2021-04-16.md

This Week in Enhancements - 2021-04-16

Enhancements for Release Priorities

Prioritized Revived (discussion after PR was merged) Enhancements

<PR ID>: (activity this week / total activity) summary

There were 2 Prioritized Revived (discussion after PR was merged) pull requests:

• 574: (1/567) installer: First iteration of running the Assisted Installer in end-user clusters. (mhrivnak)
• 703: (5/289) general: management workload partitioning (dhellmann)

Prioritized Active Enhancements

<PR ID>: (activity this week / total activity) summary

There were 2 Prioritized Active pull requests:

• 636: (2/59) kube-apiserver: API Removal Notifications (sanchezl)

  Notify customers that an API that will be removed in the next release is in use.

• 643: (1/65) update: Add Reduced Reboots enhancement (sdodson)

  This enhancement is intended to reduce host reboots when upgrading across two or more OpenShift minor versions by enabling an N-2 version skew policy between all host components and cluster scoped resources.

Other Enhancements

Other Merged Enhancements

<PR ID>: (activity this week / total activity) summary

There were 7 Other Merged pull requests:

• 663: (4/25) dns: Add configurable-dns-pod-placement enhancement (Miciah)

  The DNS operator in OpenShift 4.7 and prior versions manages a DaemonSet that serves two functions: running CoreDNS and managing node hosts' /etc/hosts files. This enhancement, in OpenShift 4.8, replaces this single DaemonSet with two: one DaemonSet for CoreDNS and one DaemonSet for managing /etc/hosts. Additionally, this enhancement adds an API to enable cluster administrators to configure the placement of the CoreDNS Pods.

• 669: (4/49) console: Add Customize Add Page proposal (jerolimov)

  Cluster admins want to customize the add page of the OpenShift Developer Console.

  This list contains a long list of actions, some of them depends on installed operators like the OpenShift Pipelines Operator, the OpenShift Serverless Operator, and others.

• 675: (3/4) operator-sdk: enhancements: Fix various links in the downstream operator-sdk proposal (timflannagan)

  The Operator SDK currently ships the Ansible and Helm Operator base images downstream. The purpose of this enhancement is to add a supported Operator SDK base image as well as an operator-sdk binary. In addition, to add more automation to syncing upstream with downstream.

• 710: (6/74) cluster-logging: New enhancment proposal: forward-to-Loki (alanconway)

  Add a new output type to the ClusterLogForwarder API to forward logs to a Loki instance. An important part of using Loki is choosing the right Loki labels to define log streams. We present a default set of Loki labels, and explain how the choice of labels affect performance and queries.

• 718: (5/44) general: Introduce HA conventions for platform components (ravisantoshgudimetla)

  This PR introduces HA conventions for platform specific operators/operands

  cc @smarterclayton

• 728: (1/3) general: management-workload-partitioning: fix typo in annotation name (dhellmann)

  This enhancement describes an approach to allow us to isolate the control plane services to run on a restricted set of CPUs. This will be especially useful for resource-constrained enviornments, such as single-node production deployments, where the user wants to reserve most of the CPU resources for their own workloads and needs to configure OpenShift to run on a fixed number of CPUs within the host.

  One example of this use case is seen in telecommunication service providers implementation of a Radio Access Network (RAN). This use case is discussed in more detail below.

Other merged

• 713: (2/3) ingress: Ingress: Post-implementation fixups for a couple of EPs (sgreene570)

Other New Enhancements

<PR ID>: (activity this week / total activity) summary

There were 3 Other New pull requests:

• 730: (7/7) network: mtu: ability to change running cluster's mtu setting (msherif1234)

• 732: (1/1) network: Add Smart NIC OVN offload enhancement (zshi-redhat)

  OpenvSwitch (OVS) Hardware Offload with Nvidia ConnectX-5 improves OVS dataplane performance by offloading processing of OVS OpenFlow flows to hardware NIC. By integrating Nvidia BlueField2 SmartNIC support in OpenShift, additional capabilities are added to accelerate and secure OVN control plane in SmartNIC ARM processors.

• 733: (11/11) builds: Support Mounted Resource Volumes (adambkaplan)

  Today builds support getting source input from configmaps and secrets, hereafter referred to as "resources". When users utilize this feature, the resource is volume-mounted into the build pod and placed in the "build context" within the build's execution environment, alongside other build sources like git source code. The next steps depend on whether it is an s2i or dockerfile build.

  For s2i builds, the generated Dockerfile contains commands to ADD the content at a path specified by the user, the assemble script is invoked, and then the injected content is zeroed out prior to committing the image via a RUN rm command added to the Dockerfile.

  For dockerfile builds, the user is instructed to add appropriate ADD and RUN rm commands to their dockerfile to inject the content that is available in the build's working directory (along with their application source, where applicable).

  There are a few undesirable aspects to this:

  1. In the dockerfile case, the content can still be found in lower layers of the image unless a layer squashing option is selected.
  2. Requires extra work by the user in the Dockerfile, so each Dockerfile must be customized

  This enhancement proposes to introduce an option to use buildah's capability to mount a volume at build time. The content mounted into the build pod would be then mounted into the container processing the Dockerfile, making that content available within the container so Dockerfile commands could reference it. No explicit ADD would be required, and since mounted content is not committed to the resulting image, no RUN rm equivalent is required to clean up the injected content.

  To avoid security and lifecycle concerns, the following volume types will be supported initially:

  1. Secrets
  2. ConfigMaps
  3. csi - this is to enable use of Projected Resource CSI driver volumes.

Other Active Enhancements

<PR ID>: (activity this week / total activity) summary

There were 14 Other Active pull requests:

• 706: (81/135) api-review: apply user defined tags to all resources (gregsheremeta)
• 712: (22/158) cluster-logging: [cluster-logging] Add proposal for loki as an alternative log store (periklis)
• 462: (19/56) ingress: Add client-tls enhancement (Miciah)
• 463: (14/587) machine-api: Describing steps to support out-of-tree providers (Danil-Grigorev)
• 724: (3/8) console: Update internationalization enhancement for how to handle login template translation strings (sg00dwin)
• 721: (3/14) network: metallb: Use CNO as the integration point (russellb)
• 201: (2/83) general: bootimages: Downloading and updating bootimages via release image (cgwalters)
• 618: (2/15) network: Add more details about host port ownership (danwinship)
• 551: (2/53) machine-api: Propose to backport the "external remediation template" feature (slintes)
• 547: (2/38) baremetal: Propose BMC-less remediation enhancement (AKA poison pill) (n1r1)
• 637: (2/269) monitoring: Add: Alerting Standards (michaelgugino)
• 719: (2/4) installer: Create change-ocp-install-config-values-after-install-completes (hhockett)
• 477: (1/43) update: enhancements/update/manifest-install-levels: Propose a new enhancement (wking)
• 554: (1/9) general: conventions: Clarify when workload disruption is allowed (smarterclayton)

Other Closed Enhancements

<PR ID>: (activity this week / total activity) summary

There were 6 Other Closed pull requests:

• 174: (5/63) builds: first draft of configmap/secret injection via volumes enhancement (bparees)
• 296: (2/183) network: Add ovs-hardware-offload enhancement (zshi-redhat)
• 415: (2/13) etcd: add backup config controller (hexfusion)
• 480: (2/88) etcd: enhancements/etcd: support assisted install (hexfusion)
• 531: (2/17) update: enhancements/update/channel-metadata: Distribute channel description strings (wking)
• 603: (4/57) network: Initial proposal of allow mtu and overlay port changes (juanluisvaladas)

Revived (closed more than 7 days ago, but with new comments) Enhancements

<PR ID>: (activity this week / total activity) summary

There was 1 Revived (closed more than 7 days ago, but with new comments) pull request:

• 679: (1/82) general: coreos-bootimage-streams: Standardized CoreOS bootimage metadata (cgwalters)

Other lifecycle/stale Enhancements

<PR ID>: (activity this week / total activity) summary

There were 5 Other lifecycle/stale pull requests:

• 255: (0/109) monitoring: add restart metrics enhancement (rphillips)
• 361: (0/110) baremetal: Minimise Baremetal footprint, live-iso bootstrap (hardys)
• 468: (0/52) machine-api: Add dedicated instances proposal (alexander-demichev)
• 486: (0/72) local-storage: Adds proposal for auto partitioning in LSO (rohan47)
• 566: (0/45) general: Separating provider-specific code in the installer (janoszen)

Idle (no comments for at least 7 days) Enhancements

<PR ID>: (activity this week / total activity) summary

There were 61 Idle (no comments for at least 7 days) pull requests:

• 124: (0/75) update: enhancements/update/automatic-updates: Propose a new enhancement (wking)
• 137: (0/299) general: CLI in-cluster management (sallyom)
• 146: (0/213) installer: openstack: Add Baremetal Compute Nodes RFE (pierreprinetti)
• 265: (0/139) general: Signal cluster deletion (abutcher)
• 292: (0/203) machine-api: Add Managing Control Plane machines proposal (enxebre)
• 302: (0/29) kube-apiserver: [thought-experiment] single-node cluster static pod creation (deads2k)
• 341: (0/80) maintenance: Machine-maintenance operator proposal (dofinn)
• 343: (0/43) authentication: cluster-wide oauth-proxy settings (deads2k)
• 346: (0/83) installer: Installer pre-flight validations (mandre)
• 357: (0/225) accelerators: Supporting out-of-tree drivers on OpenShift (zvonkok)
• 363: (0/201) cvo: Enhancement for adding upgrade preflight checks for operators (LalatenduMohanty)
• 371: (0/15) ingress: Add forwarded-header-policy enhancement (Miciah)
• 400: (0/18) general: OpenStack AZ Support (iamemilio)
• 403: (0/16) authentication: webhook authentication: kubeconfig auth specification, 0-ttl cache (stlaz)
• 406: (0/16) kube-apiserver: Add preliminary data section to network check enhancement. (sanchezl)
• 417: (0/116) installer: Add enhancement: IPI kubevirt provider (ravidbro)
• 426: (0/125) general: enhancements/update/targeted-update-edge-blocking: Propose a new enhancement (wking)
• 427: (0/54) update: enhancements/update/phased-rollouts: Propose a new enhancement (wking)
• 443: (0/96) machine-config: Support a provisioning token for the Machine Config Server (cgwalters)
• 475: (0/20) general: enhancements/update/update-blocker-lifecycle: Propose a new enhancement (wking)
• 492: (0/48) rhcos: add rhcos-inject enhancement (crawford)
• 520: (0/13) network: Static IP Addresses from DHCP (cybertron)
• 522: (0/38) olm: Update OLM managed operator metrics enhancement (awgreene)
• 527: (0/74) installer: enhancement/installer: check OpenStack versions (EmilienM)
• 538: (0/14) machine-api: update machine-api-usage-telemetry (elmiko)
• 562: (0/149) security: Enhancing SCC to Gate Runtime Classes (haircommander)
• 564: (0/18) cluster-logging: Allowing users to specify a delete policy based on amount of storage used within the ES cluster (ewolinetz)
• 567: (0/106) machine-api: Added proposal for remediation history (slintes)
• 571: (0/231) network: Cloud API component for egress IP (alexanderConstantinescu)
• 575: (0/74) installer: Installer Enhacement Proposal: Manifests from STDIN (oglok)
• 593: (0/131) general: Add proposal for hiding container mountpoints from systemd (lack)
• 613: (0/18) network: NetworkPolicies for System Namespaces (danwinship)
• 623: (0/1) storage: Confirm Azure Disk names (huffmanca)
• 624: (0/19) update: Add: upgrade-blocker-operator (michaelgugino)
• 626: (0/38) machine-config: enhancements/machine-config: securing MCS (crawford)
• 635: (0/54) manifestlist: IR-57: API changes for manifest list support (ricardomaraschini)
• 642: (0/48) kubelet: Auto Node Sizing (harche)
• 647: (0/59) windows-containers: WINC-544: Enhancement proposal for monitoring Windows Nodes (VaishnaviHire)
• 650: (0/39) scheduling: Add ClusterOperator Scheduling (michaelgugino)
• 652: (0/1) node: Enable cgroup v2 support (harche)
• 654: (0/10) dns: ARO private DNS zone resource removal (jim-minter)
• 660: (0/19) cluster-logging: Flow control API enhancements, first draft. (alanconway)
• 661: (0/118) operator-framework-api: New OpenshiftCatalogueValidator (camilamacedo86)
• 666: (0/16) kube-apiserver: adding new userequest audit policy (EmilyM1)
• 673: (0/42) machine-api: short-circuiting-backoff (mshitrit)
• 676: (0/1) kube-apiserver: api compatibility (sanchezl)
• 682: (0/31) alerting: alerting as a feature (dofinn)
• 683: (0/24) insights: Insights Operator pulling and exposing data from the OCM API (tremes)
• 687: (0/82) storage: Add AWS EFS CSI driver operator (jsafrane)
• 690: (0/3) api-review: Add mirror-by-digest-only to ImageContentSourcePolicy (QiWang19)
• 691: (0/2) installer: OpenStack root volume AZs (Fedosin)
• 693: (0/26) general: CONVENTIONS: Add section on limits (smarterclayton)
• 695: (0/25) cluster-version-operator: move CVO upgrades doc to enhancements (deads2k)
• 701: (0/43) monitoring: metrics scraping with local authentication and authorization (deads2k)
• 707: (0/12) installer: Add Enhancement for Installing to Alibaba Cloud (lemondlut)
• 709: (0/62) installer: Add proposal for credentials management outside the openshift cluster for new platforms (akhil-rane)
• 711: (0/3) olm: add "fail open" risk/mitigation (njhale)
• 716: (0/29) machine-config: Create pre-assigning-nodes-to-machine-config-pools-4-8.md (beekhof)
• 717: (0/1) machine-config: Create pre-assigning-nodes-to-machine-config-pools.md (beekhof)
• 722: (0/6) multi-arch: Add "Build OKD for ppc64le" proposal (mjturek)
• 725: (0/2) distributed-tracing: WIP distributed tracing doc (sallyom)