Windows Container Support for Red Hat OpenShift release notes

Previously, Windows containers on Windows nodes were assigned the wrong DNS Server IP if a non-default cluster DNS was specified during the cluster installation. Therefore, the DNS resolution did not work. This bug fix removes the hard-coded cluster DNS information and parametrizes the value as a command-line argument. (BZ#2030943)

Previously, the windows-exporter metrics endpoint object contained a reference to a deleted machine. This incorrect reference caused the WMCO to ignore deleted events for machines with invalid IP addresses. This bug fix removes the validation of the machine object from the event filtering, allowing the windows-exporter metrics endpoint object to correctly update when the machine is still in the Deleting phase. (BZ#2008994)

Previously, deleting the node associated with a Windows Machine object threw a reconciliation error upon restart of the Operator. This bug fix opts not to react or reconcile when the node referenced by a Windows machine in the Running state is not found within the cluster, preventing any error loop and standardizing functionality with Linux machine objects. (BZ#2009475)

Previously, the WMCO did not properly associate BYOH Windows VMs with their Node object when the VM was specified with a DNS object. This caused the WMCO to attempt to configure VMs that were already fully configured. The WMCO now correctly resolves VMs specified by a DNS address when looking for an associated node. (BZ#2020650)

Previously, encrypted usernames were being generated with extra tags, which caused them not to display correctly. This bug fix removes the extra tags, allowing the encrypted username to display correctly. (BZ#2023417)

Previously, certain commands being run by the WMCO in Windows VMs were not parsed correctly by PowerShell. This caused Windows VMs with PowerShell as its default SSH shell to be unable to join to a cluster as a node. The WMCO can now identify the default SSH shell of a Windows VM and run the associated commands accordingly. This new capability allows Windows VMs with PowerShell as the default SSH shell to be configured as nodes in a cluster. (BZ#2025730)

For clusters installed on VMware vSphere, the WMCO ignored the Deleting phase notification event, leaving incorrect node information in the windows-exporter metrics endpoint. This resulted in an invalid mapping for the Prometheus metrics endpoint. This bug has been fixed; the WMCO now recognizes the Deleting phase notification event and maps the Prometheus metrics endpoint appropriately. (BZ#1995341)

When installing a BYOH Windows instance using a DNS name entry in the config map, the WMCO configures the instance twice before marking it as a Ready node. This will be fixed in a future release of the WMCO. (BZ#2005360)

When the RunAsUser permission is set in the security context of a Linux-based pod, the projected files have the correct permissions set, including container user ownership. However, when the Windows equivalent RunAsUsername permission is set in a Windows pod, the kubelet is prevented from setting correct ownership on the files in the projected volume. This problem can get exacerbated when used in conjunction with a hostPath volume where best practices are not followed. For example, giving a pod access to the C:\var\lib\kubelet\pods\ folder results in that pod being able to access service account tokens from other pods.

Path   : Microsoft.PowerShell.Core\FileSystem::C:\var\run\secrets\kubernetes.io\serviceaccount\..2021_08_31_22_22_18.318230061\ca.crt
Owner  : BUILTIN\Administrators
Group  : NT AUTHORITY\SYSTEM
Access : NT AUTHORITY\SYSTEM Allow  FullControl
         BUILTIN\Administrators Allow  FullControl
         BUILTIN\Users Allow  ReadAndExecute, Synchronize
Audit  :
Sddl   : O:BAG:SYD:AI(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)

Previously, the load balancer service would become unstable when the backing deployment had multiple pods scheduled on different Windows nodes. This issue has been fixed. (BZ#1905950)

Previously, WMCO added the public key annotation windowsmachineconfig.openshift.io/pub-key-hash to Linux nodes. Now, WMCO no longer adds an annotation to Linux nodes. (BZ#1930791)

Previously, when users provided an invalid private key, the WMCO would fail. With this update, the WMCO produces an error alerting the user of an invalid key. (BZ#1929579)

Previously, the kube-proxy service would crash upon the creation of a load balancer service when the backing development had multiple pods scheduled on different Windows nodes. This issue has now been fixed. (BZ#1939968)

Previously, the windows_exporter component reported various metrics as windows_*. This error caused some of the node-level metrics that provide insight into the nodes through telemetry services to go unreported. Now, the components export correctly showing all of the expected metrics. (BZ#1948037)