OpenShift Container Platform 4.1 introduces the following notable technical changes.
Builds powered by buildah
Source and Docker strategy builds are now performed by buildah instead of the
docker daemon.
SecurityContextConstraints
SecurityContextConstraints
now only exist in the security.openshift.io
group.
Service CA bundle changes
Pods can trust cluster-created certificates, which are only signed for internal
DNS names, by using a CA bundle that is automatically injected into any
configmap annotated with service.beta.openshift.io/inject-cabundle=true
. The
CA bundle will be made available as PEM-encoded data under the key
service-ca.crt
. This annotation results in wiping out existing content in the
configmap.
Pods that currently consume the service-serving CA bundle from
/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt
should migrate to
obtaining the CA bundle from a configmap annotated with
service.beta.openshift.io/inject-cabundle=true
.
The /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt
file is now
deprecated and will be removed in a future release.
OpenShift Service Broker and Service Catalog deprecation
The Service Catalog and the OpenShift service brokers are being replaced over
the course of several future OpenShift 4 releases. Red Hat will be deprecating
the Template Service Broker and OpenShift Ansible Broker once important
dependent content is ported to new Operator-driven solutions. Users are
encouraged to look at the Operator Framework and Operator Lifecycle Manager
(OLM) to continue providing their applications to OpenShift 4 clusters. These
new technologies provide many benefits around complete management of the
lifecycle of your application.
Service Catalog no longer installed by default
The Service Catalog is not installed by default in OpenShift Container Platform 4.1. You must
install it if you plan on using any of the services from the OpenShift Ansible
broker or template service broker. In OpenShift Container Platform 4.1, the Service Catalog
API server is installed into the openshift-service-catalog-apiserver
namespace
and the Service Catalog controller manager is installed into the
openshift-service-catalog-controller-manager
namespace. In OpenShift Container Platform
3.11, both of these components were installed into the kube-service-catalog
namespace.
Template Service Broker no longer installed by default
The Template Service Broker is not installed by default in OpenShift Container Platform 4.1.
Cluster administrators can install the Template Service Broker if users will
need access to template applications from the web console.
OpenShift Ansible Service Broker no longer installed by default
The OpenShift Ansible Service Broker is not installed by default in
OpenShift Container Platform 4.1.
Several oc adm
commands are now deprecated
Deprecated oc adm
commands include:
-
oc adm create-master-certs
- Create keys and certificates
-
oc adm create-key-pair
- Create an RSA key pair.
-
oc adm create-server-cert
- Create a key and server certificate.
-
oc adm create-signer-cert
- Create a self-signed CA.
The configurability of the imagepolicyadmission plug-in is not present
The configurability of the imagepolicyadmission
plug-in is not present in
OpenShift Container Platform 4.1. The plug-in runs, but currently only with default
configuration. Configuring it requires using the unsupported overrides
mechanism.