►
From YouTube: Ask an OpenShift Admin (Ep 28): CoreOS
Description
This episode we welcome Mark Russell, product manager for Red Hat Enterprise Linux CoreOS, to talk about why and how RHCOS is different, along with discussing some configuration options for manageability, performance, and resiliency.
Once an application is deployed, we don’t think about the operating system much - unless it breaks. This is even more true for containerized applications, whether they’re deployed to a single host using Podman or across a Kubernetes cluster. But even though the operating system is mostly ignored by the application team, it plays an important role for administrators and can dramatically affect our experience.
OpenShift 4 introduced a significant shift in how Red Hat deploys and manages the operating system underpinning everything else in OpenShift, changing from Red Hat Enterprise Linux (RHEL), and sometimes RHEL Atomic, to Red Hat Enterprise Linux CoreOS.
So join us as we talk with Mark about OpenShift and why CoreOS is different from other Linux distributions. If you have questions, be sure to leave a comment or add them to the chat!
About Ask an OpenShift Admin:
Do you have questions? We want to answer them! Every Wednesday at 11am ET, hosts Andrew Sullivan and Chris Short sit down to answer your questions about Red Hat OpenShift.
Follow us:
Andrew Sullivan https://twitter.com/practicalandrew
Chris Short https://twitter.com/chrisshort
Subscribe to Red Hat's YouTube channel: https://www.youtube.com/redhat/?sub_confirmation=1
About OpenShift:
Red Hat OpenShift is an open source container application platform based on the Kubernetes container orchestrator for enterprise application development and deployment.
Openshift.com https://red.ht/33Fh6uV
OpenShift on github https://github.com/openshift/
OpenShift on redhat.com https://red.ht/2o4ccDk
#RedHat #OpenShift #CoreOS
A
B
A
B
So
if
you're
on
the
kubernetes
slack,
there's
open
shift
channels,
there's
open
shift
users
open,
openshift
dev,
if
you're
on
the
cncf
slack,
there's
openshift
channels
there
or
red
hat
channels,
I
think
there
you
know,
in
addition
to
all
the
other
places,
so
we
are
constantly
always
never
not
available.
I
guess
if
you
need
help,
if
you
want
to
ask.
B
Yeah,
there's
always
folks
around
so
hello,
welcome
to
anybody
who's
new
or
hasn't
been
to
one
of
the
streams.
Before,
as
chris
mentioned,
I
am
andrew
sullivan
one
of
the
technical
marketing
managers
with
the
cloud
platforms
business
unit,
so
chris
and
I
both
focus
on
openshift
and
in
particular
we
bring
an
administrator
background
right,
we're
both
administrators
architects
prior
to
being
at
red
hat,
and
we
we
bring
that
perspective
and
really
the
goal
of
the
office
hour.
B
Series
of
sessions,
which
the
ask
an
openshift
admin
is
one
of
those
is
to
give
you
our
audience
the
opportunity
to
well
ask
us
anything
whatever.
It
is.
That's
on
your
mind,
whatever
it
is
that
you
have
questions
about.
That's
bothering
you
that
you're
curious
about
right.
Ask
us,
and
you
can
do
that
at
any
point
in
time
across
any
of
the
platforms
that
you
happen
to
be
viewing
us
on.
B
If
we
can't
answer
those
questions,
we're
happy
to
follow
up
as
well,
so
you
know,
like
I
said
both
chris
and
I
have
an
administrator
background.
You
are
more
than
welcome
to
ask
about
developer
type
topics,
but
there's
a
pretty
good
chance.
We'll
have
to
follow
up
and
answer
those
questions
afterwards.
B
So
today,
as
the
title
probably
gave
it
away
we're
here
to
talk
about
core
os,
so
core
os
is
a
I'm
going
to
say
a
flavor
of
red
hat
enterprise
linux,
but
really
the
the
people
who
absolutely
know
whether
or
not
I
should
be
calling
it
a
flavor
or
not
are
here
with
us
today
and
that
is
mark
russell
on
the
product,
management
team
and
derrick
or
nellis
and
derek.
Please
correct
me
if
I,
if
I
butchered
that
on
the
engineering
team,
so
I'll
start
with
mark,
if
you
don't
mind
introducing
yourself.
C
Sure
hi
everybody
mark
russell
on
the
product
management
team
kind
of
have
one
foot
in
the
business
unit
that
deals
cloud
business
unit
that
does
openshift.
But
really
I
report
up
through
the
rail
organization
because,
as
andrew
said,
it
is
rel
core
os
is
a
is
a
distribution
of
rail,
maybe
we'll
set
set
that
for
another
topic,
we'll
continue
on
in
that
in
a
moment,
but
otherwise
yeah.
C
I'm
also,
you
know
an
operating
system,
administrator
type
background
and
I've
worked
for
multiple
distributions
and
though
this
is
my
last
one
for
sure
and
as
well
as
you
know,
worked
on
the
other
side
of
the
fence,
consuming
products
and
and
shaking
my
fists
at
software
software
distributors.
So
I've
been
in
a
lot
of
different
seats,
including
support
as
well,
so
derek.
D
D
A
B
B
Yeah
I
I've
I've,
never
I'm
right
on
that
cusp
of
of
vinyl
and
all
that
other
stuff.
I
I've
never
taken
it
up
as
a
hobby,
because
I've
got
enough
things
to
occupy
my
time
that
my
wife
would
object
if
I
had
any
more
so
yeah.
So
thank
you
again,
whoever's
watching,
please
feel
free
to
ask
questions
in
the
chat.
I
see
samuel.
How
does
cloud
pack
work
with
openshift?
I
got
a
link
okay,
unless.
B
So
at
the
high
level
cloud
packs
are
a
workload
to
openshift,
so
essentially
you're
deploying
an
openshift
cluster
right,
it
is
openshift,
is
openshift
and
then
the
ibm
cloud
pack,
whichever
one
you
happen
to
be
using,
is
deployed
as
a
series
of
pods
right
standard,
traditional
kubernetes
workload.
On
top
of
that,
so
that's
that's
really
the
way
that
we
look
at
it
the
way
that
we
treat
it
and
then,
if
you
happen
to
be
an
ibm
cluster,
essentially
they
bundle
or
customer
excuse
me.
They
bundle
everything
together,
yeah.
B
B
Pair
this
list
down
pretty
substantially
because,
of
course,
with
summit
and
coop
con,
there
was
a
lot
a
lot
that
has
happened.
So
I
don't
have.
I
don't
have
any
of
the
links
right
here.
If
you
go
to
openshift.com
blog
and
chris
might
even
have
a
shortcut
for
this,
we've
got
a
bunch
of
summary
blog
posts
on
openshift.com
that
cover
all
of
the
announcements.
All
the
things
that
happened
so
I'll
include
those
in
the
summary
blog
post,
so
friday
mornings,
we
have
a
blog
post.
That
goes
out.
B
B
I
do
all
right
so
the
the
first
thing
that
I
want
to
talk
about-
and
this
is
a
a
it-
came
from
a
conversation
amongst
the
product
management
team.
So
one
of
our
account
teams
asked
the
the
openshift
product
management
team
and
I
happened
to
find
this
particular
article
that
was
shared
as
a
result
of
that,
so
we
get
asked
fairly
commonly
about
stretching
an
open
shift
cluster
across
multiple
sites.
So
one
cluster
that
is
on
you
know
maybe
in
data
center
a
you
know,
with
node
one
and
node
two
control
plane.
B
Node
two
is
in
data
center.
One
and
node
three
is
in
data
center
hash
tag
or
something
like
that
right
pounds
on.
So
what
are
the
requirements
of
that?
Is
that
supported
right?
How
can
I
do
that
with
red
hat
and
with
openshift,
and
the
answer
to
that
is
oftentimes
very
nuanced
right
in
that
it's
not
unsupported,
but
there's
a
lot
of
things.
B
You
need
to
be
very
careful
about,
and
this
kcs,
if
you
read
through
it,
goes
through
a
lot
of
those
things
that
you
want
to
be
aware
of
and
what
are
the
actual?
You
know
guidelines
and
requirements
where
it
becomes
unsupported,
so
things
like
network,
latency,
storage,
latency,
right,
availability
right.
B
What
are
some
of
the
reasons
why
you
want
to
do
this
or
don't
want
to
do
this
and
the
impact
that
it
has
to
availability
as
well
right,
if
you
only
have
two
sites
you're,
not
really
getting
any
availability
by
spanning
it
across
two
sites,
you're,
just
increasing
complexity,
right
those
types
of
things,
so
great
kcs,
one
I
didn't
know
about
until
just
recently.
I
wanted
to
share
it
with
all
of
you,
as
you're,
going
through
doing
any
architecture
or
making
any
decisions,
because
it
does
contain
just
a
bunch
of
links
to
additional
information.
B
B
Yeah,
I
know
it,
it
helps
it
helps,
keep
me
organized.
So
if
you
weren't
aware
upgrades
from
openshift
4.6
to
4.7
are
now
available.
So
finally,
openshift
4.7
was
the
ford
at
7.7.
It
was
the
first
version
where
we
fully
opened
that
up.
Remember.
We've
talked
about
this,
for
I
don't
know
like
a
month
and
a
half
now
since.
B
B
So
if
you're
using
a
upi
or
ipi
deployments,
click
that
upgrade
button
rate
you'll
be
great,
everything
will
go
fine.
What
you'll
see
is
that
the
remediation
was
to
add
a
machine
config
that
disables
the
offload
in
the
kernel
nice.
If
you
have
an
openshift
cluster,
that
is
deployed,
non-integrated
right
or
platform
equals
none
bare
metal,
ipi
or
upi.
B
Excuse
me,
whatever
phrase
you
want
to
use
to
describe
that
on
vsphere,
you
still
have
the
potential
of
experiencing
this
problem,
so
the
way
to
fix
that
where
there
are
two
ways
to
fix
that,
I
should
say
so.
The
first
one.
First,
let
me
say
this
has
been
updated.
It
is
now
in
the
release,
notes
for
openshift,
4.7
and
I'll
post
this
into
our
our
chat
here.
Thank
you.
So
if
you
look
at
the
release
notes
for
4.7,
we
have
this
bullet
here
about
running
a
cluster
on
vmware,
with
platform
equals
none.
B
B
However,
if
you
choose
that
option,
remember
if
you're
using
the
vsphere
csi
provider,
that
requires
virtual
hardware
version
15.,
so
you
might
have
to
do
some
balancing
there.
I
say
that
knowing
also
knowing
that
you,
unless
you
have
done
something
unnatural,
like
you
deployed
with
platform,
equals
none
and
then
manually
added
this.
The
cloud
provider
for
vmware
cns
provider
needs
the
cloud
provider,
integration
or
the
cloud
native
storage,
csi
provider.
So
in
theory
you
shouldn't
be
doing
that
with
platform
equals
none,
so
you
should
be
safe
there.
B
A
B
Keeping
in
line
with
vmware,
so
I
talked
it
might
have
been.
The
last
show.
I
talked
briefly
about
how
and
for
sure
it
was
when
catherine
was
on
a
month
or
so
ago.
You
can
add
nodes
to
an
ipi
cluster
outside
of
the
machine
set
paradigm
right.
You
can
manually
provision
nodes,
you
can
bring
them
into
the
cluster
and
you
can
set
them
with
like
a
static
ip,
for
example,
all
that
type
of
stuff.
B
So
michael
mcneil
here
published
a
blog
post
on
openshift.com
that
walks
through
that
process
in
excruciating
detail,
he
did
a
phenomenal
job
here
of
documenting
in
screenshots
every
step
of
the
process
that
you
need
to
go
through
to
deploy
those
nodes
so
great
resource.
I
find
myself
doing
this
process
like
I'll,
deploy
an
ipi
cluster.
I've
been
doing
a
lot
of
testing
lately
with
using
alternative
or
different
load
balancers
with
an
on-prem
ipi
deployment.
B
So
what
I
found
myself
doing
is
I
deploy
an
ipi
cluster
and
then
I'll
manually
provision,
statically
ip
nodes
to
act
as
my
infrastructure
nodes
and
then
configure
the
load
balancer
to
use
those
statically
ip'd
nodes
right.
So
anyways
one
of
the
ways
that
you
can
make
those
openshift
clusters
more
flexible
to
do
the
things
that
you
need
to
do
and
you
can
also
manually
create
you
can
create
a
machine
and
I
believe
it
will
automatically
provision
that
way
as
well.
But
don't
quote
me
on
that?
B
B
So
even
though
this
says
on
aws,
it's
actually
supported
with
all
infrastructure
types.
The
the
documentation
is
wrong.
There
is
a
bz
for
that,
but
what
this
does?
So
you
update
the
the
ingress
here
you
add
an
apps
domain
and
what
that
does
is
all
routes
that
are
created
now
use
this
domain
instead
of
the
default
apps.cluster
name,
dot
domain
name,
that's
configured
out
of
the
box.
B
So
it's
one
of
the
ways
that
you
can
use
that
the
other
one
being
or
the
other
major
one
being
to
deploy
a
new,
a
second
ingress
controller,
so,
for
example,
using
the
nginx
operator
or
the
f5
operator
to
create
a
new
ingress
controller,
and
then
configuring
your
routes,
your
applications
to
use
that
okay,
that's
all
I
got,
I'm
done
sweet
yeah
done
with
the
show
so
coros
so
mark.
I
I'll
I'll,
ask
you
and
and
derek
please.
You
know
I'll
trust
you
guys
to
to
answer.
B
C
Sure
so,
let's
I
guess
I
can
start
by
going
back
even
before
you
know
before
it
was
a
thing.
After
red
hat
acquired
core
os
incorporated,
you
know
the
company
and
they
had
a
philosophy
that
they
had
already
started
a
path
they'd
already
gone
down
with
container
linux
and
container
linux.
Had
this
had
a
as
one
of
its
primary
goals
to
secure
the
back
end
of
the
internet.
The
same
way
that
mozilla
and
google
had
helped
improve
security
on
the
front
end
by
by
updating
their
browsers
like
very
aggressively
right.
C
So
container
linux
was
going
to
do
the
same
thing
it
was
going
to
by
default
update
automatically,
and
it
also
is
where
ignition
came
from,
which
maybe
we'll
put
off
talking
about
ignition,
but
that
is
that
is
also
the
origin
of
ignition.
It's
the
origin
of
the
operator
pattern
as
well
came,
you
know
through
core
os,
so
we
also
had
project
atomic
on
on
the
rail
side
that
used
in
used
rpm
os
tree
as
an
alternate
package
manager.
C
You
could
call
it
a
hybrid
image
and
package
manager,
so
it
it
deploys
images,
but
it
does
understand
rpms.
It
does
understand
yum
repos.
We
don't
make
a
lot
of
use
of
them,
but
it's
there
for
troubleshooting
and
and
problem
problem
solving
and
actually
upstream,
not
in
any
product.
Yet
but
upstream
rpm
os
3
now
understands
real
modularity.
So
it's
it's
gaining
a
lot
of
abilities
to
understand
other
package
systems,
but
at
heart
it's
an
image-based
system.
C
So
we
took
the
coreos
philosophy
as
you,
as
you
know,
and
if
anybody
doesn't
know,
I
don't
want
to
scare
anybody
off.
The
updates
are
not
automatic
on
an
openshift
cluster.
You
do
have
some
interaction.
There
they're
rolled
out
automatically
once
you
decide
them,
I'm
just
saying
it's:
it
is
in
your
hands,
so
we
combined
a
lot
of
their
philosophy
and
their
approach
with,
with
with
our
expertise
in
sc
linux,
our
the
rel
binary
package
foundation
and
the
battle
testing
that
that
gets
out
there
and
combined.
C
C
C
B
D
B
C
So
did
the
philosophical
or
management
approach?
First,
I
think
it
you
think
about
rpm
os
tree
and
it-
and
you
know
if
I
think,
maybe
people
are
aware,
but
it
also
it's
a
read-only,
slash
user.
So
all
the
os
binaries
are
read-only,
which
it
has
some
nice
security
effects,
but
the
but
the
real
neat
thing
about
it
is
you
can?
Actually
you
know
you?
C
Can
it's
it's
a
clear
separation
between
what
is
what
is
what
we've
distributed
the
os
vendor
has
distributed
to
the
customer
and
anything
that
has
been
layered
on
top
or
any
changes
that
have
been
made.
It
makes
that
very
clear,
and
that
is
an
implementation
of
the
philosophy
which
is.
We
want
a
clear
bright
line
between
the
platform
that
you
receive,
that
you
should
treat
in
kind
of
an
appliance
like
fashion
and
and
the
user
workloads
and
and
third-party
and
third-party
agents
as
well.
C
C
Yeah
something
short
of
murder
beast,
but
it's
a
but
it's
a
perfect
question.
It
comes
up
a
lot
actually
and
it
it's.
It
throws
people
off
a
little
bit.
Immutability
doesn't
mean
you
can't
it's
not
configurable
right,
it
doesn't
mean
not,
it
doesn't
mean
exactly
not
changeable.
Actually,
you
can
kind
of
look
at
the
way
we
distribute
rel
core
os.
In
the
same
way,
you
distribute
you
work
you'd
work
with
containers
themselves
right.
They
are
read-only,
usually
images
that
are
configured
by
the
environmental
variables
right.
You
don't
change
them.
C
You
don't
configure
individual
containers.
You
have
a
set
of
configuration
that
is
passed
with
this
image.
That's
our
that's!
That's
what
we
do
except
we
pass
that
configuration
or
we
have
that
configuration
through
the
fact
that
etsy
is
persistent,
so
user,
slash
user
is
read.
Only
slash,
var
and
slash
etsy
are
read.
Write.
Slash
far,
has
a
lot
of
state
to
it
and
etsy
has
your
configuration
as
you
would
expect,
but
we
do
not
support
outside
of
in
production
managing
those
files
manually
people
do
you
can
do
it
all.
B
B
Okay,
so
I'm
gonna,
I
don't
want
to
forget
about
ignition.
So
can
can
you
talk
about
ignition
and
like
what
kind
of
what
is
the
purpose
of
ignition
and-
and
you
know
we
we
talk
about
it-
a
lot
in
the
installation
process
right,
open
shift,
install.
You
know,
you
generate
the
ignition
files
if
you're
doing
anything
other
than
ipi
you're
hosting
those
somewhere
providing
them
to
the
vms.
So
you
know
what
does
that
do
and
and
how
does
that
work
and
importantly,
can
I
modify
those?
Can
I
customize
those.
C
And
I
may
we
yeah
well
I'll
start
with.
What's
the
difference,
so
a
lot
of
people
you
know
from
from
other
distributions
are
familiar
with
cloud
init,
which
is
a
post
pivot.
You
know,
post
in
it
ram
fs
utility
that
uses
a
it
seems
to
be
like
a
combination
of
imperative
and
declarative
configuration
and
it's
the
most
widely
used.
You
know
cloud
instance:
utility
ignition,
as
as
mentioned,
is
a
pre-pivot
init
ram,
fs
utility.
That
runs
a
single
time
right.
C
D
Yeah
laying
down
files
yeah
so
stuff
that
you
couldn't
do
post
pivot
with
something
like
cloudernet.
You
know,
so
we
get
to
run.
You
know
very,
very
early
in
the
boot
process
before
we've
done
anything
with
root
from
memory.
We
can,
you
know,
like
lay
down
encryption,
move
the
the
root
file
system
to
another
disk
or
another
partition
create
secondary
partitions,
and
you
know
with
the
ability
to
define
files
like
systemd
units
we
can
lay
down.
You
know
secondary
amounts
or
system
b
services
that
we
want
to
run.
B
So
so
you
just
opened
up.
You
know
pandora's
box,
I'm
avoiding
worm
analogies
now
because,
because
brett's
giving
me
a
hard
time
about
it,
so
a
whole
pandora's
box
of
questions
for
me,
so
things
like
so
ignition
only
runs
once
pre-pivot.
Is
that
once
per
boot
or
once
per
system
install?
And
I
ask
that
because
like
if
I
look
at
a
machine
config-
and
I
look
at
a
you-
know
in
a
machine
config
pool
that
has
this
rendered
machine
config
I
can
go
in
and
I
can
do
things
like
change
the
ssh
keys.
D
Those
kind
of
configuration
define
those
kind
of
configuration
changes,
but
the
the
way
the
two
function
are
are
are
vastly
different
under
the
hood,
so
you
know
you
have
ignition,
and
then
you
have
later
post
install
day
two
whatever
we
want
to
call
it.
We
have
the
the
management
of
the
system
via
the
machine
config
operator,
and
it
uses
that
same
syntax,
but
the
way
that
it
goes
about
doing
that
is
is
a
bit
different.
D
C
Yep
and
so
for
a
lot
of
things
like
like
derek,
was
saying,
if
you
needed
to.
If
you
wanted
to
redo
the
raid
capabilities
and
whatnot
it
things,
get
really
complicated.
You
have
a
you
want
to.
You
know:
you've
moved
you've,
moved
the
node
from
state
a
to
state
b,
and
now
you
want
it
to
be
in
state
c,
it's
simpler
to
just
delete
and
and
redeploy
in
that
state
c.
C
It's
just
a
simpler
problem
to
solve
as
well
and
a
cleaner
way
of
looking
at
it
than
trying
to
move
from
state
b
to
state
c,
and
so
that
is
kind
of
part
of
the
philosophy.
It
doesn't
mean
that
you
know
and
the
reason
why
we
have
a
machine
config
operators
we're
not
taking
that
philosophy
so
hardcore
that
any
configuration
change
requires
a
redeployment.
C
I
did
want
to
go
back,
though,
and
just
say
that
while-
and
we
can
talk
about-
you
know
how
you
use
mco,
how
you
use
machine
configs
to
change
configuration
on
the
host
and
there's
some
absolutely
necessary
use
cases
for
that.
Ideally,
we
prefer
that
vendors
and
and
and
users
adopt
a
more
you
know.
Cloud-Native
approach,
like
you
know,
things
should
be
containerized.
If
possible,
you
don't
need
to
write
configuration
files
to
etsy.
You
can
use
a
config
map.
C
B
C
Derrick
will
correct
me
if
I'm
wrong,
but
you
are,
you
are
following
our
support
policy
and
documentation
on
on
the
networking.
Changing
the
primary
networking
after
deployment
is,
is
not
really
supported
right
now,
secondary
networking
cards
are
a
different
story
and
you
know
that's
moving
in
the
direction
of
using
something
like
kubernetes
and
m
state
to
have
a
you
know,
declarative
stateless
sort
of
way
of
deploying
network
manager
changes,
but
I
don't
know
if
that,
that's
I
don't
think
is
going
to
apply
to
the
primary.
C
But
to
answer
your
question:
re
re-slicing
up
the
disc
you
know
and
changing
the
raid
array
settings.
If
you
wanted
to
and
just
a
little
plug
as
a
four
seven,
we
can
even
show
that
a
little
bit
of
how
this
works
later
we
have
soft.
We
have
support
for
software
raid,
one
mirroring
of
the
boot
device,
a
lot
of
people
don't
like
having
to
pay
a
lot
of
hardware,
and
they
may
have
remote
nodes
that
they
can't
send
folks
out
to
to
swap
drives.
C
B
D
It
it
is,
it
is
technically
possible
to
do
you
know
so
we're
using
network
manager.
Not
only
are
we
using
network
manager
from
rel
on
the
system,
but
we're
also
using
network
manager
to
to
configure
networking
and
then
in
their
mfs
phase.
So,
for
example,
if
you
guys
have
done
a
bare
metal
installation
and
you've
used
those
boot
parameters,
ib
equals,
etc.
You
know,
network
manager
is
writing
out
those
nmk
files.
D
D
It's
not
necessarily
possible
to
do
that
with
the
machine
config
operator
and
a
machine
config
today,
based
on
the
architecture
we
have
with
machine
config
pools,
so
we
kind
of
expect.
You
know
you
would
probably
want
to
make
an
over
arching
change
to
all
or
a
subset
of
your
nodes
and,
as
as
you
can
imagine
like,
say,
static,
ip
network
configuration
settings
or
or
I'll
be
like
are
they're
node,
specific
and
the
architecture
doesn't
doesn't
really
cover
that
use
case.
D
B
I'll
ask
a
question
that
that
I
get
asked
quite
frequently
which
is
like,
and
it's
basically
an
extension
of
this,
which
is
you
know
day
two.
I
need
to
modify
the
configuration,
so
is
it
it's
technically
possible
to
ssh
or
maybe
even
debug,
into
the
node
and
put
it
you
know,
put
in
those
network
manager,
config
files
to
have
it
configure.
Those
you
know
interfaces
is
that
I
know
we'd
discourage
doing
that.
You
know
really
favoring
nm
state,
even
though
nm
state
is
also
tech.
Preview.
I
think
in
4.7.
D
It
is,
I
don't
know,
mark
if
you,
if
you
want
to
it's,
not
it's
not
something
that
we,
the
the
process
itself,
is
not
something
that
we
support
now.
Certainly
a
lot
of
users
have
concerns
about
this.
Just
because
you
you
do
it
doesn't
necessarily
it's
like
negate
support
for
your
cluster
itself.
I
mean
it,
it
should
work.
We
just
at
the
moment,
there's
no
mechanism
to
do
that
in
the
way
that
we're
imagining
that
you
would
manage
your
clusters
or
the
nodes
in
your
cluster
today.
B
Yeah-
and
I
I
like
that
answer-
I
think
it
makes
sense
of
yes,
it's
technically
possible,
but
there's
a
lot
of
ways
that
you
can
break
something
and
then
it's
going
to
be
a
bad
day
for
you
and
our
support
guys
are,
you
know,
they're
going
to
do
their
best.
They
always
do
their
best
to
help,
but
sometimes
it
can
be
in
an
unpredictable
configuration.
C
But
that
said
right:
if
there's,
if
something,
if
something
works
in
your
lab,
you
know
again
as
derek
said
we're
not.
We
could
break
it
in
the
future
right
like
so.
If
something's
unsupported,
we
don't.
We
don't
consider
that
a
persistent
interface,
but
at
the
same
time
you
haven't,
you
know
you
haven't.
You
haven't
scratched
the
sticker
off,
you
know
and
and
opened
the
device
to
the
point
where
now
you've
avoided
the
warranty.
C
If
the
support
case,
if
you
know,
if
you
did
that
two
years
ago,
nobody's
going
to
say,
aha,
you
know
you
changed
your
network
again,
you
know
exactly
we'll,
never
get
that
cluster
supported.
So
I
don't
mean
to
say
I
don't
mean
to
ge.
I
don't
even
sound
like
full
of
encouragement.
Go
for
it,
but
at
some
level
it
is
your
cluster
and
if
you
can
make
certain
things
work,
then
that's
more
power
to
you.
I'd
be
careful
about
the
networking
and
I
would
be
careful
I
would.
C
I
would
also
just
you
know,
get
to
get
comfortable
and
get
familiar
with
redeploying,
though
I
mean
it's
not
that
bad,
I'm
on
the
workers,
I
know
it's
a
little
bit
of
a
trick
on
the
masters,
it's
a
little
bit
harder,
but
it's
not
that
bad
on
the
workers
and
you
know
sort
of
try
it.
Maybe
you
like
it,
you
can
even
do
things
like
we
support.
We
added
a
feature
for
a
customer
for
a
couple
customers
that
you
can
do
the
core
os
install
and
preserve
the
existing
partitions.
C
B
A
B
A
B
You
know
she
was
pointing
out
things
like
well,
when
you
end
up,
you
know
when
you
deploy
upi
or
ipi,
you
end
up
with
basically
the
same
cluster
right
just
because
it's
ipi
doesn't
mean
you
can't
manually,
add
nodes,
and
for
me
that
was
like
a
light
of
oh,
I
don't
only
have
to
use
machine
sets
to
add
nodes.
I
can
still
add
those
just
like
with
upi.
You
can
create
a
machine
set
and
deploy
nodes.
That
way
so.
B
B
B
Yeah,
so
I
don't
have
an
authoritative
answer
for
you
here,
I'm
going
to
say
so
secrets
themselves
right
can
be
used
right.
They
get
stored
in
ncd
if
you're,
encrypting,
etcd,
of
course,
they're
going
to
be
encrypted
on
disk.
That
type
of
stuff.
There's
third
party
options
right,
hashicorp,
vaults,
there's
a
number
of
them.
I
think.
Was
there
something
included
with
acs
or
something
like
that?
Or
am
I
thinking
of
something
else
or
acm?
B
I
don't
remember,
I
don't
know
so
we'll
we'll
probably
have
to
follow
up
with
that,
and
I
also
know
that
there's
some
work
going
on
upstream
in
kubernetes,
with
csi
using
csi
objects
to
hold
secure
secrets.
So
I
I
know
there's
some
work
going
on
there,
so
yeah
and
and
hello,
it's
ssk
routh.
So
thank
you
for
tuning
in
to
the
stream.
B
We
do
appreciate
everybody
who
does
watch
so
I
I
wanna,
I'm
gonna
ever
so
slightly
coarse
change
here,
because
I
to
make
sure
that
we
have
time
to
talk
about
something
that
when
I
talk
with
partners,
comes
up
on
a
somewhat
regular
basis.
I
also
see
it
come
up
with
particularly
public
sector
customers,
and
that
is
how
do
I
add
agents
and
drivers
that
are
not
containerized.
B
C
I
think
I
think
it
could
be
that's
a
tricky
one,
I
think
there's
categories
of
agents
and
when
I
end
up
talking
to
customers,
you
know-
and
you
get
to
the
point
where,
like
you
just
you
triage
them,
the
best
way
to
do
is
just
start
listing
them
out.
There's
certain
things
about
the
way
openshift
4
deploys
as
well,
by
the
way
that
can
be
can
be
a
little
tricky
right.
They
can't
the
the
the
the
operating
system
team
doesn't
just
to
install
agents
and
pass
a
golden
image
over.
C
C
So
we
think
you
know,
as
mentioned
before,
that
it'd
be
better
if,
if
all,
if
all
of
these,
if
all
vendors
sort
of
moved
in
a
more
cloud
native
container
native
way
so
but
getting
back
to
the
tactics
of
actually
triaging
it
down,
sometimes
you'll
find
a
certain
subset.
Don't
aren't
required
because
there's
some
function
in
openshift4
that
actually
can
provide
that
right.
Like
the
log
forwarding,
api,
maybe
may
meet
the
needs
of
somebody,
although
that
said,
we
have.
C
We
have
log
vendors
like
splunky
in
the
certified
catalog
for
security
agents,
and
such
it
depends
if
they
support
you
know.
If
they
support
a
kubernetes
demon
set,
then
it's
you're,
probably
not
gonna,
have
a
problem
getting
that
going
if,
if
they
don't
have
direct
support
and
what
they
end
up
truly
requiring
is
a
host
agent
installed
on
the
base
os.
We
do
basic,
we
do
have
something
of
a
support
problem
there
and
that
we
don't
we
don't
allow.
C
B
C
A
A
A
general
answer
right
like-
and
I
I
answered
this
in
chat
as
well.
The
biggest
reason
to
use
russ
is
just
the
memory
safety
of
the
language,
but
it
gives
you
kind
of
out
of
the
box.
It
eliminates
an
entire
swath
of
vulnerabilities,
just
right
out
the
box.
So
that's
my
default
answer
to
that
question.
I'm
sure
there's
other
reasons.
C
I
mean
that
there's
it's
a
lot
of
that
and
we're
talking
about
really
core
os
layer,
stuff
right
where,
where
that
safety
is,
is
it's
super
important,
incredibly
important,
so
rpmos
trees,
parts
that
are
being
rewritten
and
rust
as
well
yeah?
I
don't
really
have
anything
else
to
add.
I
trust
I
trust
the
engineering
team
for
what
you
know
why
they
think
something
is
necessary.
B
B
A
Yeah
I
mean
like
just
look
at
the
dev
sandbox,
for
example,
that
if
you're
watching
right
now,
you
see
a
link
to
a
qr
code
and
now
a
link
in
chat.
You
get
30
days
of
access
to
an
openshift
cluster
and
you
can
just
start
from
there
right
or
you
could
go
grab
a
copy
of
fedora
core
os
or
fedora
itself.
As
your
dev
environment,
and
you
know
off
and
running,
you
go
there's
a
number
of
learning
venues
as
well.
A
B
B
Or
into
chat
rather
so
so
derek,
I
I
wanted
to
ask
about
butane,
not
not
just
a
gas,
it's
it's
a
tool,
and
I'm
curious
about,
and
mark
mentioned
it.
You
know
when
we
were
having
our
pre-meeting
and
all
this
other
stuff
mark
mentioned
it,
and
I've
heard
and
seen
the
name.
I
don't
really
know
what
it
does.
So,
if,
if
you
don't
mind.
D
Sure
yeah,
I
guess
I
guess
some
a
little
bit
of
history
here,
so
this
is
so
with
container
linux
and
ignition.
We
didn't
really
talk
about
this
earlier
when
we
were
talking
about
ignition,
but
we
don't
necessarily
recommend
or
or
expect
users
to
write
ignition
configs
directly.
So
we,
the
you
know
the
spec
is
published.
It's
not
documented,
but
that's
because
we're
not
really
recommending
that
you
know
it's
json.
D
You
know
sometimes
working
with
jsons,
not
so
great
and
but
so
with
with
container
linux,
they
had
a
a
tool
called
config
transpiler
and
essentially
what
you
would.
What
you
could
easily
do
is
write
some
sugar
gammel
for
whatever
it
is
that
you
were
trying
to
configure
and
then
you
would
run
the
config
transpiler
and
it
would
generate
the
ignition
config
for
you
and
then
you'd
pass
that
and
you
know,
deploy
your
nodes.
The
same
thing
exists
for
fedora
core
os.
D
Upstream
there
is
a
fedora
core,
os
config
transpiler.
You
know
that's
kind
of
come
from
that.
From
that
same
utility
does
the
same
thing.
You
write
some
sugar
gammel,
convert
it
into
ignition
and
then
that's
what
you
pass
when
you
provision
a
core
west
node
up
until
now,
we
hadn't
really
given
users
a
great
way
to
do
this
with
rel
core
os
and
openshift.
D
But
what
we're
doing
is
we're
taking
that
fedora
core
os
upstream
project,
it's
been
renamed
to
butane
and
then
we're
going
to
pull
it
down
into
the
openshift
product
and,
as
I
suggested
that
will
allow
customers
to
write
some.
Some
sugar
gml
then
convert
that
to
ignition
config,
merge
that
with
what's
been
provided
by
openshift
and
be
able
to
do
some
of
the
more
advanced
customization
that
users
might
want
to
do.
D
For,
for
example,
like
bare
metal,
openshift
deployments
so
like
what
we
talked
about
with
ignition
disk
network
network,
not
so
much
you
could
still
do
that.
You
know
ignition
itself
can
do
that,
but
a
lot
of
the
the
disk
manipulation
stuff
is
really
what
the
use
case
is
aimed
at
at
the
moment.
So,
for
example,
if
you
were
to
take
a
look
at
a
four
seven
documentation
as
mark
suggested
earlier,
we
now
have
the
ability
to
do
raid
mirroring
on
the
disk.
D
C
D
D
If
you
want
to
do
the
disk
mirroring.
There
is
an
example
in
here.
This
is
the
way
that
this
is
written
right
now
was
before
the
the
rename,
but
in
this
example,
really
all
we're
kind
of
interested
in
for
mirroring.
Is
this
bit
right
here?
So
if
you've
ever
used
the
fedora
core
s,
config
transpiler,
there's
a
variant
called
fcos
for
four
seven,
we
added
a
variant
called
archos,
and
it's
pretty
simple.
Really
you
know
you
want
to
do
your
your
mirroring.
You
say:
okay!
D
D
D
Now,
of
course,
that
would
do
that
there
we
go
so
this
is
quite
a
lot
of
text.
Hopefully
you
guys
can
see
this,
but
remember
that
the
the
sugar
jammel
that
we've
written
really
straightforward
just
just
mirror
these
discs
together
the
the
ignition
config
that
actually
gets
generated.
It's
it's
it's
pretty
complex,
like
the
config
transpilers,
is
doing
all
of
this
work
for
us.
So
if
you
aren't
familiar
with
this
bit
right
here,
essentially
what
this
says
is
look
in
this
particular
directory
for
myworker.ign
file.
D
This
is
the
one
that
openshift
install
generated
for
us
and
then
what
it's
going
to
do
is
it's
going
to
merge
this
into
this
file
for
us?
So
that's
what
this
part
of
the
ignition
config
is
at
the
top
here.
It's
a
gzipped,
base64,
encoded
version
of
that
file
and
then
underneath
we've
got.
You
know
our
storage
directives
so,
okay,
so
we
need
to
do
something
with
our
disks.
D
We
need
to
create
some
file
systems
on
top
of
them
and
then
we
need
to
do
raid.
On
top
of
that,
and
as
you
can
see,
this
is
all
pretty
complicated.
The
config
transpiler
does
all
of
this
work
for
us.
You
know
it.
It
figures
out
the
labels
for
the
partitions
it
generates
gpt,
uhds,
etc
the
size
of
the
partitions
that
we
want
and
the
file
system
labels
and
does
all
the
work
with
mdadm
to
set
up
the
software
raid
devices
for
us.
So
this
is
this
is
pretty
nice.
D
B
D
C
Some
things
that
butane
will
will
will
translate
are
going
to
look
this
almost
the
same
in
yaml
or
json
right.
It's
just
going
to
be
the
formatting,
but
the
sugar
is
those
four
lines
expanding
out
to
like
87
lines
as
that's
where
butane
is
doing
the
heavy
lifting
to
calculate
all
this
out
and
make
sure
it
all
matches.
It's
taken
care
of
also
notice.
B
D
D
So
that's
why
there's
more
about
how
to
interact
with
ignition
and
use
the
config
transpiler
for
those
use
cases
for
fedora
chorus
than
there
are
for
for
archos,
but
some
really
and
the
reason
I
say
that
is
because
there's
some
really
simple
examples
in
here.
So,
like
here's,
how
I
would
define
ssh
keys
for
the
the
default
core
user,
here's
how
on
fedora
core
os,
I
could
create
another
user.
You
could
do
that
on
our
costs.
Ignition
will
allow
that
that's
not
something.
D
So
file
systems
and
partitions
there
you
go
so
if
you
wanted
to
create
you
know
if
you
wanted
to
manipulate
secondary
disks
like
sdb
in
this
example.
This
would
be
an
example
of
how
you
could
do
that
this.
In
this
example,
you
know
it's
it's
taking
sdb,
making
a
file
system
mounting
that
bar.
It's
gonna
put
butt
rfs
on
top
of
it,
so.
B
And
just
just
to
complete
the
thought
process
here.
So
excuse
me
the
example
you
showed
was
a
short
and
simple
right
of
take
the
worker
ignition
file
and
append
this
configuration
for
mirroring,
mirroring
the
disks
and
then
that
output
is
what
you
would
then
provide
to
your
nodes
when
they're
booted.
D
D
B
A
B
A
That
question
kind
of
counter-intuitively-
I
would
say
you
don't
get
started
with
real
core
os
right
like
you
get
started
with
openshift
and
then
you
use
real
core
os
with
openshift,
but
I
understand
that
some
people
think
I
need
to
understand
the
foundational
layers
first,
so
rpm
os
tree
would
be
the
thing
that
you
really
need
to
understand.
The
most
I
feel
like
is
that
fair
to
say
possibly.
A
C
Think,
obviously
yeah
you
know
I
I
fedora
core
os
is
in
in
a
way
a
good
way
to
get
started.
You
know
you
can
look
at
it
as
a
standalone
container
host.
It
also
can
be
clustered
and
I
used
under
okd
as
far
as
I
know,
but
the
upstream
documentation
for
rpm,
os
tree
and
and
ignition
is,
is
pretty
pretty
solid
and
I
it's
we
can
put
links
in,
but
it's
not
too
hard
to
too
hard
to
grab.
That
would
be
my
advice.
C
There's
also
ways
you
know
it's
distributed
as
a
live
iso
as
well,
so
you
can
just
take
the
iso
file
of
four
seven
plus
I
want
to
say
and
four
six
and
and
just
fire
that
up
as
a
disclose
vm
on
on
kvm
or
or
anything
right,
you
just
screwed
it
up,
and
I
mean
if
you're
curious
about
it,
you
know
what
what
will
you
do?
After
that?
I
don't
know
you
can
use
the
rpm
command
and
see
what's
installed,
run
some
containers
on
yeah
and
podman's
there
so
yeah,
it's
possible.
B
So
I
I
think
psy
might
be
flirting
with
something
that
we
talked
about
in
in
the
the
meeting
that
we
had
yesterday
sort
of
the
pre-brief
for
this,
and
that
is
a
lot
of
times.
Rel
admins
will
approach
core
os
and
think
of
it.
The
same
way
and
really
core
os,
especially
in
the
context
of
openshift,
is
meant
to
be
more
appliance-like
and
you
can
inject
configuration
via.
Why
did
my
mind
completely
went
blank.
B
Inject
configuration
before
installation
via
ignition,
but
after
deployment,
it's
managed
through
openshift,
and
so
you
have
a
series
of
operators.
Machine,
config,
operator,
file,
integrity
operator,
tune
d
operator
right.
You
have
all
these
things
inside
of
openshift
that
do
the
post
deployment
configuration
the
goal
being.
Hopefully
you
don't
have
to
connect
to
the
core
os
node.
You
don't
need
to
sshn
and
do
administration.
Rather
it's
done
through
the
cluster
itself.
C
B
B
So
for
anybody
who
has
a
question
that
you
didn't
want
to
ask
publicly-
or
we
didn't
have
time
to
get
to-
please
feel
free
to
reach
out
to
me
andrew.sullivan
firstname.lastname
redhat.com.
You
can
also
reach
out
to
me
on
social
media,
twitter,
practical
andrew.
So,
if
you've
seen
me
posting
in
the
chat
here
it
matches,
my
twitter
username
welcome
to
send
me
messages
at
any
point
in
time
chris
as
well.
He
now
has
a
nice
convenient
easy
to
remember:
email
address
short
redhat.com,
yes,
I'll,
stop
getting
those
confused
now.
A
Yeah
yeah
yeah,
no
at
c
short
at
like
there's
too
many
c's
right,
like
you
can
spell
c
in
so
many
ways
you
don't
necessarily
know
just
by
saying
it
so
yeah
but
short
redhead.com
and
chris
short,
you
know
all
one
word
with
two
s's
in
it
on
twitter
feel
free
to
reach
out
anytime.
I
just
dropped
a
link
to
our
discord.
You
can
join
that
as
well
and
dms
there.
If
you
need
to.
B
As
well
and
keep
an
eye
on
openshift.com
blog
friday
morning
is
when
we'll
post
the
blog
post
that
has
all
the
follow-ups
links
timestamps,
all
that
other
stuff
inside
of
there
so
yep.
Thank
you.
Everyone
thank
you
again,
especially
mark
and
derek
for
joining
us
today
and
have
a
great
rest
of
your
day.
Thank.