IOV operator 2. Create a SriovNetworkNodePolicy CR 3. Create an SR-IOV network 4. Create a pod with the Infiniband device and network apiVersion: sriovnetwork.openshift.io/v1 kind: SriovNetworkNodePolicy metadata: name: policy-ib-net-1 namespace: openshift-sriov-network-operator spec: resourceName: ibnic1 nodeSelector: feature.node.kubernetes.io/network-sriov.capable: "true" numVfs: 4 nicSelector: vendor: "15b3" deviceID: "101b" rootDevices: ['0000:19:00.0'] linkType: ib isRdma: true { "ipam": { "type": "whereabouts", "range": "<range>", "exclude": ["<exclude_part>, ..."], } } Product Manager: Marc Curry 97
79. What's new in OpenShift 4.6 Additional Networking Enhancements Switch to System OVS • OVS previously ran in a cluster pod, resulting in existing network flow disruption upon cluster upgrades/restarts • OVS now runs on the RHCOS host, and remains active during cluster upgrades/restarts • Requires node reboot to update the OVS version Extended serviceNodePortRange (UPI only) Allows expansion of the default service node port range (30000-32767) for services of type NodePort for customers that implement a large number of node ports, if the corresponding ports are opened at the infrastructure layer.. Increased Maximum Number of Rules per EgressFirewall Policy The number of rules in a single EgressFirewall policy was insufficient for some deployments, and was raised from a maximum of 50 to 1000. oc patch network cluster -p '{"spec":{"serviceNodePortRange": "30000-33000"}}' --type=merge Product Manager: Marc Curry 98
80. What's new in OpenShift 4.6 Configuration Enhancements HTTP Forwarded Header Policy Use Case: A developer that configures an application-specific proxy that injects X-Forwarded-For and wants an IngressController to pass the header through unmodified for the application's Route. HTTP Header Capture Configure OpenShift to log specific HTTP request and response headers for Routes, to ensure security compliance and increase observability. Product Manager: Marc Curry 99 HTTP Cookie Capture Configure OpenShift to log specific, named HTTP cookies, to ensure security compliance and enable business analytics. Ingress TLS Termination Policy Ingresses can now specify reencrypt or passthrough policy: • "reencrypt" decrypts and re-encrypts HTTP traffic when forwarding it. • "passthrough" passes traffic through without terminating TLS. HTTP Path Rewriting Support for a Route annotation to configure path rewriting. On incoming requests, the Route’s spec.path is replaced with the rewrite target before forwarding. HTTP Unique-Id Header Configure an IngressController to inject an HTTP header with a unique request id into each HTTP request before forwarding the request to the application, so that I can trace HTTP requests and increase observability.
81. What's new in OpenShift 4.6 Configure IngressController to Use AWS NLB By default, an IngressController resource will use an AWS Classic Load Balancer when the endpoint publishing strategy is “type: LoadBalancerService ” and the Infrastructure resource platform status is “type: AWS”. Simply by specifying the AWS provider parameter “type: NLB” the IngressController resource will instead use an AWS Network Load Balancer (NLB). Product Manager: Marc Curry apiVersion: operator.openshift.io/v1 kind: IngressController metadata: name: $MY_INGRESS_CONTROLLER namespace: openshift-ingress-operator spec: replicas: 1 domain: $MY_UNIQUE_INGRESS_DOMAIN endpointPublishingStrategy: type: LoadBalancerService loadBalancer: scope: External providerParameters: type: AWS aws: type: NLB 100
82. 101 Storage
83. What's new in OpenShift 4.6 Storage updates OCP STORAGE OCP Supported AWS EBS Fibre Channel Azure File & Disk HostPath GCE PD Local Volume VMware vSphere Disk Raw Block NFS iSCSI Supported via OCS File , Block, Raw Block, Object Supported via OSP Cinder • No change on support for intree drivers • CSI Operators ◦ CSI Operator Library ◦ Move to CSO managing CSI Operators ◦ Indicate support of fsGroup • CSI Capabilities ◦ Crash Consistent Snapshots (Tech preview) ▪ Fully supported when used with OCS or CNV • Enabling OCS via Local Storage Operator ◦ Auto-provision of PVs ◦ Continuous inventory of local disks 102 Product Manager: Duncan Hardie
84. What's new in OpenShift 4.6 • Encryption support for the entire cluster • Crash Consistent Snapshots, Clones • Compression and Replica 2 for block storage • Object namespaces - single view for multiple object storage buckets. • Improved bare metal deployment with LSO ◦ Auto-provision of PVs ◦ Continuous inventory of local disks ◦ Easy local drive filtering • Additional platforms - IBM Z/Power (by IBM) OpenShift Container Storage updates OCP STORAGE Out of the box support Block, File, Object Platforms AWS Azure (Tech Preview) Bare metal Google Cloud (Tech Preview) VMWare Azure (Tech Preview) IBM Z/Power (by IBM) Oct 2020 - RHV (Tech Preview) Nov 2020 - OSP (Tech Preview) Deployment modes Disconnected environment and Proxied environments 103 Product Manager: Duncan Hardie
85. 104 Telco/Edge
86. What's new in OpenShift 4.6 A Real Time Kernel is a Red Hat Enterprise Linux kernel that is modified to maintain low latency, consistent response time and workload determinism. This feature allows workloads to run uninterrupted by the Operating System. • Allow the installation of the Real Time Kernel on RHEL CoreOS nodes. • Allow the cluster administrator to provide a PerformanceProfile that defines: ◦ A number of CPU cores dedicated to “housekeeping” tasks. ◦ A number of CPU cores dedicated for workloads (CPU Pinning). • NUMA alignment for devices, memory and cores used by Low Latency Workloads. Real Time Kernel and Low Latency Workloads for RAN Product Manager: Robert Love 106 Real Time Kernel 0 1 2 3 4 5 6 A B C D E CPU Cores: RAN Workloads: Cores Dedicated For Workloads Core Dedicated to OS “housekeeping”
87. What's new in OpenShift 4.6 Cloud-native Network Functions Tests (CNF Tests) The CNF Tests container image allows service providers to validate that their cluster has been provisioned and configured correctly ready to run CNFs. The documentation resides here. It validates the following additional performance-related functionality is configured and available on the cluster: • Precision Time Protocol (PTP) • Single-root input/output virtualization (SR-IOV) • Stream Control Transmission Protocol (SCTP) • Data Plane Development Kit (DPDK) • Performance AddOn Operator (PAO) Product Manager: Robert Love 107
88. 108 Security and Compliance
89. Openshift File Integrity Operator = Notify Enable FileIntegrity Checking Monitor Summarize Observe AIDE AIDE Configuration Scan Nodes 1 The operator scans the selected nodes to populate the AIDE database 2 Repeat scans collect results, and check against the AIDE database. 3 Admins can examine the scan results for status Deploy AIDE Pods Notification (fileIntegrityNodeStatus) Roadmap Security and Compliance Product Manager: Kirsten Newcomer 109
90. RH ACM and Compliance = Install, upgrade, reconcile, config Describe intent with declarative config Monitor, scale, troubleshoot, backup Maintain Observe apiVersion: machineconfiguration.openshift.io/v1 kind: ContainerRuntimeConfig metadata: name: set-log-and-pid spec: machineConfigPoolSelector: matchLabels: debug-crio: config-log-and-pid containerRuntimeConfig: pidsLimit: 2048 logLevel: debug 2 Red Hat curates cluster configs, including RHCOS configs to meet security profiles, like CIS or NIST-800-53 1 A user requests a new cluster 3 OpenShift operators apply updates; he Machine Config Operator applies the selected secure machine config for RHCOS updates Metrics are sent to Red Hat Insights for analysis via secured HTTPS. 4 Roadmap Security and Compliance Product Manager: Kirsten Newcomer 115
91. What's new in OpenShift 4.6 Security/Auth Improvements: Customize Audit Config Control the amount of information that is logged to the node audit logs by choosing the audit log policy profile to use. • Default: Logs only metadata for read and write requests; does not log request bodies. This is the default policy. • WriteRequestBodies: In addition to logging metadata for all requests, logs request bodies for every write request to the API servers (create, update, patch). This profile has more resource overhead than the Default profile. • AllRequestBodies: In addition to logging metadata for all requests, logs request bodies for every read and write request to the API servers (get, list, create, update, patch). This profile has the most resource overhead. apiVersion: config.openshift.io/v1 kind: APIServer metadata: ... spec: audit: profile: WriteRequestBodies 116
92. What's new in OpenShift 4.6 You can configure OAuth tokens to expire after a set period of inactivity. By default, no token inactivity timeout is set. Add the spec.tokenConfig.accessTokenInactivityTimeout field and set your timeout value: apiVersion: config.openshift.io/v1 kind: OAuth metadata: ... spec: tokenConfig: accessTokenInactivityTimeout: 400s Security/Auth Improvements: Token inactivity timeout for OAuth Server Example output error: You must be logged in to the server (Unauthorized) 117
93. What's new in OpenShift 4.6 OAuth access token and OAuth authorize token object names are now stored as non-sensitive object names. Previously, secret information was used as the OAuth access token and OAuth authorize token object names. When etcd is encrypted, only the value is encrypted, so this sensitive information was not encrypted. Security/Auth Improvements: Secure OAuth Resource Storage If you are upgrading your cluster to OpenShift Container Platform 4.6, old tokens from OpenShift Container Platform 4.5 will still have the secret information exposed in the object name. By default, the expiration for tokens is 24 hours, but this setting can be changed by administrators. Sensitive data can still be exposed until all old tokens have either expired or have been deleted by an administrator. OAuth Server Access token { “scope”: “..”, “client_id”: “..”, “exp”: “..”, } OAuth Access token Encrypted 118
94. 119 Multi-Arch & Windows
95. What's new in OpenShift 4.6 Windows Community Operator • Community distribution of the Windows Machine Config Operator will be available in mid to late October • The Windows Machine Config Operator is the entry point for OpenShift customers who want to run Windows workloads on their clusters. • The intent of this feature is to allow a cluster administrator to add a Windows compute node as a day 2 operation with a prescribed configuration to an installer provisioned OpenShift 4.6 cluster and enable scheduling of Windows workloads. • Prerequisite: OpenShift 4.6+ cluster configured with hybrid OVN Kubernetes networking. • Tested on AWS and Azure. vSphere CI tests on-going • Red Hat certified operator will be generally available in December Community Operator Red Hat Operator Location In Cluster OperatorHub Red Hat Marketplace Available date Mid Oct Mid Dec Platforms supported AWS, Azure AWS, Azure, vSphere (possibly) Refresh cycle Every 1-2 months Every OCP Y stream 120
96. Windows Machine Config Operator (WMCO) workflow WMCO Transfer binaries This includes Windows Machine Config Bootstrapper Configure kubelet Remotely execute WMCB to configure kubelet Run hybrid-overlay Create OpenShift HNS network Configure CNI Configure kubelet for CNI plugin Set up kube-proxy Maintains network rules on nodes allowing outside communication WMCO WMCO WMCO WMCO 121
97. What's new in OpenShift 4.6 Multi-architecture updates OCP MULTI-ARCHITECTURE • Align IBM Power and IBM Z GA with x86 • Storage being expanded ◦ Local Storage Operator ◦ Fibre Channel ◦ HostPath ◦ Raw Block ◦ iSCSI ◦ 4k Disk support • Logging now supported • OpenShift Core (CVO Operators) • UPI installer • OVS/OVN (networking) • RHEL7 Based container support • RHEL CoreOS (host nodes) • Ansible Engine • Red Hat Software Collections • AdoptOpenJDK with OpenJ9 • Single Sign-On (Z only) Supported • OpenShift Cluster Monitoring (Prometheus, Grafana) • Node Tuning Operator • OpenShift Jenkins • OpenShift Logging (elasticSearch, kibana) • Machine Configuration Operator (used in IPI installs) • Node Feature Discovery Operator • Red Hat Runtimes (Z only) Extra content ported 122 Product Manager: Duncan Hardie
98. linkedin.com/company/red-hat youtube.com/user/RedHatVideos facebook.com/redhatinc twitter.com/RedHat 123 Thank you