Revision History: Cluster Administration

Setting Quotas

Updated the references to quota and limit ranges, as they are now listed on the Quota page.

Setting Limit Ranges

Updated the references to quota and limit ranges, as they are now listed on the Quota page.

Setting Quotas

Removed unsupported options from the Compute Resources Managed by Quota table.

Managing Security Context Constraints

Updated the Add an SCC to a User, Group, or Project section to add notes on granting SCC access and clarify project access.

Managing Security Context Constraints

Added a warning about pod creation on behalf of a user within the Grant Access to the Privileged SCC section.

Backup and Restore

Restored and updated steps for adding an etcd member.

Securing Builds by Strategy

Added that custom builds are disabled by default.

Managing Security Context Constraints

Added information about preserving labels and annotations, in addition to groups.

Managing Nodes

Fixed markup error in the examples in the Setting Maximum Pods Per Node section.

Setting Limit Ranges

Added the missing -n demoproject option to the oc describe limits example and updated the command’s output.

Backup and Restore

Updated the backup and restore procedure.

Managing Nodes

Added the Setting Maximum Pods Per Node section.

Managing Authorization Policies

Updated the ClusterRole file in the Granting Users Daemonset Permissions section.

Managing Nodes

Renamed instances of openshift_node_set_node_ip to openshift_set_node_ip, the correct openshift-ansible variable name.

Restricting Application Capabilities Using Seccomp

Updated Seccomp references of runtime/default to be docker/default.

Encrypting Hosts with IPsec

Re-added the Encrypting Hosts with IPsec topic and made it specific to the current version of libreswan.

Managing Pods

Added information and arranged the Controlling Egress Traffic section.

Added clarifying details around EgressNetworkPolicy, including that it only affects external traffic (not pod-to-pod traffic) and that you can only have a single EgressNetworkPolicy in a namespace; added additional details about rule ordering and that breaking the rules can result in all egress traffic from the namespace being dropped.

Managing Pods

Added more information about disabling MAC filtering for the Egress router.

Aggregating Container Logs

Added a requirement that port 9300 be open for Elasticsearch to the Pre-deployment Configuration section.

High Availability

Added a step for deploying the ipfailover router to monitor postgresql listening to the Configuring a Highly-available Service section

Handling Out of Resource Errors

Added clarifying details around kubeletArguments in the Example Scenario section.

Monitoring Routers

Removed references to the deprecated --credentials option.

High Availability

Removed references to the deprecated --credentials option.

Configuring the Cluster to Use Unique External IPs

Added a CAUTION box indicating that external IPs assigned to services of type LoadBalancer will always be in the range of ingressIPNetworkCIDR and updated Ingress CIDR references to the new default.

Managing Pods

Added important box about Red Hat OpenStack Platform to the Limiting Pod Access with an Egress Router section.

Managing Authorization Policies

Added clarifying details about cluster roles.

Backup and Restore

Added to the note with information on host backups over 700 MB.

Idling Applications

New topic.

Diagnostics Tool

Added Running Diagnostics in a Server Environment and Running Diagnostics in a Client Environment sections.

Managing Pods

Fixed the syntax of the Example Pod Definition for an Egress Router.

Backup and Restore

Added the Backup and Restore section.

Sysctls

New topic on Technology Preview sysctl support.

Managing Security Context Constraints

Updated the output for oc get scc.

Troubleshooting OpenShift SDN

Removed references to firewalld, as the installer does not currently support it.

iptables

New topic on how OpenShift Container Platform and iptables interact.

Securing Builds by Strategy

Added jenkinspipeline build strategy role information.

Assigning Unique External IPs for Ingress Traffic

Added a NOTE stating that this feature is only supported in non-cloud deployments.

Overcommiting

Added a Warning box about swap in the Disabling Swap Memory section.

Out of Resource Handling

New topic about memory eviction.

Backup and Restore

Added a NOTE box to the Cluster Restore section, indicating that the outlined procedure only works for single-member etcd clusters.

Configuring Service Accounts

Added a Service Accounts and secrets heading.

Restricting Application Capabilities Using Seccomp

New topic.

High Availability

Added the Multiple Highly Available Services In a Network section.

Diagnostics Tool

New topic about the oc adm diagnostics command.

Setting Quotas

Added that cpu and requests.cpu are the same value and can be used interchangeably, as with memory and requests.memory.

High Availability

Fixed deprecated commands in the Configuring a Highly-available Routing Service section.

Backup and Restore

Added Prerequisites details and created new sections for Application Data Backup, Application Data Restore, Project Restore, as well as backing up Role Bindings, Service Accounts, secrets, and Persistent Volume Claims.

Pruning Objects

Added a Note box about the required storage:delete:enabled flag when pruning images.

High Availability

Fixed deprecated commands in the Configuring a Highly-available Routing Service section.

Backup and Restore

Added Prerequisites details and created new sections for Application Data Backup, Application Data Restore, Project Restore, as well as backing up Role Bindings, Service Accounts, secrets, and Persistent Volume Claims.

Pruning Objects

Added a Note box about the required storage:delete:enabled flag when pruning images.

Cluster Administration → Managing Pods → Limiting the Bandwidth Available to Pods

Added details on limiting the bandwidth available to pods via quality-of-service traffic shaping.

Cluster Administration → Limit Pod Access with Egress Firewall

Added new topic covering how to limit the IP addresses and traffic that a pod can access.

Scoped Tokens

New topic discussing scoped tokens, which are tokens that identify given users, but are limited to certain actions by its scope.

Image Policy

New topic about controlling which images are allowed to run on your cluster using the ImagePolicy admission plug-in.

Setting Multi-Project Quotas

New topic about how to set multi-project quotas.

Monitoring Images

New topic discussing oadm top images and oadm top imagestreams commands.

Managing Nodes

Added a new Rebooting Nodes section.

Pruning Objects

Added --prune-over-size-limit information.

Setting Quotas

Added recent image quota restrictions.

Setting Limit Ranges

Added recent image quota restrictions.