►
Description
This week we're looking at two features of OpenShift 4.12, the Security Profile Operator and RHCOS Layering.
The Security Profile Operator enables administrators to control SELinux and seccomp profiles for their OpenShift nodes. This provides for fine grained controls over the restrictions placed on both the node(s) and the containers running on them.
RHCOS layering, a tech preview feature, provides a way to customize the RHCOS image used for the nodes. This means that administrators can install packages, such as hotfixes from Red Hat, to their nodes without having to wait for an OpenShift update to release.
Join us this week to learn more about each of these features and see them in action!
Want to learn more?
Try Red Hat OpenShift: https://red.ht/3uVxkya
Follow us:
Andrew Sullivan https://twitter.com/practicalandrew
Jonathan Rickard https://twitter.com/jrocktx1
OpenShift https://twitter.com/openshift
Subscribe to Red Hat's YouTube channel: https://www.youtube.com/redhat/?sub_c...
About Ask an OpenShift Admin:
Do you have questions? We want to answer them! Every Wednesday at 11am ET, hosts Andrew Sullivan and Jonathan Rickard sit down to answer your questions about Red Hat OpenShift.
About OpenShift:
Red Hat OpenShift is an open source container application platform based on the Kubernetes container orchestrator for enterprise application development and deployment.
OpenShift on redhat.com https://red.ht/3rYz5ZS
OpenShift on GitHub https://github.com/openshift/
#RedHat #OpenShift #Kubernetes #ContainerPlatform
B
B
B
A
A
B
A
B
B
Overlap
with
our
stream
today
so
for
any
folks
who
are
watching
us
live,
please
don't
hesitate
to
ask
any
questions
that
come
to
your
mind
as
you're
watching
us.
You
know
today
we're
going
to
go
through
a
couple
of
different
things.
Johnny
is
going
to
show
off
the
security
profile
operator,
I'm
going
to
be
showing
off
core
OS
layering
we're
gonna
walk
through
a
couple
of
demos
and
look
at
a
bunch
of
different
stuff.
So
you
know
ask
ask
questions
anything
that
comes
to
mind,
anything
that
you
want
to
know
about.
B
We'll
do
our
best
to
answer
those.
If
we
don't
know
the
answer,
then
we'll
do
our
best
to
find
the
answers,
but
if
you're
not
watching
us
live
if
you're
listening
to
us,
you
know
maybe
like
a
podcast
on
your
drive
into
work
or
something
or
just
catching
up
whenever
you
have
time.
You're
also
welcome
to
send
us
messages
anytime,
so
we're
pretty
easy
to
get
a
hold
of
as
soon
as
I
find
the
right
button
inside
of
here.
B
B
It
is
one
of
our
what's
new
in
openshift
4.12
series
of
streams
and
it's
we
have
a
whole
bunch
of
stuff
that
we
want
to
cover
with
this
and
this
being
for
opengf
4.12,
and
we
just
kind
of
selected
two
of
the
things
at
random,
I'll,
say:
I'll
I'll,
admit
to
the
fact
that
it
was
largely
because
what
was
it
Monday
afternoon,
we're
like
oh
crap.
What
are
we
gonna?
What
are
we
gonna
stream
about
this
week
and
we
both
looked
at
the
list
and
we're
like
yeah.
These
two
seem
reasonable.
B
We
can.
We
can
get
something
prepped
by
Wednesday
morning.
So
that's
that's
part
of
the
reason
why
these
two
got
selected,
but
also
at
least
for
me
personally,
core
OS
layering
is
something
that
I've
been
watching
for
a
while
and
something
that
is.
You
know
pretty
it's
interesting
to
me.
It
brings
back
a
tinge
of
the
old
Administration
style
which
yeah
it
might
be
good
or
might
be
bad
right.
A
B
B
A
B
B
I
I
still
have
a
little
I,
have
a
sticky
down
here
at
the
bottom
of
my
monitor.
That
reminds
me
of
like
all
the
social
stuff
that
we're
supposed
to
do
and
I
think
on
a
good
day.
I
might
hit
half
of
these
things.
So,
oh
yeah,
oh
my
God,
adding
more
is
not
gonna,
go
well
crazy,
yeah,
but
so
yeah
so
feel
free.
Ask
questions.
Send
us
chats
all
that
other
stuff
I'm
starting
to
wonder
yeah,
so
chat's
kind
of
quiet
today,
that's
okay,
like
I,
said
I.
B
B
Let's
see,
do
I
have
a
window.
Yet
let
me
share
my
window
here
and
I'm
going
to
share
a
window
because
so
last
week,
yeah
nine
days
ago,
so
last
week-ish
we
published
a
blog
post
that
came
out
not
long
after
the
4.12
went
GA
and
we
talked
about
this
or
the
product
management
team
rather
talked
about
this
during
the
what's
new
presentation,
and
that
is
basically
eus
releases
are
changing
to
now
have
tour
months
of
support.
B
So
what's
the
change
here
and
if
we
scroll
down,
we
can
see
the
a
graphical
representation
so
historically,
since
4.8,
I
think
Johnny,
4.8
or
4..
Every
I
think
it
was
4.8.
Every
release
that
18
months
of
support,
So
us
didn't
really
mean
a
lot
right.
It
was,
you
know
whether
it
was
an
even
or
an
odd
release.
They
all
had
18
months
of
support.
B
So
that
was
really
the
main
benefit
of
using
an
eus
release
for
the
EOS
channel.
Now
it
is
it
not
only
can
you
do
those
accelerated
updates,
but
you
can
also
get
that
additional
support.
So
24
months
of
support
and
you'll
see
I
I
left
it
on
this
section
here
because
of
this
particular
sentence.
So
it
does
require
a
premium
subscription
to
get
the
X
for
six
months
but
other
than
that
yeah.
It's
it's.
The
US
Channel
awesome,
yeah
I
thought
this
was
a
good
one.
In
this.
B
Yeah,
it's
a
it's
a
good
blog
post.
They
walk
through
a
bunch
of
different
stuff,
including
kind
of
I,
just
talked
about,
which
is
like
how
the
EOS
yeah
here's,
how
those
accelerated
updates
work
and
stuff
like
that.
One
thing
to
note:
if
we
look
here,
openshift
4.12,
which
is
on
4.12.2
and
stable,
so
four
dot
updates
from
4.11
to
4.12
are
not
in
the
stable
Channel
yet,
which
means
they're,
also
not
in
the
EOS
channel.
B
B
But
if
I
switch
over
here
to
fast
4.11
and
I'll
go
with
the
same
4.11.27,
you
see.
I
have
4.12.3
and
4
as
available
with
with
an
update
path,
and
you
can
see
it's
just
a
direct
update
so
where
I
should
say,
you
have
to
change
the
channel
to
fast
4.12,
but
fast
Channel
you
can
update
today.
Fast
is
fully
supported.
So
if
you
have
an
issue
during
this
update
process,
you
can
pick
up
and
you
can
call
us
you
can
get
help
for
that.
B
It's
only
the
candidate
channels
that
are
not
supported
and
I.
Don't
even
think
we
put
Canada
channels
in
here.
Do
we?
No?
We
don't
so
historically
just
for
a
reminder,
so
it
usually
takes
somewhere
between
45
and
60
days
for
upgrades
to
move
from
Fast
to
stable,
so
upgrade
from
fret
11
to
4.12
approximately
60
days
after
4.2
goes.
Ga
is
when
it
moves
into
the
stable.
B
Much
like
the
stock
market.
You
know
best
performance
does
not
indicate
gains
or
anything
like
that,
so
it
might
not
be
60
days.
It
could
be.
You
know,
75
days,
it
could
be
45
days,
I,
it's
a
window
just
be
aware
of
that.
If
you
are
waiting
on
UPS
to
4.12
.,
there
are
some
other
things
I
had
up
here.
Oh
this
is
one
of
my
clusters
that
I'm
updating
to
the
latest
4.11.
B
so
yeah.
That
was
that
was
one
of
the
big
ones.
I
wanted
to
make
sure
to
hit
this
and
highlight
this
I
know
they
talked
about
it
during
the
what's
new,
but
I
I
always
like
to
remind
folks
I
feel
like
a
a
quote,
unquote
big
deal
because
we
had
a
number
of
customers
who
were
asking
about
about
this
right.
It's
it's
hard
to,
even
with
an
18-month
cycle,
it's
hard
to
keep
up
with
that
pace
for
some
folks,
so
yeah
this
additional
time.
B
For
that
it
also
gives
additional
overlap
between
those
EOS
versions.
You
know
from
10
to
12
there's
you
know
some
changes
or
eight
to
ten.
You
know,
4.9
was
when
we
had
some
API
removals
like
that,
so
going
from
eight
to
ten
means
that
you
know,
maybe
I
need
some
extra
time
to
do
a
full
set
of
test
invalidation,
whereas
previously
it
would
have
been
I
think
six
months
or
something
like
that
overlap.
Now
it's
a
full
year
to
give
you
know
those
customers
time
to
to
work
through
those
issues.
A
B
So
I
believe
I
don't
think
there
is
anything
that
restricts
you
from
using
the
EOS
channel.
So
let
me
pick
on
one
of
my
clusters
here.
Oh
you
just
broke
because
you're
in
the
process
of
upgrading
here
you
can
see
here
it's
it's
using
the
trial
license
or
entitlement.
Rather
so
there's
nothing
that
prevents
me
from
going
in
here
and
selecting
eus
for
my
channel.
You
know,
I
can
I
can
use
that
nothing
is
going
to
stop.
B
There
is
at
this
moment
and
I
I
believe
that
this
is
going
to
change
in
the
future,
but
at
this
moment
there's
nothing
on
the
back
end
that
controls
or
validates
that.
However,
it
is
against
I,
I
guess
against
the
license
agreements
like
you're,
not
in
compliance,
if
you
don't
have
a
premium
subscription
for
either
for
any
of
the
openshift
entitlements,
so
whether
using
oke,
openshift
container
platform
or
openshift
platform
plus
as
long
as
you
have
that
premium
subscription,
the
managed,
Services
I
think
are
different.
B
We
do
have
some
control
over
like
when
that
happens,
but
they
target,
or
they
only
offer
specific
versions
that
we
can
update
to
with
each
one
of
those
we
should
we.
We
can
check
on
that.
We
can
probably
verify
that
with
one
of
the
managed
open
shift
Folks
at
some
point
yeah,
please
do
an
OC
get
API
request
before
you
leap
yeah,
that's
a
great
point:
Our
Hope
nine!
So
if
I
do
an
OC
gets
API
request,
counts
or
I
think
I
could
just
do
API
request
count.
B
I
use
this
particular
call.
You
can
see
as
I
scroll
up
here.
There
are
three
columns
out
here,
the
important
one
that
we
want
to
that
we
care
about
as
both
through
those
different
versions.
Is
this
removed
and
release
so
as
I
scroll
down
here
you
can
see
that
right
now
my
cluster
is
using
this
flow.
Schemas
V1,
beta1
flow
control,
blah
blah
blah
and
it's
removed
at
26..
B
B
B
You
know
it's
part
of
the
clustered
managed,
which
means
that
it'll
get
taken
care
of
automatically,
but
I
can
get
confirmation
and
details
on
that
by
doing
things
like
so
OC
describe,
I,
request
counts
and
provided
that
name-
and
she
gives
me
a
bunch
of
information
inside
of
here
about
what's
what's
actually
using
that
so
I
can
say
in
the
last
24
Hours
by
node.
Here's
the
nodes
that
have
been
you
know
using
this
particular
API
I,
don't
even
see
not
all
of
these
read
zero
I
have
no
idea
where
that
16
count
came
from.
B
Here
we
go
by
user,
so
Coupe
storage
version,
migrator
service
account,
so
basically
I
can
track
down.
You
know
where,
where
this
is
at
and
what
it's
doing
where
the
service
account
is
being
used,
which
appears
to
be
this
particular
namespace
figure
out
what
that's
doing
and
why
it's
doing
it
and
kind
of
go
from
there
like
I
said
this
is
a
core.
You
know
openshift
one,
it's
it's
managed
by
red
hat,
so
we'll
have
that
fixed
before
all
that
happens,
but
yeah.
Thank
you
for
the
reminder.
Our
Hope.
B
Yeah
machine
config,
so
this
one
came
up,
I
was
having
a
conversation
with
some
internals
and
what
they
were
asking
is
in
particular,
with
or
not
machine
config
machine
sets
either
with
vsphere.
You
know,
I
want
to
modify,
say
the
CPU
or
the
memory
associated
with
my
nodes.
So
this
is
an
AWS
cluster,
but
same
principle.
Kind
of
applies
so
with
vsphere
and
IPI,
or
really
anytime,
you're
using
a
machine
set.
B
So
you
can
use
machine
sets
with
UPI
by
the
way
you
know
you
set,
you
configure
things
like
the
amount
of
CPU
the
amount
of
memory,
the
size
of
the
disks,
the
network
connections,
all
of
those
things
inside
of
the
machine
set
I,
could
and
should
bring
up
the
docs.
So
that
way
we
can
actually
show
that.
B
B
So
my
personal
opinion
is
that's
not
a
not
not
a
desirable
thing,
because
it
can
lead
to
unexpected
things.
Similarly,
I
can
go
in
on
the
machine
set
and
I
can
change
these
values.
So
if
I
come
back
over
here
to
my
AWS,
cluster
I
could
go
into
this
machine
set,
and
you
know
edit.
It
and
I
can
change
this
machine
type
or
down
here
from
like
m6i
extra
large
to
like
m6i,
double
extra
large
and
I
can
say
this
and
from
then
on
any
nodes.
B
New
nodes
that
are
created
by
this
machine
set
will
use
the
new
instance
type,
but
it
doesn't
change
anything
about
the
existing
nodes
so
to
use
our
vsphere
on-prem
vsphere
instance.
If
I
go
into
the
machine
set
and
I
tell
you,
it
doesn't
affect
the
existing
VMS
that
have
been
provisioned.
It
doesn't
go
back
and
retroactively
apply
that
config
instead,
any
new
nodes
that
are
configured
would
have
that
new
configuration.
B
B
B
The
way
that
that
you
expect
them
to
I
used
to
say
that
I
did
a
I
did
a
demo
of
openshift
virtualization
one
time
and
I
was
I,
was
going
through
this
whole
thing
and
and
I'm
talking
about
it
and
the
the
person
that
I
was
demoing
to
they
said
this
is
kind
of
a
kind
of
a
boring
demo.
Equal
yeah,
it's
virtualization
like
you,
don't
want
it
to
be
scary,
like
you
don't
want
it
to
like.
B
You,
don't
want
to
be
surprised
when
it
behaves
the
way
you
expect
it
to
which
is
create
a
virtual
machine
turn
it
on
and
like
live
migrate,
and
do
this
type
of
stuff,
like
you
want
it
to
be
boring
like
it's
a
core
service.
It's
something
that
you!
You
know
your
business
depends
on
yeah.
It
should
so
you
know
I
I
feel
like
you
know,
this
is
one
of
those
things
that
contributes
to
that.
A
A
So
mine
are
just
like
kind
of
like
updates.
One
is
a
one
is
that
red
hat
has
updated
their
certification
policy.
So
if
you
are,
if
you're
taking
Red
Hat
certifications
or
if,
if
you've
taken
a
red
hat
certification,
then
you
know
like,
if
you
fail,
then
that's
you're,
one
and
done,
and
it
that
kind
of
It
kind
of
stinks
and
so
red
hat
training
has
updated
their
policy
for
exam
retakes.
A
Maybe
here
we
go,
and
this
is
kind
of
a
big
deal.
I
mean
it's
awesome
because,
like
the
exams
are
expensive
and
they're
hard,
and
so
it
kind
of
gives
you
that
peace
of
mind
that,
like
you,
can
go
into
it
and
maybe
not
have
your
best
day,
but
then
still
have
a
chance
to
go
back
and
get
the
cert
again
so
I
I'm
glad
that
we
finally
did
this.
A
This
is
kind
of
in
line
with
what
the
Linux
Foundation
is
doing
and
with
like
what
a
bunch
of
the
other
providers
are
doing.
So
this
is
awesome
and
then
the
other
thing
is
that
recently
ish
there's
a
piece
of
podman
called
quadlet
that
was
released,
are
added
to
the
product
and
it's
where
it
makes
interacting
with
podman
containers
as
systemd
units
like
it
just
simplifies
that
whole
process.
So
this
is
a
this
is
a
really
big
deal,
especially
if
you've
ever
used
podman
and
try
to
use
the
systemd
component.
A
It
worked,
but
then
sometimes
it
wouldn't
sometimes
would
be
a
little
hacky
this.
This
is
like
the
the
new
version
of
that
and
it
allows
you
to
manage
these
containers
as
as
systemd
units,
and
it's
it's
pretty
well
integrated,
and
it's
really
nice
so
check
it
out
posted
the
link
and
the
in
the
chat
here
and
those
are
my
two
things.
B
B
A
Right
on,
but
yeah
so
like,
if
you,
if
you're
interested
in
certs,
you
know
like
I,
think
now
is
probably
the
best
time
to
like
to
get
into
it.
Yeah,
and
especially
now
that
you
have
like
the
ability
to
do
a
scout
run.
As
my
friend
Darren
used
to
say,
you
know
you
go
in,
go
check,
it
out,
see
what
it's
about
and
then
go
back
and
focus
on,
but
I
was
trying
to
win
the
first
time,
though
so,
don't
you
know,
don't
listen
to
I'm,
not
trying
to
tell
you
to
do
that.
B
B
Somebody
posted
a
thing
internally
that
was
like
you
know
you
using
the
the
golden
ratio
thing.
You
know
that
that
swirly
thing
using
that
to
you
know,
identify
like
the
length
of
each
day
like
the
relative
length
of
each
day,
and
you
know
it's
like
Monday.
Is
this
huge
block
and
the
Tuesday's
a
little
smaller
until
it
circles
around
and
like
Sunday's?
B
Just
this
little
blip,
let's
see
due
to
power
outage
NFS
server
recertable
is
used
for
bounded
PVS
with
4.10,
according
to
Victory
boot,
on
coordinate
node
by
note
yeah,
so
for
pods
that
have
PVCs
mounted
rescheduling
them
is
harder
until
because,
basically
it
doesn't
know
whether
or
not
the
PVC
has
been
released
from
the
other
node
and
it
wants
to
have
confirmation
or
it
wants
to
have
some
kind
of
confidence
that
that
has
been
released.
So
it
doesn't
reschedule,
restart
the
Pod
and
then
result
in
data
corruption.
B
We
encountered
this
with
openshift
virtualization
right.
You
know
only
one
node
at
a
time
can
access
that
vm's
disk,
otherwise
it'll
corrupt,
so
yeah
it
the
fastest
way
to
recover
those-
and
this
is
what
we
see
with
the
poison
pill
operator-
is
to
reboot
the
nodes
and
when,
as
soon
as
the
node
reboots,
it
says.
Oh
all,
those
PVCs
are
now
released
like
I
I
am
comfortable.
B
I
can
I
know
that
those
are
released
and
it'll
go
through
and
reschedule
all
of
the
workload
again
I
think
poison
pill
operator
takes
it
a
step
further
because
it
doesn't
there's
not
necessarily
A
Fencing
mechanism
for
all
of
the
providers.
So
rather
it
just
removes
the
node
from
the
cluster
I
think
and
lets
it
rejoin.
B
Is
there
any
other
way
to
fix
this
I?
Don't
I,
don't
think
so,
aside
from
waiting
for
it
to
time
out,
you
could
probably
delete
the
objects
and
have
it
recreate
them,
but
that's
that
I.
Don't
think
that
that's
a
necessarily
a
better
way
of
doing
that,
because
essentially
so,
let's
pick
on
anytime
there's
an
aha
event.
So
let's
say
the
you.
B
I
have
a
node
deployed
in
VMware
and
there
is
an
aha
event:
the
the
underlying
esxi
host
reboots
or
whatever
so,
or
fall
through
the
floor.
So
when
the
openshift
node
disappears
after
five
minutes,
it
will
go
into
a
unresponding
or
not
responding
status
with
the
scheduler.
At
that
point
it
will
attempt
to
reschedule
pods
that
don't
have
PVCs
and
then
the
ones
with
PVCs
there's
another
timeout
that
I'm
not
remembering
off
the
top
of
my
head,
but
eventually
it
will
reschedule
those
pods.
B
But
it's
it's
a
while,
however,
like
in
the
case
of
VMware,
it
restarts
the
node
within
a
few
seconds
and
then
the
node
comes
back
on
and
it
says:
hey,
I'm
back
and
here's
all
the
pods
that
I
have
and
the
scheduler
says,
but
you're
supposed
to
have
all
of
these
pods.
So
it
immediately
realizes
that.
Oh
no,
all
of
this
workload
needs
to
be
rescheduled,
and
you
know
things
like
the
PVCs
and
all
that
have
been
unmounted.
So
it
immediately
goes
through
that
process.
B
So
let's
say
that
it
you're
using
like
bare
metal
or
something
like
that.
You
know
a
physical
server
and
that
server
goes
away.
You
know
it
dual
power
supplies
failures,
right,
something
like
that,
where
it's
not
coming
back
in
a
reasonable
amount
of
time,
the
fastest
way
to
get
that
workload
back
is
to
simply
delete
the
node
from
the
cluster
literally
OC
delete,
node
and
it'll.
Kick
that
node
out
and
it'll
immediately
reschedule
all
of
that
workload
inside
of
there
so
again,
not
necessarily
a
fix
so
much
as
workarounds.
B
Okay,
so
yeah
keep
keep
keep
questions
coming
in.
We
appreciate
those
happy
to
do
our
best
to
answer
them,
but
I'm
gonna,
I'm
gonna,
ask
Johnny
in
the
interest
of
time,
because
I
do
I
do
have
a
I
have
to
stop
at
a
quarter
after
I'm
gonna
ask
Johnny
if
he's
ready
to
to
demo
some
security
profile
operator
stuff.
Yes,.
B
Admit
Essie
Linux
to
me
is
like
I
I
have
a
I
have
a
vague
understanding
of
it,
but
probably
not
as
good
as
I
should
I'm
with
Christian
Hernandez
and
like
stop
stop
disabling
SC
Linux
like,
but
anything
that
involves
policy
modifications
and
all
that
I
gotta
go
dig
through
docs
and
remember
how
all
of
it
works.
Yeah.
A
So
I
mean
I've
always
been
like
pretty
decent
at
like
relabeling
context
and
stuff
like
or
relaying
directories
and
stuff.
Like
that's
yeah,
that's
pretty
much
as
deep
as
I've
gone.
You
know
like
when
you
add
a
new
service
and
you
want
to
like
set
up
the
directories
or
whatever
and
then
adding
ports
and
stuff
like
that.
So
I've
never
gone
like
super
deep
into
it
and
like
I,
I
I
sent
you
a
message
before
we
started
this
today,
where
it's
like.
A
A
Also
didn't
know
this
until
yesterday
is
that
SC
comp
is
part
of
the
BPF
like
umbrella
right,
so
yeah
BPF,
which
is
the
extended
kind
of
falls
into
that
and
when
it
comes
to
like
permissions,
it's
controlling
the
access
is
that
a
process
can
have
within
a
container
and
then
SC
Linux
is
controlling,
like
the
the
accesses
to
like
a
file
system
or
a
service,
or
an
account
and
stuff
like
that.
So
just
kind
of
like
keeping
those
in
mind
and
then
with
the
SPO.
A
We
can
distribute
these
SC
comp
profiles
and
SC
Linux
policies
profiles
whatever
they
are
crds,
and
so
it's
really
nice,
like
the
that's
the
Linux
one
that
will
show
off.
So
what
I'm
going
to
do
is
I'm
going
to
create
a
a
nice
Linux.
One
just
run
it
through
the
examples
that
are
on
there
Upstream
docs,
but
the
the
SC
comp
when
it's
like
I'll,
show
a
profile
that
we
have
that,
like
just
kind
of
it's
essentially
like
the
oh
man
like
the
SC
alert
stuff.
A
You
know
like
back
in
the
day,
if
you
want
to
try
and
figure
out
like
what's
actually
triggering
an
essay
Linux
context
or
whatever,
then
you
can
set
up
an
alert
where
it'll
essentially
be
noisy,
and
so
what
will
happen
is
like,
as
a
process
is
trying
to
make
a
call
and
it
can't
then
it'll
log
it.
You
know
what
I
mean
so
then
you
can
go
back
and
actually
create
the
context
or
policy
for
it.
B
A
A
Oh
yeah,
my
bad
all
right
so
over
at
operator,
Hub
just
go
through
and
you
just
install
the
special
or
security
profiles
operator
and
then
what
that'll
do
is
that'll
give
you
access
to
the
API
to
create
an
SD
account
profile.
If
you
wanted
to
do
like
an
sc
Linux
profile,
we
could
do
that
and
we
can
also
do
profile
binding,
which
means
that
we
can
attach
that
profile
either
an
sc
comp
or
a
SC
Linux
profile
to
a
pod,
and
so
then
that
pod
will
have
that
restriction.
A
A
B
A
Yeah
all
right:
well,
if
you
can
see
it
I'm
sorry
I
apologize,
but
it's
under
spec
and
then
default
action
and
it's
scmp
underscore
act,
underscore
log
and
that's
a
that's
a
mode
that
essentially
makes
it
noisy.
So
if
a
policy
is
trying
to
or
if
a
process
is
trying
to
do
something,
that's
not
allowed
to
do
it'll
log
that
process
and
then
you
know,
then
you
can
go
back
and
actually
Define
the
process.
That's
more!
You
know
geared
towards
what
that
process
is
trying
to
do
all.
A
B
Right
of
like
you,
want
to
deploy
something
in
your
secure
environments,
and
so
you
go
in
and
the
first
thing
is
you
deploy
it
and
it's
it's
failing
miserly.
So
you
turn
on
logging,
so
you
can
see
what's
causing
the
issues
and
you
can
use
those
logs
to
then
go
in,
and
you
know
craft
the
SC
Linux
policy
or
craftius
setcom
profile
and
all
that
other
stuff.
So
that
way
you
can
get
it
back
to
working
again.
Yep.
A
And
and
Mira
had
asked,
what's
a
What's
the
difference
between
the
sdcon
profile
and
SEC
and
the
the
answer
is
really
like:
the
SEC
incorporates
the
SC
comp
profile
and
the
SC
Linux
profile.
So
it's
like
the
restricted
V2
is
the
it's
the
culmination
of
like
the
SC
comp
profile,
as
well
as
the
Linux
profile.
So
they're
they
don't
allow
certain
processes
like
you,
can't
have
host
access
and
network
access
and
stuff
like
that
with
the
basic
or
with
the
default
SEC.
It's.
B
A
And
that's
exactly
it
right
like
if
you
you
have
to
look
at
it
as
like
a
cake
right,
so
that
it's
just
a
different
boundary
at
the
layer
of
a
cake
you
know
and
as
you're
going
up
you're
getting
more
and
more
as
you
get
closer
to
the
top
you're,
less
secure
or
more
secure.
And
then,
as
you
know,
it's
just
yeah.
B
Yeah
because
he
I
think
it's
it's
technically
possible,
but
I
don't
think
it's
supported
to
do
things
like
disable
SC
Linux
in
core
OS,
but
if
you
disable
SC
Linux,
that
doesn't
mean
that
the
SEC
isn't
still
going
to
be
there
enforcing
whatever
policies
it
has.
So
it
very
much
becomes
a
defense
in-depth
type
of
thing
of
if
there's
something
that
causes
the
SEC
to
fail.
If
there's
something
that
you
know
on
and
on.
B
I
wouldn't
be
surprised
if
it
set
off
all
kinds
of
alarm
bells
and
warnings
and
all
kinds
of
stuff
with
openshift
4
as
well
I've
seen
the
question
asked
internally
a
couple
of
times.
Like
you
know,
oh
my
customer
wants
to
turn
off.
Sc,
Linux
and
consensus
seems
to
be
like
one.
No,
two,
definitely
no
and
three.
It
might
be
possible,
but
no.
B
A
Yeah
yeah
it
I'm
it's
it's
the
easiest
thing
to
do
to
protect
your
system
that,
like
comes
free,
you
know
what
I
mean
like
it's
it's
enforcing
by
default,
and
almost
every
service
that
you
have
built
in
has
a
has
an
essay
Linux
context
associated
with
it.
So
it's
it's!
It's
almost
especially
at
this
point
like
real,
eight,
real,
nine,
it's
pretty
transparent.
A
A
You
know
yeah,
and
so
the
next
thing
I
think
this
is
the
one
that
most
people
are
probably
going
to
do
is
like
the
SC
Linux
profile,
and
this
is
one
that
I
created
earlier
and
it's
just
using
engine
X
and
we're
just
going
through,
and
the
cool
thing
about
this
is
this
is
a
yaml
rep
resentation
of
like
of
of
this
policy.
But
what
happens
is
when
the
system
interprets
it?
It
actually
turns
it
into
like
a
Cil
format.
So
then,
you
can
actually
see
like
the
SC
Linux
formatted
language.
A
You
know
inside
the
inside
the
Pod.
So
what
we
did
is
we're
Dan.
You
know
we're
just
giving
some
nginx
configurations
here
and
then
what
I'm
going
to
do
is
like
I,
messed
up
and
I
didn't
install
web
SSH
standards,
so
I'm
gonna
stop
sharing
this
really
quick.
How
dare
you
I
know
I
know
and
then
I'm
gonna
share
this.
A
A
A
A
A
B
A
So
what
I'm
doing
is
I'm
going
to
check
inside
of
my
the
open
security
profiles,
namespace
the
damage
s
pod
and
I'm,
going
to
look
for
the
spct,
which
is
again
the
default
profile.
So
now,
if
I
do
a
patch
and
I
want
to
patch
this
to
unconfined,
then
what
I'm
doing
is
I'm
essentially
just
I'm
going
to
patch
this
to
stem
inside,
and
then
we
can
see
where
they
get
set
for
all
the
pods
again,
all
right.
So
all
right!
A
That's
in
unconfined,
it
generally
won't
work,
so
you'll
have
to
go
on
either
relabel
or
you
know,
you're
gonna
have
to
relabel
you
know
or
or
add
some
kind
of
a
roll
to
allow
it
and
then
what
we
can
do
now
is.
We
can
attach
that
policy
to
a
pod
and
so
I'm.
Just
going
to
jump
back
over
to
the
documentation.
A
All
right
bam
and
what
I'm
going
to
do
is
this
is
the
SE
comp
profile,
or
this
is
a
deployment
that
I
I
created
earlier
and
it's
it's
got
a
patch
in
it,
and
so,
if
I
look
at
this
patch,
essentially
what
I'm
saying
is
hey
look
I
want
to
use
this
SC
comp
profile
that
got
created,
and
just
so
you
can
see
it
profile
one.
This
is
the
profile
that
I
created
that
was
in
the
openshift
console.
A
All
right,
so
what
I'm
doing
here
is
I'm
just
taking
a
look
at
the
at
the
deployment
at
c-comp
demo
and
then
I'm
just
getting
the
security
context
out
of
that
out
of
that
deployment,
and
so
we
can
see
now
that
my
Etsy
comp
profile
has
been
set
to
this
profile,
one
that
I
created
earlier.
So
really,
this
is
just
gonna
again
log,
all
the
all
the
noise
right.
A
A
But
I
Andrew
I
really
think
that
this
is
like
something
that
we
should
probably
do
like
a
full
like
a
full
episode
on,
because,
like
there's
so
much
that
we
can
do
with
it
and
then,
when
you
take
the
whole
story
of
security
and
openshift,
and
then
you
know
like
the
the
file
Integrity
operator
and
then
all
the
other
things
are
the
compliance
operator
and
all
that
stuff
right.
It
really
builds
into
that
whole
story.
So
it's
probably
something
we
should
do
like
a
like.
B
They
so
we
just
added
a
tech
marketing
person
to
focus
on
like
the
overall
openshift
security
story
and
stuff,
like
that,
so
I
I
think
in
the
not
too
distant
future,
we'll
be
able
to
have
that
that
type
of
conversation
but
yeah
there's
also
you
know,
there's
an
entire
product
management
team
just
for
the
security
stuff,
ACS
gets
lumped
in
there
too,
but
it's
like
all
of
the
security
features
of
openshifts
kubernetes.
You
know
underlying
Rel
all
of
that
stuff.
They
focus
on
all
of
those
things.
B
A
B
Yeah
I
need
to
ask
if
they're
going
to
update
the
the
security
white
paper
now
that
this
stuff
has
been
released
just
for
I'm
looking
at
it
now,
it
looks
like
it
was
last
updated,
September
of
2021
here
just
for
reference
for
anybody
who
wants
to
see
it
so
I
wonder
if
they'll
update
that
now
and
add
in
you
know,
there's
been
a
bunch
of
stuff:
that's
happened
in
the
last
18
months.
Basically,
since
that
was
published,
so
the
gosh
file,
Integrity
Operator
Operator,
the
security
profile
operator.
A
A
B
I,
do
it
so
in
frequently?
Well,
it's
funny
because,
20
years
ago,
15
years
ago,
let's
see
when
did
I
actually
like
professionally
become
a
Linux
administrator.
So
at
least
15
years
ago
you
know
like
back
in
the
you
know,
Rel
three
and
four
days
like
you
had
to
understand
like
to
be
a
a
professional
Rel
administrator.
You
had
to
have
a
fairly
decent
understanding
of
Essie
Linux
profiles,
and
you
know
how
to
create
them,
how
to
manage
them,
and
all
that
because
there
was
just
they
haven't,
had
the
ensuing
15
years.
B
To
mature
of
you
know
all
these
workloads
and
all
this
improvement
from
the
community
and
like
all
of
the
stuff.
Now,
where
I,
don't
even
think
about
it
anymore,
like
maybe
once
a
year
will
I
encounter
something
where
the
SC
Linux
profile
comes
to
mind
and
honestly
I
can't
even
most
of
the
time
it's
when
I
want
to
do
things
like
use
h,
a
proxy
use.
You
know
a
an
NFS
or
an
SMB
share.
B
You
know
something
like
that
where
I
have
to
go
in
and
enable
you
know
SC
Linux
to
say
yes
so
allow
these.
You
know
these
types
of
connections
and
that
type
of
stuff
I,
don't
remember
the
last
time
I
touched
an
sc
Linux
policy,
which
is
not
to
say
there
aren't
people
out
there
doing
that,
there's
a
lot
of
really
really
impressive
applications
and
stuff
like
that
that
people
are
putting
on
you
know
not
just
openshift
but
Rel
Etc.
So
yes,
there's
absolutely
cases
where
it
happens.
It's
just
for
Andrew.
Personally,
it
hasn't
been
yeah.
A
B
A
B
B
B
Come
down
here
to
4.12
and
I
want
securing
do
our
costs
Imaging.
So
the
point
of
this
feature
is
more
or
less
to
be
able
to
allow
as
administrators
the
ability
to
add
packages
to
core
OS
and
the
way
that
this
works
is
really
really
interesting,
in
that
it
is
implemented
as
a
container,
which
makes
sense
right,
red
hat
chips,
a
base
core
OS
image
and,
just
like
you,
have
a
from
line
in
your
container
image
file.
B
It
creates
that
copy
on
right
layer
on
top
I
can
install
packages
on
top
of
it
and
or
add
code
or
do
whatever
and
then
at
the
end
of
that
I
end
up
with
this
image
that
is
deployed.
That
is,
my
containers.
Chorus
works
the
exact
same
way
and
in
fact
image.
Layering
is
a
container
image.
So
I
start
with
my
base
core
OS
image:
I
can
do
an
RPM
OS
tree
install
of
packages
and
then
ship
that
out
and
basically
have
machine
config
operator
apply
it
to
our
hosts.
B
So
that's
exactly
what
I'm
going
to
show
here
in
a
moment,
and
it's
it's
frighteningly
straightforward,
which
is
again
not
necessarily
A,
Bad
Thing.
So
a
couple
of
things
to
note
through
here
one:
it
is
rpm
os3,
which
means
that
we
have
to
use
the
RPM
OS
tree
tools
and
methodologies
for
managing
that
underlying
file
system.
Right.
It's
image
based.
This
is
one
of
those
really
cool
things
about
core
OS.
B
If
you
didn't
know
this,
so
when
we
do
things
like
updates
with
openshift
with
core
OS,
it
applies
the
new
image
it
reboots
it
to
flip
over
to
that
image,
and
assuming
everything
is
good,
it
stays
if
something
goes
wrong.
It
simply
flips
back
to
the
old
image
during
that
update
process,
so
I
RPM
ostree
is,
is
something
that
has
really
been
a
powerful
enabler
inside
of
openshift
and
the
whole
management
Paradigm
for
the
Clusters.
B
B
So,
with
some
features
that
cause
like
low
level
configuration
changes
inside
of
openshifts,
you
have
to
set
this
Tech
preview
note
upgrade
feature
gate
and
when
you
do
that
a
configuration
change
that'll
result
in
all
the
nodes
rebooting,
but
it
also
enables
a
number
of
other
features
and
functionality
inside
of
the
cluster.
So
we
can
see
here
you
know
CSI
automatic
migration
for
Azure
and
vsphere,
enabling
swap
memory
on
nodes.
B
You
can
choose
to
enable
these
one
at
a
time
they
don't
all
automatically
get
enabled
by
the
way
so
down
here,
like
c
groups
V2,
you
know,
if
you
want
to
test
out
c
groups
V2
the
important
thing
is
the
no
upgrade
set
I.
Think
one.
Once
you
set
this,
you
can
no
longer
upgrade
your
cluster.
You
can't
go
from
you
know.
If
you
set
this
on
4.12,
you
won't
be
able
to
go
to
4.13
you'll
have
to
reinstall
the
cluster
and
all
that.
B
So
these
are
things
you
don't
want
to
do
with
a
production
cluster
for
this
one.
You
don't
have
to
set
that
feature
Gates,
but
I
would
say
you
still
don't
necessarily
want
to
use
it
in
a
production
cluster.
Without
you
know,
guidance
without
out
interacting
with
red
hat
and
red
hat
support.
First
and
I
say
that
civically,
because
one
of
the
first
use
cases
that
we
have
for
this
is
applying
hotfixes.
B
You
know
customers.
This
has
been
something
that
we've
I
struggled
with,
but
it's
it's
been
a
something
that
has
been
concerning
to
streamers
for
a
while
now,
which
is
you
know,
hey
I
found
this
bug
or
hey.
There's
this
security
issue
and
the
way
that
we
apply.
Those
is
through
an
openshift
update
right.
You
have
to
wait
for
a
z
stream
once
it
that
Z
stream
makes
it
through
it
gets
applied
and
then
you're
good
to
go
well
with
this.
We
can
basically
say
you
know
immediately.
B
You
know,
yeah
Rel
has
the
fix,
apply
this
package
inside
of
your
core
OS
ing
layering,
you
know,
deploy
it
amongst
your
hosts
and
then
you've
got
that
fix,
and
in
a
week
or
two
weeks
or
however
long
the
relay
cycle
is
for
the
next
e-stream.
When
that
gets
applied,
then
yeah
you
can
go
in
and
you
can
unset
your
your
customized
image
and
have
it
reapply
the
the
base
template
with
the
new
you
know
updates,
so
you
can
kind
of
go
in
and
out
of
this
model
as
well.
B
What
I
mean
by
that
is,
if
I
create
my
own
customized
template
or
a
core
OS
image.
I
can
apply
that
for
a
week
or
two
weeks
or
a
month
or,
however
long
and
then
I
can
remove
it
and
go
back
to
the
default
where
that
changes
or
where
you
might
not
do
that.
That's
the
use
case
they
have
explained
here
with
things
like
hotfixes
is,
if
you're
needing
to
apply
things
like
drivers.
B
B
B
So
we
go
through
here
and
in
a
moment,
I'll
show
creating
a
machine
config
to
then
apply
our
customized
image
apply,
this
machine
config
will
know,
or
the
machine
config
operator
will
no
longer
update
those
pools.
It
basically
says
you
need
to
go
in
whenever
so,
let's
say
4.12.3
gets
released.
You
need
to
go
in.
You
need
to
pull
the
new
base
image.
You
need
to
apply
whatever
packages
against
it
and
then
you
need
to
go
in
and
update
your
machine
config
in
here
to
use
that
new
image.
B
B
So
there's
a
couple
of
things
that
we
need
and
I'm
just
now,
realizing
that
I
took
all
of
my
notes
and
I
did
all
of
this
on
my
laptop
and
I'm,
not
sitting
on
my
laptop
I'm
sitting
at
my
desktop,
which
means
that
they
are
not
synced.
So
we
get
to
do
it.
So
you
all
get
to
watch
me.
Do
it
live,
let's
see
image
layering.
B
So
let
me
copy
this
command
out
and
switch
back,
and
so
what
this
is
going
to
do
is
for
my
cluster,
as
you
can
see,
I'm
running
again
4.12.2,
it's
going
to
pull
out
the
specific
container
image
that
it
uses
for
this
core
OS,
and
this
core
OS
would
be
expected
to
change
with
each
Z
stream
associated
with
our
cluster
right
or
most
C
streams.
I
should
say,
after
that,
we
need
to
go
in
and
create
a
container
file
that
sources
or
uses
that
as
the
base.
B
So
if
I
do
a
bib
on
my
container
file,
let's
see
that
I've
already
created
one
for
us
here,
so
bye
oops
go
here,
I'm
just
going
to
paste
it
in
to
show
you
that
this
is
the
same
image
that
I
used
before
right.
So
this
is
the
one
that
I
just
determined
from
my
cluster,
so
we
can
get
rid
of
that
line
just
like
any
other
connection
from
that
core
OS
base
image.
B
Now,
if
you
look
at
the
documentation
over
here,
it
focuses
on
the
use
case
of
again
applying
those
hot
fixes
and
stuff
like
that.
Where
we're
not
adding
a
package,
we're
replacing
you
know
some
some
core
package
or
some
base
package
of
openshift
or
of
a
core
OS.
Rather
so
you
can
see
the
command
that
you
use,
for
that
is
going
to
be
different.
It's
going
to
be
an
override,
replace
as
opposed
to
an
install
so
I.
B
Also
in
my
case,
I
went
ahead
and
pulled
the
pneuma
control
package
down
and
kept
it
locally
simply
because,
as
I
was
prepping
for
this
I
didn't
want
to
have
to
worry
about
any
kind
of
registration
or
anything
like
that.
Trying
to
you
know,
pull
from
various
repositories,
I
don't
even
know
if
it
has
repositories
configured
because
remember
our
normally
historically.
This
is
not
something
that
we
would
do.
You
know
you
know
SSH
into
the
nodes
and
do
an
RPM
OS
tree
install
so
I
didn't
test
to
see.
B
If
any
of
that
stuff
is
configured,
I
just
went
ahead
and
pulled
the
package
locally
and
then
added
in
and
installed
it
locally,
but
yeah
other
than
that
pretty
straightforward.
So
RPM
os3
install
it
installs
our
package
from
the
location
that
I
copied
it
into
right
here.
Does
it
clean
up
and
then
does
a
commit
against
that
particular
image?
B
So
remember,
container
image
here
is
going
to
be
from
so
it's
going
to
pull
this
image
down.
It'll
create
a
new
copy
on
right
layer.
It
will
add,
in
our
RPM
it'll,
create
a
new
copy
on
right
layer
and
it'll
run.
These
particular
commands
against
that,
and
then
that
becomes
our
new
base
image,
which
we
will
then
push
into
a
repository,
a
registry
and
then
we'll
tell
openshift
in
order
openshift
to
use
that
for
our
nodes.
B
B
B
B
So
that
we
can
do
the
build
process
here,
so
in
order
to
avoid
the
download
you
can
see
it's
a
2.86
gigabyte,
download
I
won't
delete
this
base
image,
but
but
it
would
pull
that
down
if
it
needed
to
at
let's
go
ahead
and
do
our
build
again
so
from
our
base
image
it's
already
pulled,
so
we
don't
need
to
wait
on
that
copy
in
our
RPM
file
and
then
the
next
step
is
going
to
be
an
OS
tree.
Rpos
tree
install
using
that
particular
RPM
file.
B
B
Let's
see
is
using
a
custom
core
OS
image
and
modifying
default
packages
in
the
cluster,
supported
by
Red
Hat.
So
at
this
moment
no,
so
it's
a
tech
preview
feature
which
means
that
it
is
unsupported
but
you're
welcome
to
test
it
and
you're
welcome
to
use
it
for
those
things
in
the
future.
Yes,
however,
what
specifically
is
supported
to
be
modified
or
changed?
B
So
I
would
expect
clarification
as
we
get
closer
to
GA,
which
I
again
without
speaking
for
product
management,
which
means
take
it
with
a
grain
of
salt,
I,
susp,
I,
I,
hope
we'll
hit
GA
in
413,
but
you
know
we'll
have
to
wait
to
see
what
what
reality
looks
like
there
features
can
always
get
pulled,
but
it's
hard
to
add
them
if
that
makes
sense,
all
right,
so
pretty
straightforward
here
if
you've
ever
done,
RPM
OS
tree.
This
is
the
standard
output.
B
B
And
now
it's
okay
for
a
minute,
and
now
we're
done
so
now
if
I
were
to
look
in
my
Quay
repository.
What
I
see
is
those
that
that
container
image
having
been
pushed
up
and
being
available,
so
you
don't
have
to
use
quay
for
this.
You
can
use
you
know
whatever
your
normal
internal
registry
is
I,
think
over
here
in
the
docs
they
use
yeah,
see
example.com,
which
is
just
replace
it
with
whatever
yours
is
so
with
that.
So
with
our
our
layered
image
now
being
available,
it's
been
created.
B
B
So
we
have
our
machine
config
I'm,
going
to
tell
it
to
apply
to
any
node
that
has
the
worker
role.
Of
course,
you
can
be
more
granular
with
this,
as
you
would
like
OS
layer,
hotfix,
we'll
call
this
OS
layered,
pneuma
CTO
and
then
I'm
going
to
point
this
to
my
OS
image
URL.
So
one
thing
to
note:
here:
they
are
using
the
shot,
256
sub,
I
kind
of
like
that
approach
and
it's
relatively
easy
to
get
those
from
Quay
as
well.
B
B
B
Here
we
have
our
OS
layer,
Nova
control
I
can
go
to
my
mCP
and
you
can
see
that
now
the
worker
one
has
been
re-rendered
and
now
my
nodes
are
updating
click
on
this.
What
we
should
see
is
it
go
through
in
do
what
it
needs
to
do:
yeah
an
available
count
as
one
because
it's
going
to
apply
those
one
at
a
time
because
the
default
Max
unavailable
is
one.
B
So
now
it's
just
you
know
we
we
wait.
It'll,
take
it
a
few
minutes.
It'll
go
through,
it
will
apply
the
new
image
it
will.
Reboot
the
nodes
or
it'll
coordinate
drain,
apply
the
new
image
reboot
the
nodes
they
should
come
back.
They
should
now
have
our
customized
image
available
to
them,
so
very
straightforward.
In
that
respect,.
B
A
B
A
B
It's
just
it's
just
like
a
container
like
this
makes
perfect
sense
and
I
I
think
so,
even
though
it
is
applied
as
a
or
managed
as
a
container
image,
a
core
OS
itself
isn't
running
as
a
container
image
right
it
uses
it.
Does
an
RPM
OS
tree
upgrade
no
gosh
now
I'm
forgetting
the
command.
It
basically
copies
that
entire
image
out.
So
we
don't
suffer
from
things
like
the
copy
on
right
layer,
penalties
or
anything
like
that
at
the
base.
Os
Image
level,
yeah
yeah.
B
I'm
I
said
I'm
looking
forward
to
this,
because
it
enables
some
you
know,
particularly
for
Edge
devices
and
stuff,
like
that.
Where
we
end
up
with,
shall
we
say:
uncommon
Hardware
combinations
it
it
has.
This
makes
it
easy
to
add
things
like
drivers
and
other
stuff
that
we
need
at
those
nodes
without
going
through
the
process
of
okay.
How
do
I
create
a
privileged
container
that
has
a
a
kernel
module
and
have
it
get
instantiate
like
it's
a
complex
process
that
this
is
just
dramatically
simpler?
B
B
A
A
B
Yeah
I
assume
we
cannot
create
a
conf
for
the
control
play
nodes.
Actually,
I,
don't
know,
I
I
would
I
would
assume
you
can.
But
that's
a
good
question.
Well,
I'll
ask
the
product
management
team
about
that,
whether
or
not
that's
on
the
plan
to
be
supported.
Etc,
because
in
my
mind
you
know
again,
if
we're
talking
about
something
like
drivers,
it
makes
sense
that
you
know
at
an
edge
no
at
an
edge
deployment
or
something
like
that.
B
You're,
probably
going
to
be
using
something
like
single
node
openshift
or
a
a
compact
cluster
right,
a
three
node
cluster,
where
you
know
the
the
nodes,
the
worker
nodes
are
control,
plane
nodes,
so
things
like
that
are
going
to
be
it's
going
to
be
important
to
be
able
to
apply
these
and
manage
these
with
those
control
plane
nodes
as
well
and
I.
Don't
know!
B
That's
an
interesting
question:
I
wonder
if
things
like
kublet
are
managed
through
RPM
OS
tree
I,
don't
think
they
are,
but
I
don't
know,
because
that
could
cause
complications
if
there's
mismatches
but
I
think
that
there's
enough
flexibility
in
kubernetes,
where
kubernetes
can
be.
You
know
here:
let's,
let's
look
at
this,
you
know
OC
version,
so
you
know
here:
kubernetes
is
125.4,
I.
Think,
there's
enough
flexibility
that
you
know
the
cluster
can
be
kubernetes
1.25.4,
but
the
nodes
can
be
using
kubelet
from
1.25.3.
B
You
know,
which
is
the
type
of
change
I,
would
expect
to
see
in
like
a
a
z
stream
update
where
we're
having
to
do
that.
So
I
update
the
cluster.
You
know
I
I
go
in
through
here
and
I
update
the
cluster
and
it
updates
openshift
in
kubernetes,
but
not
the
UNS
and
then
I
go
in
and
I
update
the
core
OS
and
it
can
be
done
in
conjunction
I.
Don't
think
there
are
any
strong
ties
to
those
or
rigid
I
should
say.
A
B
Yeah
and
then
for
anybody
and
everyone,
including
Red,
Hat,
folks,
IBM
folks,
you
know
customers
Partners.
Anyone
who
wants
to
chat
with
us
I
always
recommend
the
kubernetes
slack,
so
the
kubernetes
slack
and
Johnny
I,
don't
know.
If
you
have
your
link
handy.
The
kubernetes
slack
has
a
openshift
users
channel
that
you
can
reach
out
and
ask
questions
and
interact
with
the
community.
It's
something
like
4,
000,
strong
or
4500
strong.
Now
you
can
also
ping
Johnny
and
I.
B
B
B
Yeah
anyways
and
we're
also
hoping
to
have
a
number
of
other
topics
coming
up,
so
not
just
around
4.12
but
around
other
features.
Other
capabilities
in
openshift,
as
well
as
we
started
talking
some
Partners
about
bringing
some
Partners
on
so
I
would
definitely
suggest
if
you
have
not
already
to
subscribe
to
whatever
Channel
you're
watching
us
on.
B
You
know
maybe
set
up
an
email
filter
or
something
like
that.
If
you
don't
want
to
get
a
an
alert
or
anything
like
that,
every
time
you
know
red,
hat
or
openshift
posted
a
video
to
the
channel
but
yeah,
we
would
love
to
have
you
all
and
of
course
you
can
go
to
the
streaming
calendar
as
well.
That's
at
red,
hats.com
or
red.ht
slash
streaming,
I'll
post
that
in
the
chat
here.
B
A
B
A
B
Maybe
see
you
next
week,
I
know
you
said
you
had
something
that
might
overlap
and
in-person
things
are
important.
So
if
not
I
will
be
here
next
week
for
sure
I
think
somebody
mentions
the
agent-based
installer,
which
is
what
I
was
considering
doing
for
next
week's
topic,
and
hopefully
Johnny
can
join
us
for
that.
B
So
best
way
to
expose
a
service
to
a
public
IP
address
via
metal
IB,
a
metal
lb,
so
metal
lb,
you
assign
it
a
pool
of
ips
that
it
can
use,
and
you
can
you
can
either
allow
it
to
Auto
Select
from
that
pool
or
you
can
manually
assign
it
an
IP
from
that
pool.
So
if
those
are
publicly
exposed
IPS
already,
then
you're
kind
of
good
to
go.
If
not,
you
can
you
know,
set
up
firewall
rules
or
or
a
another
external
load
balancer
to
direct
that
traffic
through
and
connect
them
together.