►
Description
Hear directly from Red Hat OpenShift Product Managers on the key updates expected with Red Hat OpenShift 4.10. Get the slides here: https://cloud.redhat.com/learn/whats-new
Chapters:
0:00 - Introduction - Red Hat OpenShift 4.10
1:23 - What’s New - Red Hat OpenShift 4.10
6:43 - Spotlight Features
23:30 - Console Updates
28:30 - Platform Service Updates
41:00 - Installer Updates
48:03 - Control Plane Updates
53:05 - Management and Security Updates
1:01:50 - Networking and Routing Updates
1:04:46 - Virtualization Updates
1:07:24 - Specialized Workloads
1:10:35 - Operator Framework
1:15:15 - Quay Updates
1:20:55 - Storage Updates
1:24:56 - Telco 5G
1:28:48 - Observability and Monitoring Updates
A
A
A
Red
hat,
open,
hybrid
cloud
platform
includes
everything
you
see
here
so
openshift
platform
plus
is
the
package
that
has
all
of
this
in
it,
and
it
covers
things
all
the
way
from
multi-cloud
must
see.
Multi-Cluster
management
do
all
the
security
tools
you
need
for
all
those
clusters
getting
content
out
of
them
through
a
global
registry,
all
data
services,
plus
all
the
developer
application
platform
services
that
you
come
to
know
and
expect
inside
of
openshift,
for
building
your
applications
getting
them
out
there,
keeping
them
secured.
So
we're
going
to
talk
about
all
of
it.
A
Today.
We've
got
the
pms
from
each
of
these
areas
to
talk
about
what
is
happening
specifically
in
410
for
those
areas,
I'm
looking
at
410
at
a
quick
overhead
view,
we've
got
a
bunch
of
new
installer
platforms,
so
our
ibm
cloud
ipi
is
going
ga
as
well
as
azure
stack
hub
and
then
following
quickly
behind
that
is
alibaba
cloud
as
a
tech
preview.
This
is
a
pretty
mature
one,
so
definitely
test
it
out
and
that'll
be
ga
pretty
soon.
Also
getting
today.
Our
arm
instances
for
amazon
is
ga.
We've
been
testing
this
out.
A
It's
been
well
received,
so
please
take
a
look
at
that
in
the
automated
operations.
Buckets
we've
got
a
bunch
of
cool
things
here,
so
we
covered
last
time
how
our
eus
policy
is
changing,
and
so
410
will
be
one
of
those
eu
s
releases
and
it'll
be
one
of
the
times
that
you
can
do
this
reduced
worker
reboost
during
an
eus
us
upgrade,
and
so
we'll
talk
about
that
as
well
as
some
other
changes
to
cluster
upgrades
around
reducing
risk.
A
Sandbox
containers
are
ga,
so
if
you
need
a
little
extra
isolation,
you
can
wrap
your
workloads
in
those
on
the
networking
front.
Two
exciting
things
one
is:
you
can
now
bridge
your
virtualization
vms
into
a
service
mesh.
So
if
you
have
vms
and
containers
that
want
to
talk
securely
together,
they
can
use
your
service
mesh
and
then
expose
services
outside
of
your
cluster
with
metal
led.
A
As
you
know,
we
shook
a
new
version
of
kubernetes
with
every
openshift
release
and
so
we're
shipping
1323
excuse
me
today
and
a
cool
set
of
new
features
there
that
we're
going
to
pick
up
clusters
are
going
to
default
to
dual
stack
networking.
So
this
is
a
feature
gate
that
was
there
upstream,
it's
now
being
removed,
so
it's
on
by
default.
This
has
actually
been
ga
and
open
shift
for
a
few
versions
now,
since
4
8,
so
no
change
for
us
there,
pod
security
is
graduating
to
beta.
A
So
this
is
something
where
we're
doing
a
lot
of
upstream
contribution,
and
so
our
plan
here
is
to
support
the
upstream
pod
security
admission
work
when
it
comes
in
and
goes
ga
and
we'll
continue
to
support
our
sccs
side
by
side,
and
so
you
can
use
the
new
stuff,
you
can
use
the
old
stuff.
We
got
you
secure
the
entire
way
through
and
if
you've
heard
us
talk
about
our
csi
migration
work
that
continues
upstream.
So
this
is
replacing
first
drivers
with
the
corresponding
csi
driver
versions.
A
We've
been
doing
this
work
in
openshift.
We
will
seamlessly
migrate
to
this
in
the
future,
and
so
we've
been
watching
this
one
pretty
closely
and
then
last
on
the
software
supply
chain
front.
You
know
a
ton
of
news
about
this
recently,
so
kubernetes
has
put
some
attention
into
their
own
release
process
and
have
gotten
level
one
compliance.
A
A
Then
the
roadmap-
I'm
not
going
to
go
over
all
this-
feel
free
to
pause
your
video
or
take
a
look
at
these
slides
when
they
end
up
on
the
red
hat
website,
but
we've
got
a
ton
of
work
going
across
our
platform
here.
What
you
see
in
q1
is
most
of
the
stuff
that
we're
going
to
talk
about
today
and
then
a
bunch
of
stuff
going
on
for
q2
you'll,
see
a
ton
of
investment
in
our
hosted
platforms,
app
and
dev
services.
A
A
As
always,
if
you
have
questions
on
this
we'd
love
to
reach
out
and
talk
to
customers
directly,
and
so
please
reach
the
pmt
all
right.
Lastly,
I
want
to
talk
about
rfes.
These
are
our
requests
for
enhancement.
We
ship,
45
rfes-
and
these
are
direct
customer
asks.
They
come
to
us
and
you'll
see
the
kind
of
the
top
ones
here,
a
lot
around
network
configuration.
This
is
a
classic
thing.
A
You
know,
everybody's
network
looks
different,
and
so
we
want
to
adapt
and
meet
you
in
your
world,
so
some
great
options
there,
as
well
as
debug
ability
and
kind
of
you
know
the
way
that
we
own
management
of
the
nodes.
All
the
way
up
into
the
cluster
means
that
you
know
we
can
emit
some
of
more
events
to
help
for
debuggability.
A
A
cluster
and
maybe
a
little
bit
so
really
cool
to
see
those
like
I
said,
there's
45
of
these.
This
is
just
a
subset,
so
openshift
keeps
getting
better
and
with
that,
let's
jump
into
our
spotlight
features.
So
I'm
going
to
start
handing
it
off
to
the
pm
team
you're
going
to
hear
from
the
best
and
brightest,
and
I
will
start
off
with
adult.
D
Hello,
everyone,
my
name,
is
either
zaluk
and
I
am
the
product
manager
for
openshift
box
containers.
The
good
news
is
it's:
it's
going
from
tech
preview
to
ga.
So
mark
that,
however,
what
is
sandbox
containers
for
the
first
time
people
are
hearing
about
it.
It's
an
additional
optional
runtime
that
you
can
use
for
your
additional
or
third-party
applications,
or
for
your
app
for
the
applications
that
require
extreme
and
stringent
levels
of
isolation.
D
You
get
that
for
free
in
openshift
when
you
install
the
operator,
the
openshift
sandbox
containers
operator.
So
what
did
we
do
from
a
feature
level
perspective?
In
4.10
we
added
three
most
important.
Our
major
features.
One
is
instead
of
you
having
to
check
manually
your
node
eligibility
for
installing
sandbox
containers.
The
sandbox
containers
in
the
back
end
relies
on
cathode
containers
and
that
is
also
using
virtualization.
D
So
things
like
dmx
needs
to
be
there.
We
rely
on
hardware
level
virtualization,
so
we
made
that
easy
for
you,
so
you
can
just
check
on
our
custom
resource
that
you
want
to
make
sure
that
the
nodes
are
eligible
for
installing
sandbox
containers.
In
the
back
end,
we
use
the
node
feature,
discovery
opener,
and
you
know
just
just
make
sure
that
you
have
that
checked
and
the
installation
will
proceed
once
all
the
nodes
are
eligible
or
the
nodes
that
you
chose
for
sandbox
containers
are
eligible.
D
So
now,
if
you
set
the
log
level
to
debug,
you
get
logs
across
the
entire
stack,
including
the
catastack
log,
the
cathode
runtime
logs
qmi
logs
ratio
of
sd
and
more-
and
this
does
not
just
help-
you
see
what's
happening
underneath
in
the
background,
but
also
helps
you
when
they're,
when
you're
facing
problems
when
you're
raising
support
tickets.
This
will
be
a
great
help.
D
E
F
Hi,
I'm
subin
for
ocp
4.10.
We
have
a
quicker,
safer
and
less
disruptive
upgrade
experience
when
you're
going
from
extended
update
support
version
one
to
another
in
the
diagram,
you'll
notice,
node
1,
which
is
on
ocp
4.8
keeping
version
4.9
when
it
upgrades
to
4.10.
So
what
happens
is
that
you
have
a
safer
upgrade
and
you
have
a
quicker
upgrade,
which
involves
just
a
single
reboot
of
the
worker
node.
We
also
have
a
upgrade
aware
scheduler,
which
steers
these
rescheduled
parts
from
4.8
to
available
4.10
worker
notes.
F
G
We
know
that
some
of
our
customers
really
want
to
deploy
openshift
in
environments
without
a
direct
connection
to
public
red
hat
services
like
the
red
hat
registry
and
they're
doing
this,
mostly
in
on-prem
environments,
in
their
own
data
centers,
but
also
in
some
of
these
cloud
environments
and
for
these
deployments,
which
we
call
openshift
disconnected
deployments
in
410.
We
are
really
delivering
a
lot
of
simplifications
and
streamline
tools
to
help
install
these
disconnected
clusters.
So,
in
order
to
install
this
connected,
you
kind
of
need
two
things.
G
First,
you
need
all
the
images
container
images
that
openshift
is
using
as
part
of
the
installation
and
at
runtime,
and
you
need
a
bucket
to
store
them
all
in
before
you
actually
carry
out
the
install
using
the
overshift
installer.
So
the
first
thing
we
did
is
we
actually
already
released
the
solution
to
the
bucket.
It's
called
the
mirror
registry
and
it's
essentially
a
simple
installer
that
gets
you
up
and
running
with
a
streamlined
all
in
one
instance
of
red
hat
quay
on
a
system
with
relays
installed
and
part
man
available.
G
G
And
what
that
gives
you
is
your
first
mirror
to
carry
out
installation
of
your
first
disconnected
clusters,
and
the
tool
is
very
smart
about
this.
It's
not
just
a
simple
downloader
right.
It
will
actually
take
advantage
of
things
like
layer
sharing
and
duplication
as
well
as
allow
you
to
trim
the
releases
of
openshift
and
operators
and
catalogs
that
you
really
need
in
your
disconnected
environments
to
really
just
what
you
want
in
order
to.
G
You
know
reduce
the
amount
of
data
that
needs
to
be
downloaded,
but
what
you
also
want
is
for
these
disconnected
clusters
to
keep
receiving
updates
right.
In
order
to
do
that,
you
need
to
keep
the
mirror
up
to
date
and
oc
mirror
actually
does
that
as
well,
and
it
does
this
by
simply
re-running
the
tool
with
the
same
configuration
again
in
something
as
simple
like
a
cron
job,
and
it
is
very
smart
when
it
does
this,
so
it
will
actually
take
a
look.
G
What
you
have
already
mirrored
the
last
time
you
did
the
initial
mirror
and
it
will
figure
out
what
has
been
released
in
the
meantime
in
terms
of
additional
openshift
releases,
new
operator,
catalogs,
new
versions
in
those
catalogs
and
new
channels,
and
it
will
start
to
download
all
of
this
in
order
to
get
you
a
update
path
that
you
can
walk
along
to
update
to
the
most
recent
version
of
openshift
and
the
desired
operators
that
you
have.
You
need
to
basically
do
nothing
else
than
just
feeding
it.
G
The
same
config
file
that
you
did
earlier
and
it
will
figure
out
what
intermediate
releases
if
any
need
to
be
downloaded
in
order
to
upgrade,
and
it
will
also
do
dependency
resolution
on
the
operators
that
it
is
updating,
resulting
in
a
disconnected
experience.
That,
from
the
perspective
of
updating
cluster,
is
very
close
to
what
you
would
have
if
the
cluster
was
connected
and
with
that
I'm
heading
over
to
john.
A
That's
my
lost
door
in
here
I'll
cover
this
really
quick.
So
we've
got
three
new
compliance
operators,
so
this
operator
runs
in
your
cluster
and
can
enforce
these
three
standards,
so
we've
got
pci
dss,
fedramp
moderate,
as
well
as
the
nerc
cip
for
kind
of
the
telco
and
kind
of
electrical
type
appliances.
So
this
is
really
cool
the
you
know
it's
enforcing
these
standards,
where
we
can
inside
of
the
cluster
itself
to
remain
in
compliant.
A
H
Thanks
rob
and
hello
everyone.
I
am
very
sure
that
you've
all
heard
about
the
buzz
going
around
about
arm-based
systems,
the
new
systems
from
apple,
the
offensive
aws
and
all
those
nice
juicy
servers
that
are
coming
to
market
now
that
you
can
go
out
and
buy,
and
it
really
does
feel
like
this
year
is
going
to
be
the
time
that
will
see
major
adoption
and
you
know
at
openshift.
We
always
want
to
give
our
customers
the
choice,
to
run
your
workloads
and
your
applications
on
the
best
infrastructure.
H
Of
course,
openshift
is
such
a
rich
platform,
and
while
we've
got
all
the
core
pieces
in
place,
and
we've
still
got
some
work
to
do
on
those
surrounding
nice
juicy
add-ons
but
expect
those
gaps
to
be
filled
really
quickly.
We're
seeing
really
nice
results
there
about
bringing
these
things
along
out
of
the
box.
You'll
probably
only
be
able
to
use
ebs
and
nfs.
H
As
always,
we
recommend
using
the
certified
systems
on
the
on
the
rel
acl,
but
the
great
news
is
we've
kind
of
opened
things
up
or
red
hat
has
opened
things
up
as
far
as
choice
and
we'll
also
be
supporting
you
to
run
on
systems
that
have
met
the
arm
system,
ready
server,
ready
specification.
So
that
really
opens
up
what
kind
of
systems
you
can
buy
and
run
on.
I
One
can
also
pair
a
bgp
session
with
a
bft
session
for
faster
failover
detection
and
given
that
each
node
acts
as
a
mini
router
with
metal
lb
deployment,
we
do
not
allow
external
routers
to
inject
routes
into
the
cluster
and
with
bgp
pure
node
selector,
you
can
run
metal
lb,
speaker
pods
on
specific
nodes
by
specifying
the
node
selector,
and
we
also
have
an
ibgp
ebgp
and
single
and
multi-hop
support
with
this
release.
Next
slide,
please
thank.
J
The
you
title
management
for
image
build.
This
is
an
area
we
have
been
working
on
the
past
couple
of
releases
and
delivering
pieces
of
that
and
the
problem
that
it
addresses
that
a
lot
of
our
customers
run.
Image
builds
on
the
cluster
using
dockerfile
builds
and
within
that
they
want
to
install
rel
rpms
within
those
dockerfile
builds,
and
since
every
openshift
container
platform,
customer
or
cppcustomer
is
entitled
to
real
content,
and
we
wanted
to
make
this
really
easy,
similar
to
how
it
was
in
ocp3.
J
For
them,
there
are
three
areas
that
these
improvements
are
applied.
One
is
how
for
how
customers,
how
do
they
get
access
to
the
entitlements
that
I
have
purchased
with
openshift?
Second,
one
is:
how
do
they
manage
access
to
this?
They
perhaps
they
have
a
multi-tenant
cluster.
They
don't
want
to
expose
all
the
tenants
to
to
use
these
entitlements
that
they
have
and
the
last
bit
of
how
to
actually
use
them
in
a
dockerfall
build
in
410
managing
those
entitlements
getting
them
into
the
cluster
it,
which
is
ga.
J
This
is
a
function
that
insights
operator
fulfils
an
insight
team
had
have
delivered
in
410.
The
cluster
reaches
out
to
ocm
and
downloads.
The
entitlement
certificates
of
the
openshift
subscription
that
customer
has
purchased
customer
needs
to
enable
simple
content
access
on
their
account.
This
is
a
one-time
thing.
They
do
at
their
account
level
at
account
level
and
from
that
point
on,
they
can
automatically
pull
the
certificates
and
insight.
J
Averager
manages
the
life
cycle
of
this
certificates
as
well,
because
they
get
invalidated
with
any
change
in
in
the
real
content,
so
automatically
refreshes
them
to
make
sure
that
cluster
at
all
times,
is
access
to
a
valid
entitlement
certificate
to
use.
This
is
only
available
on
cp
and
not
available
on
os0c
and
other
managed
instances
of
openshift,
because
those
do
not.
B
J
Customers
to
real
content
and
on
how
to
managing
access
to
these
entitlements,
the
the
work
that
the
build
team
has
done
with
shared
resource
csi
driver
this
movie
to
take
preview,
and
this
this
operator
essentially
allows
the
the
platform
owners,
the
admins
cluster
admins,
to
control,
to
share
that
entitlement
that
is
pulled
to
the
cluster
with
their
tenants
across
different
name
spaces
and
controlling
who
can
access
and
who
can
cannot
access.
It
so
gives
them
a
granular
control
of
how
to
consume.
J
Who
is
allowed
to
consume
this
entitlement,
and
the
last
bit
is
once
a
team
gets
access
to
these
entitlements.
They
can
mount
it
inside
a
build
config
through
a
csi
driver
which
will
move
to
tech
review,
or
they
can
mount
the
secret
that
if,
if
admin
decides
to
duplicate
the
entitlement
secret,
that
insights
operator
puts
it
on
the
cluster,
they
can
mount
it
as
a
secret
instead
of
build
config
or
pipelines
or
pods
or
or
anywhere
else,
that
a
secret
can
be
mounted
and
used
in
in
a
docker
file
build
and
that
capability
it
remains.
J
K
Hey
everyone
ollie
here
from
the
console
team,
so
big
news
really
excited
to
share
with
you
all.
Multi-Cluster
capabilities
have
finally
come
to
the
ocp
console.
What
does
this
mean?
This
means
we
now
have
a
single
interface
to
view
your
fleet
and
to
drill
down
into
the
details
of
each
cluster
or
app
running
on
individual
clusters.
K
So
you
can
now
easily
switch
contacts
between
each
of
your
clusters
and
come
up
a
level
to
get
a
glance
of
your
fleet.
Essentially,
what
we're
doing
is
we're
going
giving
you
the
best
of
both
asim
and
ocp
ui
brought
together.
So
how
does
this
work?
You
start
with
a
single
ocp
cluster.
Then
you
have
essentially
two
options.
You
can
install
the
multi-cluster
engine
operator
standalone.
K
This
mce
operator
is
new
and
will
enable
the
cluster
switcher
the
basic
cluster
management
capabilities,
which
gives
you
the
ability
to
either
create
update
or
destroy
clusters
and
gives
you
the
cluster
inventory
list.
The
nc
operator
is
included
with
your
ocp
subscription
from
now
on.
So
the
second
option
you
have
is
you
can
install
acm,
which
will
give
you
the
entire
cluster
life
cycle
management
stuff
you
get
from
mce,
plus
all
the
great
stuff
like
policy,
config
management,
multi-cluster
network,
multi-cluster
application
deployment
and
much
much
more
so
really
excited
to
announce
this.
K
This
will
be
tech,
preview
and
410.
You'll
need
a
feature
flag
to
enable
it
and
expect
to
see
a
quick
start
to
help
guide
users
enable
this
new
multi-cluster
console
next
slide.
Please
so
also
new
in
410,
dynamic
plugins
will
be
offered
as
tech
preview
from
the
console
team.
We
get
a
lot
of
requests
to
be
able
to
come
across
customize
the
ocp
console
experience.
Previously.
K
We
we
had
a
really
prescriptive
ways
of
updating
the
console
using
either
console
crds
like
the
console
links
already
to
add
a
link
to
the
ui.
This
is
as
an
example
or
olam
descriptors
for
customizing
your
operand
creation
now
with
dynamic
plugins,
we're
giving
our
partners
and
customers
a
lot
more
flexibility
to
tailor
the
ui
for
different
personas
or
even
add
an
elevated
experience
for
your
service
and
offering
so
a
couple.
K
K
The
other
option
that
we're
giving
our
users
excuse
me
is
to
add
new
perspectives.
If
you
want
to
create
a
personal
task-based
perspective,
that's
completely
standalone
you'll.
Have
that
ability
to
do
that
as
well?
A
little
bit
about
the
tech
behind
this.
This
is
essentially
based
off
what
webpack
five
module
federate
federation.
So
you
can
write
your
own
webpack
module,
federate
federation
piece.
K
It's
built
with
all
the
pattern
fly
four
components:
plugins
are
dynamically
loaded
during
runtime
and
disabled
and
enabled
via
ui
console
plugins
can
be
updated
independently
of
the
host
application.
This
means,
if
you
have
an
operator,
that's
delivering
the
plug-in.
You
could
do
this
at
any
moment.
You
don't
have
to
wait
for
a
new
release
or
update
of
the
ocp
console
and
then
finally,
plugins
enable
and
provide
extension
points
for,
for
your
whole
perspective.
K
So
currently,
we've
added
a
ton
of
extension
points
that
we
talked
about
adding
nav
items,
pages
actions
to
the
admin
perspective,
but,
for
example,
we
actually
used
acm
to
provide
the
multi-class
review
and
ocd
console
and
what
that's
going
to
do
is
they
could
go
ahead
and
add
all
their
extension
points
to
allow
people
to
come.
Extend
the
multi-cluster
view
as
well.
K
That's
going
gonna
be
really
nice,
so
you
could
also
expect
a
getting
started
guide
to
come
soon
and
then
anybody
wants
early
access
before
the
release,
contact
me
and
then
I'll
give
you
all
access
to
the
samples
and
template
repo
available
next
slide.
Please
so
you
asked
we
listened
every
sap
release.
We
tried
to
address
some
of
the
most
popular
rfes.
K
Here
are
the
ones
we
got
to
this
release
so
pod
debug
mode
right
from
the
ui.
This
will
allow
you
to
run
exactly
the
same
thing
as
ocd
bug.
Pog
right
from
the
ui
it'll
start
up
an
interactive
shell
which
will
stop
the
pod
from
crash
loop,
cache
looping
it'll.
Allow
you
to
check
your
environment
variables.
Config
files,
allow
you
to
access
your
logs
and
events
right
from
the
console,
which
is
fantastic.
K
K
So
if
you
want
to-
and
you
know
make
sure
that
secure
routes
was
the
default
option
selected
when
you're
trying
to
create
a
new
route
that
will
be
enabled
as
well
and
then
finally,
we
added
the
ability
for
non-admin
users
to
come
in
and
see
their
quota
usage
via
the
applied
cluster
resource
quotas,
and
that
is
now
available
to
non-admins
in
the
ui.
All
right
next
slide,
please
and
I'm
going
to
be
passing
off
to
believe
yeah.
J
Right,
thank
you.
So
an
openshift
builds
on
the
classic
builds
already
mentioned
related
to
all
the
work
that
has
happened
around,
enabling
the
rail
tactical
management,
with
the
shared
resources
as
a
driver
and
mounting
that
inside
the
build
configs
true
pride
builds.
Is
the
next
generation
build
that
we
are
moving
on
to
as
as
evolution
of
classic
builds
and
within
this
release?
Building
from
local
sources
enabled.
J
L
J
Openshift
pipelines,
one
seven
will
be
available
alongside
410.
There
are
quite
a
lot
of
capabilities
that
are
added
within
this
particular
release
pipeline.
As
code
will
move
to
tech
preview.
Hyperlapse
code
is
enabling
get
asked
workflows
for
your
ci,
so
you
could
customer
can
put
their
techcloud
pipeline
and
git
repo
and
that's
the
sort
of
singles,
that's
the
source
of
truth
for
the
pipeline
and
every
time
an
event
comes
from
git
comment
or
pull
request.
J
We
are
transitioning
to
bringing
the
ability
to
create
a
set
of
tasks
for
developers
and
devops
engineers
on
the
cluster
to
our
customers,
so
takedown
hub
is
brought
onto
the
cluster
is
optional.
At
this
point,
the
customer
can
enable
it
at
their
own
task
in
there,
and
we
are
working
on
bringing
integrations
in
the
tooling
that
we
have
to
this
instant,
that
customers
can
run
for
themselves
and
have
full
control
over
what
kind
of
tasks
they
want
to
expose
to
their
development
teams.
J
Another
key
people,
the
important
one
that
have
been
on
on
the
horizon
for
us
for
for
a
while,
is
that
in
this
release
on
ocp
410,
there
is
the
ability
to
run
tasks
or
cast
from
pods
really
in
in
the
username
spaces,
which
allows
those
tasks.
Those
images
that
are
that
are
required
to
run
as
root
inside
the
container
to
be
run
in
the
username
spaces
as
non-root
on
the
host.
J
So
it
addresses
one
of
the
criteria
that
some
of
our
customers
or
a
good
portion
of
them,
have
that
they
do
not
allow
any
any
privileged
containers
to
run,
and
things
like
s2i,
image
and
dockerfile
builds
require
that
because
they
use
buildup.
But
we
have
the
ability-
and
this
rule
is
to
run
them
as
non-root
without
any
particular
privilege
or
sec
or
service
account.
Just
using
the
default
service
account
and
just
run
it
in
the
username
spaces.
J
If
you
have
committed
to
the
git
repo,
we
heard
from
adele
that
operation
standby
container
is,
as
has
moved
to
ga,
and
they
verify
that
it
works
with
pipeline.
That's
one
of
the
use
cases
for
customers
that
require
higher
level
of
isolation
within
their
ci
pipeline,
so
that
also
works
instead.
The
last
screenshot
at
the
bottom
that
you
see
it
shows
how
that
is
enabled
in
a
pipeline
run,
for
example,
to
use
the
cutter
on
time
for
executing
the
pipeline,
and
there
are
a
diverse
enhancement
within
the
dev
console
around
the
pipeline
ui.
J
We
support
now
multiple
python
templates
when
a
user
developer
is
importing
the
application
into
into
openshift,
that's
at
the
the
top
screenshot
and
that's
the
ability
that
allows
platform
owners
to
have
pre
prescribed
or
predefined
supply
chain
templates.
Also
for
for
their
tenants.
They
can
add
it
to
the
platform
as
a
template
and
when
they
are
when
the
tenant
is
important,
application
or
name
space,
they
have
an
option
of
choosing
the
pipeline
before
410.
There
is
a
single
pipeline
that
it
can
provide
for
for
the
entire
platform.
J
Now
we
have
links
to
the
documentation
of
those
tasks
that
can
jump
onto
takedown
hub
and
read
more
about
the
the
task
and
how
it
can
be
used
within
the
pipeline.
Next
slide.
Please
do
open
shift.
Git
apps,
we
should
get
off.
1.5
will
be
released
alongside
410.
This
provides
argo
cd
2.3
that
will
be
released
quite
shortly.
There
are
two
new
generators
that
are
added
in
application
sets.
This
allows,
for
example,
generating
the
application
for
every
pull
request
that
comes
to
the
repo.
J
This
is
really
useful
if
you
want
to
automatically
deploy
the
application
on
pull
request
to
a
particular
namespace
and
be
able
to
test
that
and
decommission
that,
so
it
allows
us
to
have
that
kind
of
dynamic
application.
Creation
for
pull
requests,
and
another
aspect
is
is
another
generator.
Is
the
ability
to
merge
multiple
generators,
so
maybe,
after
a
generator
after
an
application,
is
created
for
pull
requests?
You
want
to
override
some
attributes
of
that
application
from
a
git
repo
or
a
list
in
a
git
repo
or
from
a
different
type
of
generators.
M
J
There
are
some
improvements
done
also
for
making
it
easier
to
deal
with
resources
that
are
not
completely
get
offs
compatible.
So,
for
example,
there
are
objects
on
openshift
and
on
kubernetes
that
that
are
that
some
attributes
of
them
are
managed
by
the
operators.
So
when
you
create
an
object,
an
operator
comes
and
mutates
those
fields.
So
now
there
is.
We
have
already
always
had
support
to
ignore
these
attributes.
J
Now
there
are
new
ways,
more
advanced
ways
of
ignoring
them
through
managed
fields,
for
example,
and
if
you
look
at
some
of
the
objects
on
on
openshift,
you
see
at
the
top
most.
There
is
a
managed
field
attribute
under
that,
a
long
snippet
of
saying
which
what
are
those?
What
are
the
fields
that
are
managed
by
by
whom,
by
which
operator?
J
J
Another
ability
is
that
previously
ignoring
fields
was
only
happening
during
diff,
so
that
argo
city
doesn't
complain
about
an
object
being
out
of
sync.
What
happens
in
this
release
is
that
you
can
also
respect
those
during
the
sync
flow
so
for
for
the
objects
that
are
or
or
fields
that
are
managed
with
something
else.
You
can
all
you.
You
can
tell
argo
cd
that
the
first
time
that
you're
creating
this
object
create
this
fill.
J
But
after
that
point
ignore
it
in
any
of
the
scenes
or
ignore
it
in
any
of
the
divs
that
you
do
so
that
it
doesn't
show
out
of
the
sync
and
you
don't
overwrite
that
fill
if
an
operator
on
the
cluster
is
changing
and
mutating
it
and
there
are
enhancements
within
the
dev
console.
So
that
is
added
health
status
of
the
resources
we
already
had
the
sync
status
in
the
environments
view
and
the
the
sync
status
and
health
status.
J
N
Hello:
everyone
openshift
serverless,
is
based
on
upstream
project
k
native
and
for
4.10.
It
will
be
updated
to
a
native
1.0,
and
this
is
gonna
be
big
milestone
for
us.
We
have
added
some
features
around
eventing
for
this
for
these
releases
and
to
enable
developers
writing
event-driven
solutions.
One
such
feature
is
apache
kafka
based
broker.
As
a
tech
preview
feature,
this
can
maximize
kafka
performance,
persistence
and
can
also
avoid
event
duplication.
N
It
will
also
prevents
tight
coupling
with
kafka
because
it
because
it
eliminates
the
use
of
kafka
clients
by
event
producers
in
the
same
theme.
Another
tech
preview
feature
is
k
native
kafka,
sync
for
openshift
4.10.
It
could
store
receive
cloud
events
from
source
subscription
trigger
eventing
construct
on
a
kafka
topic
without
writing
any
custom
code.
N
Now
for
our
developer
experience,
a
new
plugin
is
being
added
to
the
cli
for
developing
debugging
and
testing
again
event-driven
applications
by
sending
cloud
events
interactively
to
apps
using
kncli
on
dev
console
a
new
visualization
of
event.
Sync
has
been
added,
as
you
see,
from
the
screenshot
on
the
left,
and
another
important
addition
on
dev
console
is
to
make
any
kubernetes
services
as
a
target
output
or
sync
for
cloud
events
from
a
serverless
eventing
infrastructure
a
subscription
or
trigger
can
be
added
to
any
cube
services
available
on
the
cluster.
N
N
As
of
note,
various
runtimes
are
available
out
of
box
and
it
provides
local
developer
experience
using
docker
and
or
podman
on
macro
and
and
windows.
Please
try
out
these
tech
preview
features.
We
would
love
to
hear
your
feedback
and
the
use
cases
that
you
are
trying
to
solve
with
them.
With
that,
I
will
pass
it
on
to
jimmy.
O
Thanks
dana
so
yeah
for
openshift
service
mesh,
we're
aiming
to
ship
service
mesh
tutu
this
april,
it'll
be
based
on
istio
112
and
kylie
147
at
least
going
forward.
We're
looking
to
keep
our
service
mesh
within
a
release
or
two
of
upstream
is
geo,
so
accelerating
a
bit.
Istio
112
also
introduces
a
wasm
plug-in
api,
which
will
deprecate
our
existing
service
mesh
extensions
api,
as
the
upstream
api
was,
was
largely
influenced
by
the
one
that
we
had
with
openshift
service
measured.
It
will
be
a
straightforward
migration
by
popular
demand.
O
We
have
also
recently
introduced
the
ability
to
override
and
customize
network
policy
creation
and
management
around
service
mesh.
We
know
that
our
customers
set
up
mesh
in
many
different
ways,
and
this
this
provides
more
flexibility
between
how
how
service
mesh
and
kubernetes
networking
work
work
together
so
like
by
popular
demand.
Finally,
the
kiali
update
in
service
message
youtube
will
come
with
several
enhancements
for
viewing
and
navigating
larger
meshes,
especially.
O
We
know
that
that
some
customers
have
had
challenges
with
with
yali
for
viewing
that
they're,
the
very
large
meshes
that
they
have
and
that's
something
that
we're
working
to
improve
over
time.
It
also
comes
with
a
few
new
debugging
features,
such
as
the
ability
to
view
internal
certificate
information
and
the
ability
to
adjust
envoy
proxy
log
levels.
E
E
E
We're
also
only
supporting
cloud
internet
services,
dns
or
cis,
and
not
the
ibm
cloud
dns
services.
What
this
means
is
that
only
public
clusters
can
be
created
at
the
moment
in
the
future,
we're
looking
to
support
private
dns,
so
you
can
open
and
create
private
clouds
in
the
future.
One
thing
to
note
about
ibm
cloud
is
we're
only
supporting
ibm
ipv4
at
the
moment,
so
dual
stack
and
ipv6
environments
are
not
yet
possible.
E
Okay,
maybe
if
kara
fred
is
not
able
to
speak
I'll
continue
so
in
4.10
we
are
going
to
check
preview
ipi
installation
of
openshift
on
alibaba
cloud.
So
what
this
means
is
you'll
not
be
able
to
give
it
a
try
for
the
410
release.
We
will
support
the
international
portal,
which
includes
the
world
and
china
mainland,
and
then
please
note
this
is
a
fully
connected
installation
with
new
and
existing
vpcs
next
slide.
Please.
E
So
in
410
we're
introducing
a
new
capability
to
enable
oem
partners
to
pre-install
openshift
at
the
factory.
What
this
means
is
they're
now
able
to
build
turnkey
solutions
with
openshift
embedded
or
rather
pre-installed
on
the
oem
partners.
Hardware-
and
this
is
well
suited
for
partners
looking
to
build
turnkey
solutions
for
rapid
edge
deployments,
so
think
about
use
cases
where
you're
trying
to
power
edge
workloads
where
customers
might
want
to
deploy.
E
Typically,
these
are
being
used
to
enable
compute
real-time
data
processing
and
analysis
at
the
edge,
but
the
solution
leverages
zero
touch,
provisioning
or
ztp,
which
uses
a
declarative
specification
stored
in
git
repos
to
deploy
the
infrastructure
using
github's
deployment,
setup
practices
for
infrastructure
deployments
in
410
we've
added
documentation
that
will
walk
you
through
setting
up
the
factory
or
management
cluster
which
you
use
to
build.
The
turnkey
spoke
clusters
simultaneously
for
folks
interested
in
trying.
This
out
do
feel
free
to
contact
me
and
let's
move
on
to
ramon.
P
P
That
will
allow
you
to
use
the
install,
config
and
specify
per
host
network
configurations
and
something
that
you
know
many
people
have
told
us
that
they
required,
which
is
you
don't
need
dhcp
anymore.
With
this,
you
can
allocate
static
ips
to
your
nodes
without
an
external
customer
provided
dhcp
server,
so
next
we
are
doing
or
actually
promoting
to
ega
the
kubernetes
enemy
state.
For
those
of
you
of
you
have
been
using
anime
state.
This
needs
no
introduction,
but
essentially
you're
gonna
be
able
to
use
on
day
two.
P
The
enemy
stated
operator
fully
supported
to
again
configure
your
notes.
Just
like
you
would
do
on
day,
one
with
the
same
syntax,
which
is
the
end
of
the
state
syntax.
There
is
a
link
at
the
bottom
of
this
slide
to
see.
You
know
all
the
things
that
you're
going
to
be
able
to
do
within
an
and
finally
another
thing
we
wanted
to
highlight
is
the
ability
to
update
your
hosts
bios
settings.
P
Now
we
are
adding
two
crds,
one
is
the
hfs,
so
hardware
finger
settings
and
the
other
one
is
the
firmware
schema
and
what
we
are
doing
is
we
are
collecting
all
the
bios
attributes
and
storing
them
in
the
firmware
schema
along
with
how
to
use
them
right.
What
kind
of
attributes
and
values
you
can
set
and
then
you
will
be
able
to
host
again
to
configure
your
hardware
firmware
settings
on
day
two
and
with
this
I'll
pass
it
over
to
suvi
and
an
ant
for
control.
Plane,
updates.
F
Now,
if
you're,
using
the
oc
command
line
tool
from
version
4.10
you're
going
to
see
two
new
flags
when
you
upgrade
the
first
option
is
include
not
recommended,
and
if
you
use
that
option,
you
you're
gonna,
see
all
those
versions
in
the
channel
which
are
supported
but
not
recommended
for
the
cluster
and
the
cluster.
Admin
can
now
look
at
these
data
and
information
provided
by
the
new
option
and
evaluate
if
the
risk
associated
with
these
conditional
updates
are
okay
or
not.
F
Okay
for
the
current
cluster,
and
if
the
cluster
admin
thinks
that
the
risk
is
okay
for
the
workloads,
the
cluster
admin
can
now
go
ahead
and
update
the
cluster
and
to
update
the
cluster.
You
have
a
new
option
called
allow
not
recommended.
So,
while
upgrading
use
this
option-
and
you
can
update
to
the
version
which
is
a
conditionally
recommended
update
now
over
to
arnandth.
L
L
As
you
can
see
from
the
diagram,
it
can
help
issue
certificates
from
a
variety
of
you
know,
supported
sources
such
as:
let's
encrypt
hashicorp,
venafe
and
even
a
private
kpi
offset
manager
ensures
that
certificates
are
valid
they're
up
to
date
and
you
can
attempt
to
renew
certificates
in
a
configured
time
before
expiring
and
just
some.
You
know
little
background
on
search
manager
is
that
it's
based
on
you
know,
cube
lego,
and
it
also
has
some.
You
know:
intelligence
from
cube,
search
manager.
It
is
a
fully
open
source
project.
L
It
was
developed
by
this
company
called
jetstrack,
which
was
brought
over
by
venefi,
but
you
know
they've
contributed
this
project
upstream
and
it's
you
know
a
cncf.
You
know
sandbox,
you
know
project
right
now,
so
it's
fully
open
source
and
what
we're
doing
is
we're
building
a
operator
for
using
search
manager
in
openshift.
L
The
latest
version
of
the
upstream
project
is
1.7.1
and
in
the
speaker,
nodes
you'll
see
the
detail,
you
know
productization,
you
know
roadmap
and
the
proposal,
for
you
know
onboarding
this
new
operator
on
openshift
and
you'll
also
see
links
to
the
latest.
You
know
search
manager,
use
cases.
For
instance,
you
know
what
are
some
use
cases
for
the
cluster
admin.
What
are
some
use?
L
Cases
for
the
service
infrastructure
admin
service
developer,
to
use,
search
manager
with
an
open
shift
and
you'll
also
see
the
github
repo
from
where
you
can
go
use
the
search
manager
operator
for
openshift,
so
summarizing
set
manager
is
doing
tech,
preview
and
410
with
ga
to
you
know
be
announced.
You
know
soon
after
that,
thanks.
L
So
next
is
around
syncing
group
membership
from
identity
providers
in
410
we
have
introduced
support
for
syncing
group
membership
from
openid
connect
providers
to
openshift
platform
upon
login,
and
you
can
enable
this
by
configuring.
The
group
claim
information
in
the
openshift
container
platform,
open
id
connect
provider.
So
on
the
right
you
see
an
open
id
connect
cr.
So
if
you
navigate
to
spec
identity
providers,
you
can,
you
know,
specify
the
name,
the
mapping
method,
which
is
plain
and
right
at
the
bottom
under
claims.
You
will
see
the
group
information
that
you
can
provide.
L
Q
We've
also
enhanced
the
administration
of
the
the
platform.
As
you
know,
acs
was
the
result
of
an
acquisition
we've
simplified
administration
of
openshift
platform
plus
through
the
reuse
of
the
openshift
oauth
authentication
for
acs
users.
In
this
way,
administrators
don't
need
to
set
up
the
the
same
standard
configuration
across
multiple
platforms.
We've
also
improved.
The
scalability
of
our
registry
integrations
so
for
those
of
you
who
play.
S
Hey
jamie,
this
is
scott.
Hopefully
you
all
can
hear
me.
I
always
love
working
with
our
acs
team.
You
guys
are
set
in
such
a
high
standard
and
high
pace,
and
I've
recently
been
able
to
use
your
new
oauth
on
the
openshift
platform
and
it
works
beautifully.
That's
one
of
the
things
we
want
to
do
here
in
acm.
We
want
to
build
things
better
together,
you'll
see
our
statement
includes.
S
Ansible
includes
the
full
openshift
platform,
plus
we're
diving
into
openshift,
get
ops,
making
sure
advanced
cluster
security
works,
beautifully
and
even
bringing
bits
of
the
storage
at
the
data
foundation
layer
up
into
our
acm
experience
right
out
of
the
gates.
We've
got
a
dev
preview
with
ansible
automation
platform.
That's
surfacing
our
cluster
inventory
into
the
ansible
automation
platform
for
their
users
to
experience
the
openshift
world
directly
at
their
fingertips,
so
the
ops
team
doesn't
have
to
move
out
of
their
comfort
zone
to
start
learning
new
things.
S
A
quick
on-ramp
with
with
low
entry
on
the
skills
you'll
see
the
highlights
there
about
openshift
get
ops,
we're
leveraging
the
application
sets
feature
and
bringing
that
to
ga
in
acm
coincided
with
the
the
expected
ga
of
the
application
sets
by
the
argo
cd
team.
That's
a
great
way
to
bring
applications.
S
At
the
same
time,
we're
also
providing
improvements
in
secrets,
management,
integrating
variable,
templating
templating.
That
allows
you
to
handle
secrets
in
a
more
effective
way,
a
more
secure
way
when
dropping
them
into
managed
clusters.
And
finally,
as
I
mentioned
before,
our
integration
with
acs
continues.
We'll
see
policy
sets
dedicated
to
acs,
as
well
as
that
openshift
plus
integration.
That
brings
acm
at
the
center
point
for
deploying
the
acs
central
and
sensors
to
athletes
I'll.
Take
the
next
slide,
please.
S
So,
with
our
expected
release
in
late
april,
you
are
going
to
see
cluster
lifecycle
for
red
hat
virtualization
known
as
rev
and
adb
gov
cloud
in
the
us.
This
is
awesome.
It
means
you
don't
have
to
leave
your
existing
infrastructure.
You
can
be
comfortable
with
any
type
of
infrastructure
to
deploy
your
openshift
clusters,
whether
that's
on-prem,
bare
metal,
even
in
the
cloud
or
any
of
the
the
private
government
spaces
that
we're
targeting
like
azure
gov
and
aws
gov.
S
As
duncan
mentioned
earlier,
we
are
working
hard
to
coincide.
Our
release
with
the
arm
architecture
support
we're
targeting
that
as
dev
preview
to
support
both
the
hub
on
arm,
as
well
as
the
managed
clusters
leveraging
arm
for
low
power
consumption.
In
particular,
we
see
edge
as
a
great
opportunity
in
that
space
hypershift.
S
Thank
you
to
adele
the
team
that
are
working
hard
to
bring
hypershift
into
the
fold
the
opportunity
there
to
share
the
control
plane
at
scale,
reducing
the
cost
hardware
footprint
and
the
time
position
is
super
exciting
for
acm
we're
super
thrilled
to
be
bringing
that
to
market
as
a
tech
preview
and
look
forward
to
your
feedback
on
that
as
well,
and,
finally,
I'll
wrap
it
up
by
pointing
to
central
infrastructure
management.
This
has
been
such
a
fun
area
to
work
in
with
the
assisted
installer
team
and
bringing
their
technology
from
sas
into
the
on-premise
space.
T
Thanks
a
lot,
but
so
finally,
we
have
been
able
to
provide
crucial
features
around
business
continuity.
We
have
the
rh
acm
hub,
backup
and
restore
using
a
backup
solution
based
on
openshift
api
for
data
protection,
managed
cluster
configurations
can
be
backed
up
and
restored
in
a
different
hub
cluster.
You
also
leverage
odf,
formerly
known
as
ocs
and
average
acm
for
disaster
recovery
across
stateful
workloads
for
your
business
critically.
T
Stateful
apps
odf,
along
with
irish
acm,
will
ensure
you
have
a
robust
multi-site
multi-cluster
disaster
recovery
strategy,
both
odf
and
irish
acm
enable
fast
and
consistent
application,
dr
that
protects
both
application
data
and
application
state.
While
odf
ensures
your
application.
Data
volumes
bvs
are
consistently
and
frequently
replicated
resulting
in
reduced
data
loss,
recovery,
er
operators
that
are
enabled
with
acm
automate
the
dr
failover
and
failback
processes
ensuring
that
your
recovery
is
fast
and
error-free
for
manual
operations.
T
I
would
also
quickly
highlight
another
feature:
persistent
volumes,
replication
using
volume,
sync
formally
known
as
scribe,
which
is
also
currently
tech
preview.
It
provides
value
scenes
for
business,
critical,
stateful
apps
by
ensuring
a
planned
application
migration
strategy
across
your
classes.
You
can
also
use
volume
zoom
to
create
your
own,
dr
solution,
when
working
with
non-odf
storage
or
heterogeneous
storage
providers.
M
That's
helpful
for
those
far
edge
scenarios
as
well
we're
generating
those
du
profiles
through
the
policy
generator.
So
it
does
demonstrate
how
we
can
do
this
at
scale.
These
are
all
through
the
zero
touch
provisioning
which
is
stored
up
in
git,
so
we're
able
to
use
the
infrastructure
as
code
by
pulling
it
down
from
git
and,
lastly,
some
exciting
news.
M
We
have
the
ability
to
export
the
hub
collected
metrics
to
external
tools,
so
we
can
give
that
more
holistic
view
for
customers
that
are
needing
to
merge
their
ocp
metrics
with
other
other
metrics
and
monitoring
platforms
for
for
a
converged
holistic
view.
Thank
you.
Handing
off
the
next
presenter
networking
and
routing.
I
I
Now
this
functionality
mainly
provides
the
ability
to
dynamically
control,
dns
records
of
an
external
dns
server
via
kubernetes
resources,
and
this
is
done
in
a
dns
provider
diagnostic
way.
Now
this
feature
can
be
enabled
by
installing
the
external
dns
operator
via
the
operator
hub,
and
this
actually
deploys
and
manages
the
upstream
external
dns
functionality.
I
It's
an
in-cluster
component
that
makes
kubernetes
resources
discoverable
through
public
dns
servers.
Here
we
use
it
to
synchronize
exposed
openshift
services
and
routes
for
dns
providers.
This
is
supported
currently
on
aws,
gcp
and
azure
and
is
in
tech
preview
and
going
forward.
We
will
support
many
more
providers,
including
blue
cat
and
inflow
box.
Next
slide,
please.
I
I
Now
we
could
use
egress
ip
functionality
to
allow
you
to
ensure
that
the
traffic
from
one
or
more
pods
in
one
of
our
name
spaces,
has
a
consistent
source
id
address
for
services
outside
of
the
cluster,
and
this
was
supported
on
bare
metal
and
vsphere
environments
and
with
this
release
we
are
happy
to
extend
this
feature
on
public
clouds
like
aws,
gcp
and
azure
egress.
Ip
setup
continues
to
be
orchestrated
by
the
network
plugins.
However,
they
will
utilize
a
new
component
called
the
cloud
network,
config
controller,
to
perform
the
required
setup
on
the
cloud
side.
I
I
Another
thing
which
we
have
worked
upon
this
release
is
the
ability
to
modify
the
mtu
post
installation
during
openshift
installation,
the
mqs
automatically
detected
based
on
the
empty
of
the
primary
network
interface
of
the
nodes
in
the
cluster,
but
as
a
cluster
administrator.
If
you
want
to
change
the
you
know,
the
mtu
of
the
cluster
post
installation,
the
addition
of
new
nodes
that
needs
a
different
mtu
for
optimal
performance
or
any
change
in
infrastructure.
I
I
Finally,
we
are
happy
to
announce
the
support
for
intel,
ea10nx
and
broadconnex
that
are
listed
here
for
the
srv
operator
on
openshift410,
with
this
support,
sriov
and
the
pdk,
functionalities
of
this
nix
can
be
configured
via
sriv
operator,
seamlessly
next
slide.
Please,
and
I
think
it's
over
to
peter
for
virtualization
updates.
Thank
you.
R
We've
also
got
plenty
of
work
for
gpu
as
well,
and
I
really
want
to
point
out.
In
the
past
year
and
a
half
two
years,
we've
been
very
busy.
You
can
see
across
the
bottom
here
we
actually
have
demonstrated
ability
in
every
one
of
these
areas
of
cloud
native,
gpu,
acceleration,
modernization
and
actually
telco,
and
I'd
like
to
just
preview.
R
We
actually
have
a
customer
segment
that
we're
going
to
have
a
success
story
published
very
soon
that
has
actually
replaced
their
entire
virtual
infrastructure
with
openshift
bare
metal
and
they're
actually
migrated
their
three-tier
applications
into
this
environment.
It's
a
very
exciting
story.
Next
slide.
Please.
R
So
the
real
question
is:
is
how
do
you
actually
get
your
workflow,
your
virtual
workloads
from
say,
vsphere
or
rev
into
openshift?
You
would
use
mtv
or
migration
toolkit,
and
this
is
actually
based
on
the
upstream
conveyor
project
and
now
has
the
ability
to
actually
do
a
war
migration
which
is
a
running
vm
on
your
old
infrastructure.
R
B
Hello,
I'm
erwin
guerin,
product
manager
for
openshift,
ai
and
compute
acceleration,
so
we've
openshift
4.10
we're
enabling
more
advanced
gpu,
deep
learning
workloads.
So
first
we
have
work
with
nvidia
to
bring
cloud
native
workloads
on
dgx
a100
servers,
so
the
jg
xl100
server
are
the
first
five
petaflops
ai
systems
for
really
big
servers,
and
you
can
quickly
deploy
openshift
on
dgx700
for
testing
with
single
land,
open
shift
or
deploy
your
full
cluster
of
dgx
nodes.
B
As
tech
review.
We
are
also
introducing
new
features
with
a
new
nvidia
network
operator.
You
can
enable
ai
distributed
deep
learning
training.
So
if
you
use
multi-gpu
on
the
multi-node
communication
primitives
in
your
code,
sharing
the
gpu
memory
could
be
required
for
the
performance.
So,
as
you
can
see
in
this
diagram,
this
operator
will
enable
the
gpu
direct
rdms
stack,
so
you
will
be
able
to
access
that
directly
from
one
gpu
to
another
gpu.
H
Thanks
erwan
and
yes,
as
usual,
we've
been
busy
on
the
power
and
z
side
as
well.
This
release
we've
decided
to
focus
on
flexibility,
networking
and
security,
as
you
can
see
on
the
slides.
I
guess
security
is
an
important
topic
for
everyone.
It's.
It
seems
like
a
a
long
time
that
that's
been
the
case
and
particularly
interested
in
this
releases
support
for
ipsec,
so
you
can
take
advantage
of
network
encryption
without
having
to
make
any
changes
to
your
application.
H
Also,
on
the
networking
side,
we
all
agree.
Choice
is
good.
Everyone
has
different
requirements
and
needs
so
we're
pulling
in
those
multis
plugins
that
are
available
on
the
x86
side
of
the
house,
so
you
can
choose
them
and
decide
what
networks
you
want
to
attach
to
and
then
finally,
on
the
flexibility
piece,
if
you're
all
like
me,
we
all
want
a
really
easy
life.
U
Thank
you
duncan
so
for
operator
sdk.
The
overall
theme
is
to
help
increase
the
operator
maturity.
The
first
notable
feature
is
the
hybrid
helm
operator,
sdk
plugin,
compared
to
go
or
n
support,
operators
which
both
can
reach
operator
capability
level.
5,
the
traditional
helm
operator,
has
limited
functionality.
U
The
hyper
help
operator
enhance
this
through
go
apis,
so
the
operator
authors
can
not
only
still
create
an
operator
from
an
existing
health
control
easily,
but
also
continue
improving
it
through
adding
event
driven
logic
to
the
new
camry
concealer
in
golan
to
easier
make
it
beyond
capability
level.
2.
next
to
the
right
operator
can
create
kubernetes
object
as
part
of
their
normal
operations,
if
not
properly
removed.
Those
objects
could
be
hogging,
valuable
resources
like
scd
keys
or
storage
space.
U
Number
three
for
an
operator
to
run
in
a
restricted
network
with
the
om
it
needs
to
list
all
the
related
image
to
perform
their
functions
and
all
those
container
image
needs
to
be
referenced
by
a
digest
rather
than
attack.
So
the
updated
make
bundle
command
is
here
to
help
easier
package
the
operator
project
for
running
successfully
in
the
disconnected
environment,
with
that
I'll
pass
it
over
to
daniel
for
an
update
next
day.
Please
thank
you.
G
G
We
sometimes
had
installations
that
were
exhibiting
a
lot
of
memory,
consumption
caused
by
all
them
because
it
had
global
operators
under
its
management
and
in
today's
model.
That
means
that
in
each
of
these
potentially
thousands
of
namespaces,
a
object
is
going
to
be
copied
into
in
order
to
drive
discoverability
of
the
tenant
via
the
ui
and
that
a
circuit
operator
is
available.
If
that
is
a
problem
for
your
cluster,
we
actually
build
a
release
valve
into
olam
and
410.
G
Now,
where
you
can
disable
that
copying,
that
will
not
impact
any
of
the
functionality
of
the
cluster
nor
the
operator,
but
it
obviously
degrades
a
little
bit
the
the
discovery
experience
in
the
ui,
so
the
tenants
can
see
that
an
operator
is
available
to
them.
However,
it
will
still
function
as
normally
on
the
cli,
the
api
level,
and
obviously
this
is
also
just
a
stop
gap.
As
we
move
to
a
global
operator
model.
G
Now
in
410,
we
allow
authors
to
respect
to
specify
and
express
these
dependencies
in
more
complex
terms
and
more
complex
constraints
using
a
separate
language
and,
as
you
can
see
in
the
screenshot,
they
can
also
now
contain
custom
error
messages
to
tell
the
administrator
that
a
certain
dependency
is
missing
or
not
at
the
right
version
level.
In
case
they
are
managing
these
manually
next
slide.
G
Let's
switch
gears
real,
quick
to
red
hat
quay,
our
central
registry
for
distributing
images
to
an
open
shift
cluster
feed
in
redhead
quay
37,
which
ships
alongside
very
closely
with
410,
we
are
introducing
the
ability
to
run,
builds
on
openshift
clusters
that
are
not
by
metal
so
bills.
What
is
it
you
can
actually
use
quay
to
build
your
container
image
right
inside
registry?
This
is
sort
of
a
very
easy
pipeline
setup
where
you
connect
gitlab
or
github,
for
instance,
via
backhoes,
to
quay
and
trigger
an
image,
build
therefore
alleviating
the
need
to
distribute.
G
You
know
credit
registry
credentials
or
api
tokens
in
your
ci
pipeline.
The
build
is
carried
out
in
quay,
and
previously
this
was
done
in
a
containerized
to
emo
virtual
machine
that
was
run
on
top
of
openshift
and
then
the
build
result
in
form
of
an
image
was
pushed
to
the
create
repository
associated
with
the
build.
G
The
only
problem
there
was
that
you
needed
a
bare
metal
object
cluster
to
do
this,
because
qemo
needs
a
bare
metal
machine
to
run,
and
now
we
have
actually
moved
away
from
qemo
to
a
containerized
builder
environment,
which
allows
us
to
build
a
container
image
in
an
openshift
pod
that
is
running
on
any
openshift
cluster.
On
a
infrastructure
provider
of
your
choice,
including
your
favorite
virtualization
or
cloud
provider
in
37,
you
will
be
able
to
configure
this
via
the
config
file
and
in
38.
This
is
going
to
be
managed
by
the
koi
operator.
G
We're
also
planning
some
future
features
like
the
ability
to
produce.
Multi-Arch
builds
with
this,
so
images
for
separate
compute
architectures
and
we're
also
looking
to
add
support
for
pipelines
in
the
future
as
another
way
to
dedicate
build
functionality
from
quay
to
openshift
next
slide
and
very
often
feature
from
quay
is
to
serve
as
a
pull
through
cash
proceed.
That
means
you
can
actually
configure
a
organization
in
quay
to
proxy
a
particular
upstream
registry
like
docker
hub.
G
What
happens
is
that
the
client
is
actually
attempting
to
pull
from
that
query
organization
that
is
configured
to
cache
either
an
entire
upstream
registry,
or
just
a
certain
namespace
in
an
upstream
registry,
and
what
quay
will
do
is
it
will
stream
the
image
transparently
to
the
client
in
the
background,
while
also
caching,
the
image,
so
the
subsequent
pull
attempt
against
the
cache
will
be
fulfilled
from
that
cache
miss
therefore
much
faster
and
much
more
resource,
friendly
and
also
insulating
you
from
any
of
pull
rate.
Limiting
that
may
happen
upstream.
G
This
is
also
a
way
where
you
can
essentially
have
admins
allow
partial
access
towards
quote-unquote,
untrusted
community
registries
like
quay,
io
or
docker
hub,
without
opening
up
the
floodgates
to
entirely
the
entire
registry
and
allowing
all
images
to
be
pulled.
So
you
can
configure
the
cache
to
just
cache
a
certain
portion
of
the
option
registry
and
it
will
work.
G
You
can
also
limit
the
cache
size,
so
it
will
not
eat
up
indefinite
storage
and
it
really
makes
it
transparent
to
the
users
because
they
can
configure
their
clients
to
do
a
mirror
mapping
to
prefer
the
quake
cash
registry.
When
a
pool
attempt
against,
for
instance,
docker
hubs,
library
project
is
performed.
G
B
G
In
that
slide,
for
that
next
slide
is
also
related
to
storage.
It's
allowing
quay
administrators
to
prevent
the
storage
from
growing
ever
and
ever
every
day
in
a
cray
registry,
and
we
do
this
by
showing
users
consumption
information
about
the
storage
consumption
at
both
the
repository
level,
so
a
particular
image
and
all
its
tags,
and
also
query
administrators
source
consumption
at
the
organization
level.
G
G
The
quota,
that's
behind,
that
system
can
also
be
enforced.
So
a
registry
admin
can
define
quotas
at
an
organization
or
a
registry
level
that
will
limit
the
amount
of
storage
that
a
certain
can
organizat
up
and
when
that
storage
limit
is
reached,
there
will
be
no
further
pushes
allowed
until
the
owner
of
that
organization
actually
starts
to
clean
up
older
unused
images
to
fall
below
the
quota.
G
To
not
surprise
users
of
the
registry
with
these
kind
of
enforcements
there's
also
a
notification
system
built
in
that
allows
owners
of
organizations
define
custom
warning
thresholds
which
will
use
craze
notification
system
to
warn
users
of
that
organization
that
their
storage
quota
is
about
to
be
fully
consumed,
and
with
that
I'm
going
to
be
handing
over
to
another
storage
topic
read
out
by
gregory.
Thank
you.
V
Thanks
danielle
and
hello,
everyone,
let's
have
a
look
to
what's
new
in
storage,
so
with
openshift
4.10,
we
are
having
to
announce
the
new
csi
driver
support
for
this
year.
Amazon,
aws
efs
for
rwx
storage,
access,
ibm
cloud,
as
mentioned
earlier,
and
an
ali
cloud
we're
also
introducing
the
azure
file
aztec
preview
in
terms
of
csi
migration.
4010
includes
technology,
previews
for
vsphere
and
azure
file
and
as
a
reminder,
the
csi
drivers
are
automatically
deployed
at
installation
time
or
after
upgrade
when
leveraging
the
installer
cloud
provider
integration.
V
V
I'd
like
to
take
the
opportunity
to
give
a
heads
up
on
a
cluster
that
are
running
on
top
of
vmware.
As
I
just
said,
we
are
getting
the
vcu
csr
driver
and
it
will
be
deployed
by
default
up
after
upgrade
for
cluster
that
are
running
in
3
today.
The
introduction
of
this
csi
driver
requires
virtual
machine
hardware
version
15.,
that's
a
requirement
from
driver
version.
15
is
supported
by
vsphere
version,
67
u3
or
later
so,
in
order
to
ensure
a
successful
deployment
of
the
driver.
Please
make
sure
your
cluster
is
running
vm
hardware
version
15.
V
for
clusters
that
are
running
csi
today
with
a
driver
coming
from
an
external
source,
because
the
two
versions
of
the
same
driver
cannot
coexist
within
a
given
environment.
The
external
csi
driver
needs
to
be
removed
so
that
the
embedded
dsi
driver
deployment
can
proceed.
In
both
cases.
The
cluster
stability
nor
the
performance
are
impacted.
V
Checks
are
in
place
to
detect
this
situation,
and
the
csi
deployment
will
resume
once
the
requirements
are
met.
However,
the
cluster
that
are
in
this
situation
will
be
marked
and
upgradeable
to
preserve
upgrade
stability.
They
can
still
perform
minor
updates,
but
upgrade
to
411
will
be
blocked
until
it's
solved
next
slide.
Please.
V
So
we
are
introducing
cluster-wide
encryption
with
old
kms
using
a
service
account
for
at
rest,
encryption
and
better
integration
with
kubernetes
odf
now
supports
gp3
and
gp2
csi.
As
the
underlying
banking
storage
on
the
multi-cloud
object
gateway
side,
we
added
a
capability
for
legacy,
application
to
write
and
read
from
the
file
system.
Why
clue
native
application
use
the
s3
api
and
that
allows
a
better
migration
and
collaboration
between
legacy
and
and
cloud
native
applications?
V
One
last
important
update
is
the
introduction
of
a
new
dynamic
local
storage
solution
for
single
loadout
shift
a
stack
preview.
This
solution
has
a
very
low
footprint
in
terms
of
resources,
consumption
and
is
based
on
the
toppo
lgm
upstream
project.
That's
it
for
the
storage
and
ogf
updates
handing
over
to
rob
for
the
telugu
5g.
W
Hi
folks,
high
performance
applications
running
dpdk
in
the
case
of
cloud
native
network
functions
require
cpus
network
interfaces
and
memory
to
be
located
on
the
same
pneuma
node
any
cross.
Pneuma
node
situation
leads
to
a
significant
and
unacceptable
performance
drop,
in
other
words,
cpus
devices
and
memory
absolutely
need
to
be
on
the
same.
Pneuma
node
kubelet
relies
on
topology
manager
for
container
pneuma
alignment,
and
so
far
only
cpus
and
devices
were
numa
aligned.
With
the
addition
of
the
memory
manager,
kublet
can
now
align
regular
memory
and
huge
pages
with
cpus
and
other
devices.
W
W
We've
we've
been
aggressively
strengthening
our
zero
touch,
provisioning
solution
for
telco
use
cases,
and
we've
made
significant
advancements
in
4.10
to
highlight
a
few
we've.
Now
we
now
support
deploying
dus
to
a
cran
hub,
whether
that
be
a
traditional
cluster
or
a
three
node
compact
cluster
we've
added
better
status
reporting
of
the
ztp
status
with
ztp
labels,
we've
tightly
integrated
ztp
with
the
topology
aware
lifecycle
operator
we
now
allow
for
custom
manifests.
W
We
have
a
technology
preview
feature
for
policy
driven
multi-cluster
upgrades.
We
added
a
feature
to
allow
the
cluster
operator
to
sequence,
sno
provisioning
across
an
acm
instance.
And
lastly,
we
added
support
for
pre-caching
images
and
artifacts
prior
to
an
update
or
upgrade
so
that
you
can
download
the
necessary
bits
prior
to
updating
and
upgrading,
providing
as
little
downtime
as
possible
when
updating
and
and
upgrading
next
slide.
Please.
W
It's
very
important
for
rand
vu
workloads
to
have
as
many
cpus
as
available
so
that
the
du
deployment
on
an
ocp
node
can
support
as
many
cell
sectors
and
radio
units
as
possible.
Red
hat
has
been
driving.
Openshift's
compute
needs
down
for
over
a
year
in
4.10,
we're
confident
that
the
open
shift,
control
plane
and
the
load
applied
by
the
du
workload
can
fit
within
four
hyper
threads.
W
The
workload's
characteristics,
for
example
the
number
of
pods
and
the
number
of
probes.
The
control
plane
must
manage
and
run
directly
influences.
Openshift's
compute
needs
on
this
slide.
We
define
the
application
infrastructure
budget
as
the
allowable
load
that
the
application
can
put
on
the
control
plane
if
the
workload
does
not
exceed
an
application
infrastructure
budget
of
1700
millicourse.
W
W
In
4.9,
we
added
a
node
local
low,
latency
event,
bus
vetted
by
oran
in
4.9
openshift
supported,
ptp
ordinary
clock,
with
ordinary
clock
events
published
to
this
event,
bus
and
ptp
boundary
clock,
but
without
events
in
4.9
excuse
me
in
4.10
we're
now
publishing
ptp
boundary
clock
events
to
this
event.
Bus
and
we've
also
added
redfish
hardware,
events
to
the
same
oran
approved
low,
latency,
node
local
event,
bus
now,
telco
workloads
can
get
all
relevant
events
when
running
in
ordinary
clock
or
boundary
clock
mode,
as
well
as
getting
a
better
understanding
of
the
hardware
state.
W
X
Thank
you
very
much
rob
appreciate
it.
We're
excited
to
announce
some
open
shift
monitoring
additions
as
far
as
the
openshift
410
release
is
concerned,
so
stop
by
highlighting
a
focus
here
on
the
functionality
with
providing
audit
lotting
for
metrics,
so
with
our
ability
to
view
now
and
audit
which
components
are
requesting
and
calling
the
metrics
apis.
X
We
also
have
enabled
query
logging
for
all
prometheus
instances
with
support
for
both
platform
monitoring
and
user
workload.
Monitoring
there
is
support
to
use
the
thanos
queria
to
view
which
queries
are
frequently
executing
and
the
potential
impacts
to
queries
have
on
resources
for
both
performance
and
capacity
purposes.
For
monitoring
next
slide.
Please.
X
To
extend
that
so
some
of
the
enhancements
we
offer
is
basically
the
prometheus
logging
certificate
capabilities.
So
we
have
the
ability
to
improve
the
reliability
of
metrics
collection
with
the
new
premathius
client
certificate,
authentication,
we're
able
to
scrape
metrics
and
allow
certificate
authorities
to
be
able
to
provide
that
so
with
authentication
through
apis.
We're
able
to
scrape
metrics
enable
reducing
performance
impacts
on
our
scrape
endpoints,
which
is
really
good.
A
lot
of
feedback
from
customers
asking
us
to
minimize
the
overhead
from
prometheus.
So
we're
happy
to
provide
that.
X
X
Our
improved
openshift,
barring
ui
experience,
so
what
we're
really
focused
on
here
is
really
delivering
that
in
cluster
monitoring
experience
we
can
start
to
bring
together
the
value
add
of
rather
having
a
distributed
management.
Experience
of
different
assets
and
components
from
prometheus
to
alert
manager
into
straight
pinpoints.
We're
pleased
to
announce
that
now
in
the
ocp
console
we're
better
able
to
provide
a
more
native
and
coherent
user
experience
for
administrators
and
developers.
X
So
in
410,
we've
enhanced
our
user
experience
to
bring
together,
alerting
and
metrics
into
the
openshift
console,
so
basically
integrated
alert
manager
under
the
observe
in
the
learning
menu
from
integrated,
prometheus
user
experience
for
the
metrics
specific
menu,
and
then
also
also
I'm
going
to
highlight
them
on.
The
next
slide
is
integrated,
scrape
endpoint
targets
to
observe
targets
which
is
going
to
be
another
enhancement.
Next
slide,
please.
X
So
this
is
a
key
feature
that
is
intended
to
provide
a
lot
of
value
and
a
lot
reduce
a
lot
of
the
administrative
overhead.
So
we
have
new
prometheus
target
endpoints
inside
of
the
console
under
the
observed
menu
which
allows
us
to
observe
and
manage
all
of
our
scrape
endpoints.
As
one
entity
under
the
ocp
goal
versus
in
in
previous
releases,
having
individually
managed
those
independent
in
those
individual
targets,
that
gives
us
a
lot
more
ability
to
look
at
the
aggregated
view
of
our
scrape
endpoints
and
be
far
more
efficient
there
next
slide.
Please.
X
Y
Thanks
a
lot
shannon
for
just
being
tracing
one
of
the
technologies
that
probably
most
of
you
is
already
familiar.
It's
based
on
a
as
openshift
410.
We
are
releasing
these
discipline
tracing
data
collections,
which
is
pretty
much
based
on
open,
telemetry
collector
and
what
you're
it
gonna
do
is
it
can
act
as
a
agent
to
work
side
by
side
with
your
application,
or
even
it
can
work
as
a
gateway
to
get
connected
to
existing
back-ends
on
the
open
shift,
but
also
outside
the
open
shift.
Y
C
C
C
Z
Another
thing
that
we
were
been
asking
a
lot
is
increasing
the
number
of
days.
The
information
is
available
so
from
four
to
ten
on.
You
will
have
at
least
90
days,
so
you
will
be
able
to
go
to
the
causes
plotter
and
select
more
than
this
month
from
the
previous
month.
That
was
what
we
were
supposed
supporting
before,
and
another
thing
that
has
been
really
required
by
customers
is
the
support
of
osdp
and
gcp,
but
we
support
amazon
azure
on
google
as
underlying
infrastructure
clouds.
Z
In
the
past
we
were
supporting
the
distribution
of
cost
of
those
clouds
into
ocp
concepts
like
metrics
or
attacks.
With
this
release
we
add
the
same
functionality
to
gcp
on
ocp,
so
we
have
parity
in
the
three
clouds
that
we
support
and
the
last
thing
is
we
are
actually
modifying
the
way.
We
are
calculating
things.
Z
One
of
the
things
we
do
is
we
distribute
cost
based
on
cpu
or
memory
into
your
projects
or
tabs
or
notes,
and
we
had
the
thing:
that's
you
could
use
the
use,
the
they
use
all
the
requests,
but
actually
customers
were
saying
that
the
they
use
it's
never
gonna
be
below
the
request,
because
the
request
is
a
reservation,
so
whatever
they
have
are
clustered
with,
the
use
was
very
low
and
the
request
was
high.
The
numbers
that
were
seen
was
not
reflecting
reality.
Z
Nor
use
or
requests
by
separated
will
allow
them
to
see
what
was
going
on,
and
now
we
are
adding
this
capability.
When
you
created
our
our
resource,
when
you're
creating
a
rate
plan,
you
can
select
the
effective
usage
and
we
will
select
the
maximum
of
usage
and
requests.
So
every
time
you
use
it,
the
minimum
will
be
the
request
and
the
maximum
will
be
the
actual
usage
and
that's
all
for
coach
management,
and
I
think,
and
the
last
one.
So
this
is
the
last
slide.
A
A
A
As
always,
you
can
find
more
informative
information
documentation
more
at
cloud.redhat.com,
and
I
want
to
call
out
we
have
a
new
database
gathering
coming
up
in
openshift
commons.
This
is
our
user
group
where
folks
can
learn
from
each
other
about
how
they're
using
openshift
successfully,
that
is
on
february
23rd
and
if
you're,
watching
this
recording
after
that
date
go
check
out
the
video
of
that
as
well.
If
you
use
databases
on
openshift,
thank
you.
So
much
hope
you
enjoy
openshift410
in
mid-march
and
we'll
talk
to
you
next
time.