Red Hat OpenShift OpenShift Commons Briefings hosted by Karena Angell (Red Hat), 3 Nov 2021

Previous Meeting

Next Meeting

⏯

youtube image

►

From YouTube: OpenShift Release Update and Road Map - Karena Angell (Red Hat) OpenShift Commons Gathering 2021

Description

OpenShift Commons Gathering 2021
OpenShift Release Update and Road Map & demos
Guest Speakers: Karena Angell (Red Hat) and Christian Hernandez (Red Hat)
https://commons.openshift.org/index.html#join

A

All right so today we're going to dig into some of what's going on in 4-9 last week. If you watched it, the openshift product management team went through a whole session on what's new in 4-9 and it's over two hours long. So you know this weekend getting your pjs and you know, grab some popcorn and watch that so today, we're not going to.

A

We don't have time to get into all of that, so we're going to cover a few key areas and uh rob zumski uh helped with this, and if you've watched the other openshift comments, uh we already did a recording, but rob is online if you're watching this on the live stream or you're in hoppin. Right now he's there answering questions and I'm also on the openshift product management team, I'm karina angel.

A

I know a lot of you but please come say hi during the break, all right. So let's dig into some of this all right. First thing we want to talk about is how openshift is exploding for more than a single cluster use case.

A

Almost all of our customers are running not only one or two but 10 20 100 clusters, and so you need standardized tools to manage this fleet of open shift. That's out there all right! Now it comes down to this multi-cluster layer.

A

You need tools to manage your whole cluster. Your you need tools for the multi-cluster management. You need a container registry to store all your artifacts and your applications and your security and getting your configuration and compliance checks across your fleet and then there's this routing leg layer. So your global ingress, your egress, your load, balancing your service mesh and then bringing that into the cluster itself and getting encrypted tunnels between all of your clusters.

A

So they can talk together, and this goes all the way down to the node layer where you're actually interfacing, with the hot, with the hardware, so you're doing. Hardware offload your super fast, telco type, workloads, um your gpus, your other machine learning tools and it's all backed by multi-cluster storage. Your backups, your disaster recovery and all your storage needs are met across the entire fleet.

A

So that's the openshift ecosystem.

A

Now today I want to talk about a couple areas in depth.

A

We have multi-cluster security, automation and when christian runs over here from his keynote, he has a great demo set up for you so covering these areas as well, and so for each of these areas, we're going to talk about what's going on in the upstream, what's going on right now and then some futures.

A

So let's talk about multi-cluster.

A

Upstream, there's two main areas in the multi-cluster arena: first, there's open cluster management. Now this is the upstream for our advanced cluster management product, and this is being bootstrapped right now and donated to the cncf so go visit. It join the community and give it a star.

A

So this is simplified fleet management and it's key for managing all of your clusters. um There's a bunch of cool things under the hood for cluster provisioning. It's through a project called openshift hive. Now that's another open source project.

A

It provides a framework for doing governance and compliance tasks so delivering your policies down to your fleet, auditing, your fleets, making sure they're in compliance with the policies and all other kinds of security and compliance needs.

A

Another thing you need to do is actually deploy out to your fleet, your applications. So that's another key part of this project. You can do dynamic placement and other policies around your applications.

A

So replicated between a sec all right under the hood, it uses uh projects like argo cd, um which we'll talk more about later open policy agent, which we'll also talk about more later, as and thanos for metrics and observability now. Another great thing that's happening upstream is all the work with the cluster api.

A

This is a project out of a working group in the kubernetes community. That says it's designed to fill the gaps and tools like for um like cube, adm, so cubadium, it's a cli for bootstrapping coupe clusters, and it turned out to be not as declarative as you need for doing infrastructure as code workflows.

A

So if you want to describe an entire cluster and maybe stamp it out, 20 30 100 times you weren't really able to do that with kubatium.

A

So this is this was going to this wraps around cubadium and uh provides a better tool for that.

A

Let's see so right now in open shift from multi-cluster management.

A

uh A lot of that upstream work is being baked right into openshift. First there's a cluster creation in acm, so advanced cluster management. Today you can boot new clusters, that'll automatically inherit all the role-based access control, governance, security policies that you have across your entire fleet. It sees a new cluster shows up. It automatically applies all of that policy.

A

You can also manage the full life cycle of all your openshift clusters, so that software upgrades scaling out the cluster managing other things like that. Another really cool feature is cluster pools. So, just like we have a pools of machines worker machines. You can have pools of clusters that you can claim.

A

So, if you're doing some quality testing- and you need a quick cluster, you can go claim it use it, tear it down, destroy it all without having to wait for it to be installed. So that's a huge time saver and it's really cool.

A

On the monitoring front, it's really important to have application deployed across your clusters. um Have the big picture.

A

So it's important to know. What's going on how many resources are you using? Have I claimed too many resources? um Am I using too many that are reserved and not actually in use? So we have built-in dashboards for that see the networking arena. So this is really key.

A

You have a front end that needs to talk to a database on a different cluster or you've scaled out. The data base across two different clusters and you need they need to talk to each other. So extending that networking link is also key.

A

The advanced poster management can help. You expand that pod network across the encrypted link and another really cool thing is all your pod ips continue to work right, so it looks like kubernetes does on a single cluster, but it's on multiple clusters and it can be a ton of clusters.

A

So that's really cool and the cncf submariner project is the backing technology here. So go check that out too. If you want to dive further in all right, quick road map for multi-cluster, some key items, so the new cluster switcher, you can move in the ui, you can move between, seeing all your clusters and then dive further into a single cluster. If you need to debug or change the configuration.

A

And some other things that are coming out in the acm world, just continuing to mature and the shared sso is something that can be very easily configured once you have access to all your fleet management tools, so we're looking into that as well as built-in default policies for governance and risk, so things like cis compliance can be built into acm and the submariner multi-cluster networking that we talked about, and there are test workflows for that right now.

A

So if you want to dive in and go look at that working on getting that to ga, but definitely if you have feedback, please let us know all right. That's a really quick overview of the multi-cluster world and of course, if you're online ask rob questions, he would love that.

A

All right now, let's dive into security.

A

A

Pod security, pod security has been deprecated and it was deprecated and it's being replaced in um kubernetes 125 or at least that's. The target. Removal openshift still supports just want to make sure everybody's still clear, still support security context constraints.

A

So, even though we're talking about upstream, that's not going away, but if you are a partner or your clusters depend on pod security policy start looking into pod security.

A

The future replacement for pop security policy is much much simpler. So if you're used to more complex policies, you'll want to look into open policy agent or opa or kyverno. So oppa right now is supported in acm through a plugin, see something else. That's going on upstream, where it intersects kubernetes and linux is the username spaces, so username spaces, that's something that works with sc linux. It protects the container context on the operating system on the operating system node.

A

So this is an intersection of that it's actually a cri. So it's a container runtime interface feature that we already use in openshift, but the kubernetes community is going to plumb that all the way down into kubernetes and when that happens, openshift will start using it automatically.

A

What that allows you to do is user id mapping. So if you have root inside your container, it doesn't mean that you have root outside or root on the host.

A

So upstream, this enhancement proposal is still in progress, and so we hope to use that as soon as it lands.

A

All right, so we talked about advanced cluster management. Now, let's talk about advanced cluster security, I'm sure you've seen all the announcements on acs so advanced cluster management and advanced cluster security together with openshift. This is a offering called openshift platform plus, if you've already heard a lot about that.

A

So openshift here in the middle, it comes with an immutable operating system so with all the default security policies and automated operations.

A

But now you have a number of different different personas, and so we need additional tools to help out all of them. So starting on.

A

The left right depends on what screen I'm looking at starting with advanced cluster security. So you have your security and your operations. Folks, uh your sac ops, if you will those folks have a very focused role, uh they're looking at threats that are happening right now in the cluster, so real-time security incidents, as well as automated things like scanning for compliance and vulnerabilities auditing, your network policies- they can do all of that through advanced cluster security and then affect the number of openshift clusters across the entire fleet.

A

With your standard set of policies now, where advanced cluster management comes into play is some of your other personas.

A

You have developers that are deploying applications and they want to store their applications as code, and they can deploy all of that through advanced cluster management, so that you have exactly what's happening in production at any moment in time now, your devops team might be changing some cluster configuration at the same time, and they want to have that also managed, as code through security for security and so going through the pipeline of changing around some of the default config on the cluster.

A

That can happen through that pipeline as well all orchestrated through advanced cluster management.

A

And then your security folks, they may want to affect some of those same cluster configs, and they can do that through advanced cluster management as well as deploy out our quay registry. um So developers can scan those uh things at build time. So one of the cool things is, you can scan your containers at build in acm and then scan it again at runtime as you're going through acs.

A

Okay, let's look at some of what's happening on our security roadmap. I mentioned compliance a few times, so we have a compliance operator that can do cis benchmarks and standards like that we'd like to build that into the openshift console right now, it's available in the acs ui.

A

So you can already look at that, but you'd like to expand that even further alright and if you've been tracking a jet stack, serp manager project, it's a really popular tool for generating certificates for web applications, we're productizing that and bringing that into openshift and we're doing it in a unique way.

A

It's going to be automated certificate management for all the users in your cluster, but it's going to do something kind of interesting where you can issue certs from a number of different places.

A

So you can issue search from the internal cluster ca, which is what openshift uses right now or you can do it from your hashicorp vault or let's encrypt. So, let's encrypt is more for web applications. So it's one of the traditional use cases for cert management.

A

Now from those two, you can actually issue certs to a number of different places and probably the main thing is going to be developer. Applications and those are running on your cluster, but they can be used for operators that are installed on your cluster and if you have operators doing web hooks.

A

If you need certificates from them, they can also you can roll those through this project, as well as other red hat products like middleware all right, openshift, sandbox, containers.

A

So this right now is available in tech preview for four nine, so that we're working towards uh gaining that and if you have feedback on your sandbox containers again reach out and this lets, you run your third party or your untrusted code.

A

And it's designed for your applications that are cloud native, so they're already in your containers and they need a little bit of extra isolation and you wrap all of that in this extra kernel.

A

So it's just a bit safer.

A

We hope to get that fip certified by the second half of next year um and fips sure we all know, but it's a us government standard security standard all right and last user name spaces.

A

We talked about this already, but once this lands upstream, we want to bring it out of the box into openshift, so for all the applications that are running in openshift- and this is especially helpful for openshift builds and if you want to use the quay registry by design, they are third party untrusted code and are just by nature, and we want to protect those as much as possible, so further focus on security, all right. That is what we have for security.

A

uh Let's talk about automation,.

A

All right, we talked about platform level and management level. Automation earlier, uh what's also being driven across openshift is workload and development, automation and standard standardization of how your applications are delivered automatically through your workflows.

A

Now, there's a lot of innovation that is happening upstream, uh it's not on the side, but what I really want to mention is the get ops working group uh where christian is right. Now I haven't seen a few ah there. He is thanks, so christian was just there, but the get ops working group is uh it's a very active community and just kind of exemplifies what upstream is and just multiple companies coming together to focus on get-ups and anyway. I want to mention and that's through the application delivery technical advisory group.

A

So if you want to get involved, go join that so argo cd is one of the most popular projects in this area and that's the upstream for openshift get offs and argo right now I mean there's continual support for helm, customize, other tools that are really popular and um consolidating those features into the user interface uh previously and still now, there's um all the different interfaces that you have to switch between and now they're being consolidated, see another thing so, for example, since customize 42 has been pulled in now, you can specify that helm should include crds when inflating a chart.

A

So that's cool.

A

Argo cd has also moved to project scoped repositories and clusters, and what this means is that it makes it easier for developers to continue working without having to reach out to your cluster admin or needing your global configs, and another key enhancement I didn't put it on here- is the application uh application sets. That's part of argo cd.

A

I know christian is very excited about application sets so and with application sets, you can create, modify and manage multiple applications through your templated automation. So previously you can only do that through a single repo or name space. All right, techton techton is the upstream for openshift pipelines.

A

It's continuing to gain maturity with pipeline, as code teams can configure your builds your tests and deployment and code that's trackable and stored in the central repo.

A

And with this continued focus on dev cyclops, so security running theme, so there's support for your rootless images and your experimental hermetic execution mode. So that removes the networking so that you can go ahead and test it without worrying about uh it. Just isolates it more and makes it more secure all right.

A

um One last note on techton they're, also doing a lot of work on advanced error handling and making it easier to debug your pipelines. If something happens so again that maturity for the project, keda keda, is really interesting. So this is kubernetes event driven, auto scaling. So that's what cada stands for this is event aware, autoscaling. So currently, with auto scaling with your hpa, it's focused on cpu memory.

A

However, cada has this concept of scalars, and what this means is that now you have different triggers such as that you can set up such as a sql query, so that's cool or a stream or how many messages you have in your queue. So you have these different triggers that you can set up to scale your application, also exposing your cloud events so cloud events.

A

This is it's a specification out of the server list working group, so that's another cncf working group and that allows you to set up it's a specification defining a common standard for a common format for your event data. So that's really helpful in creating all the scalars.

A

So there's a lot of work being done there. Cada is being productized into openshift and that's going to not land for a little bit, but uh we're doing a lot of work upstream on that as well. All right, hey native.

A

And make sure we have time for christian's awesome demo, k native is the upstream for openshift serverless.

A

And the k native, the openshift serverless team really drives a lot of work upstream. um So there's so much going on uh so k native functions, the openshift serverless team donated the all the work being done on functions to k-native um and to the k-native sandbox they're, also driving a creation of a functions working group. So if you're interested in serverless functions go get involved upstream and also they're putting a lot of effort into there's a function, repository directory that has all kinds of runtimes and templates.

A

And then, let's see apache kafka, the eventing team has done a lot of integration work with apache kafka upstream, so there's so much going on uh integrating those as well and for serving.

A

I talked earlier about the end-to-end encryption so driving a lot of work upstream on encrypting all hops through your cluster.

A

There's a lot of cold start improvements too. So.

A

All right so what's happening right now again, I want to talk about so workload, automation as well as cluster automation, workload, automation, all that work being done upstream for your git ops and your pipelines. That's all coming downstream, uh also, integration work with advanced cluster management and a lot of off cluster automation, so more integration with ansible.

A

Also talked about the scaling, uh dynamic scaling of using cada is the backing technology and, under the covers it uses. The horizontal pod, auto scaler so puts a wrap around that and by default, the pod otter, scaler uses cpu and memory utilization to auto scale and cada just expands on that.

A

Cluster automation, all right, we talked about multi-cluster management. I just want to highlight all the different areas where automation is being driven across the platform, so automation through advanced cluster management, to manage your entire fleet through acm and.

A

Right now definitely want to highlight you can manage up to a thousand clusters in a single hub and that's just amazing. That's a lot! That's a lot of clusters so started this by saying that you know we see that a lot of customers are are using. You know 10 20 100, it's even up to a thousand so and even more they're testing.

A

Further from that.

A

And want to also highlight that by design openshift4 is designed to automate all your operations and operators themselves are designed to automate.

A

Your workloads your day, two operations, sorry all right, automation, roadmap and then we can get to christian's amazing demo. No pressure, though.

A

All right, the um some highlights on the automation roadmap, all right again, continuing to build on all the work being done upstream for techton and get ups or argosy and tecton all right and integrating further with techton hub. So it's easier to pull the workloads and or the workflows in from tekton hub and a lot more pipelines as code use cases.

A

Something really exciting will be the ga of open shift, builds v2 and build packs for pipelines, so moving from openshift builds to v2 and, of course, the sandbox containers and pipelines. So there's so much happening, and so much that's going to land exciting times.

A

Serverless again, the cada integration talked about cada before and that will be probably more in the looking at 411 and beyond time frame to bring that into openshift serverless. But it's on the horizon and that'll be k native and k to complement each other, so that'll be great, bringing that into openshift serverless advanced cluster management.

A

So I mentioned a thousand clusters they're going to be doing even more testing and improving the performance and scale of managing across the entire fleet.

A

There's so much more, I could say, but I want to make sure we have time for your demo.

A

All right, so we talked about multi-cluster, the multi-cluster layer and each of the layers and uh christian.

A

If you want to come, show us what you have prepared.

B

Let's go, is it oh, it's not. There. We go.

A

All right, let me switch out.

B

B

All right, cool.

B

Can you hear me good thumbs up all right um cool yeah? Oh look at that. You guys have a monitor here, so this is really cool by the way. This is like the first time. I've seen this in any um any conference. So let me quickly set up here because I actually want to mirror my desktop and not just.

B

Okay, hopefully this doesn't cause a kernel, panic.

B

B

All right just look good. Should I make a little bigger, maybe just a scouch okay, there we go so um actually um by the way, it's great to see everyone here. um It's it's a little awkward right to to be back at conferences after you know, so so long uh not being at conferences and seeing everyone in 3ds is is, is actually really cool. It's a little weird where I guess we'll get over the awkwardness as the week goes and um it'll uh you know, it'll be really cool.

B

Actually, um a quick shout out to gurish grish is someone. I've worked at for a long time.

B

There's a demo sort of halfway inspired uh by some of the talks he's had with his customers, where we talk about how openshift acs acm it's all better together right and so I'm kind of kind of go through a work workflow to talk a little bit about how you can integrate acs and all its functionalities into openshift and into acm um and into pipelines to kind of just see how you can have that security integrated all in so here I have acm right so advanced cluster manager, I'm supposed to say red hat, advanced cluster manager, sorry- um and so here I have a list of my clusters um again.

B

It has like, um if you worked with acm before you, should see that there is my my local class. I keep forgetting. I have the monitor, but I'm so used to looking this way. um As you can see, I have the local. um This is the whole local hub cluster there's a little test cluster here. This is actually um which one I really think is really cool about. Acm um is that uh this actually test cluster is be in my home lab behind the firewall and acm is still managing it.

B

So, for those who have like things like disconnected clusters or um their gap clusters, acm can still work in a model where you can still have that secured right. So this is literally this. It's a server sitting under under my desk, um but um I'm also managing uh this cluster called cluster two- and I can um from here it gives me certain information about the the cluster.

B

um You know what version that there's an upgrade available that um uh that there's nine nodes in this cluster is actually pretty big, because you'll see why, in a second um looks like there's an issue being identified here that wasn't there yesterday, so I won't click on that um and then you can actually go to the cluster here itself, um and this is open one of the managed clusters here there we go and part of this installation is that I'm actually running um acs right.

B

So just like anything with openshift, just like the the the entry point for anything in openshift right is the operator hub. You go to the operator hub, it's there right, um and so this is advanced cluster manager. I've already pre-installed. It um pre-set it up here and I kind of want to go through just a little bit about acs in general right so so see here. This is a dashboard. At first glance, you can see that I have some system violations right. I have zero critical. I have 165 high.

B

You know I have all of these at a glance I can see. What's what's going on here, um I can see my top riskiest deployment and you have to kind of keep in mind with security and especially with acs. This is all relative right, so risky. It just means relative to what it finds right. So I have, since I have zero critical risky doesn't necessarily mean critical or it just means. These are the the top offenders of what you have here, um and it shows you the list of those deployments.

B

um I'd like to take a look. This is this is my favorite page by the way of acs um when I first started working with acs, I'm like I wish I had this.

B

You know back in openshift, 3 and openshift two sort of thing. I I like seriously right so here you can see the top um violation is that someone accessed a secret. The seeker just happens to have the cube admin password so that it raised that as a um uh as a violation right and right now it's set up just for um just to note it right.

B

You can set it to either block it or you can set it to it to fire off alert to page of duty right, hey someone access the secret, um you know it access it multiple times. This is not a big deal because it was me accessing the secret, um but this is actually um a really cool. This is probably like one of my favorite things is is like. I wish I had a way to just it notified me when someone's accessing something in my cluster, um some of the vulnerability management here, yeah there we go.

B

So this gives you an information of the top riskiest deployments right. So here there is um an application called price list that um jason- I don't know if he's around he. He helped me build it a long long time ago and he made fun of me because I misspelled purse list when I first built it, but anyway um this tells me the image that I got scanned. There is um the top riskiest components here.

B

It tells you that it uh which cve and if whether it's fixable or not, so basically, you can have information that tells you hey, um you know, hey you need to. You know, rebuild this image. You need to make sure this image is updated. You can go back to your developers and say hey. You know we found these vulnerabilities, I'm not gonna, um we're not gonna deploy this out. um You know we, it could be as simple here there are a bunch of rpms, so it's just as simple as a dnf update on the image.

B

So um but it's this is like my top riskiest one, because I think I built this like a two years ago. I'm not sure um one last thing is the network diagram, which I also really really like as well. You can see the network flows, for example.

B

Here I want to choose okay dude, so this shows um the network flows. It shows um what is connecting to what here. This is an ingress network flow. You can do things like uh list network policies and you can actually do things like a simulate, a network policy.

B

So you don't, um you can see, what's gonna block what without it actually doing it, um and you can actually um do that workflow here, so you can actually see at a glance how everything is connected to everything else and what is allowing access to what, as you is, let me bring back that page um this one right here is like it. It says um these these workflows here, it's kind of anomalous. Why? Because it's wide open to everyone right, so the stack rocks right away.

B

Sorry, acs, acs um right away, tells you that hey this traffic is wide open to everyone. You may want to take a look at it and then you can simulate again in the network policy simulator. So this is all great.

B

This is all great tool for um for an admin right, a great great tool for uh security practitioners or having uh containerized workloads coming in, um but really what I want to show is that um how you can integrate it in your pipelines right so um you know the um karina was talking about argo and tekton, that's kind of like the world, I'm in right now. um Here I have an application right, that's deployed with argo cd, um oh by the way, if I go back to acs.

B

Actually, acs um sees that it's an argo application right, so it actually there's that integration there, so just really quick, but back to the demo app. So there's a there's, a demo application here that is built using pipelines and deployed using argo cd.

B

If I go to the here, we go the pipelines here, so I have a pipeline here this um this pipeline, built that application and deployed that application, but part of the building process. I've integrated with acs to where it'll run the security checks, while it's building and it'll, either block or it'll, allow the the um the uh the build to continue fully to deployment around. As you see here, I built it initially, it went through um I've added a few more security checks to the acs integration right.

B

So we because we want to um see it fail right. um So, let's, let's start this build process, so this build process kind of kicks off takes a little bit because if you've worked with pipelines that actually goes and grabs a persistent volume first as a workspace, so you can use it as a workspace to do the git cloning right here. So there is a there's, a git clone that happens, there's a deployment check, meaning there's that security uh scan that happens using acs and then the deployment happens afterwards.

B

So let me put the logs here. So this takes a little bit there. It goes um so it does the git clone and, as you can see here, let me see if I can expand this, make it a little bigger.

B

um We do all this with uis and in the end we just like terminals right um so here, as you can see when it went by really quick, looks like I have a bunch of violations, the initial uh violation, I guess for my name space, uh there was no violations, because that's all that was set in the initial run um and it looks like I have some cves that I need to fix.

B

So there's um um there's like the version of curl the version of a busy box right and various other violations, so it sets the overall status to fail.

B

So once it fails here, I go back to the details page and go back to the pipelines. Runs it didn't actually finish and it didn't actually deploy it, but it stopped right. It stopped short of deploying the application. um As you see here. It's still on that same version, um and this is how you can use acs within your pipelines to kind of stop this at the. um I can stop it at the source right, just like literally, if you're talking about the git clone does the scan it could do an image scan.

B

It can do policy scans from your yaml file right so like if you're doing a git, ops, workflow and you're, storing your yaml and git, you can actually scan those and make sure it's to compliance right, compliance, meaning whatever you set. The rule sets that you set for your environment, so um so that's the. I think I'm almost at 10.

B

yeah good timing, um so that's it from from a high level that you can show how you can not only use acm to deploy multiple clusters, but you can also use acs to manage the policies on those clusters and then also integrate your pipelines from a developer's standpoint from a developer workflow you can developers can then be notified early and often when a violation exists or whether they need to update um not have it further down right.

B

You don't want that further down in your process, where you know you're delaying a deployment of your application because uh there's a security violation. They have to rebuild and redo the whole process. You scan that early and often and be alerted early and often and have it fully integrated into one platform. So um yeah with that, thank you very much and um I'm not sure who's up next stu he's coming here. Yep.

B

Thank you. Thanks christian.

A