►
From YouTube: [What's New] OpenShift 4.6 [Oct-2020]
Description
Join our OpenShift product managers for an in-depth overview of Red Hat OpenShift 4.6 through OpenShift.tv. Live date: October 7 @ 10AM - 11:30 AM EST.
OpenShift.tv sets out to provide unprecedented access and engagement with experts from throughout Red Hat and the community in these trying times.
This is an exciting opportunity to engage the developers and IT professionals within your customer accounts by inviting them to interact directly with our OpenShift community and learn about the latest updates for OpenShift 4.6.
Slides: https://speakerdeck.com/redhatopenshift/whats-new-in-openshift-container-platform-4-dot-6
Learn more at openshift.tv. Subscribe to the calendar at red.ht/streamcal.
Disclaimer: All customers received this live update during the same briefing given to our internal Red Hat field.
A
Chris
is
this
thing
on
we're
doing
this?
Welcome
to
the
presentation,
everybody
so
some
quick
housekeeping
tasks,
q,
a
comments,
I'm
coming!
Do
them
in
your
youtube
doom
in
your
twitch.
Do
them
in
your
facebook?
Do
them
in
the
blue
jeans,
doesn't
matter
where
you're
doing
them
we're
going
to
get
them
answered?
If
we
don't
know
the
answer,
we're
going
to
figure
it
out
and
send
it
to
you
after
this
is
a
recorded
call.
So
if
you
don't
like
that,
go
ahead
and
hang
up
next
slide.
A
And
next
slide,
so
what
is
this
presentation?
Well,
this
presentation
is
the
living
release,
notes
it's
the
animated
change
log.
It's
the
just,
tell
me
what's
in
the
release,
and
it's
always
great
now,
it's
not
just
me!
I'm
just
kicking
this
off.
I've
brought
some
of
my
favorite
people,
they're
gonna
pop
in
they're,
gonna
pop
out,
they're
gonna.
Keep
it
interesting
and
lively,
but
I
will
warn
you
once
they
start
talking.
A
They
love
to
talk,
so
we're
going
to
do
our
best
to
give
you
an
on
timer
bear
with
us
next
slide,
there's
an
awful
lot
in
any
given
openshift
release.
Well,
it's
good
to
pull
the
gems
out
and
just
talk
about
the
gems
for
a
second
in
this
particular
release.
There's
some
amazing
stuff
in
the
installer.
We
tackle
some
really
hard
ground
with
the
government
clouds.
A
So
right
in
that
time
zone
right
there
in
quarter,
four
we'll
have
two
releases
in
the
first
half
of
next
year
and
then
we'll
add
into
the
second
half.
So
definitely
take
your
time.
Look
at
this
slide
and
then
come
back
to
us.
If
you
have
any
questions
later
on
next
slide,
I
will
warn
you
that
this
is
an
exciting
eus
release.
So
everybody
understands
the
openshift
4
release
cycle.
A
We
support
three
releases
at
any
given
time,
so
we're
talking
4.6
traditionally
when
4.9
comes
out
in
the
second
half
of
next
year,
4.6
would
be
pushed
out
of
support
within
eus.
We
elongate
that
release
cycle
into
2022.
So
you
get
about
18
months
now.
The
layered
products
that
sit
on
top
they'll
either
release
aeus
release
or
they'll,
make
sure
they
still
support
4.6
during
the
4.6
life
cycle.
So
that's
how
that
comes
out
next
side.
A
Kubernetes,
it's
good
to
know
the
version
of
kubernetes.
This
is
kubernetes
119..
There's
some
really
clever
things
that
the
community
got
into
this
particular
release.
I
love
the
tn.
I
love
the
restricted
admission
controller.
I
love
the
pod
topology
spread
and
I
love
the
schedule
profiles,
but
don't
take
my
word
for
it:
we're
going
to
go
into
even
more
exciting
ground
in
the
coming
slides.
So
let's
not
spend
a
lot
of
time
here.
Next
slide
spotlights
chris.
This
show
not
have
music
come
on.
B
B
Let's
move
to
the
next
slide
and
talk
about
how
we
do
this
magic
and
essentially
the
metal
management
is
power
management
and
a
few
other
operations,
for
example,
change
boot
border
right,
where
we're
saying
that
we
are
managing
a
bare
metal
mode.
We
are
controlling
these
bare
metal
nodes
out
of
bands
and
through
the
bmc's
right,
and
how
do
we
do
this?
B
In
this
first
release
the
installation
happens
over
the
network
and
well,
you
can
use
provisioning
over
pixie,
pixel,
booting,
dhcp,
etc,
and
you
have
operational
network.
You
get
the
notes
provision
in
a
very
familiar
way.
I'm
sure
for
many
of
you,
but
also
you
can
do
it
with
virtual
media
and
virtual
media
is
actually
amazing,
because
you
don't
need
a
provisioning
network.
All
you
do,
or
in
fact
all
the
installer
does-
is
presenting
the
installation
media
remotely
to
listen
locally
by
the
notes.
B
This
is
something
you
do
through
the
dmc
as
well,
and
you
probably
have
done
this
from
your
laptop
when
you're
provisioning,
a
node
somewhere
else
right
remotely,
and
then
you
proceed
with
the
installation.
The
installer
does
that
this
works
in
case
this
is
a
very
common
question.
That's
why
I
mention
it
here
explicitly
on
disconnected
installations
right.
We
are.
B
We
have
documented
for
you
how
to
do
this
when
you
don't
have
direct
access
to
the
internet
as
well,
and
here
on
the
right,
you
can
have
well
a
look
at
how
we
do
is
specify
these
two
things,
so
how
we
tell
the
installer
hey.
These
are
my
notes,
and
this
is
how
you
manage
them.
This
is
the
url
for
ipmi,
for
example,
and
my
credentials,
and
with
that
I'm
gonna
hand
it
over
to
catherine.
C
C
All
you
do.
Is
you
select
that
or
use
that
omni
id
that
you
have
for
the
upload?
You
specify
it
in
the
install.config
install
config
and
then
the
process
for
importing
images
will
be
outlined
in
the
openshift
product.
Documentation
next
slide,
so
in
conjunction
with
support
for
aws
gov
cloud
going
to
be
also
enabling
microsoft
azure
government
as
well.
C
C
The
second
one
is
the
policy
engine
which
is
responsible
for
selectively
serving
updates
to
clusters
based
on
a
set
of
filters.
So
if
you
want
to
exclude
an
update
edge,
for
instance,
there's
already
a
developer
preview
release
available
today,
that's
been
announced
in
a
recent
blog
post
that
is
linked
on
this
slide.
It's
also
available
on
openshift
blog's
website.
D
Thank
you.
The
next
one
I'm
talking
about
is
the
specifications
for
remote
worker
nodes.
As
many
of
you
know,
real
world
remote
locations
are
constrained
by
space
and
power
and
cooling
to
run
servers
and
hardware
and
therefore,
as
a
result,
open
shift
clusters
are
also
constrained.
This
is
common
in
telecom,
but
also
in
retail
and
transportation.
D
D
Node
workers
and
supervisors
should
be
part
of
the
same
routable
network,
and
the
network
requirements
have
little
to
do
with
bandwidth
or
latency,
but
reliability
has
a
huge
impact
and
that's
where
the
caveats
come
into
picture
also,
you
could
have
at
any
site
as
many
workers
as
needed
right.
So
if
the
caveats
really
are,
if
a
worker
is
disconnected
from
the
supervisor,
the
workloads
keep
keeps
on
working
locally
until
the
connection
is
back.
E
Okay,
thank
you.
Tushar
next
up
is
to
announce
the
general
availability
and
support
for
a
new
primary
cluster
networking
plug-in
open
virtual
network
or
ovn.
So
this
plug-in
is
not
the
default
openshift
network
and
plug-in
at
4-6
out
of
the
box.
That
remains
the
same
as
it
was
in
4-5.
However,
ovn
is
easily
implemented
at
install
time
by
simply
swapping
out
the
plug-in
name.
E
That's
in
the
install
config
for
from
openshift
sdn
to
ovn
kubernetes
for
bare
metal
deployments,
where
it's
not
as
easy
as
the
public
cloud
to
stand
up
new
host
instances.
We
provide
some
migration
tooling
to
go
from
the
default.
Openshift
46
networking
to
obn
obn
will
become
the
default
networking
plugin
in
a
follow-on
release.
E
There
are
many
reasons
to
choose
this
particular
kubernetes
networking
plug-in,
some
of
which
are
listed
here
in
the
lower
left
of
the
slide.
But
ultimately
we
were
looking
for
a
modern
project
with
an
active
community
that
consolidated
the
networking
across
our
different
platforms,
and
that
would
also
complement
the
existing
capabilities
of
ovs.
E
F
Kirsten
everybody
really
excited
to
announce
that
with
4.6
we
will
be
shipping
the
openshift
compliance
operator,
allowing
you
to
kind
of
to
automate
audit
and
contr
of
technical
controls
that
need
certain
regulatory
frameworks
or
security
requirements,
we'll
be
leveraging.
The
same
approach
that
you
might
be
familiar
with
with
rel
so
will
be.
The
operator
once
deployed
on
your
cluster
will
use
openscap
in
combination
with
a
compliance
profile
that
you
select
to
scan
your
cluster,
assess
whether
or
not
the
technical
controls
in
that
compliance
framework
are
configured
properly.
F
F
It
will
provide
more
details
about
exactly
what
those
controls
are
kind
of
in
a
in
a
future
briefing,
and
we
will
be
able
to
deliver
additional
compliance
profiles
incrementally
in
between
releases.
So
you
can
expect
to
an
update
of
new
content
new
profiles
about
every
six
to
eight
weeks,
and
our
next
major
target
for
a
profile
is
a
cis
benchmark
for
openshift
and
I'd
like
to
hand
off
to
the
next
speaker.
G
H
G
Customers,
the
the
way
how
you
enable
that
is
by
an
admin,
so
we
still
have
the
out
of
the
box
monitoring
experience,
but
it
will
also
will
only
deliver
the
platform
experience
that
we
always
shipped
in
previous
releases
as
well.
An
administrator
now
has
to
enable
the
new
infrastructure
that
is
responsible
for
taking
care
of
workloads,
monitoring
in
user-defined
namespaces
and
there's
only
a
flag
that
you
need
to
add
and
then
automatically
our
operator
is
spinning
up
every
component
that
is
necessary
for
you
to
use.
G
Then
you
can
go
easily
to
the
developer
perspective,
switch
to
any
of
your
name
spaces
and
you
can
create
metrics
from
that
same
experience
and
also
looking
at
all
elements,
and
you
can
silence.
This
is
a
truly
multi-tenant
experience
for
your
monitoring
and
we
may
even
making
it
a
little
bit
easier
if
you
never
done
this
before
with
service
monitors,
and
we
actually
added
a
quick
start
guide
into
this
console
that
you
can
use
to
understand
how
you
can
easily
add
monitoring
or
scraping
for
your
services
itself
next
slide.
G
G
Logging
has
gone
through
significant
changes
since
openshift
4
and
I'm
really
happy
to
announce
that
we
will
finally
make
our
new
log
following
api
generally
available
as
well,
which
includes
a
lot
of
exciting
features
such
as
kafka,
support
and
support
for
forwarding
messages
to
an
external,
yes
elastic,
and
we
also
added
better
and
more
secure
syslog
support
as
well,
and
you
know
to
just
closing
all
these
new
great
features.
We
also
added
a
very
simple
mechanism
that
you
can
specify
which
locks
from
which
namespaces
go
to
its
own
location.
G
That
has
also
been
very
much
a
frequent
request.
The
goal
for
this
api
is
to
provide
an
easier,
less
failure
prone
option
to
configure
log
forwarding
than
hacking
fluently.
So
previously
you
had
to
go
through
go
to
fluid
directly.
You
had
to
write
some
fluency
syntax
code.
That
was
not
easy.
You
had
to
learn
what
you
do
and
obviously
there
are
no
guarantees.
G
The
fluency
changes
its
protocol
that
you
know
there's
some
backwards,
compatibility
all
that
we
will
ensure
with
our
new
api,
making
it
really
easy
for
you
to
just
keep
using
it.
Even
if
we
change
protocols
underlying
technologies
or
anything
else,
so
I'm
pretty
excited
about
that
and
that's
it
for
my
site
and
I
hand
it
over
to
william.
Thank
you.
J
J
The
idea
here
is
really
to
provide
a
mechanism
for
developers
to
build
even
driven
applications
that
can
connect
microservices
functions
or
pretty
much
any
containerized.
Workflow
eventing
provides
that
through
I'd,
say
this
powerful
construct,
so
one
of
them
is
the
even
source,
which
is
the
thing
that
translates
the
event
from
whatever
native
format.
J
J
With
that
again,
you
can
just
drag
and
drop
using
the
ui
in
the
developer,
console
or
use
the
cli,
the
kn
cli,
to
build
the
same,
even
driven
pipelines
for
your
micro
services.
We're
very
happy
to
announce
that
it's
been
a
great
pleasure
to
work
on
this
feature
and
I'm
happy
to
see
what
you
built
with
it.
Next
now
I
will
transition
to
scott
from
the
acmt.
K
Hey
thanks,
william,
very
exciting
format,
we're
thrilled
to
to
announce
our
version.
2.1
release
comes
out
in
about
a
month
and
in
that
release
we'll
be
including
an
observability
pillar,
which
is
an
exciting
new
opportunity
for
cluster
health
in
the
multi-cluster
space.
Next
slide,
please
too
sure
so,
man
there's
so
much
coming.
You
and
I've
tried
to
narrow
it
down
to
just
one
slide
in
the
multi-cluster
life
cycle,
space
we're
bringing
the
ga
for
vsphere
and
bare
metal.
K
That
means
deploying
multiple
clusters
out
using
the
hive
api
with
a
fully
yaml
backed
model
in
the
policy
space,
with
governance,
risk
and
compliance,
we're
bringing
enhanced
oprah,
regulate
integration
and
look
for
that
to
continue
with
more
work
under
the
2-2
release.
Coming
in
february,
we
have
an
open
source
policy
report
repository
that
helps
you
get
the
day,
two
configurations
right
out
of
the
box,
things
like
oauth
things
like
world
binding
and
im
already.
K
There
ready
ready
to
go
in
a
multi-cluster
way
in
the
advanced
application
space,
so
many
new
things,
the
new
and
improved
application.
Experience
really
simplifies
the
entry
point
for
defining
an
application
with
placement,
with
rules
to
define
how
it
spreads
out
to
multi-cluster,
and
the
subscription
and
channel
really
speaks
to
the
get-off
opportunity.
We
have
in
a
multi-cluster
way
very
nice
entry
point
for
any
customers
looking
to
start
off
with
their
get
ops
and
rack
them.
K
Looking
at
a
a
broader
set
of
features
in
the
portfolio
integration
side,
we
bring
ansible
pre
and
post
hook
into
the
same
application
space.
So
as
you're
building
an
application,
you
have
context
for
load,
balancers,
servicenow
tickets
for
things
that
touch
your
traditional
it
and
have
ansible
tasks
ready
to
go.
K
K
As
you
can
see,
those
resources
are
located
in
a
git
repository.
The
subscription
and
channel
model
brings
that
out
to
the
managed
cluster
and
in
this
method
the
openshift
platform
really
gets
to
start
speaking
to
ansible
in
a
way
that
makes
sense
from
it
from
a
standard
infrastructure
without
having
to
focus
on
just
the
kubernetes
layer.
So
bringing
together
these
pieces
with
pre
and
post
allows
you
to
execute
that
tower
job
in
the
same
context
of
deploying
an
application
in
a
kubernetes
contract.
This
is
a
beautifully
architected
solution.
K
L
L
L
More
details
will
be
shared
on
a
blog
post
over
on
blog.openshift.com,
so
you'll
be
able
to
read
about
it
there,
and
you
can
also
see
details
at
the
link
that
I
have
in
the
slide.
Openshift.Com
pricing
for
openshift
dedicated
we're,
also
reducing
the
minimum
number
of
worker
nodes
required
to
provision
a
cluster
in
combination
with
the
price
change,
it's
now
more
affordable
to
get
started
with
osd
and
then
finally,
we're
increasing
the
sla
to
99.95.
L
L
K
L
Is
a
new
ui
so
that
you
can
schedule
cluster
upgrades
to
occur
the
time
and
date
that
works
best
for
you
and
your
company,
so
you'll
be
able
to
schedule
an
upgrade.
You
pick
the
upgrade
version
and
you
can
schedule
when
you
want
that
upgrade
to
kick
off
on
your
cluster,
we're
also
adding
the
ability
to
create
machine
pools.
So
these
are
availability
zone
availability
zone,
aware
machine
sets
and
they
allow
you
to
have
mixed
instance,
types
in
your
openshift
dedicated
cluster.
M
N
O
O
This
moves
metadata
about
operators
in
their
catalogs
into
a
format
that
is
built
and
shipped
as
a
container
image.
This
is
versus
the
old
app
registry
api
that
we
used
before
this
makes
it
super
easy
to
build
these
catalogs
with
our
opm
tool,
which
you
can
see
an
example
on
the
slide
and
all
the
default
operators
that
ship
with
openshift
have
been
moved
over
to
this
new
format.
O
Last
with
this
change,
we've
made
a
shift
in
paradigm
from
a
shared
catalog,
that's
available
across
all
operator
versions,
to
a
catalog
that
is
specific
to
each
operator
and
in
an
openshift
release.
This
makes
it
really
intentional
when
a
partner
or
a
red
hat
team
or
a
community
ships
an
operator
on
openshift,
they
know
that
it's
supported
well
and
it's
tested
well
on
that
versus
the
shared
catalog
that
was
shared
across
all
of
the
openshift
versions
before
so
we're
really
excited
about
that.
O
P
P
P
Another
key
feature
is
openshift.
Extensions
have
not
have
now
gade,
so
extensions.
You
can
add
them
directly
into
your
maven
project
and
also
the
extension
by
default.
It
is
configured
to
use
your
container
image
source
too,
or
your
container
image
source
to
image.
However,
it
can
also
be
continued
configured
to
use.
Non-S2I
builds,
so
that's
really
important
as
well.
P
So
that's
now
in
the
red
hat,
build
of
open
jdk,
the
red
hat
integration
team
they
are.
One
of
the
key
features
is
bringing
you
air
gap
support
for
your
deployments.
So
now
you
can
deploy
three
scale:
api
management
and
fuse
into
your
air
gapped
environments,
whether
you're
government
finance
or
using
it
in
another
way.
Also,
now
you
can
monitor
and
backup
and
restore
your
three
scale:
api
management
deployments.
P
The
process
automation
enhancements
the
employee
rostering
for
optiplanner.
If
you're
using
optiplanner,
that's
awesome,
you
can
now
select
different
rotations
for
your
employee,
rostering
and
then
also
there's
a
standalone
dashboard
builder.
So
go
play
with
the
dashboard
builder.
You
can
create
multiple
dashboards,
so
that's
they
put
a
lot
of
work
into
that.
So
go
check
it
out
and
now
on
to
you,
miguel
for
migrations,
we'll
get.
Q
Oh
hello,
everyone
thank
you
karina
and
we
have
launched
some
weeks
ago.
The
migration
took
for
applications
to
analyze
java
applications,
whether
binary
or
source
code,
and
be
able
to
to
bring
them
to
new
platforms,
whether
it
is
open,
jdk,
jboss,
enterprise,
application
platform,
containerize
them
bring
them
to
linux.
So
if
you
want
to
modernize
your
applications,
this
is
the
tool
to
go.
It
will
review
your
application.
It
will
tell
you
okay,
what
changes
do
you
need
to
do
to
it
to
bring
it
to
a
set
linux?
Q
Your
open,
jdk,
openshift
or
or
java,
cip,
and,
and
you
will
be
able
to
modify
your
application
yourself
and
and
be
able
to
modernize
it.
We
have
also
added
new
rules
for
camel
2
to
camera.
3..
You
have,
we
have
seen
quite
a
lot
of
things
around
camel,
3
and
camel
k
in
serverless,
and
probably
you
have
your
own
rules
in
kamuto
and
you
want
to
modernize
it.
So
we
have
other
147
rules
in
13
rule
sets
to
be
able
to
help
there.
Q
Q
R
Thanks
miguel
championization
is
the
ability
to
run
virtual
machines
inside
of
openshift.
This
is
a
feature
we
introduced
in
openshift
4.5
we're
getting
a
lot
of
traction
with
this.
The
team's
been
super
busy
and
I
want
to
highlight
a
couple
of
things
that
they've
been
focused
on
the
first
one
is
part
of
the
core
platform.
R
We
actually
have
a
very
dedicated
and
and
very
awesome,
I
must
say,
a
performance
team.
That's
looking
at
the
performance
of
virtual
machines
on
every
red
hat
platform,
so
openstack
rev
and
now
open
shifter.
We're
making
sure
that
all
of
the
things
that
we
use
to
make
sure
you
get
the
best
performance
and
lowest
latency
out
of
the
platform
applies
to
virtual
machines
that
you
migrate
into
openshift
for
networking.
There's
a
couple
of
changes.
R
R
But
one
last
thing
to
mention
the
openshift
virtualization
is
a
separate
operator.
It
ships
just
a
couple
of
weeks
after
openshift
itself,
is
generally
available.
So
you
can
make
sure
that
you
look
for
us
right
after
we
land
in
fortnite
right
after
4.6
length.
Now
I'm
going
to
turn
it
over
to
jamie
for
service
mesh.
S
S
This
release
will
be
based
on
istio
1.6
and
includes
some
pretty
big
changes.
The
control
plane
has
been
completely
re-architected
around
a
single
demon
known
as
istio
d.
There
have
been
significant
improvements
in
how
certificates
are
distributed
and
rotated
among,
amongst
the
proxies
in
istio,
using
envoy's
secret
discovery
service.
S
S
S
Next
slide,
the
slide
shows
the
consolidated
istio
control
plane
that
I
mentioned
with
the
single
sdod
binary
that
encapsulates
the
control,
pin,
components,
pilot
citadel
and
mixer.
This
change
simplifies
installation,
upgrades
and
management
of
control
plane.
It
also
reduces
resource
consumption
and
improves
the
performance
of
the
control
plane.
S
The
secret
discovery
service
I
mentioned
is
the
new
way
of
distributing
certificates
to
sidecar
proxies
it's
both
more
secure
and
performant
than
the
previous
method
that
used
kubernetes
secrets.
It
also
enables
us
to
integrate
with
third-party
certificate
managers
such
as
volt,
which
has
been
a
common
request.
S
S
S
This
lets
users
visualize
requests
between
services
in
this
view,
and
allows
you
to
drill
down
into
the
more
detailed
tracing
view
that
you
would
get
with
jager.
We
also
have
a
few
new
wizards
that
make
it
easier
to
configure
service
timeouts,
retries
and
run
various
faults,
fault
injection
scenarios.
S
Finally,
in
jaeger,
we
now
support
an
external
elastic
search
cluster
that
you
think
you
can
use
with
jaeger
and
open
telemetry.
The
open
channel
collector
is
now
a
tech
preview
feature.
This
allows
you
to
this
allows
developers
to
instrument
their
code
with
vendor
agnostic,
apis
and
avoiding
vending
locker,
and
when,
when
doing
instrumentation
I'll
now
pass
it
on
to
william
who
will
discuss
serverless.
J
Another
important
thing
that
we
are
enabling
is,
of
course
the
cli
commands
for
eventing,
but
really
tying
all
things
together
is
one
of
the
key
aspects
of
what
we're
doing
with
servers
right
now.
Next
slide
please
now.
This
is
one
of
the
most
exciting
features
that
we
have
to
announce
here.
It's
currently
a
developer
review
of
your
our
functions
experience.
J
J
We
are
enabling
three
runtimes
quarkus
node
and
go
and
of
course,
once
you
are
done
with
the
development
locally
as
you
build
and
deploy
those
applications,
they
are
going
to
be
deployed
as
serverless
applications
with
k
native
next
slide.
Please
that's
going
to
show
a
brief
animation
of
that
entire
workflow.
So
again,
you
can
very
quickly
get
a
project
started
trigger
a
build
and
I'm
gonna
show
very
quickly
the
source
code
which
again
it's
very
simple,
very
intuitive.
J
This
is
a
node
app,
but
on
the
left
side,
as
we
deploy
the
application,
you
see
that
pretty
much
reusing
all
the
experience
that
we
have
built
with
openshift
serverless
so
far,
so
you
can,
for
example,
simply
now
wire
that
channel
to
that
function
now
and
with
that
you're
going
to
start
receiving
events
leveraging
the
same
event,
sources
that
we
have
in
openshift
serverless.
We
are
very
excited
about
this.
Looking
forward
for
your
feedback
on
this
now,
I'm
passing
to
the
next
speaker
that
is
cmak.
T
Thank
you,
william
I'll,
be
talking
about
ci,
cd
and
and
github's
on
openshift
4.6.
Our
first
news.
First
release
is
openshift
pipelines.
One
point
two:
we
still
take
preview
on
ocp
for
six.
It
will
be
released
in
the
preview
channel
of
the
operator
end
of
this
month.
A
couple
of
new
things
available
within
this
release
are
the
addition
of
templates
for
canadian,
like
william
display
these
are
modifiable
by
the
customer,
so
customers
can
have
their
own
default
templates.
T
So
when
they
onboard
new
new
projects,
new
applications,
they
can
generate
pipelines
automatically
for
those
applications,
and
we
are
switching
our
our
templates
that
we
ship
also
to
workspace
instead
of
pipeline
resources,
and
there
is
also
the
improvement
of
being
able
to
define
a
default
workspace
or
parker
rod.
So
users
don't
have
to
select
it
and
it
works
best
for
every
python
one.
T
T
From
jenkins
to
take
time,
and
they
want
to
be
able
to
continue
the
rest
of
their
ci
city
flow
in
in
jenkins
as
support
for
disconnected
clusters
added
in
this
release,
as
well,
we'll
start
to
get
a
matrix
in
in
prometheus
in
cluster
monitoring
from
python
execution
as
well.
The
time
the
average
time,
for
example,
the
number
of
python
network
tasks
and
so
on.
T
T
The
vs
code
extension
is
also
updated
to
match
the
capabilities
in
in
the
pipeline
1.2
release.
There
is
a
new
wizard
for
starting
a
pipeline
directly
from
vs
code,
so
it
gives
you
a
visual
weight
or
form
to
to
enter
the
parameters
and
start
a
pipeline.
You
can
add
triggers
to
your
pipeline.
You
have
great
access
to
the
documentation
of
takedown
directly
when
you're
modifying
the
yaml
or
offering
a
pipeline
in
nvs
code
and
there's
a
restart
python
action
that
they
can
rerun
and
a
pipeline
that
they
have
executed
before
next
slide.
Please.
T
Another
exciting
addition
to
openshift,
which
is
a
plan
to
release
on
openshift
4.6,
another
point
that
the
ga
later
in
the
year
is
openshift
get
offs.
It's
a
new
add-on
alongside
openshift
pipelines
and
official
builds
serverless
and
service
mesh.
It
aims
to
enable
teams
and
customers
to
adopt
github's
practices
for
application,
delivery
and
and
cluster
configuration
it
builds
on
top
of
argo
cd.
It
gives
customers
an
instance
of
supported
argo
cd.
There
is
an
opinion.
It's
a
way
to
do.
Githubs
as
well,
github's
application
manager,
cli
that
helps
customer
bootstrap.
T
An
entire
project
generate
ci
cd,
configure
argo
cd
from
nothing.
They
would
get
a
number
of
repos.
We
generated
our
artifacts
in
them
that
can
start
coding
and
push
code
over
applications
through
that
that
github's
flow
that
we
are
advocating
for
them,
and
this
will
be
integrated
into
the
console.
This
is
available
as
part
of
openshift
sku
a
separate
product
but
available
in
the
same.
The
same
entitlement
next
slide
please,
and
this
edition
and
really
brings
our
our
devos
portfolio
and
openshift
to
another
level.
It's
really
comprehensive,
offering
for
hybrid
cloud.
T
A
combination
of
openshift
builds,
which
are
for
simpler
automation
from
source
code
to
building
an
image
and
deploying
it
with
that
to
ci
cd,
which
more
more
complex
flows
for
application,
delivery,
with
takedown
and
jenkins
and
in
openshift
pipelines
and
openshift
githubs
really
takes
it
all
the
way
to
production
with
a
github's
a
way
of
continuous
delivery
on
openshift
next
slide.
Please
talking
more
about
the
code,
ready
portfolio
tools
and
devtools
on
openshift
next
slide.
Please
we'll
have
a
take
preview
release
of
service
binding
operator.
T
This
operator
is
a
replacement
for
the
binding
capability
that
existed
in
the
service
brokers.
It
allows
you
essentially
to
make
a
link
between
a
service
provider
that
would
be
a
database
or
aws
operator,
azure
operator
to
an
application
consuming
these
credentials
and
those
credentials
automatically
get
injected
into
into
those
applications
based
on
delay,
bill
and
kind,
and
this
is
actually
going
beyond
just
deployment.
It
can
do
it
also
in
canadian
service
and
even
with
plain
secrets
and
configs.
T
U
Great
thanks,
samuel
I'll
continue
on
with
some
more
of
our
developer
tools
on
the
next
slide.
We're
talking
about
code,
ready
workspaces,
which
is
scheduled
to
be
released
in
early
november.
2.5
includes
d
support,
as
well
as
experimental
support
for
using
intellij
as
an
ide
client
running
locally
and
connecting
to
a
remote
workspace.
U
This
is
a
huge
win
for
most
of
the,
since
most
of
the
java
community
is
using
intellij.
So
it's
another
example
of
us
meeting
the
devs
where
they
are.
If
you
go
on
to
the
next
slide,
we'll
talk
about
openshift's
developer
focus,
cli,
odoo
2.0
was
recently
released
and
it's
now
aligned
on
dev
file
support
which
originated
from
eclipse
j.
It's
worth,
highlighting
that
this
new
model
showcases
rapid
iterative
development,
the
new
deployment
model
is
available
for
a
number
of
languages
and
enables
quarkus,
which
is
a
big
one.
U
U
You
can
write
applications
from
scratch,
iterate
the
development
in
our
loop
and
commit
your
code
to
get
all
within
the
same
environment
and
with
this
release,
the
odoo
debug
command,
also
graduates
from
tech
preview
going
on
to
the
next
slide.
We're
talking
about
containers
code,
ready
containers,
so
this
allows
developers
to
run
on
openshift
on
your
to
run.
Openshift
on
your
laptop.
V
Hey
everybody
olin
over
here
so
as
you've
already
seen,
we've
had
a
ton
of
great
enhance
enhancements
to
the
console.
There's
a
couple
other
ones.
We
want
to
showcase
you
so
right.
Here,
we've
improved
the
over
there
update
experience
on
the
left
hand
side.
You
can
see
we've
added
visuals
to
really
show
and
give
you
the
best
recommendation.
Upgrade
path.
You'll
be
able
to
see
how
many
releases
you're
behind
you'll
be
able
to
see
all
your
release,
release
notes
for
each
of
the
versions.
V
V
W
W
After
installing
the
operator
using
the
console,
the
user
will
be
prompted
to
create
that
unit
cr,
so
user
can
easily
make
the
operator
back
services
fully
functional.
Second,
in
the
middle
on
the
operand
instant
page,
the
console
improves
the
ui
zonings
by
better
grouping
properties
per
crds
schema
structure.
The
new
pop
over
on
each
property
field
also
shows
more
schema
information,
so
user
can
directly
see
them
on
this
ui
without
the
need
to
check
in
crd
manifest.
W
Lastly,
on
the
right,
the
console
now
better
support
user
to
see
if
a
kubernetes
resource
is
owned
or
managed
by
an
operator.
This
way
user
can
easily
go
ahead
to
apply
changes
directly
to
the
owners
without
being
reverted.
With
that
I'll
hand,
it
over
to
serena
to
talk
more
about
the
dev
console
site.
U
Great
thanks
tony.
So,
let's
talk
about
what
we've
done
to
improve
the
getting
started.
Experience
in
4.6
to
onboard
developers.
We've
introduced
a
number
of
new
features
in
the
past,
we've
heard
there's
a
discoverability
issue
with
the
prospective
switcher
and
being
able
to
go
back
and
forth
from
admin
to
dev
to
help
improve
this.
The
first
time,
a
non-privileged
user
or
non-cluster
admin
user
logs
into
the
openshift
console
they'll,
be
brought
directly
to
the
developer
perspective
by
default.
U
U
This
provides
an
easy
and
extremely
efficient
flow
for
users
to
quickly
set
up
a
get
a
sample
app
created
so
that
they
can
kick
the
tires
with
an
app
running
on
openshift
and
then
now,
I'm
going
to
focus
on
the
middle
section,
which
is
around
quick,
starts.
Quick
starts
are
being
introduced
as
the
focal
point
of
our
onboarding
process
in
the
openshift
console,
both
on
the
admin
and
the
dev
sites.
U
U
So,
alternatively,
in
the
center
column,
you
can
see
the
consumption
mode
that
that
allows
the
developers
to
focus
solely
on
resource
consumption.
So
how
many
pods
do
I
have
up
and
running?
What's
the
status
of
those
pods
etc,
but
there's
really
no
connectors
or
groupings
shown
in
that
specific
mode.
U
U
U
These
features
now
persist
when
switching
between
the
graph
and
the
list
view
the
find
feature
increases
the
discoverability
of
components
inside
of
the
application,
and
it
highlights
the
components
whose
names
match
the
search
string.
This
feature
helps
the
scalability
of
a
project
with
a
large
number
of
resources,
and
then
the
filter
feature
also
helps
with
scalability.
This
is
also
a
new
one
where
it
allows
you
to
indicate
which
resource
types
to
display
in
the
view,
while
the
rest
are
hidden.
U
Finally,
on
the
admin
side,
the
workload
tab
of
the
project's
detail
page
has
an
increased
feature
set.
It's
now
sharing
the
implementation
with
the
list
view
of
topology
and
the
dev
side.
So
all
the
new
features
that
we've
got.
What
we've
added
in
the
dev
side
on
the
list
view
are
now
available
in
the
admin
side,
post
4.6
we're
also
talking
about
enabling
access
to
the
topology
graph
view
from
here
as
well,
and
the
next
slide.
Let's
move
on
to
application
stages
view
as
ceo
mac
mentioned
earlier.
U
G
Thank
you
serena.
We
already
talked
about
a
lot
of
critical,
highly
important
features
inside
the
spotlight
section,
but
there
is
more
that
we
actually
expose
in
4.6
around
blogging.
The
first
feature
is
tuning
fluid.
Basically,
what
that
means
is
that
we
now
expose
specific
fields
inside
our
cluster
logging,
cr
that
you
can
use
to
optimize
the
performance
of
fluency
specifically
around
how
we
deliver
messages
from
our
logging
stack
to
a
third-party
system.
G
This
feature
is
really
for
advanced
administrators
that
really
or
truly
understand
what
those
fields
actually
mean
and
when
you
set
up
specific
knobs
for
that,
actually
what
the
impact
on
the
stack
actually
is.
Usually
you
know
out
of
the
box.
We
have
default
values
for
all
of
this.
This
should
be
completely
enough.
This
is
really
just
to
really
fine
tune
if
necessary.
G
G
G
It
is
important
to
note
that
we
removed
some
index
level
metrics,
since
they
introduced
a
very
high
calibrality,
which
was
which
is
obviously
not
good.
For
the
monitoring
stack.
We
will
continue
to
improve
matrix,
editing
roots
with
you
know
later
releases.
We
will
bring
back
some
of
these
index
level
metrics
as
we
go
as
we
have
to
figure
out
what
the
best
way
is
for
us
to
expose
these
without
you
know,
impacting
the
monitoring
stack
too
much.
C
You
thanks
christian
next
slide,
so
for
open
check,
openshift4,
there's
two
pro
installation
experiences.
If
you're
not
aware,
yet
we
have
our
full
stack
automation
where
the
installer
controls
all
areas
of
the
installation,
including
the
infrastructure,
provisioning
with
an
opinionated
best
practice
deployment
of
openshift.
C
Then
we
have
our
pre-existing
infrastructure
deployments
where
administrators
are
responsible
for
creating
managing
their
own
infrastructure,
but
allows
them
to
have
greater
customization
and
operational
flexibility
for
4.6.
The
supported
provider
list
largely
stays
the
same
as
4.5,
with
the
exception
of
extending
bare
metal
support
for
a
installer
provision,
infrastructure
workflow,
the
new
government
region,
support
for
aws
and
azure
that
I
mentioned
earlier,
and
support
for
deploying
openshift
on
vmware
vsphere
7.0.
C
B
Thank
you,
catherine,
so
openstack
in
4.6
we
have
a
number
of
new
features
and
this
release
is
supported
in
retro
token
stuff
platform,
13
and
right
openstack
platform
16.1,
and
I
would
like
to
highlight
the
first
one
that
I
mentioned
here,
openstack
by
metal,
ironic
integration,
because
with
this
feature
now
you
can
deploy
with
api
actually
also
with
your
pi.
So
you
want
on
bare
metal
nodes
provided
by
openstack.
B
You
know
that
openstack,
thanks
to
ironic,
has
the
capability
of
managing
their
metal
nodes
and
you
can
deploy
with
the
installer
on
openstack
and
now,
regardless
of
you
deploy
to
vms
or
diameter
nodes.
This
is
super
cool.
You
can
even
have
a
mixed
environment
between
virtual
machines
and
bare
metal
nodes,
and
beyond
that
we
have
worked
on
a
number
of
new
features
highlighted
here.
B
You
can
see
that
we
now
the
installer
now
understands
what
openstack
availability
zones
are
and
you
can
specify
openstack
availability
zones
to
the
installer
so
that
you
can
deploy
the
nodes
where
you
want
cura,
ipv6,
support
and
we're
working
on
this.
We
we
haven't
finished
the
integration
with
the
installer,
but
you
know
this
is
something
that's
been
taking
a
lot
of
time
for
for
us
to
develop
and
next
floating
ips.
B
If
any
of
you
is
familiar
with
deploying
openshift
on
openstack,
you
will
have
noticed
that
we
always
require
floating
ips
for
the
vips
and
starting
4.6.
You
don't
need
them
anymore,
then
so
so
user.
So
there
are
some
users
that
can't
use
floating
ids.
Maybe
their
admin
hasn't
set
them
up
in
their
external
network
or
you
know,
for
other
reasons
they
are
simply
not
available,
and
now
without
them
you
can
also
install
openshift
on
openstack,
and
with
that
I
will
pass
it
over
to
peter.
R
Thanks
ramon,
so
open
shift
on
red
virtualization
whole
stack.
Automation
is
something
that
we
introduced
back
in
openshift
4.4,
it's
very
popular,
but
one
of
the
things
that
we
wanted
to
add
as
dynamic
storage
provisioning,
which
is,
was
one
of
the
one
of
the
bigger
gaps
that
we
had
that's
now
fully
available
if
the
operator
and
drivers
are
automatically
installed
when
you
deploy
using
the
full
stack
automation
and
that's
just
something
that
will
allow
you
to
allocate
rev,
controlled
storage
domains
to
your
openshift
clusters.
R
R
R
Since
as
we're
coming
in
openshift,
4.6,
we've
also
been
very
busy
with
new
versions
of
rev
as
well,
and
I
want
you
to
pay
attention
here.
Currently,
we
support
both
openshift
supports
being
deployed
on
rev,
4.3
and
rev4,
which
went
generally
available
a
few
months
ago,
but
in
terms
of
timing
and
sort
of
compatibility,
what
we're
going
to
need
to
do
is
really
focus
on
going
with
rev44
going
forward.
R
So
customers
that
are
currently
running
openshift
4.5
on
a
rev
4.3
cluster
will
need
to
upgrade
their
rev
cluster
first
before
upgrading
to
openshift
4.6,
that's
really
a
to
get
into
a
supported
configuration
as
far
as
testing
goes.
One
of
the
other
things
to
note
is
we
did
have
a
user
provision
infrastructure
thing
that
was
actually
targeted
for
4.6
that
didn't
quite
make
the
release.
That's
currently
targeted
for
openshift,
4.7
and
now
katherine.
I
think
I'm
turning
it
back
over
to
you.
C
C
So
cases
where
this
would
be
useful
would
be
where
you
may
have
access
restriction,
problems
to
the
cloud,
identity
and
access
management.
So
I
am
so
you
that
would
be
important
where
you
have
to
provide
it
yourself,
since
you
can't
look
that
up
with
that
api
endpoint
or
where
the
admin
prefers
not
to
store
the
administrator
level
credentials
in
the
cluster
namespace.
C
C
So
we
have
a
new
field
service
endpoints
in
all
config,
which
allows
users
to
specify
a
list
of
custom
endpoints
to
override
the
default
service.
Endpoints
on
aws
custom
endpoints
can
be
specified
for
any
of
the
services
that
we
use,
which
is
s3.
I
am
elastic,
load,
balancer
tagging,
ralph,
53
and
sds.
C
Aws
endpoint,
like
example,
would
probably
be
like
the
ec2
fips
endpoint.
For
instance,
it's
not
needed
for
deploying
openshift
to
any
of
the
known
regions,
since
all
these
endpoints
are
actually
found
in
the
aws
sdk,
which
openshift
already
utilizes.
So
you
shouldn't
need
to
set
this
to
define
to
install
a
new
region.
C
The
aws
sdk
already
has
these.
You
just
need
to
specify
it
next
slide.
So
the
openshift
installer
now
supports
user
defined
routing
the
egress
strategy
on
azure.
This
allows
users
to
choose
their
own
outbound
routing
for
internet
access,
leveraging
pre-existing
network
rather
than
defaulting
the
openshift
recommended
way
of
using
public
ips
and
public
load
balancers.
C
This
can
be
important
for
customers
who
want
who
don't
want
to
expose
any
external
endpoints
clusters
so
for
restricted
environments
for
use
for
user
defined
routing
to
work
properly.
Users
have
to
have
pre-existing
network
in
place
where
the
outbound
routing
has
already
been
configured
prior
to
deploying
openshift
the
installer.
E
E
E
D
All
right
I'll
cover
the
pot
topology
spread
constraints.
This
allows
parts
that
are
spread
across
a
cluster
among
various
failure,
domains
such
as
regions,
zones
or
nodes.
You
know
to
be
spread
by
specifying
the
topology
spread
constraints,
your
spot
specs,
so
that
you
can
see
here
in
this
example.
You
know
to
illustrate
this.
D
M
M
For
those
of
you
not
familiar
with
spot
instances,
they're
a
way
to
get
access
to
cheaper
resources
from
the
cloud
providers,
though
those
resources
can
be
terminated
at
short
notice,
so
user,
beware,
and
for
gcp
and
azure
you
can
still
configure
this
just
like
you
do
for
aws
via
the
machine
set
yaml
file.
But
there
are
a
few
differences.
M
Gaming
is
different,
just
to
differ
between
the
different
providers
and
the
google
option
itself
is
actually
a
boolean
operators.
I.E
you
just
set
true
or
false,
also
make
sure
you
watch
out
for
the
shorter
google
as
your
notification
handlers
they're
30
seconds
each
compared
with
two
minutes
for
aws,
and
with
that
I'm
going
to
hand
you
over
to
mark
who
is
going
to
take
us
through
rata
enterprise,
linux,
coreos,.
X
X
Please
note
that
4,
4
and
4
5
will
also
stay
on
rel
a2
content
until
the
end
of
their
support
lives.
Core
os
4.6
is
the
first
version
that
will
support
the
use
of
the
v3
ignition
spec.
Among
other
things,
it
locks
the
it
unlocks
the
ability
to
place
all
of
slash
var
on
a
separate
disk.
This
allows
users
to
place
the
read-only
root
fs
on
one
device
and
the
rewrite
var
partition
on
a
different
physical
or
virtual
device
that
may
have
different
performance
or
reliability
characteristics
and
the
extension
system
is
landed.
X
This
allows
us
to
ship
certain
carefully
selected
packages
for
core
os
outside
of
the
base
image
in
4.6.
You'll
now
have
the
option
to
enable
usb
guard
a
utility
to
manage
and
disable
usb
ports
and
environments
with
higher
physical
security
requirements.
Next
slide
for
those
of
you
installing
by
bare
metal
upi,
we
have
some
really
nice
improvements
around
the
iso
and
pixie
images
and
the
core
os
installer
itself.
X
A
few
of
the
features
I
want
to
call
out
here
are
one
the
new
ability
of
the
installer
to
optionally
preserve
existing
data
partitions
through
a
redeployment
of
the
node.
The
default
behavior
will
stay
the
same
and
two
the
ability
to
embed
the
ignition
configuration
inside
a
custom
iso
for
environments
where
having
an
addition,
endpoint
is
not
allowed.
X
Finally,
the
iso
and
pixie
images
are
now
a
railcore
os
live
environment
which
you
can
boot
into
interactively
for
installation
or
troubleshoot.
It
also
allows
you
to
discover
hardware
things
like
interface
names,
one
particularly
useful
reason
to
do.
This
is
next
side
the
improved
networking
experience
for
upi
installs
in
the
live
environment.
You
can
run
nm2e
or
nmcli,
configure
bonds,
static,
networking
settings
and
then
persist
that
configuration
into
the
installed
node
and
for
vmware.
E
Great,
thank
you
mark
so
on
this
one
in
option.
4.6
we've
made
many
networking
improvements,
a
small
number
of
which
are
highlighted
over
the
next
few
slides.
So
first
up,
we've
further
enhanced
our
sri
lv
support
so
for
our
customers
with
high
throughput
low
latency
internodal
cluster
traffic
requirements,
like
aiml
applications
tend
to
have,
and
they
want
flexibility
of
solution
and
something
other
than
rdma
over
converged,
ethernet
or
rocky
support.
We
now
provide
native
infiniband
support.
E
Next
slide,
please
some
other
networking
enhancements,
so
another
change
we
made
in
openshift46
is
to
move
ovs
from
a
container
that
ran
inside
the
cluster
to
the
host.
The
reason
we
did
this
is
to
eliminate
any
network
flow
disruption
during
cluster
upgrades
or
restarts,
since
obs
remains
active
during
those
events.
E
Also,
we
have
some
large
customers
that
quickly
consume
the
number
of
available
node
ports
in
the
cluster,
so
we
made
an
enhancement
also
to
provide
a
mechanism
to
easily
expand
the
service
node
port
range
for
kubernetes
services
of
type
node
port.
Of
course,
you'll
still
need
to
expand
the
number
of
open
ports
at
the
infrastructure
layer
when
you're
doing
this,
but
but
the
the
the
ability
to
modify
that
range
exists.
E
So
without
going
into
a
lot
of
specifics
on
each
individual,
one
you'll
be
able
to
get
these
specifics
from
our
46
product
documentation.
Let
me
try
to
briefly
address
each
one
of
these,
so
the
first
one
http
forwarded
header
policy.
This
basically
helps
customers
that
have
the
requirement
that
our
ingress
controller
pass
along
unmodified.
E
A
set
exported
four
header
for
an
applications
route,
the
second
one,
there
ingress
tls
termination
policy,
so
we
now
support
two
ingress
policy
options:
re-encrypt
and
pass
through
for
encrypted
traffic
types,
the
third
one
http
cookie
capture,
so
we
have
customers
that
use
specific
named
cookies
in
their
http
traffic
for
reasons
of
business
analytics
and
auditing.
So
we
now
support
logging,
those
cookies
to
satisfy
those
requirements.
E
E
Next,
one
http
unique
id
header,
so
this
enhancement
provides
the
ability
to
configure
the
ingress
controller
to
inject
an
http
header,
with
a
uniquely
defined
request
id
into
their
http
requests
that
our
customers
can
then
use
to
trace
cluster
traffic,
and
it
provides
them
with
an
improved
understanding
and
observability
of
their
internal
cluster
traffic
and
the
last
one
on
this
slide.
Http
path,
rewriting
this
simply
provides
support
for
path
rewriting
on
incoming
traffic
to
direct
that
traffic,
as
required
next
slide.
E
Please
configuring
ingress
controllers,
aws
nlb,
so
in
openshift46
we
now
support
the
ability
to
modify
the
load
balancer
type
used
when
deploying
aws
from
a
type,
a
classic
load,
balancer
to
aws's
network
load,
balancer
or
nlb.
The
nlb
is
just
simply
another
aws
offered
tool
that
can
be
used
in
deployments
to
to
distribute
traffic
across
multiple
cloud
resources
to
reduce
latency
and
provide
higher
application.
M
Thanks
mark,
and
so
we
come
to
storage
next
slide,
please
with
4
6.
We
continue
to
push
to
be
ready
to
eventual
change
over
to
the
world
of
all
csi
plugins
everywhere,
instead
of
our
entry
drivers,
but
it's
worth
noting
up
front
that
nothing
is
changing.
As
for
our
support
of
storage
in
4
6,
we
still
support
all
the
entry
storage
drivers.
You've
come
to
know
and
love
a
couple
of
things
worth
mentioning
on
the
new
front.
M
We've
done
a
lot
of
work
on
plumbing,
so
it
might
not
be
too
visible,
but
things
like
the
csi
operator
library
are
really
going
to
help
us
quickly
develop
those
csi
drivers
we
need,
and
second
well
csi
snapshots
will
remain
in
tech
preview.
We're
enabling
this
feature
to
be
fully
supported
when
it's
used
in
conjunction
with
cnv
and
ocs
environments.
M
This
is
for
something
that
is
the
well-known
term
of
brush
consistent
snapshots.
Next
slide,
please,
the
ocs
team
or
the
openshift
container
storage
team
have
also
been
extremely
busy
with
their
release.
You
can
see
all
the
main
features
listed
on
the
slide,
but
again,
let
me
highlight
a
few
for
you.
The
first
is
encryption
support.
This
is
a
frequently
asked
for
highly
desirable
feature
which
will
land
in
the
4.6
release.
But
that's
not
all.
This
is
just
not
just
ordinary
encryption
support.
It's
encryption
support
for
the
entire
cluster.
M
Secondly,
you
can
see,
on
the
right
hand,
side
of
the
slide
the
much
extended
platform
support
available
in
ocs
and
even
though
it's
hiding
at
the
bottom
of
our
feature
list,
I
should
take
time
to
mention
that
ocs
will
be
following
in
ocp's
footsteps
by
making
itself
available
on
ibm
z
and
power
systems,
and
with
that
I
think
we're
ready
for
some
stories
about
telco.
So
I'm
going
to
hand
over
to
robert.
H
Thanks
duncan
I'm
pleased
to
announce
that
we
are
providing
support
for
real-time,
kernels
and
low-latency
workloads
for
rand
use
cases.
Real-Time
kernels
allow
low,
latency,
consistent
response
time
and
workload
determinism.
This
is
going
to
be
handled
by
something
called
the
performance
add-on
operator
that
will
allow
you
to
to
define
a
performance
profile
which
will
install
the
real-time
kernel
and
tune
your
system
such
that
cores
are
isolated
and
dedicated
for
workloads
such
that
the
operating
system
will
not
interrupt
them.
H
It'll
also
do
numa
alignment
for
your
devices
memory
and
all
the
other
internals
that
you
need
to
have
a
high
performance
workload
next
slide.
Please
I'm
also
pleased
to
announce
that
we
will
be
making
our
cloud
native
network
function
tests
available.
This
is
a
container
image
that
ensures
your
platform
is
ready
to
run
your
container
network
functions.
This
will
check
your
precision.
F
F
This
will
leverage
the
aid
technology,
advanced
intrusion,
detection
engine,
and
this
will
help
our
customers
meet
compliance
and
security
requirements
to
do
file
integrity.
Checking
on
the
hosts
you'll
be
able
to
specify
the
list
of
files
that
you
want
to
ensure.
Are
there
no
changes
to
that
will
create
an
a
database
with
a
hash.
F
When
you
run
the
file
integrity
operator
after
that's
been
created,
it
will
scan
every
node
in
the
cluster
and
check
to
see
whether
those
files
have
changed
now
the
databases
per
node,
as
there
may
be,
some
differences
on
each
node,
some
might
have
gpu,
etc.
So
admins
can
examine.
Scan
results
for
status,
can
share
those
that
information
with
auditors
as
needed.
I
Thanks
kristen,
so
next
couple
of
slides,
I
want
to
talk
about
all
the
latest
and
greatest
security
enhancements
in
openshift
4.6,
especially
for
security-minded
customers,
starting
with
customizing
audit
config.
So
now
with
4.6,
you
can
now
control
the
amount
of
information,
that's
locked
to
the
node
audit
logs
by
choosing
the
right
audit
log
policy
profile.
I
So
these
profiles,
let
you
define
how
to
log
requests
that
come
to
the
openshift
api
server,
the
kubernetes
api
server
and
the
oauth
api
server
by
default
prior
to
4.6
ocp
used
only
the
default
audit
log
profile
and
with
4.6.
Now
you
have
two
additional
profiles:
write
request,
bodies
and
all
request
bodies.
I
What
the
write
request
body
will.
Let
you
do
is
in
addition
to
the
default
logging,
which
logs
only
the
metadata
and
not
the
read
and
write
requests.
The
write
request
body
will,
let
you
log
request
bodies
for
every
write
request
to
the
api
server,
such
as
create
update
and
patch
the
next
profile,
all
request
bodies.
I
What
that
will?
Let
you
do
in
addition
to
logging
metadata
for
all
requests?
Is
it
will
let
you
log
request
bodies
for
every
read
and
write
requests
that
get
into
the
api
server,
including
get
list
create,
update
and
patch
mind
you
that
besides
the
default,
the
other
two
profiles,
write,
request
bodies
and
draw
request.
Bodies
will
have
some
additional
resource
overhead
in
terms
of
cpu
and
memory,
but
it
is
not
too
much
is
what
our
performance
studies
have
shown
us.
I
So
essentially
you
can
modify
the
can
you
go
back
to
the
previous
life
yeah
on
the
pre.
You
can
modify
the
api
server
object
and
you
can
just
you
know,
select
whatever
profile
you
want
and
mind
you
that
we
will
not
log
anything
beyond
the
metadata
level
for
security,
sensitive
resources
such
as
secrets,
routes
and
oauth
clients.
I
So
the
next
one
is
setting
token
inactivity
timeout
for
overwatch
server.
Essentially,
if
you
want
to
set
a
token
inactivity,
timeout
after
a
specific
period
of
time,
so,
for
instance,
let's
say
you
log
into
the
console,
you
perform
some
activities
and
then
you
know
you
don't
do
some
some.
You
know
any
actions
for
a
particular.
You
know
interval
of
time.
You
can
try
to
do
something
it
should
you
know
log
you
out,
so
that's
essentially
what
this
is.
I
You
can,
essentially,
you
know,
modify
the
oauth
object
by
adding
this
value,
spec,
dot,
token
config,
dot
access,
token
inactivity
set
it
to
whatever
time
you
want
and
then,
like
I
said
you
go
to
the
console,
you
perform
certain
set
of
actions.
You
wait
for
400
plus
seconds.
You
go
back
and
try
to
do
some
actions.
It
should
give
you
an
error,
saying
you
must
be
logged
into
the
server
to
perform
these
actions
and
you're
unauthorized
next
slide
face.
I
So
next
slide
is
securing
oauth
resource
storage.
So
what
access
token
and
oauth
authorization
token
use
the
object
name
for
security,
sensitive
token
information,
so
encrypting
the
value
only
in
hcd
means
that
the
token
itself
is
stored
as
plain
text
in
the
http
database
and
in
encrypted
backups.
That
is
it's
unprotected.
I
I
You
will
still
have
some
of
those
you
know
tokens
lying
around
and
if
the
admin
has
changed
expiration
of
those
tokens
from
24
hours
or
something
greater,
that
is
still
something
you
need
to
be
aware
of.
Sensitive
data
could
be
exposed
at
that
point.
So
essentially,
you'll
have
to
wait
until
all
the
old
tokens
from
4.5
have
either
expired
or
have
been
deleted
by
the
administrator
next
type.
I
I
I
So
you
can
start
you
know
playing
around
with
the
windows
operator.
You
know
prior
to
ga,
and
this
is
essentially
an
entry
point
for
those
openshift
customers
that
want
to
run
windows
workload
on
openshift
clusters.
If
you
want
to
bring
you
know
a
windows
worker
node
run,
you
know,
windows,
containers
and
run
windows.
Workload
like
you
know.net
framework,
is
web
servers.
Sql
servers.
I
We
are
trying
our
you
know
level
best
here
to
see
if
vsphere
could
be
supported.
The
issue
with
vsphere
is
there's
a
lot
of
upstream
dependency
with
vmware,
so
we're
working
with
them
on
things
like
storage
components,
working
with
microsoft
and
logging
and
monitoring
components.
So
there's
a
little
bit
of
upstream
dependency
here
as
far
as
vsphere
is
concerned,
but
we
will
see
what
best
we
can
do
to
get
vsphere
supported,
hopefully
either
by
ga
or
a
little
after
and
last,
but
not
the
least.
I
The
red
hat
certified
operator,
as
I
mentioned,
will
be
available
in
december.
You
know
give
it
a
couple
of
weeks
into
december,
so
I
would
say
by
mid-december,
but
the
community
operator
should
be
out.
You
know
by,
I
would
say,
mid-october
and
you
can
try
the
community
operator
from
the
influster
operator
hub
and
in
terms
of
the
refresh
cycle.
I
It
had
operators
mid
december
platform,
supported
aws
and
azure
for
community
for
red
hat,
it's
going
to
be
aws,
azure
and
possibly
vsphere
and,
like
I
said,
riff
recycle
red
hat
operator
will
be
you
know
every
red
hat.
You
know,
white
stream
release,
ocp
live
stream
release
and
the
community
operator
will
be
following
a
faster
cadence
every
couple
of
sprints
you
know
maybe
a
month
or
two
and
that's
going
to
be
the
workflow
of
what
the
windows
machine
config
operator
does.
This
is
really
you
know
the
the
meat
of
this
feature.
I
Is
we
basically
will
you
know
pick
up
whatever
microsoft
delivers
upstream
in
terms
of
the
cubelet,
the
q
proxy,
the
cni
hybrid
overlay?
What
not?
We
will
nicely
package
everything
up
in
operator
and
the
operator
will
automate
all
the
steps
that
is
needed
to
get
the
windows
node
ready,
like
you
know,
transferring
the
binaries
configuring
the
cubelet
setting
up
networking.
You
know
plumbing,
like
the
hybrid
overlay,
cni
q
proxy.
I
What
not
and
it
will
essentially
prepare
the
windows
node,
so
it
can
be
bootstrapped
into
the
cluster
and
be
a
happy
citizen
of
the
openshift
cluster,
and
then
it
can.
You
know,
communicate
to
out
other
linux
nodes.
Communicate
to
you
know,
windows,
nodes,
get
english
traffic
from
the
outside.
You
know
make
increased,
calls
outside
the
cluster
so
on
and
so
forth.
I
M
Thanks
anand
and
last
and
by
no
means
least
the
multi-architecture
side,
we
continue
to
focus
on
ibm
power
and
z
systems
and
there
have
been
two
main
pushes
in
the
group.
The
first
in
great
news
is
that
we're
aligning
with
the
x86
releases
before
you
have
to
wait
a
little
bit
and
pick
us
up
in
a
zed
stream,
but
that's
no
longer
the
case
from
the
full
six
release.
Secondly,
storage:
previously
we
only
had
support
for
nfs
as
a
storage
option,
and,
while
that's
okay,
nfs
isn't
appropriate
for
all
situations.
M
So
we're
now
expanding
support
to
cover
all
the
key
storage
types
you
would
need
and
the
addition
of
non-nfs
storage
gives
us
the
additional
bonus
that
it
brings.
Logging
into
the
picture,
elastic
search,
isn't
supported
on
nfs
file
systems.
Right
now
we
have
other
options.
You
can
run
it
all
in
a
supported
configuration.
A
A
You
know
I
will
say
that
working
in
a
community
in
an
open
source
community
on
cncf
projects
is
what
we
like
to
do
best,
because
we
get
to
move
thoughts
and
ideas
forward
together
in
a
community.
There's
no
room
in
cloud
for
proprietary
software
and
2020
has
been
hard
and
working
on
projects
like
openshift
help.
The
people
here
at
red
hat,
get
through
those
times
because
you're
there,
and
without
you
being.