Windows Container Support for Red Hat OpenShift release notes

• About Windows Container Support for Red Hat OpenShift
• Getting support
• Release notes for Red Hat Windows Machine Config Operator 4.0.1
  • Bug fixes
• Release notes for Red Hat Windows Machine Config Operator 4.0.0
  • Bug fixes
  • Known issues
• Windows Machine Config Operator prerequisites
  • Supported platforms based on OKD and WMCO versions
  • Supported platforms for Bring-Your-Own-Host (BYOH) instances based on OKD and WMCO versions
  • Supported Windows Server versions
  • Supported networking

About Windows Container Support for Red Hat OpenShift

Windows Container Support for Red Hat OpenShift enables running Windows compute nodes in an OKD cluster. Running Windows workloads is possible by using the Red Hat Windows Machine Config Operator (WMCO) to install and manage Windows nodes. With Windows nodes available, you can run Windows container workloads in OKD.

The release notes for Red Hat OpenShift for Windows Containers tracks the development of the WMCO, which provides all Windows container workload capabilities in OKD.

Getting support

You must have a subscription to receive support for the Red Hat WMCO. Deploying Windows container workloads in production clusters is not supported without a subscription. If you do not have a subscription, you can use the community WMCO, a distribution that lacks official support. Request support through the Red Hat Customer Portal.

Release notes for Red Hat Windows Machine Config Operator 4.0.1

Issued: 2021-12-13

The WMCO 4.0.1 is now available with bug fixes. The components of the WMCO were released in RHBA-2021:4757.

Bug fixes

• Previously, the windows-exporter metrics endpoint object contained a reference to a deleted machine. This incorrect reference caused the WMCO to ignore deleted events for machines with invalid IP addresses. This bug fix removes the validation of the machine object from the event filtering, allowing the windows-exporter metrics endpoint object to correctly update when the machine is still in the Deleting phase. (BZ#2008992)

• Previously, deleting the node associated with a Windows Machine object returned a reconciliation error upon restart of the Operator. This bug fix opts not to react or reconcile when the node referenced by a Windows machine in the Running state is not found within the cluster, preventing any error loop and standardizing functionality with Linux machine objects. (BZ#2009474)

• Previously, certain commands being run by the WMCO in Windows VMs were not parsed correctly by PowerShell. This caused Windows VMs with PowerShell as its default SSH shell to be unable to join to a cluster as a node. The WMCO now identifies the default SSH shell of a Windows VM and runs the associated commands accordingly. This new capability allows Windows VMs with PowerShell as the default SSH shell to be configured as nodes in a cluster. (BZ#2014707)

• Previously, encrypted usernames were being generated with extra tags, which caused them not to display correctly. This bug fix removes the extra tags, allowing the encrypted username to display correctly. (BZ#2016712)

• Previously, the WMCO did not properly associate BYOH Windows VMs with their Node object when the VM was specified with a DNS object. This caused the WMCO to attempt to configure VMs that were already fully configured. The WMCO now resolves VMs specified by a DNS address when looking for an associated node. (BZ#2020648)

Release notes for Red Hat Windows Machine Config Operator 4.0.0

This release of the WMCO provides bug fixes for running Windows compute nodes in an OKD cluster. The components of the WMCO 4.0.0 were released in RHBA-2021:3702.

Bug fixes

• Previously, the WMCO used the raw user-provided instance address when creating Bring-Your-Own-Host (BYOH) Windows nodes. This caused BYOH Windows instances to not join an OKD cluster. This bug fix ensures user-provided DNS names resolve to valid IPv4 addresses, and that the resolved value is used when creating BYOH Windows instances. Now BYOH instances with differing hostnames and DNS addresses can be configured as Windows Nodes. (BZ#1995684)

• Previously, the WMCO performed direct comparisons using unresolved instance addresses when identifying instance-to-node associations. This caused BYOH Windows instances configured to join an OKD cluster to be removed. This bug fix validates DNS addresses by performing DNS lookups of entries that are added to the windows-instances config map. Now the WMCO can properly identify configured instance-to-node relationships, preventing any premature removals of BYOH nodes. (BZ#2005126)

Known issues

• The file system graphs available in the web console do not display for Windows nodes. This issue is caused by changes in the file system queries, which will be fixed in a future release of WMCO. (BZ#1930347)

• For clusters installed on VMware vSphere, the WMCO ignored the Deleting phase notification event, leaving incorrect node information in the windows-exporter metrics endpoint. This resulted in an invalid mapping for the Prometheus metrics endpoint. This bug has been fixed; the WMCO now recognizes the Deleting phase notification event and maps the Prometheus metrics endpoint appropriately. (BZ#1995341)

• When the RunAsUser permission is set in the security context of a Linux-based pod, the projected files have the correct permissions set, including container user ownership. However, when the Windows equivalent RunAsUsername permission is set in a Windows pod, the kubelet is prevented from setting correct ownership on the files in the projected volume. This problem can get exacerbated when used in conjunction with a hostPath volume where best practices are not followed. For example, giving a pod access to the C:\var\lib\kubelet\pods\ folder results in that pod being able to access service account tokens from other pods.

  By default, the projected files will have the following ownership, as shown in this example Windows projected volume file:

  Path   : Microsoft.PowerShell.Core\FileSystem::C:\var\run\secrets\kubernetes.io\serviceaccount\..2021_08_31_22_22_18.318230061\ca.crt
  Owner  : BUILTIN\Administrators
  Group  : NT AUTHORITY\SYSTEM
  Access : NT AUTHORITY\SYSTEM Allow  FullControl
           BUILTIN\Administrators Allow  FullControl
           BUILTIN\Users Allow  ReadAndExecute, Synchronize
  Audit  :
  Sddl   : O:BAG:SYD:AI(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)

  This indicates all administrator users, like someone with the ContainerAdministrator role, have read, write, and execute access, while non-administrator users have read and execute access.

  OKD applies the RunAsUser security context to all pods irrespective of its operating system. This means Windows pods automatically have the RunAsUser permission applied to its security context.

  In addition, if a Windows pod is created with a projected volume with the default RunAsUser permission set, the pod gets stuck in the ContainerCreating phase.

  To handle these issues, OKD forces the file permission handling in projected service account volumes set in the security context of the pod to not be honored for projected volumes on Windows (BZ#1971745). Note that this behavior for Windows pods is how file permission handling used to work for all pod types prior to OKD 4.7.

Windows Machine Config Operator prerequisites

The following information details the supported platform versions, Windows Server versions, and networking configurations for the Windows Machine Config Operator. See the vSphere documentation for any information that is relevant to only that platform.

Supported platforms based on OKD and WMCO versions

Supported platforms for Bring-Your-Own-Host (BYOH) instances based on OKD and WMCO versions

Supported Windows Server versions

The following table lists the supported Windows Server version based on the applicable platform. Any unlisted Windows Server version is not supported and will cause errors. To prevent these errors, only use the appropriate version according to the platform in use.

Supported networking

Hybrid networking with OVN-Kubernetes is the only supported networking configuration. See the additional resources below for more information on this functionality. The following tables outline the type of networking configuration and Windows Server versions to use based on your platform. You must specify the network configuration when you install the cluster. Be aware that OpenShift SDN networking is the default network for OKD clusters. However, OpenShift SDN is not supported by WMCO.

Version 4.x of the WMCO is only compatible with OKD 4.9.