►
From YouTube: [What's New] OpenShift 4.8 [Jun-2021]
Description
On June 24 2021, the OpenShift PM team will broadcast the internal [What’s New] OpenShift 4.8 [Jun-2021] briefing to internal Red Hatters on Primetime, as well as directly to customers and partners on OpenShift.tv.
FAQ
What is changing with the [What’s New] and [What’s Next] OpenShift briefings?
In addition to being made available on Primetime for internal Red Hat audiences, the [What's New] OpenShift release update and the [What's Next] OpenShift roadmap briefing will simultaneously be made available to the general public (including customers and partners) through OpenShift.tv.
Why are the [What’s New] and [What’s Next] briefings being broadcast on OpenShift.tv for customers and partners?
Making this information live and available to partners and customers will drive further engagement with our developer and technical communities, and will contribute to our open culture by engaging target audiences in our latest product developments. OpenShift.tv may be leveraged to build advocacy for our portfolio within customer accounts.
What does this mean for the field regarding these timely updates from the BU?
New information on OpenShift releases and updates to the OpenShift roadmap will be made available to customers through OpenShift.tv at the same time it is made available to our internal field audiences. Red Hatters are encouraged to attend through the internal Primetime invitation for access to secure Q&A with the product team.
Internal Red Hatters are also encouraged to invite their target and existing customers to view and interact with OpenShift PM through the live briefings on OpenShift.tv.
#RedHat #OpenShift
A
A
A
A
B
We've
got
some
themes
for
openshift
48,
where
we
did
a
bunch
of
work
on
installer
flexibility.
So
we
know
a
lot
of
folks
in
their
it.
Environments
sometimes
have
protected
roles
for
making
new
iam
on
amazon
want
to
use
sts
tokens
install
into
different
resource
groups
that
already
exist,
so
we've
done
a
ton
of
work
there
on
amazon
and
azure
as
well
as
pick
up
kubernetes
1.21
some
exciting
feature.
Graduation.
B
We
have
a
bunch
of
apis
that
are
going
to
their
stable
v1s
in
kubernetes,
as
well
as
some
features
in
openshift
that
are
going.
Ga
we've
got
our
cron
jobs,
pod
disruption,
budgets
and
vertical
pod,
auto
scalers,
as
well
as
scheduling
profiles
going
to
tech
preview
and
what
we're
really
excited
about
is
ipv6
single
and
dual
stack
and
then
our
next
gen
developer
tools.
We've
got
a
bunch
of
investment
in
openshift
git,
ops,
which
we
were
excited
to
ga
as
well
as
open
pipelines
and
then,
lastly,
a
new
tech
preview
coming
in
the
developer
tools.
B
Arena
is
serverless
functions,
so
we've
already
gained
some
of
our
other
serverless
technologies.
This
is
kind
of
getting
closer
to
a
functions
as
a
service
experience.
I'm
really
excited
to
talk
about
that
more
later
on
in
the
presentation
all
right,
and
then
I
want
to
dig
into
kubernetes
121..
This
is
what
we're
shipping
with
kubernetes.
Excuse
me
with
openshift48,
as
I
mentioned,
a
bunch
of
apis
graduated
to
stable,
as
well
as
some
better
control
over
node
disruption.
B
This
is
a
big
thing
for
us,
because
we
do
our
upgrades
over
the
air,
and
so
we
care
about
how
your
pods
are
moved
off
of
nodes
and
move
back
on.
So
a
new
node
shutdown
timer
gives
you
a
little
bit
more
control
over
that,
as
well
as
pod
disruption.
Budgets
really
are
that
main
kind
of
primitive
that
you
have
and
that's
going
to
graduate
to
stable
as
well
cube.
B
121
is
required
for
ipv4
and
ipv6
dual
stack
support,
so
we've
been
waiting
on
that
one
to
call
that
ga
and
then
a
few
other
pod
scheduling.
Primitives
are
coming
in
cube
121,
so
in
alpha.
There's
the
memory
manager
and
then
in
beta
is
storage
capacity
and
as
always,
a
reminder
that
we've
versioned
kubernetes
with
openshift,
so
we've
got
cryo121
we've
got
cube121
and
we've
got
openshift48
all
designed
tested
to
work
together.
B
Then
here
is
the
the
overall
openshift
roadmap,
so
this
is
kind
of
as
far
out
as
we
can
see
I'll.
Let
you
pause
your
video
if
you
want
we're
not
going
to
dig
into
all
these
things,
but
you
can
see
that
we've
got
a
ton
of
investment
happening
and
the
developer
tool
space,
our
application
space,
as
well
as
the
platform
itself,
and
then
our
hosted
and
managed
clusters.
B
C
Right,
thanks
rob,
so
this
is
probably
the
only
slide
that
doesn't
have
anything
to
do
with
openshift
4.8.
But
since
it's
june
and
we
are
having
a
life
cycle
event,
we
thought
we'd
draw
your
attention
to
it.
So
the
last
release
of
openshift
3
was
openshift
3.11
and
this
month
in
june
it
leaves
its
end
of
full
support,
we're
extremely
proud
of
the
3.x
line.
It's
been
nothing
but
successful
with
our
customers
and
users
and
the
ecosystem,
but
it
is
time
to
move
it
on
to
its
next
stage,
and
that
is
maintenance
support.
C
So
maintenance
support
is
critical,
cves
and
critical
bugs
and
that
will
go
all
the
way
to
june
of
2022.
Now
the
next
one
is
a
little
confusing
to
some
people
but
easy
to
understand.
Once
you
know
what
the
words
mean:
it's
extended
life
cycle
phase
and
that
simply
means
that
we're
still
answering
the
phone,
but
we're
not
issuing
any
fixes.
So
after
2022
going
into
2024
and
by
the
way,
2024
is
like
the
next
presidential
election
here
in
the
united
states.
C
It
looks
like
that
blue
box,
and
it
says
that
if
you
are
in
a
current
openshift
three
to
openshift
for
migration,
and
then
you
want
a
little
bit
more
time
on
that
maintenance
cycle,
maybe
you
just
want
one
more
year
right
so
june,
2022
to
june
2023,
we
do
have
a
for
sale
offering.
That
would
allow
you
to
buy
cbe
and
critical
fixes
during
that
one
year
extension-
and
that
is
also
mentioned
on
the
migration
page-
so
definitely
spend
some
time
on
our
migration
page.
B
A
Thank
you
mike
so
openshift
pipelines
that's
downstream
add-on
on
openshift
that
productizes
takedown
upstream
project,
the
kubernetes
native
ci
cd
system,
four
kubernetes
built
for
kubernetes
and
on
ocb48
1.5,
openshift
pipelines.
1.5
will
be
released
via
already
g8
on
ocp47
and
now
the
next
release
of
that
will
be
made
available.
There
are
a
bunch
of
really
significant
requests.
We
have
had
from
customers
that
are
included
in
this
release.
A
The
first
one
of
those
are
auto
pruning
of
python
runs
and
task
runs
so
that
this
has
been
possible
before,
but
customers
had
to
manually
create
a
chrome
job.
Now
the
operator
manages
that,
and
they
can
configure
to
keep
the
latest
20
of
their
python
runs,
for
example,
and
automatically
get
the
rest
of
them
get
garbage
collected
not
to
burden
a
cd.
A
The
the
other
big
chunk
of
capabilities
that
are
coming
in
1.5
is
pipeline
as
code
that
enables
git
centric
workflows
around
your
pipeline
themselves,
not
just
about
your
application,
but
the
pipeline
definition
itself.
So
you
define
your
pipeline.
Your
takedown
pipeline
in
as
yaml
put
in
your
git
repo
and
that's
all
that
there
is
to
it
and
you
don't
create
on
anything
on
the
cluster
every
time.
There's
a
change
on
the
repo
that
definition
is
taken
and
exit
gets
executed
on
the
cluster,
and
there
are
a
bunch
of
features
around
that.
A
Like
event
filtering,
you
can
define
if
that
needs
to
happen
on
comments
or
pull
requests
or
other
events,
for
example,
which
branches
which
tags
that
should
be
included
or
should
be
monitored.
For
for
those
changes,
there
is
automatic
task
resolution,
so
you
don't
have
to
have
the
take
on
tasks
that
your
pipeline
needs
on
the
cluster,
and
rather
you
can
keep
them
in
your
repo
alongside
your
pipeline
or
simply
just
refer
to
them
in
another
repo
or,
if
you
just
name
them.
A
The
platform
automatically
installed
them
from
ticked
on
hub,
and
there
is
also
a
file
support
in
python's
code
that
allows
you
to
limit
who
can
trigger
your
ci
opposition
pipelines
to
to
avoid
bad
actors.
You
don't
want
just
anyone
to
create
a
pr
intensity
or
ci,
so
you
can
have
a
limited
number
of
users
or
groups
roles
that
that
are
able
to
do
that
and
we
support
pull
request
commands
and
one
of
those
is
actually
for
the
previous
point.
A
So
if
you
have
defined
particular
users
that
are
approved
to
to
run
the
ci,
then
those
spin,
the
pr
coms,
then
those
people
can
go
and
run
and
and
put
a
comment
on
that
pr,
okay
to
test
and
the
ci
gets
triggered
or
you
can
run
a
retest,
for
example,
similar
flows
to
to
pro,
if
you're
familiar
in
the
minis
board.
With
that
there
is
integration
with
github
checks,
api.
A
So
on
your
pr,
you
would
get
the
result
of
your
pipeline
execution
as
it
executes
on
openshift,
but
the
results
are
available
on
your
pr
as
well
with
details
through
the
task
and
link
to
the
logs
of
all.
Those
task
runs
back
to
the
on
the
platform,
openshift
console
and
currently,
in
the
first
release
of
that
we
support
github
and
github
enterprise.
A
It's
a
diff
preview
feature
and
over
the
next
feature,
the
next
releases
we're
going
to
add
gitlab
and
beatpocket
as
well,
and
the
next
item
is
the
ability
to
customize
the
default
templates
that
we
should
be
talking
to
pipelines.
You
might
have
noticed
when
you're
adding
an
application
through
dev
console.
You
have
a
checkbox
at
a
pipeline
as
well,
and
customers
can
replace
these
templates
that
we
give
them
their
own,
sophisticated
pipelines
that
they
can
provide
to
the
dev
team
and
around
dev
console.
A
A
At
the
next
piece
of
work,
you've
done
is
open,
shift,
get
offs
again,
g8
on
oc,
7
or
648
1.2
of
openshift
git
ups
will
be
released
and
another
frequently
requested
capability
that
they
have
had
is
that
argo
cd
authentication
should
be
integrated
with
openshift,
so
that
openshift
users
can
reuse
their
credentials
to
login
into
openshift
and
in
previous
versions
we
had
a
manual
process
to
set
that
up
in
1.2.
The
operator
sets
that
up
automatically
through
provision
and
irish.
A
So
as
a
part
of
argo
cd
is
embedded
inside
the
arbor
city,
the
naming
space
that
runs
argo
cd,
they
have
also
simplified
the
privilege,
configuration
argo
cd.
A
lot
of
our
customers
want
to
give
an
instance
of
argo
cd
to
their
development
team
and
limit
that
argo
cd
instance
to
only
the
name
spaces
that
the
dev
teams
have
access
to.
A
So
they
can
apply
if
they
can
follow
github's
processes
only
for
that
development
team
application
within
the
name
spaces
they
have
access
to
and
in
in
doing
so
they
have
to
create
a
number
of
role
bindings
and
role.
It's
it's
fairly
cumbersome
and
not
complex,
but
it's
a
lot
of
toil
that
needs
to
be
created
in
1.2.
We
have
automated
that
and
all
of
that
goes
inside
the
argo
cdcr
and
the
operator
takes
care
of
that.
A
They
have
done
a
great
job
on
bringing
argo
cd
more
into
the
experience
of
acm
when
you
are
managing
cluster
within
acm
icm
recognizes
that
there
is
arbor
cd
on
those
clusters
and
it
would
import
the
cluster
registry
of
acm
into
our
cd's
registry
so
that
you
can
easily
define
applications.
Our
cd
and
sync
get
reposted
to
those
clusters
as
well
and
within
acm,
console
or
dashboard.
A
You
can
see
you,
you
would
notice
argo
cd
instances
of
applications,
so
obviously
the
application
is
recognized
both
in
the
topology
and
the
list
of
applications
with
a
role
capabilities.
So
if
you
have
org
with
the
same
application
acquis
across
multiple
clusters,
acm
can
roll
that
up
to
a
single
application
that
can
expand
to
all
those
clusters.
If
you,
if
you
need
to
and
with
that
I'll
pass
it
down
to
odell,
I
think.
D
Yep,
thank
you
so
in
4.8
we're
also
introducing
openshift,
sandbox
containers
aspect
preview,
openshift
sandbox
containers
brings
along
as
download
like
the
overlay
for
catholic
containers.
So
what
is
catholic
containers?
Cata
containers
is
an
upstream
project
that
provides
you
with
an
oci
compliant
runtime
to
run
your
workloads
and
virtual
machines
in
lightweight
virtual
machines
was
the
same
exact
experience
as
you
would
do
it
with
normal
containers.
D
What
we
bring
with
openshift
sandbox
containers
is
an
operator,
and
the
operator
takes
care
of
doing
all
the
grunt
works,
combining
all
the
bits
and
pieces
to
bring
category
containers
to
your
openshift
cluster,
including
so
some
of
the
tasks
that
the
operator
does.
It
is
available
on
the
red
hat
operator
catalog
on
the
console,
so
you
can
enable
it
as
any
other
operator
with
openshift.
D
It
exposes
a
crd
for
you
as
a
cluster
admin,
for
example,
to
configure
day
one
and
day
two
tasks,
and
it
provides
chemo
as
the
back
end
for
or
as
your
virtual
machine
monitor.
Using
coreos
extensions
additionally
provides
the
cata
containers
rpms
and
installed
them
in
in
the
node.
The
same
method,
wizos
extensions.
This
allow
us
to
delegate
the
lifecycle
management
to
a
tool
that
does
it
very
well
the
machine,
config
operator,
and
then
you
have.
It
does
also
cryo
configuration.
D
So
you
would
need
to
configure
usually
script
that
without
an
operator
to
configure
the
handler,
add
the
runtime
handler
for
any
runtime
class
you're,
adding
to
your
cluster.
In
that
case,
we're
adding
a
catholic
containers
as
an
additional
runtime
class,
which
also
the
operator
will
create
that
runtime
resource
for
you.
D
So
it
basically
automates
all
these
necessary
stuff
that
you'd
usually
do
by
a
bash
scripts,
and
does
the
life
cycling
how
you
would
use
that,
basically,
as
a
cluster
admin,
you'd
create
our
resource
called
catacomfic
and
that
resource
the
like
at
the
moment
allows
you
to
choose
which
nodes
you're
you're,
enabling
cata
containers
on?
Do
you
have
the
choice
to
choose
or
to
configure
certain
nodes
and
not
all
the
nodes
of
your
cluster
to
run
cata-specific
workloads
or
virtual
machine
workloads?
E
D
D
So
you
have
not
built
an
image
or
a
container
image
for
that
and
openshift
virtualization
could
be
a
good
default
use
case
or
a
good
product
to
use.
On
the
other
hand,
if
you
have
built
an
image
already
and
you're
already
far
in
your
cloud
native
journey,
then
openshift
sandbox
containers
can
be
a
good
choice
for
you
to
re-architect
and
because
it's
also
an
oci
compliant
runtime.
So
the
experience
is
exactly
the
same:
you're
just
changing
the
runtime
class.
D
G
Thank
you
adele,
so
chip
serverless
brings
the
serverless
deployment
platform
to
openshift
that
enables
the
users
to
run
almost
any
containerized
workload
in
serverless
fashion,
aka
scale
up
on
demand
and
scale
back
to
zero.
What
serverless
functions
bring
is
a
simple,
focused
and
opinionated
way
to
author
solutions
and
then
deploy
them
in
serverless
manner.
It
is
a
collection
of
tools
that
enable
developers
to
create
and
run
functions
as
a
canadian
service
on
kubernetes,
and
we
are
delighted
to
announce
the
serverless
functions.
G
Tech
preview,
with
openshift
4.8
functions
is
offering
a
simple
programming
model
that
reduces
the
complexity
and
it
empowers
users
to
no
longer
worry
about
platform.
Specifics
like
networking,
resource
com,
consumption,
sizing,
etc
and
functions.
Take
it
a
step
further
and
takes
the
application,
configuration
project,
structure
and
container
creation
as
well.
You
create
and
deploy
your
application
in
two
commands.
Dev
console
has
a
new
visualization
for
these
functions
and
they
play
very
well
with
the
drag
and
drop
topology
of
event
sources,
and
this
will
be
covered
later
in
the
presentation
by
serena.
G
In
that
console
section.
The
simplicity
of
function
is
what
attracts
the
power
developers
and
non-developers
such
as
data
scientists,
so
they
can
easily
author
their
models
and
web
servers
even
to
listen
on
the
port
for
the
services
and
apart
from
shielding
the
developers
from
platform
specifics,
it
also
provides
a
certain
level
of
consistency
and
safety.
G
Security
functions
offer
well-loved,
runtime
languages
such
as
quarkus
node
python
go
spring
boot
with
typescript
and
rust
on
the
horizon
and
with
the
vast
event,
sources,
courtesy
of
kmlk
and
the
addition
of
kafka
event
source
as
ga
double
ls
is
paving
the
way
for
production
grade
event,
driven
solutions
to
solve
your
today's
modern
day.
Challenges
with
that
over
to
you
mark.
H
I
H
I
Thanks
light
hi,
my
name
is
god
saying
there
are
few
features
that
we
have
graduated
from.
There
are
a
few
features
that
we
have
graduated
from
tech
preview
to
ga.
First,
one
is
vertical
part,
auto
scaler
or
also
known
as
vpa.
What
it
is
is
you
are
adding
it's
scaling
up
of
your
part
by
adding
more
resources
into
the
pod.
Let's
take
an
example,
let's
say
your
application
team
team
build
an
application,
give
it
to
you
to
run
it
in
in
the
production.
You
don't
know
how
to
size
it.
I
You
can
use
vpa
and
run
some
simulation
load
on
there
and
based
on
historic,
cpu
and
memory.
You
can
figure
out
what
resources
it
will
need
and
in
production
another
feature
is
cron.
Job
is
basically
what
you
have
in
front
tab
in
linux,
where
you
can
schedule
your
jobs
to
be
run
at
particular
time
in
a
day.
I
Let's
take
an
example:
let's
say
you
have
your
master
nodes
been
deployed
in
each
zone
and
your
worker
been
deployed,
invest
zone
and
when
you
create
your
cron
job
it
I'll,
it
is
going
to
schedule
your
job
based
on
the
zone
where
your
master
load
node
lives.
In
this
case
there
will
be
a
ease
zone,
part
description
budget,
basically
avoid
application
outpage
by
using
part
description
project
right.
For,
let's
take
an
example,
let's
say
you
have
three
copy
of
your
application.
I
Your
business
requirement
is
that
one
copy
of
the
application
should
be
running
all
the
time.
Then
you
can
define
that
in
the
part
description
budget,
and
then
let's
say
you
click
upgrade
that
will
drain
the
node.
It
will
start
evicting
part
one
and
then
part
two
when
it's
when
it
goes
to
part
three
it
it
reaches
the
eviction
that
budget
and
will
pass
the
eviction
process
so
making
sure
you
have
one
copy
of
the
application
running
all
the
time.
I
I
We
have
put,
in
definition
that
at
the
minimum,
vp
can
only
be
applicable
to
a
deployment
set,
which
has
two
part,
and
you
can
always
change
it
manually
by
going
into
configuration,
there
are
few
modes
that
vpa
runs
and
two
mode
which
is
very
popular,
is
off
mode,
which
is
your
commander
mode
where
it
will
just
recommends
you.
How
much
cpu
memory
based
on
historical
data
is
needed,
for
the
part
second
is
recreate,
is
fully
automatic.
J
Hey
everyone
I'm
over
here,
so
we
have
many
customers
tell
us
their
I.t
departments,
don't
allow
them
to
use
wildcards
in
production.
So
now
48
we
allow
users
to
configure
the
external
console,
auth
service
and
cli
download
routes
hosted
on
the
cluster.
The
configuration
is
done
on
the
cluster
ingress
resource
object
under
the
cluster
administration.
J
J
So
this
slide
is
all
about
making
things
easy
right.
So,
on
the
left
hand
side
we
have
the
ability
to
import
multiple,
multiple
doc
yaml.
So
you
can
go
ahead
to
the
import.
Yaml
screen
drag
a
bunch
of
a
bunch
of
gamma
files
over
and
go
ahead
and
import
them
in
very
easily
and
then
on
the
right
hand,
side.
We
added
the
ability
ability
to
drag
and
drop
jar
files
right
into
the
topology
view.
So
you
can
pick
your
favorite
spring
record.
J
K
Great
thanks
ali
so
to
continue
to
focus
on
the
developer.
Experience
in
the
openshift
console
we're
going
to
talk
about
the
enhancements
that
were
made
to
console
for
serverless
in
48.
We've
made
progress
in
three
main
areas.
The
first
one
is-
and
this
is
what
the
the
image
is
about
here
on
the
on
the
screen.
It's
around
the
make
serverless
tech
preview
action
which
actually
creates
a
new
serverless
deployment.
Next
to
your
existing
deployments,
other
configurations,
including
the
traffic
pattern
setter,
can
still
be
modified
in
the
in
the
form.
K
So
this
is
really
exciting
on
how
to
convert
an
existing
workload
to
serverless
and
will
continue
to
enhance
those
features
as
we
produce
additional
releases.
The
second
one
is
around
topology.
We
now
support
visualizing
cloud
functions
and
additionally,
as
nathan
mentioned,
we
do
support
addition,
all
the
associated
commands,
as
well
as
the
ease
of
use
of
drag
and
drop
capabilities
when
interacting
with
those
cloud
functions.
K
The
service
is
scaled
to
zero.
If
no
requests
are
received
in
that
time
period.
On
the
next
slide,
we
talk
about
what
we've
been
doing
for
to
continue
to
improve
onboarding.
So
we
now
have
a
getting
started:
resources
card
for
both
cluster
admins
and
and
developers.
So,
on
the
left
hand,
side
you'll
see
the
top
image
is
what
we're
doing
for
cluster
admins.
K
What's
new
blog
and
then
additionally,
we
also
have
some
great,
a
great
enhancement
to
quick
start.
So,
as
you
you
all
kind
of
know,
in
four
seven
we've
provided
a
mechanism
for
custom,
quick
starts
and
in
48
we've
addition
added
this
additional
feature.
So
quick
starts.
Authors
can
now
use
special
syntax
in
their
console.
Quick
start.
They
can
use
the
copy
name
to
provide
a
way
for
users
to
copy
a
string
into
their
copy
buffer.
K
But
even
more
kind
of
exciting
is
the
ability
that
you
can
use
execute
commands
so
that,
if
you
have
the
web
terminal
operator
installed,
there's
a
way
for
the
users
just
to
see
the
command
in
the
quick
start,
click
an
icon
and
it
actually
executes
in
the
web
terminal.
For
you
on
the
next
slide,
we're
going
to
talk
about
two
additional
ways
to
customize
the
developer
experience.
K
Both
of
these
features
have
been
really
requested
heavily
by
customers,
so
the
first
one
is
around
the
ability
to
customize
which
roles
are
being
shown
in
the
project
access
area
in
in
the
developer
console
so
again,
the
screen
on
the
left
hand,
side
is
showing
that
this
is
a
way
for
developers
to
quickly
provide
access
to
their
project,
and
so
this
new
feature
allows
admins
to
not
only
to
enhance
the
number
of
roles
that
are
available
in
that
drop
down.
There's
some
syntax.
K
That's
shown
there
on
how
to
achieve
that,
and
in
addition
to
that,
we
also
have
the
project
that
access
customization
is
in
the
console
spec
and
that
code
snippet
is
available
in
the
yaml
editor
for
this
customization
and
then
on.
The
right-hand
side,
you
can
see
that
we
now
provide
access
for
cluster
admins
to
hide
features
from
the
ad
page.
K
Another
thing
that
people
have
asked
for
in
the
past,
so
this
feature
allows
just
allows
the
admin,
the
ability
to
hide
whatever
things
that
they
don't
want:
the
developers
to
access
and
to
achieve
this
again.
Similarly,
it's
a
customization
in
the
console,
stack
for
add
page
and
there's
a
code
snippet,
that's
available
in
the
email
editor
for
this
as
well,
and
this
snippet
here
shown
on
the
screen
is
just
shown.
How
do
you
hide
the
import
from
dev
file
entry,
for
example,
okay
and
then?
K
Finally,
we've
recently
on
the
next
slide,
we've
recently
announced
the
certification
program
for
helm
charts
and
have
been
working
with
a
few
partners
to
get
them
in
the
catalog.
So
our
catalog
now
display
the
developer.
Catalog
now
displays
a
a
badge
there.
If,
for
the
charts
that
are
certified,
the
certified
charts
are
also
going
to
be
visible
in
a
red,
hot
marketplace
and
additional
charts
will
be
made
available
to
the
catalog.
L
Flexibility,
thank
you
so,
as
you
might
know
already,
for
openg4,
there
are
two
primary
installation
experience
and
the
first
one
is
a
full
full
stack,
automation
or
ipi,
where
the
installer
controls
all
the
areas
of
the
installation,
including
infrastructure,
provisioning
with
an
opinionated
best
practices,
deployment
for
openshift
and
the
second
one
is
pre-16
infrastructure
deployments
or
upi,
where
administrators
are
responsible
for
creating
and
managing
the
their
own
infrastructure,
allowing
them
greater
customization
and
operational
flexibility
for
this
release
for
48
the
support
provider
list
stays
the
same
as
four
seven
next
slide.
Please.
L
L
L
Please,
user
upper
existing
route,
53
host
bright
its
own,
say
with
your
bbc's,
so
support
has
been
out
to
specify
an
existing
route.
53
private
hosted
has
that
sun.
Sorry
in
in
cases
where
offensive
is
deployed
in
a
shared
vpc
in
situations
where
the
bpc
is
owned
by
a
different
account
that
the
account
is
used
to
deploy
openshift,
you
can
associate
up
the
the
private
hosted,
hosted
son
to
the
the
shared
vpc
and
specif
specify
the
son
id
in
the
install
config
file.
L
L
Use
upper
existing
instance
hybrid
also
on
aws,
so
we
have
enhanced
the
openshift
installer
to
allow
pre-existence
iems
instant
roll
to
be
passed
and
to
be
passed
instead
of
the
installer.
Creating
those
vi.
Api
deployment
deployment
method,
while
while
the
the
documented
list
of
permissions
remain
exactly
the
same
as
previously.
This
allows
the
admins
to
pro
to
provide
additional
permissions
boundaries
or
use
specific
name
conventions
for
the
bootstrap
control,
plane
and
worker
instance
roles.
L
M
Our
customers
want
to
use
temporary
short
credentials
during
and
post
installation.
We
have
started
this
work
with
the
aws
provider,
because
sts
enables
the
authentication
flow
that
allows
a
client
to
assume
a
role
resulting
in
a
short-lived
credential
aws
extended
their
sdk
to
offer
the
web
identity
token
off,
and
it
allows
the
automation
of
the
process
of
requesting
and
refreshing
credentials
using
an
open,
ied
connect
or
identity
access
management,
identity,
provider
and
openshift
can
sign
a
service
account
tokens
trusted
by
aws.
I
am.
M
These
tokens
can
be
then
projected
into
a
pod,
and
then
the
pod
can
use
that
for
authentication.
This
feature
became
available
in
ford
at
seven,
but
we
are
announcing
the
ga
in
florida
eight,
given
everything
that
we've
added
for
it.
If
water
eight
would
support
new
deployments
as
well
as
some
green
thing
build
cases
later
in
ford
at
night,
we
plan
to
continue
to
expand
and
improve
the
upgrade
path,
as
well
as
automating.
N
One
is
the
graph
builder
which
fetches
the
release:
payload
information,
openshift
release,
payload
information
from
a
local
container
image
registry
that
which
is
what
you
have
used
to
mirror
the
content
and
builds
an
upgrade
graph
based
on
valid
edges.
The
second
one
is
the
policy
engine
that
can
be
then
be
responsible
for
selectively
serving
updates
to
the
cluster,
based
on
a
set
of
filters
that
you
define
as
admins.
N
O
O
Okay
and
another
addition
that
we
have
in
for
the
rate
is
the
ability
to
schedule
parts
based
on
their
metal
hardware,
attributes
and
specific
hardware
attributes
that
we've
been
learning,
especially
from
the
telco
industry
and
with
the
help
of
a
telco
team.
We've
been
learning
about
a
number
of
attributes
that
are
related
to
a
type
of
hardware
that
you
may
need,
for
example,
to
run
pods
with
maximum
performance
or
with
real
time
right
and
not
all
of
your
hardware.
Not
all
your
notes
will
have
these
attributes
enabled
right.
O
So
you
want
to
know
when
you
schedule
a
note
whether
you
can
place
that
part
in
an
auto
based
on
on
this
hardware
attribute.
So
the
first
thing
you
do
is
you
use
the
node
feature
discovery
operator.
This
is
nothing
new
and
we
have
been
adding
well
higher
attributes
like,
for
example,
checking
if
p
stage
is
active
or
not.
O
This
is
something
we've
learned
that
customers,
it
comes
from
telco
requirements,
but
in
reality
any
customer
may
want
to
know
if
a
specific
node
supports
a
specific
type
of
hardware,
accelerator
or
kernel
state
etc.
So
in
this
example,
you
can
see
how
you
can
tell,
apart
to
schedule,
to
be
scheduled
only
via
the
node
selector
two
nodes
that
have
the
cpub
state
active
yeah
next
slide.
O
Okay
and
to
finish
with
new
features
in
in
bare
metal,
one
of
the
things
that
we've
done
is
so
say
that
you
have
deployed
a
cluster
with
virtual
media
right
or
with
the
assisted
installer.
To
do
this,
you
don't
need
a
provisioning
network
right
when
you
install
through
virtual
media.
All
you
need
to
do
or
all
the
installer
does
is
map
an
image
to
the
bios
over
the
network,
obviously,
but
to
the
bios
of
the
nodes,
and
then
the
nodes
will
boot
that
image
as
if
it
was
locally
right.
O
If
you
install
your
nodes
with
the
assisted
installer,
similarly,
you're
gonna
have
an
iso.
You
will
boot
your
nodes
from
that
iso
and
you
don't
need
a
provisioning
network
but
say
that
after
your
cluster
is
installed.
Now
you
have
new
nodes
that
you
need
to
add
via
pixel
booting
right
you,
you
need
to
provision
them
through
pixel
booting,
and
for
this
you
do
need
a
provisioning
network.
O
So
in
this
release,
we
have
had
the
ability
to
enable
the
provisioning
network
on
day
two
after
the
cluster
has
been
installed
and
after
you
start
having
this
need
wanting
to
have
your
nodes
deployed
by
epc.
Now
you
can
do
this
directly
on
existing
nodes,
and
the
diameter
operator
allows
you
to
do
this
now
and
with
this
I
finish
with
bare
metal
and
I'll
hand
it
off
to
moran
to
talk
about
geotouch,
provisioning.
P
Hi
everyone
so
zero
touch
provisioning.
What
is
it
is
aimed
at
regional,
distributed
on-prem
deployment,
multi-cluster
deployment,
and
it's
enabling
customers
automated
paths
from
zero,
meaning
uninstalled
infrastructure
to
a
fully
functional
cluster
with
application
running
on
it.
The
high
level
flow,
as
you
can
see
on
the
right
side,
is
basically
begins
with
a
site
plan.
So
all
the
site,
infrastructure,
configuration
and
application
data
is
fed
into
a
git
repo
manifested
into
git,
using
some
of
the
capabilities
discussed
before
with
github's
integration
with
reddit
advanced
cluster
management.
P
We
can
basically
do
the
entire
site
planning
and
that's
just
waiting
for
something
to
happen,
so
that
basically
enables
an
unskilled
technician
to
go
to
a
remote
site
and
using
a
barcode
scan
or
some
triggering
of
the
githubs
changing
it
actually
start.
The
entire
flow
start,
the
entire
provisioning
of
the
cluster.
P
So
it's
the
provisioning,
it's
the
configuration
and
application
rollout.
How
do
we
do
that?
So?
Basically,
this
ztp
flow
enablement
integrates
and
leverage
existing
technology
stack
and
taking
components
like
rhcm,
reddit,
advanced
cluster
management,
hive
metal3,
assisted
store
and
leverage
and
integrate
them
together
to
provide
an
end-to-end
flow
for
zero
touch.
Provisioning,
it
has
minimal
prerequisites
and
enabling
untrained
technicians
to
do
the
physical
installation,
while
controlling
the
actual
installing
remotely
it
can
be
done
over
layer
3..
It
doesn't
need
any
additional
services,
external
services
or
bootstrap
node,
or
anything
like
like
that.
P
A
P
P
So,
just
talking
again
again
about
the
ingredients
and
the
logical
phases
we
go
through
with
this
installation.
So,
first
of
all,
the
site
planning
the
site
planning
is
done
and
all
the
data
manifested
in
it.
We
do
the
infrastructure
as
code.
So
infrastructure
is
one
is
the
first
segment
that
we
added
as
git
and
as
git
code
and
possible,
basically
to
to
deploy
and
configure
the
entire
cluster.
F
Sure,
good
morning,
good
afternoon
my
name
is
anand.
So
let's
talk
about
the
control
plane
updates
in
openshift
for
the
next
couple
of
minutes,
or
so
thank
you.
The
first
one
being
a
single
service
serving
certificate
for
headless
stateful
sets.
So
this
feature
provides
for
automatic
certificate
generation
and
rotation
for
direct
part-to-bot
communication
similar
to
the
service
serving
certificates
operator.
F
This
lets
you
generate
a
service
serving
certificate
for
headless
services
now,
and
this
includes
a
wildcard
subject
in
the
format
of
star.servicename.servicenamespace.svc,
and
this
allows
for
tls
protected
connections
to
individual
stateful
setbots
without
having
to
manually
generate
certificates
for
these
parts.
The
only
important
thing
to
note
is
because
the
generated
certificates
contain
wildcard
search
for
headless
services.
F
F
Why
is
important
because
the
oauth
server
rejected
logins
from
users
of
oidc
idps
that
are
quite
popular
like
microsoft
or
you
know,
yahoo
or
google
or
opt-up,
even
though
these
followed
the
rfc
requirements
for
the
subject
claim
and
the
award
server
found
this
problematic
and
I
rejected
the
subject
so
in
4.8
users
of
idps
that
use
the
uri
scheme
in
the
subject
lines
will
now
be
able
to
log
into
openshift
next
year.
Please.
F
So
the
next
feature
in
the
control
plane
that
we're
proud
to
talk
about
is
improved
customization
of
the
audit
config.
Just
to
give
you
some
context
and
to
set
some
background
in
4.6,
we
introduced
a
node
audit
log
policy,
feature
that
let
you
control
the
information,
the
amount
of
information
that's
logged
into
the
node
audit
logs.
F
It
had
basically
three
profiles,
default,
write,
request
and
all
request
the
default.
Let
you
log
only
metadata
for
read
and
write
requests.
The
write
requests,
let
you
logs
request
bodies
for
every
write
request.
Besides
the
metadata
and
the
all
request
bodies
lets
you
log
request
bodies
for
every
read
and
write.
Besides
all
the
metadata
with
4.8.
What
we've
introduced
is
in
the
default
profile
that
you
see
on
the
top.
You
can
now
log
request
bodies
for
oauth
access,
token
creation
for
both
creation
and
deletion,
which
is
basically
login
and
logger.
F
The
way
you
would
set
this
audit
profile
is
you
would
edit
your
api
server
resource
object
and
then
edit
the
spec.audit.profile,
and
you
would
set
the
specific
profile
you
want
default
or
write,
request
all
request,
and
then
you
know
roll
all.
The
kubernetes
cube
api
server
forms
make
sure
that
all
the
nodes
come
up
are
on
the
latest
revision
and
you're
good
to
go
nice
like
this.
F
So
the
next
feature
in
the
control
plane
that
you
probably
talked
about
is
we've
introduced.
Two
new
alerts
that
get
fired
when
an
api
that
will
be
removed
in
the
next
release
is
in
use.
Those
two
specific
alerts
are
api,
remote
and
next
release
and
use,
and
api,
remote
and
next
eu
is
released
in
use.
So,
for
instance,
if
you're
using
an
api,
that's
going
to
be
remote
in
the
next
release
of
the
next
eos
release.
F
We
will,
you
know,
send
you
an
alert
that
gets
fired,
so
you
can
be
aware
that
you're
using
apis
that
are
still
going
to
be
deprecated.
There
is
also
another
api.
I've
introduced
called
the
api
request,
count
to
track
two
things.
One
is
the
number
of
you
know:
api
requests
for
every
api
and
also,
if
you're,
using
a
deprecated
api
or
not.
So
you
could
get
this
information
two
ways
you
can
obviously
go
to
the
openshift
console.
You
know
go
to
the
api
explorer.
F
The
usage
for
those
apis
in
terms
of
the
requests
in
the
last
hour
in
the
last
24
hours,
but
also
there
is
another
column
called
removed
in
the
next
release
right.
So,
for
instance,
if
you're
using
an
api,
for
instance,
ingress
dot,
v1
beta
one
dot,
extensions
will
clearly
tell
you
that
it's
been
removed
in
the
next
in
a
cube,
1.22
release.
Q
Q
For
those
of
you
not
familiar
with
it,
you
can
essentially
assign
metadata
to
your
aws
resources.
Each
tag
is
really
just
a
simple
label
consisting
of
a
customer
defined
key
and
an
optional
value,
and
that
just
makes
it
easier
to
manage
search
for
built
on
resources
by
power
or
owner
or
environment
or
other
criteria.
Q
Next
up
is
your
disk
encryption
sets
which,
unsurprisingly,
helps
protect
and
safeguard
your
data.
This
is
about
kind
of
meeting
requirements
from
your
security
and
compliance
teams.
It
actually
uses
dmcrypt
feature
of
linux
to
provide
the
volume
encryption
and
there
is
some
integration
with
the
zero
care
vault
to
help
you
control
and
manage
your
disk
encryption
keys
on
that
side
and
then,
finally,
we're
bringing
vsphere
up
to
date
with
our
other
cloud
providers
and
giving
you
auto
scaling
from
xero
again.
Those
are
you
know
familiar
with
this.
Q
It
was
all
about.
This.
Is
all
about
saving
resources
previously
to
use
auto
scaling
on
v3?
You
had
to
have
at
least
one
node
hanging
around,
even
if
it
wasn't
being
particularly
used.
So
we've
done
away
with
that
requirement
now
and
with
that
I'll
say
next
slide
and
move
us
on
to
some
network
joy
with
mark.
I
think.
H
All
the
bug
fixes
health
checks,
some
improved
observability.
All
things
are
very
important
to
us
and
our
customers.
Another
thing
along
with
the
h.a
proxy
upgrade
we
added
several
new
supported
customizations
for
it.
So,
for
example,
this
router
used
proxy
protocol
this.
This
basically
allows
the
source
ip
address
to
pass
through
a
load
balancer.
If
that
load
balancer
supports
the
protocol
like
like
amazon
elb,
does
there's
also
the
router
back
end
process
endpoints.
H
So
this
is
critical
for
shuffling
endpoints,
for
proper
distribution
of
requests
when
you're
running
multiple
routers
that
have
a
load
balancer
in
front
of
them
like,
for
example,
an
f5,
the
tuna
bulls
there,
the
two
and
max.
We
have
two
and
left
sides,
so
some
customers
have
the
use
case
of
very
large
header
data
on
the
order
of
48k
or
more
so,
but
if
aj
proxies
buffer
for
that
header
data
is
not
large
enough,
it
gets
dropped.
H
So
what
we
are,
what
we
did
is
we
added
support
for
the
configurability
of
those
parameters.
We
don't
limit
what
that
value
is
that
you
can
set
it
to
just
keep
in
mind
that
the
larger
the
cluster,
the
more
memory
it's
going
to
consume
as
you
increase
that
configured
value
another
thing
customizable
number
of
router
threads
nb
thread.
H
So
we
since
4.1
we've
supported
the
nv
threads
parameter,
but
what
we
did
was
we
defined
a
fixed
value
of
four
threads,
so
that
was
determined
to
be
sort
of
a
best
practices,
value
for
most
or
many,
but
not
all
workloads
that
our
customers
ran.
So
customers,
with
really
large
cluster
nodes,
asked
us
to
make
that
configurable.
So
we
have
n
4.8
another
one.
Ip
failover
keep
live
d
support.
The
keep
live
d
image
has
been
there
in
the
product
for
a
while
since
three,
but
in
open
shift.
H
What
we
did
in
4.8
is.
We
formalized
support
for
the
use
of
that
image
to
provide
aha
in
openshift
and,
as
part
of
that
support,
we
also
now
document
a
best
practices
procedure
for
implementing
on
the
gateway
api
front.
Openshift
48
will
present
a
developer's
preview
of
gabe
api,
formerly
known
by
the
names
of
ingress,
v2
and
service
api,
but
gateway
api
represents
a
unifying
technology
for
ingress
and
we're
targeting
integration
of
it
with
contour
as
the
primary
english
controller
for
traffic.
H
Alongside
our
current
agent
proxy,
this
will
represent
an
enhanced
integration
with
envoy
deployments
and
openshift
service
mesh.
The
global
access
option
for
gcp's
ingress
internal
lb.
Without
that
particular
option,
traffic
originating
between
projects
in
a
shared
vpc
network
have
to
be
in
the
same
region
as
the
load
balancer,
that's
being
used.
So
what
this
does?
This
facilitates
communication
cross
region
for
shared
vpc
deployments
and
finally,
the
last
one
egress
ip
load,
balancing
enhancement.
So
this
is
for
openshift
sdn
and
this
provides
the
ability
to
spread
traffic
across
cluster
nodes.
H
Next
slide,
please
so
in
the
category
of
general
networking
enhancement.
So
we
have
a
rather
large
effort
underway
for
upshift
observability
and
in
general.
This
first
enhancement
on
this
slide
represents
enablement
of
networking
flows,
tracking
and
monitoring
for
network
analytics,
so
basically
we're
adding
a
netflow
s,
ipfix
collector,
to
oven
kubernetes.
H
This
would
give
us
a
supported
way
to
monitor
traffic
in
and
out
of
the
cluster,
and
this
will
be
really
helpful
for
those
customers
that
and
for
us
as
well
to
troubleshoot
performance
issues,
to
do
capacity,
planning,
security
audits
and
so
on.
Also
in
48,
we
added
some
key
sriv
capable
nic
hardware,
support
for
our
customers,
and
so
those
key
key
sets
of
hardware
are
listed
there
in
bullets.
H
One
thing
to
note
in
the
next
version
4.9
I
know
this-
this
is
about
four
eight,
but
at
four
nine
we're
moving
to
a
model
of
whatever
rail
supports.
We
support,
so
this
is
going
to
hopefully
remove
any
necessary
future
work
and
on
this
so
we've
also
enhanced
the
openshift
sdn
to
oven,
kubernetes
dni
migration
that
we
support.
So
if
you
want
to
go
from
openshift,
testy
and
obn,
we
support
it
for
all
of
our
currently
supported
platforms.
H
We
already
support
ipi
deployments,
but
now
what
we
added
48
is
all
upi
deployments
as
well.
We've
enhanced
and
strengthened
the
rollback
capability
and
just
for
planning
purposes,
keep
in
mind
that
when,
if
you
do
switch
from
one
ci
plug
into
another,
that
a
reboot
is
gonna
be
required
of
all
the
nodes,
but
hopefully
that's
that's
not
too
shocking,
and
then
audit
logging.
So
for
security
and
compliance
reasons,
our
customers
asked
us
to
provide
a
mechanism
to
optionally
audit
logging
of
network
policy.
H
H
R
Hi
there,
my
name
is
robert
love,
I'm
here
to
talk
to
you
about
a
feature
that
we're
adding
in
4.8
that
allows
nick
sharing
and
guaranteed
bandwidth
for
each
of
the
entities
using
that
that
nick
port,
so
some
servers
have
a
limited
number
of
nics
or
they're
lim.
They
limit
the
number
of
nics
on
purpose,
to
minimize
the
number
of
cables
that
they
have
to
pay
for
and
manage.
R
So
you
know
if
you
have
a
single
nic
port
and
you
want
to
share
that
between
the
control
plane
and
the
workloads
we've
added
that
functionality
in
4.8,
so
via
configuration
on
the
oven,
kubernetes,
sdn
and
configuration
of
nik
rate
limiting.
We
will
allow
that
sharing
of
a
single
port
between
the
control
plane
and
the
workloads.
R
R
R
You
may
need
to
specify
the
newman
topology,
the
cpu
layout,
isolated
cpus
that
will
be
pinned
to
workloads
huge
pages
and
in
other
node
level,
configurations
that
performance
add-on
operator
requires
you
to
specify
a
performance
profile
and
what
we're
providing
in
4.8
is
a
performance
profile
creator.
So
this
is
a
tool
that
introspects
the
hardware
and
then
generates
the
performance
profile
for
the
operator
as
a
convenience
in
creating
this
performance
profile
that
can
sometimes
be
quite
complex.
S
S
The
other
thing
is
sometimes
it
can
be
a
little
tricky
to
get
csi
compliance
storage
providers
working
easily
with
vms
and
kubernetes.
So
what
we've
done
is
created
this
idea
of
a
storage
profile
that
automatically
picks
the
proper
access
mode
and
storage
type
for
virtual
machines
as
you
create
them.
S
You
can
hear
more
about
in
recorded
summit
sessions
where
folks,
like
lockheed
martin,
have
done
some
very
clever
things,
scaling
their
infrastructure,
using
virtual
machines
pipelines
and
get
ops
functionality,
and
then
there
was
also
a
dump,
the
expert
session
that
we
recorded
as
well.
Now,
I'm
going
to
turn
it
over
to
miguel
who's
going
to
talk
about
how
to
get
your
virtual
machines
into
openshift.
T
Thanks
a
lot
peter,
so,
as
peter
said
I
mean
we
can
run
virtual
machines
in
openshift,
but
how
do
we
bring
those
virtual
machines
that
we
have
currently
running
into
openshift?
Well,
you
have
the
migration
with
the
migration
toolkit
for
visualization,
now,
fully
ga
fully
generally
available
and-
and
you
can
use
it
just
to
bring
those
vms
into
openshift.
T
T
We
have
another
feature
that
is
board
migration,
because
we
know
that
normally
you
require
an
intervention
window
to
do
those
migrations
and
what
migration,
what
it
does
it
copies
the
data
from
the
vm
while
it's
running
and
then
you
shut
down
and
you
copy
only
the
changes
to
it.
There's
a
validation
services,
tech
review
that
will
review
the
vms
and
the
configurations
that
they
have
like,
let's
say,
raw
device,
mappings
shared
disks,
cpu
pinnings
and
this
kind
of
configuration
that
would
require
some
manual
intervention
or
that
could
render
the
migration
not
possible.
T
N
N
I
have
less
number
of
gpus
than
data
scientists
and
they
want
to
use
it
for
some
development
and
experimental
purposes,
maybe
not
necessarily
full
model
training,
but
but
just
to
do
some
development
work
and
they
need
access
to
a
gpu
so
that
they
can.
You
know,
experiment
with
cuda
or
some
of
the
other
things
that
are
possible
on
gpus,
so
nvidia
introduced
this
idea
of
multi-instance,
gpus
or
meg
in
earlier
this
year.
N
Maybe
last
year,
anyways
and
the
gpu
operator
from
nvidia
that
is
certified
with
open
shift,
did
not
have
support
for
this
so
far,
but
with
1.7
that
changes
that,
as
you
can
see,
with
the
1.7
works
on
4.6,
4.7
and
4.,
eight
versions
of
ocp,
and
that
allows
for
this
mig
mode,
allowing
you
for
a
sharing
of
gpus.
This
is
the
native
sharing
versus
the
other
ways
in
which
you
can
do
it,
which
is
the
vgpu
which
we
talked
about
at
the
last
what's
new,
but
this
is
an
additional
way.
E
So
for
customers,
in
which
case
this
cluster
is
in
a
disconnected
environment.
You
usually
have
to
overcome
a
catch-22
situation,
because
in
order
to
get
to
that
cluster,
you
need
to
install
it
first,
and
for
that
you
need
a
registry
so
to
help
customers
who,
at
that
point,
don't
already
have
a
registry.
We
are
going
to
deliver
a
streamlined,
simplified
quay,
all-in-one
installer,
that
ships
actually
as
part
of
openshift
and
will
deploy
a
lightweight
streamlined.
E
The
mirroring
itself
will
still
be
carried
out
via
oc,
and
if
that
host,
that
will
run
this
all
in
one
way,
instance
is
actually
behind
firewall
or
behind
an
air
gap.
There
will
also
be
an
offline
variant
of
that
installer
available
and
since
the
scope
of
the
support
for
this
question
is
reduced
to
just
openshift
payload
mirroring,
and
it
will
actually
be
available
to
all
openshift
customers
with
a
valid
subscription
at
no
additional
cost.
It's
going
to
run
on
rail
8
using
part
man,
and
it
will
be
released
shortly
after
4.
E
E
Another
feature
that
we
are
adding
with
quay
3.6,
which
is
gonna
trail.
The
openshift
forwarded
agility
slightly,
is
called
nested
repository
support,
and
this
is
for
all
those
customers
who
are
using
quay
as
an
ingress
for
multiple
upstream
registries
and
want
to
organize
content
in
a
single
organization
in
kuwait.
E
Further,
so
organizations
in
kuwait
are
our
highest
level
bucket
and
all
the
images
live
inside,
at
least
one
organization,
and
it's
usually
like
a
flat
name
space
right.
So
when
you
have
a
lot
of
images
that
you
mirror
down,
for
instance,
as
part
of
mirroring
the
openshift
operator
catalogs,
this
gets
quite
convoluted
right
and
there's
a
potential
for
naming
collisions
as
well.
The
nested
repository
support
will
support
users
using
forward
slashes
and
repository
names,
therefore
creating
the
concept
of
stub
folders
quote-unquote
to
structure
the
content
in
an
organization.
E
You
see
some
examples
of
how
this
will
look
like
on
the
left
hand,
side
of
this
slide,
and
while
some
of
these
may
actually
be
in
the
same
folder
or
have
the
same
repos
image
name
and
tag,
they
will
actually
all
be
different
images
and
they
will
not
collide
with
each
other.
So
this
eases
mirroring
of
openshift
catalogs
with
operators.
This
also
eases
mirroring
with
scopio
with
multiple
upstream
registries,
and
it
will
all
be
able
to
live
inside
one
organization
which
is
making
permission
management
much
easier.
E
What
you
don't
get
as
part
of
this
is
hierarchical
permission
management
in
those
folders.
So
think
of
it
as
very
similar
to
object,
storage
buckets
where
inside
a
bucket,
you
can
also
have
a
folder.
But
you
know
all
the
access
management,
the
permissions
and
the
acls
are
still
managed
either
at
the
bucket
level
or
at
the
object
level,
and
with
that
I
hand
over
to
our
course
mark.
U
It's
like
I'd
like
to
bear
attention
to
butane,
formerly
known
as
fcct
the
fedora
core
os
and
the
transpiler
and
available
upstream.
We
found
that
fcct
didn't
quite
roll
off
the
tongue,
nor
was
it
quite
the
right
names.
The
tool
is
not
actually
fedora,
coreos
specific,
and
so
now
it's
called
butane
and
we
are
shipping
it
with
openshift
butane.
Is
there
to
help
you
create
ignition,
configs
and
now
machine
configs
more
easily.
U
Q
Q
Unfortunately,
this
is
a
per
driver
effort,
so
we're
just
going
to
have
to
keep
going
through
and
and
getting
rain
to
getting
them
all
moved
across
on
the
operator
side,
we're
geeing,
gce
discs
and
bringing
tech
previews
for
azure
and
vco,
and
what
you'll
see
us
trying
to
do
here
is
we'll
take
preview
and
in
a
release
and
then
ga
and
that
and
the
release
afterwards.
So
you'll
see
this
kind
of
rolling
roll
out.
Q
I
guess
you
can
see
the
table
on
the
left
hand,
side
to
see
how
we're
progressing
at
the
moment,
and
please
don't
worry,
all
the
support's
still
there
for
the
entry
drivers.
This
is
just
us
getting
ready
for
the
switch
over
and
finally,
on
our
side,
there's
a
completion
of
the
addition
of
aws
tags,
complementing
what
we
did
on
the
cluster
infrastructure
side
and
for
those
those
of
you
asleep
or
ignoring
me
earlier.
Q
These
are
the
tags
to
help
you
manage,
identify,
organize,
search
for
and
and
filter
resources,
one
little
kind
of
tip.
There
don't
put
personally
identified
information
in
tags.
That's
just
not
what
they're
designed
for
next
slide.
Please
and
then
we've
got
the
openshift
data
foundation,
so
hopefully
you've
all
caught
the
name:
change
from
openshift
container
storage,
I'm
still
trying
to
get
my
brain
used
to
talking
about
it.
They've
also
been
extremely
busy
with
the
release.
Q
You
can
see
all
the
features
there
on
the
slide,
but
let's
touch
on
a
few
metro,
dr
stretch,
which
is
a
stretch
cluster
with
an
arbitrary
arbitrator
for
two
data.
Centers
is
in
there
multis
for
network
isolation
between
data
and
control
traffic,
and
you
can
see
pv
granularity
encryption
with
kms
integration.
Q
This
is
in
addition
to
the
cluster-wide
encryption
that
was
already
introduced
in
one
of
the
previous
releases.
Two
interesting
dev
preview
features
there
in
this
release
as
well.
The
first
is
what
we
call
in
regional
disaster
recovery,
that's
asynchronous
replication
across
clusters
deployed
in
multiple
regions
and
the
second
one
is
something
called
data
segregation
per
host
group.
This
is
for
customers
that
need
to
isolate
and
bind
tenant,
workloads
and
data
to
a
specific
set
of
hosts
next
slide.
Please
that
moves
us
nicely
onto
multi
architecture.
Q
So,
on
the
ibm
pnz
side,
it
does
actually
feel
now,
like
we've
got
all
the
main
features
and
add-ons
in
place
that
we
really
need
to
push
open
shift
into
those
markets.
That
said,
there's
always
more
that
we
can
do
more,
that
we
can
add.
So
in
this
release.
You
know:
we've
got
a
few
things
coming,
that
we've
already
got
on
the
x86
side,
the
cluster
log
foldering,
so
you
can
take
use
of
the
log
aggregate
aggregators.
Q
If
you
want
to
there's
other
things
like
the
converge
three
node
cluster
to
allow
you
make
more
efficient
use
of
of
your
system.
This
is
particularly
important
on
the
z
side,
where
the
ifls
are
are
quite
expensive,
and
then
you
know
enabling
that
better
security
practices
by
encrypting
your
data
store.
Q
There
are
a
couple
of
things
that
only
make
sense
for
certain
platforms,
so
on
the
z
side
and
we're
filling
out
our
portfolio
of
storage
that
we
support
with
this
4k
fcp
disk
support.
I
remember
the
days
when
this
first
came
along
and
we
could
only
do
nfs
storage.
So
it's
nice
to
see
that
story
rounded
off
and
then
on
the
power
side.
We've
got
multiple
again
for
sri
ov,
I'm
sure
you
all
know
this
much
better
than
I
do
already.
Q
V
So
over
the
last
quarter,
we've
been
hard
at
work
and
we're
pleased
to
announce
that
we've
achieved
the
red
hat,
certified
technology,
vulnerability,
scanner,
designation
and
what
this
designation
does
is.
It
represents
transparency
and
accuracy
on
the
issues
that
matter
most
to
containers
with
red
hat
packages.
So
it's
going
to
help.
You
reduce
the
cost
of
your
vulnerability
management
program
by
helping
you
apply
the
appropriate
context
for
software
packages
that
are
identified
as
vulnerable.
V
So
when
this
context
is
applied
over
a
more
generalized
data
source
like
the
nvd,
this
can
change
a
risk.
Severity
of
an
issue,
help
highlight
potential
risk,
compensating
controls
and
even
establish
when
an
issue
is
relevant.
So
by
highlighting
this
relevancy,
your
teams
avoid
wasting
time
triaging
an
issue
that
doesn't
apply
to
a
red
hat
packet,
and
this
helps
you
focus
on
real
threats
for
your
clusters
and
reduce
false
positives.
V
V
V
V
So
what
you'll
see
here
is
things
like
our
everything
here
on
this
slide
is
already
delivered,
but
because
we
work
on
such
tight
release
frames,
you're
going
to
see
us
be
delivering
feature
value,
much
faster
and
you're,
going
to
see
us
being
able
to
discuss
with
the
market
things
that
aren't
ready
yet
so,
for
instance,
our
operator
is
being
in
active
development
right
now
and
coming
soon.
So
with
that
be
excited
and
on
to
you
jimmy.
W
All
right
so
just
wanted
to
give
everybody
a
quick
overview.
What's
going
on
with
red
hat
advanced
cluster
management
for
kubernetes,
so
red
hat,
advanced
custom
manager
for
kubernetes
provides
an
end-to-end
management,
visibility
and
control
to
manage
your
clusters
and
app
life
cycles,
plus
security
and
compliance
of
your
entire
kubernetes
domain
across
multiple
data,
centers
and
public
clouds.
W
We
are
announcing
that
we
have
a
wonderful
ui
refresh
to
keep
it
more
in
line
with
the
openshift
look
and
feel
we
also
have
the
ability
to
import
and
manage
openshift
on
amazon
or
rosa.
A
lot
of
our
customers
are
now
migrating
a
lot
of
their
workloads
into
that.
So,
of
course,
it
makes
sense
to
have
a
management
tool
to
be
able
to
help
them
go
through
that
process.
W
W
We
also
can
provision
ocp
within
red
hat
openstack.
So
this
was
an
ask
from
you
know.
Since
the
product
was
1.0
days,
a
lot
of
our
customers
are
running
openstack
and
they
want
to
be
able
to
run
ocp
or
openshift
right,
on
top
of
it
right
having
the
ability
to
be
able
to
provision
that
directly
from
acm.
It's
a
huge
advantage,
as
you
can
keep
everything
all
the
management
of
your
clusters
consistent
across
the
different
platforms.
X
B
X
Jimmy's
audio
comes
back
so
jimmy
I'm
gonna,
I'm
gonna
jump
in
on
the
cluster
pools
and
talk
about
the
value
that
we're
delivering
space
allows
you
to
quickly
deploy
clusters,
have
those
clusters
being
a
hybrid,
a
state,
so
they're
not
consuming
resources
on
the
cloud
or
generating
cost.
These
are
great
for
development
environments.
These
are
also
great
for
ci
cd
in
situations
where
you
need
to
quickly
spin
up
a
cluster
and
then
bring
it
back
down
in
the
pool
also
bring
the
worker
pool
scaling.
X
So
a
lot
of
you
have
been
asking
to
build
a
scaled
up
and
down
clusters
centrally,
and
we
can
now
do
that
directly
from
the
acm
user
in
phase
I'm
going
to
move
through
a
couple
of
these
quickly,
but
the
cluster
sets
allows
us
the
ability
to
do
grouping
of
clusters
or
simplified
our
back
experience,
and
that's
also
how
we
leverage
ui
support
to
configure
submariner.
It's
been
a
big
ask
that
teams
want
to
quickly
make
use
of
submariner
as
a
cross
networking
component,
but
they
don't
really
know
how
to
do
it.
X
They
don't
really
want
to
go
through
a
bunch
of
steps,
so
we're
accelerating
the
amount
of
time
it
takes
to
make
use
of
submariner
for
cross-cluster
networking
services.
The
discovery
and
import
is
awesome.
It
brings
the
reach
of
cloud.red
hat
into
acm,
so
bringing
some
of
these
services
directly
from
the
cloud
and
providing
a
way
to
discover
your
existing
clusters
and
quickly
import
those
into
acm.
X
This
is
awesome.
It
really
improves
the
time
to
value
and
getting
your
existing
fleet
under
management
with
acm
and
then.
Lastly,
so
many
folks
have
been
asking
for
the
ability
to
update
cluster
versions,
and
we
can
do
that
in
batch.
We
can
take
a
selection
of
clusters
and
move
their
version
channel
to
stable
or
candidate
releases
of
the
next
major
version
and
allow
you
to
roll
groups
of
clusters
to
those
new
versions
in
a
bulk
way,
so
really
reducing
the
time
it
takes
to
manage
your
income
jimmy.
W
Yes,
thank
you
so
much
scott
appreciate
you
taking
over
there
all
right
so
going
on
to
the
next.
You
know
about
expanding
and
portfolio
and
embracing
open
source.
We
are
happy
to
announce
that
red
hat,
advanced
customer
manager
for
kubernetes
is
now
fully
open
source
and
you
can
see
the
url
there
for
if
you
wanted
to
go
ahead
and
check
out
everything
now
from
the
cluster
lifecycle
to
application
to
security
and
governance,
everything
within
the
product
is
now
fully
open
source.
W
So
we're
very
happy
to
announce
that
we're
also
happy
to
announce
that
the
red
hat
ansible
integration
is
now
fully
ga.
So
for
those
of
you
that
a
little
bit
of
history
lesson
for
acm
2.0,
we
introduce
the
ability
to
be
able
to
have
an
integration
with
ansible,
and
this
brought
a
lot
of
value
to
our
customers.
W
We
were
able
to
integrate
from
the
application
lifecycle
perspective
being
able
to
do
pre
and
post
tasks,
and
this
again
brought
a
big
value
to
our
customers,
we're
having
the
ability
to
quickly
integrate
with
third-party
tools
within
their
data
center,
so
the
buck.
Obviously,
when
you're
building
kubernetes
clusters
doesn't
stop
at
just
being
able
to
you
know
provision
clusters
right,
there
is
a
school
of
things
that
happen
behind
the
scenes
before
you
get
there,
but
now
we're
happy
to
announce
that
we
also
have
expanded
that
integration.
W
Besides
making
a
ga
where
now
have
the
ability
to
have
a
cluster
lifecycle,
integration,
so
you're
able
to
integrate
ansible,
playbooks,
pre
and
post,
you
know
cluster
deployment.
We
also
have
integration
with
the
governance,
risk
and
security
perspective,
so
we're
able
to
trigger
remediations
based
on
a
specific
policy
violation.
So
if
you
wanted
to
take
an
action
within
your
policy,
perhaps
you
know
open
up
a
a
ticket
or
a
degree
with
a
ticketing
system
or
perhaps
perform
a
remedial
remediation.
That
requires
an
interaction
with
a
third-party
system.
W
W
So
now
you
within
the
application
lifecycle,
if
you
call
you,
you
have
argo
cv
and
you're,
using
leveraging
argo
cd,
you're
able
to
fully
integrate
within
the
acm
ui,
all
of
your
applications
and
you're
able
to
interact
with
the
applications
in
a
seamless
way
so
you're
able
to
deploy
the
applications
interact
with
the
applications.
Troubleshoot
issues
with
the
application,
then
this
is
a
huge
value.
W
Add
for
customers
that
are
running
argo
cd
as
their
application
deployment
engine
today,
and
that's
really
who
you
know
we're
basically
targeting
you
know
those
customers
that
kind
of
have
multiple
argo
cvs
deployments
and
they
just
want
to
bring
in
and
centralize
it
into
one
a
single
place.
So
acm
really
enables
you
to
do
that
and
of
course
we
are
constantly
adding
new
policies,
new
governance,
compliance
policies.
So
I
highly
encourage
you
to
go
and
look
at
the
github
repo,
we're
constantly
updating
those
as
well.
Next
slide.
W
W
All
right
from
a
multi-cluster
observability
perspective,
we
continuously
keep
enhancing
the
ability
to
have
visibility
into
your
clusters.
We
understand
that
you
know.
Part
of
management
of
clusters
is
just
not
only
provisioning
them
right.
We
got
to
continue
with
the
day
two
operations
and
so
part
of
the
day
two
operation
enhancements
here
is
the
integration
with
insights.
W
So
obviously
you
know,
as
your
deployments
grow,
you
will
have
more
and
more
metrics
right
that
you
kind
of
want
to
be
able
to
kind
of
keep
track
of,
to
make
sure
that
you're
able
to
kind
of
establish
patterns
and
see
you
know
as
as
you
go
through,
and
the
analysis
right
of
your
clusters
right,
you
want
to
make
sure
that
you
can
establish
patterns.
So
now
we
have
the
ability
to
configure
those
as
well.
W
We
also
have
the
ability
to
configure
alert
forwarding
from
from
all
of
your
managed
clusters
directly
into
the
acm
hub
and
there's
a
lot.
This
makes
it
easier
for
being
able
to
create
a
learning,
so
you
can
create
a
learning
and
integrated
learning
to
things
like
slag,
for
example.
Then
you
can
kind
of
see
here.
Screenshot
of
you
know,
of
an
alert
that,
on
a
slack
alert
that
provides
you
a
direct
link
into
our
final
dashboard
to
be
able
to
kind
of
go
deeper
and
and
analyze
more
about.
W
What's
going
on
there
we
also
have
available.
We
can
customize
specific
metrics
right.
You
have
able
to
kind
of
have
those
recording
rules
to
support
those.
As
well
so
with
this
release,
really,
as
I
mentioned,
we
100,
focusing
on
end
user
experience
the
ability
to
bring
more
visibility
into
your
clusters,
the
ability
to
make
it
easier
to
provision
clusters
a
larger
scale
and
deploy
applications
much
much
easier
and
integrate
with
other
tools
within
the
portfolio
of
red
hat.
Y
Y
So
it's
just
slightly
different
how
you're
gonna
get
there,
and
meanwhile,
we've
been
working
on
adding
google
cloud
support,
but
only
for
infrastructure.
This
we
are
still
working
in
ocp
and
gcp.
There's
some
changes
that
we
need
to
do
to
fully
support
it,
but
it's
actually
been
developed.
But
right
now
you
can
add
your
gcp
sources
and
have
the
same
breadth
of
functionality.
You
have
in
amazon
and
in
azure
today
and
talking
about
amazon.
We
also
lift
the
requirement
to
add
a
parent
account.
Y
All
that
information.
Also,
we've
worked
to
create
the
new
cause
explorer
that
it's
a
fully
timed
serious
view
of
your
data.
You
can
group
you
can
filter
by
different
concepts.
You
can
see
that
in
time-
and
in
fact
is
the
is
the
core
of
new
developments
in
the
future,
where
we
will
be
allowing
more
than
60
days
of
data
and
also
it's
important
to
notice
that
it's
the
first
view
where
you
can
see
the
line
items
numbers.
Y
Y
More
important
things
we
now
have
a
certified
operator:
it's
we're
going
to
keep
the
cocoa
the
open
source
version
of
the
operator
for
beta
testing
and
for
advanced
development,
but
now
it's
possible
to
use
the
certified
operator
and
in
fact
it's
so
easy
that
you
can
actually
install
both
operator
in
parallel.
If
you
want
to
test
the
new
one,
while
you
are
installing
the
35,
it's
perfectly
fine
right
now.
Installation
is
still
support
on
our
gap
and
it's
less
than
a
minute.
Y
If
you
use
the
standard
installation
we're
working
a
lot
in
performance,
you
will
see
that
the
the
time
we
take
to
update
the
data
and
the
performance
of
the
tool
overall
has
improved
a
lot
and
also
one
thing
that
we
like
a
lot
is
that,
right
now,
when
you
look
in
into
openshift
cluster
manager,
you
will
have
a
widget
showing
you
the
cost
of
your
cluster.
So
this
is
the
first
integration
between
the
overall
ocm
and
cost
management.
We
plan
to
continue
adding
new
features,
so
you
can
have
more
views
of
your
cost.
Z
Thank
you
sergio.
I'm
really
excited
to
basically
present
the
last
two
slides
of
today's
session.
First,
we
are
kicking
off
with
another
round
of
improvements
for
our
native
possibility
experience.
So
you
all
know,
since
a
long
time
we've
been
craving
to
give
you
better
tools
inside
the
openshift
console
so
that
you
don't
have
to
leave
the
the
very
warm
kind
of
experience
that
you
have
in
the
console
go
to
a
third-party
system.
Z
In
4.4,
we
reached
a
milestone
by
adding
important
dashboards
into
the
console
itself,
and
we've
been
since
then
improving
that
4.8,
it's
just
another
round
to
just
make
it
easier
to
work
with
the
dashboards
that
we
have.
So
we
have
tons
of
new
features
coming
in
just
as
just
two
examples.
One
is
instead
of
just
selecting
like
seconds
minutes
hours,
you're
now
able
to
basically
select
a
very
specific
time
range
that
you
want
to
look
into
for
your
dashboards.
Z
We
have
groups
now.
So
if
you
have
a
very
big
dashboard
with
many
many
different
shots,
we
are
now
grouping
similar
shots
into
into
very
specific
groups,
so
that
you
can
easily
digest
the
data
that
you
can
actually
see,
and
then
we
have
a
few
others
like
zooming.
So
if
you
zoom
basically
into
one
dashboard,
every
dashboard
is
getting
updated
as
well,
and
then,
if
you,
you
can
also
then
now
click
kind
of
like
into
a
specific
chart.
Z
Z
Switching
gears
a
little
bit
to
looking
now
jason
has
been
probably
the
most
requested
feature
for
us
for
a
long
time.
We
had
some
issues
in
the
past
on
how
we
basically
provided
adjacent
capabilities
to
our
customers
and
we've
put
in
tons
of
work
to.
Basically,
you
know
work
around
those
limitations
that
we
have
by
something
that
we
can
fairly
say
that
you
know
we
are.
We
feel
good
with
and
the
way
how
we
basically
expose
the
json
feature
is
through
our
log
forwarding
api.
Z
So
we
wanted
to
make
sure
we
actually
support
two
different
type
of
use
cases.
One
is
you
are
a
customer
who
uses
primarily
third-party
systems
and
the
only
thing
you
want
to
do
is
you
want
to
be
able
to
deploy
a
collector,
make
sure
you
select
the
logs
that
you
are
interested
in
pass
those
logs
into
adjacent
objects
and
send
those
off
into
your
third
party
system?
Z
That
is
what
we
basically
do
now
with
the
cluster
look
forwarding
api.
That's
basically
use
case
one.
The
second
use
case
is,
you
know
you
are
a
customer
that
is
using
our
manage
elasticsearch
and
you
want
to.
You
know
put
in
specific
locks
into
our
manage
elasticsearch
and
also
json
objects,
so
that
you
can
go
to
kibana
and
then
query
individual
fields
to
really
selectively
choose
what
kind
of
locks
you
are
interested
in.
That
is
also
available
through
the
look
forwarding
api.
Z
So
everything
that
you
really
do
our
permit.
Your
primarily
interface,
basically
set
everything
up.
Is
the
cluster
look
forward
to
cr
that
we
have,
and
there
you
basically
just
put
in
what
you
need
put
in
like
what
kind
of
locks
you
need
to
pass?
And
then
you
tell
us
what
schemas
those
logs
primarily
relate
to,
so
you
might
have
like
a
weblogic
application,
jbustle
application
or
whatsoever
that
all
use
the
same
schema
right.
Z
This
is
very
important
for
some
of
the
more
advanced
lock
management
system
to
know
what
kind
of
schema
so
that
they
can
kind
of
like
group
those
locks
into
into
a
single
entity
to
save
operational
costs
to
save
kind
of,
like
you
know
how
things
are
going
and
to
give
you
kind
of
like
a
more
reliable
approach,
and
last
but
not
least,
last
one
that
we
have
here
is.
I
talked
a
little
bit
a
little
bit
about
the
selectiveness,
the
flexibility
info
in
5.1,
so
the
upcoming
logging
solution.
Z
What
we
also
do
expose
now
is
the
ability
for
you
to
select
specific
locks
based
on
port
labels.
So
before
you
have
the
ability
to
push
blocks
from
specific
namespaces
or
projects
into
your
third
party
application,
now
you're,
basically
able
to
choose
from
specific
pod
labels.
So
you
can,
you
might
have
like
specific
apps
that
need
to
go
into
a
specific
into
a
specific
topic
into
kafka.
As
an
example,
you
might
have
team
labels
on
specific
pots.
Z
You
are
not
using
namespace
as
a
team
you're,
basically
using
labels
to
identify
what
kind
of
application
belong
to
what
kind
of
team.
So
they
can
do
that
as
well.
Now,
so
we're
pretty
excited
for
the
next
one
of
logging
features
and
that's
it
for
today
hope
you
all
enjoyed
the
session
and
I
think
what
you
probably
wanted
to
say
something
in
the
end
right,
yeah.
B
I'm
just
going
to
say
thanks
for
joining,
we've
got
a
bunch
of
great
stuff
coming
out
in
openshift
4-8.
So
look
for
that
on
your
clusters
and
your
upgrades
here
in
a
few
weeks
and
a
reminder,
so
this
is
all
about
4-8.
We
also
have
another
session
coming
up
in
about
a
month
on
kind
of
looking
ahead
for
what's
next
in
openshift,
so
we
would
love
you
to
join
us
for
that
too.
Thank
y'all,
so.