Updating clusters overview

You can update an OKD 4 cluster with a single operation by using the web console or the OpenShift CLI (oc).

Understanding OpenShift Container Platform updates

About the OpenShift Update Service: For clusters with internet access, Red Hat provides over-the-air updates by using an OKD update service as a hosted service located behind public APIs.

Understanding upgrade channels and releases

Upgrade channels and releases: With upgrade channels, you can choose an upgrade strategy. Upgrade channels are specific to a minor version of OKD. Upgrade channels only control release selection and do not impact the version of the cluster that you install. The openshift-install binary file for a specific version of the OKD always installs that minor version. For more information, see the following:

• Upgrading version paths

• Understanding fast and stable channel use and strategies

• Understanding restricted network clusters

• Switching between channels

• Understanding conditional updates

Preparing to perform an EUS-to-EUS update

Preparing to perform an EUS-to-EUS update: Due to fundamental Kubernetes design, all OKD updates between minor versions must be serialized. You must update from OKD 4.9 to 4.10, and then to 4.11. You cannot update from OKD 4.8 to 4.10 directly. However, if you want to update between two Extended Update Support (EUS) versions, you can do so by incurring only a single reboot of non-control plane hosts. For more information, see the following:

• Updating EUS-to-EUS

Updating a cluster using the web console

Updating a cluster using the web console: You can update an OKD cluster by using the web console. The following steps update a cluster within a minor version. You can use the same instructions for updating a cluster between minor versions.

• Performing a canary rollout update

• Pausing a MachineHealthCheck resource

• About updating OKD on a single-node cluster

• Updating a cluster by using the web console

• Changing the update server by using the web console

Updating a cluster using the CLI

Updating a cluster using the CLI: You can update an OKD cluster within a minor version by using the OpenShift CLI (oc). The following steps update a cluster within a minor version. You can use the same instructions for updating a cluster between minor versions.

• Pausing a MachineHealthCheck resource

• About updating OKD on a single-node cluster

• Updating a cluster by using the CLI

• Changing the update server by using the CLI

Performing a canary rollout update

Performing a canary rollout update: By controlling the rollout of an update to the worker nodes, you can ensure that mission-critical applications stay available during the whole update, even if the update process causes your applications to fail. Depending on your organizational needs, you might want to update a small subset of worker nodes, evaluate cluster and workload health over a period of time, and then update the remaining nodes. This is referred to as a canary update. Alternatively, you might also want to fit worker node updates, which often requires a host reboot, into smaller defined maintenance windows when it is not possible to take a large maintenance window to update the entire cluster at one time. You can perform the following procedures:

• Creating machine configuration pools to perform a canary rollout update

• Pausing the machine configuration pools

• Performing the cluster update

• Unpausing the machine configuration pools

• Moving a node to the original machine configuration pool

Updating a cluster that includes Fedora compute machines

Updating a cluster that includes Fedora compute machines: If your cluster contains Fedora machines, you must perform additional steps to update those machines. You can perform the following procedures:

• Updating a cluster by using the web console

• Optional: Adding hooks to perform Ansible tasks on Fedora machines

• Updating Fedora compute machines in your cluster

Updating a restricted network cluster

Updating a restricted network cluster: If your mirror host cannot access both the internet and the cluster, you can mirror the images to a file system that is disconnected from that environment. You can then bring that host or removable media across that gap. If the local container registry and the cluster are connected to the mirror host of a registry, you can directly push the release images to the local registry.

• Preparing your mirror host

• Configuring credentials that allow images to be mirrored

• Mirroring the OKD image repository

• Updating the restricted network cluster

• Configuring image registry repository mirroring

• Widening the scope of the mirror image catalog to reduce the frequency of cluster node reboots

• Installing the OpenShift Update Service Operator

• Creating an OpenShift Update Service application

• Deleting an OpenShift Update Service application

• Uninstalling the OpenShift Update Service Operator

Updating hardware on nodes running in vSphere

Updating hardware on vSphere: You must ensure that your nodes running in vSphere are running on the hardware version supported by OpenShift Container Platform. Currently, hardware version 13 or later is supported for vSphere virtual machines in a cluster. For more information, see the following:

• Updating virtual hardware on vSphere

• Scheduling an update for virtual hardware on vSphere

Updating a cluster that includes the Special Resource Operator

Updating a cluster that includes the Special Resource Operator: When updating a cluster that includes the Special Resource Operator (SRO), it is important to consider whether the new kernel module version is compatible with the kernel modules currently loaded by the SRO. You can run a preflight check to confirm if the SRO will be able to upgrade the kernel modules.