OpenShift容器云平台新功能介绍

What’s New in Red Hat OpenShift Container Platform 3.9 OpenShift Commons Briefing21 March 2018Marc CurrySteve SpeicherOpenShift Product Management TeamSERVICE CATALOG(LANGUAGE RUNTIMES, MIDDLEWARE, DATABASES, …)SELF-SERVICEAPPLICATION LIFECYCLE MANAGEMENT(CI / CD)BUILD AUTOMATIONDEPLOYMENT AUTOMATIONCONTAINERCONTAINERCONTAINERCONTAINERCONTAINERNETWORKINGSECURITYSTORAGEREGISTRYLOGS & METRICSCONTAINER ORCHESTRATION & CLUSTER MANAGEMENT(KUBERNETES)ATOMIC HOST /RED HAT ENTERPRISE LINUXOCI CONTAINER RUNTIME & PACKAGINGINFRASTRUCTURE AUTOMATION & COCKPITOpenShift = Enterprise Kubernetes+Build, Deploy and Manage Containerized AppsQ3 CY2017Q4 CY2017OpenShift Container Platform 3.6 (August)●Kubernetes 1.6 & Docker 1.12●New Application Services - 3Scale API MgtOnPrem, SCL 2.4●Web UX Project Overview enhancements ●Service Catalog/Broker & UX (Tech Preview)●Ansible Service Broker (Tech Preview)●Secrets Encryption (3.6.1)●Signing/Scanning + OpenShift integration ●Storage - CNS Gluster Block, AWS EFS, CephFS ●OverlayFS with SELinux Support (RHEL 7.4)●User Namespaces (RHEL 7.4)●System Containers for dockerOpenShift Container Platform 3.7 (December)●Kubernetes 1.7 & Docker 1.12●Red Hat OpenShift Application Runtimes (GA)●Service Catalog/Broker & UX (GA)●OpenShift Ansible Broker (GA)●AWS Service Broker ●Network Policy (GA)●CRI-O (Tech Preview)●CNS for logging & metrics (iSCSI block), registry ●CNS 3X density of PV’s (1000+ per 3 node, Integrated Install ●Prometheus Metrics and Alerts (Tech Preview)OpenShift RoadmapQ1 CY2018Q2 CY2018OpenShift Container Platform 3.9 (March)●Kubernetes 1.8 and 1.9 and docker 1.13 ●CloudForms CM-Ops (CloudForms 4.6)●CRI-O (Full Support in z stream)●Device Manager (Tech Preview)●Central Auditing ●Jenkins Improvements ●HAProxy 1.8●Web Console Pod ●CNS (Resize, vol custom naming, vol metrics)OpenShift Container Platform 3.10 (June)●Kubernetes 1.10 and CRI-O and Buildah (Tech Preview)●Custom Metrics HPA ●Smart Pruning ●Istio (Dev Preview)●IPv6 (Tech Preview)●OVN (Tech Preview), Multi-Network, Kuryr, IP per Project ●oc client for developers ●AWS AutoScaling ●Golden Image Tooling and TLS bootstrapping ●Windows Server Containers (Dev Preview))●Prometheus Metrics and Alerts (GA)●OCP + CNS integrated monitoring/Mgmt, S3 Svc BrokerOCP 3.9 - Extensible Application Platform●Service Expansion●Database APBs, SCL 3.0, Catalog view enhancement●Security●Auditing, Jenkins secret integration, private repo ease of use●Manageability●CFME 4.6, HAProxy 1.8, Egress port control, Soft Prune, PV resize ●Workload Diversity●Device Manager, Local Storage●Container Runtime●CRI-OEXCITING MIDDLEWARE SERVICES UPDATES- high-performance rule processing service basedon the Drools 7 community project, withextensions for complex event processing (CEP).- guided rules editor, decision tables, andweb-based rule authoring, testing, anddeployment tools.- business resource optimization tool based onthe OptaPlanner community project.- managed repository for rule definitions, withbuilt-in governance workflows to ensure thatchanges and updates are properly controlled.●Node core distro to be delivered only through RHOAR, no stand alone SKU ○Evaluating NPM modules for future support, with focus on microservice development and deployment concerns ●Non-Distro efforts ○Tooling & boosters for RHOAR integration ●Booster coverage ○Showcases features in Node.js specific to RHOAR/microservices ○Work continues on infrastructure/workflow ●Consumption ○S2I images (supported for v8, unsupported but available for v9/v10)○Openshift Streams integrationEXCITING MIDDLEWARE SERVICES UPDATESMarch12th!OPENSHIFT SERVICE CATALOGOpenShift Ansible BrokerOpenShift Template BrokerAWS Service BrokerOther Service BrokersANSIBLEOPENSHIFTAMAZON WEB SERVICESOTHER COMPATIBLE SERVICESAnsible Playbook BundlesOpenShift TemplatesPublic Cloud ServicesOther ServicesSERVICE BROKERSExpose and Provision ServicesFeature(s): OpenShift Ansible BrokerWhat’s New for 3.9:●New upstream community website: Automation Broker●Downstream will still be called ‘OpenShift Ansible Broker’ with main focus on APB ‘Service Bundles’ (application definition)●Community contributed application repo: https:///ansibleplaybookbundle●Support for running the broker behind an HTTP proxy in a restricted network environment●Documentation: https:///openshift/ansible-service-broker/blob/master/docs/proxy.md●Video: https:///watch?v=-Fdfz1RqI94●Plan or parameter updating of PostgreSQL, MariaDB, and MySQL APB-based services will preserve data●Update logic in the APB that handles preserving data; useful for cases where you want to move between a service plan withephemeral storage to a different service plan utilizing a PV●Video: https:///watch?v=kslVbbQCZ8s&t=220s●Now Official add-on for MiniShift●Documentation: https:///minishift/minishift-addons/tree/master/add-ons/ansible-service-broker●Video: https:///watch?v=6QSJOyt1Ix8●Network isolation support for multi-tenant environments●For joining networks that are isolated to allow APBs to talk to the resulting pods it creates over the network●[Experimental] Async bind support in Broker●Used to allow binds that need more time to execute than the 60 seconds response time defined in the OSB API spec.●Async bind will spawn a binding job and return the job token immediately; the catalog will use the last_operation to monitor thestate of the running job until either successful completion or a failure.Feature(s): Catalog from within project viewDescription: Quickly get to the catalog from within a projectHow it Works:●“Catalog” item in left navigationDescription: Need to quickly find servicesHow it Works:●Type in your search criteria●Get minimal service icon●Access the menu from accountdropdown●Pick any of: Catalog Home, Allprojects, Specific project●Logout and then back in●Enjoy!Feature(s): Configurable inactivity timeoutDescription: Configure web console to loguser out after a set timeoutHow it Works:●Default is 0 (never)●Set ansible variable to # of minutesopenshift_web_console_inactivity_timeout_minutes=nFeature(s): Console as separate podDescription: Separate web console out of API serverHow it Works:●Web console packaged as a containerimage●Deployed as a pod●Configuration can be made viaConfigMap and auto-detects changesDescription: Removed tech preview labelHow it Works:●Same capability as tech preview feature in 3.7DevExp / BuildsFeature(s): Jenkins memory usage improvementsDescription: Jenkins worker pods often consume too much or too little memoryHow it Works:●Startup script intelligently looks at pod limits●JVM env vars appropriately set to ensure limitsare respected for spawned JVMsDevExp / Builds Miscellaneous●‘oc cluster up’ allow for number of PVs to create●Ability to specify default tolerations●Toleration of CRI-O in build scenarios●Secrets available in Jenkins as credentialsMinishift 1.14 / CDK 3.3:●Many improvements around addons:dependencies, management, …●Caching of container images●Static IP for HyperV●Host folder mounts using sshfs3.410.21.127.19.68N E W3.6U P D A T E DFeature(s): Semi-automatic namespace-wide egress IPDescription: All outgoing external connections from a project will share a single fixed source IP address and will send all traffic via that IP, so that external firewalls can recognize the application associated with a packet.NetworkingHow it Works:●Supported by the multitenant / networkpolicy plugins●Egress IPs do not accept connections on any port●NetNamespace has an EgressIPs array that can be set(though only one IP, currently) for the egress IP●The Egress IP must be on the local subnet of the node'sprimary network interface (added as additional address on that interface)●Once EgressIPs is set on a NetNamespace, and untilthe EgressIP is claimed, pod-to-pod traffic is allowed,but pod-to-external traffic is dropped ●Once claimed, a pod in that NetNamespace on thatnode will be able to send traffic to external IPs, with that EgressIP as the source of traffic●For a pod in that NetNamespace on a different node,traffic will first travel via VXLAN to the node hosting the egress IP, then it will be able to send traffic to externalIPs●Egress traffic from pods in other NetNamespaces arestill NAT’d to the primary IP address of the node, justlike in the no-automatic-egress-IP case3.7Stability enhancements that will enable in 3.10:●HA●“Semi-Automatic” → “Automatic”(no longer a manual admin process)3.9Feature(s): Support our own HAProxy RPM for consumption by the routerDescription : Route configuration changes and process upgrades performed under heavy load have typically required a stop/start sequence of certain services, causing temporary outages. There existed iptables “trickery” to work around the issue.In OpenShift 3.9, HAProxy 1.8 sees no differencebetween updates and upgrades; a new process is used with a new configuration, and the listening socket’s file descriptor is transferred from the old to the new process so the connection is never closed. The change is seamless , and enables our ability to do things, like HTTP/2, in the future.NetworkingHow the HAProxy “soft reload” used to work:The new process with its new configuration tries to bind to all listening portsThe new process sends asignal to the old process(es) asking it to temporarily release the portFailFailGive up and signal the old process to continue taking care of the incomingconnectionsSignal the old process it can quit once it has finished serving existing connectionsSucceedSucceedTry againports may not bebound by any process...The new process listens for incoming connections.Feature(s): StatefulSets / DaemonSets / Deployments no longer Tech PreviewDescription: The core workloads API, which includes the DaemonSet, Deployment, ReplicaSet and StatefulSet kinds, has been promoted to GA stability in upstream Kubernetes.For OpenShift, this means that StatefulSets, DaemonSet and Deployments are now stable/supported and the Tech Preview label is removed in OpenShift 3.9.Additional Information:●StatefulSets●DaemonSets●DeploymentsFeature(s): Central Audit CapabilityDescription: Provides auditing of items that admins would like to…View (examples):●Event Timestamp●The activity that generated the entry●The API endpoint that was called●The HTTP output●The item changed due to an activity, with details of the change●The username of the user that initiated an activity●The name of the namespace the event occurred in where possible●The status of the event, either success or failureTrace (examples):●User login and logout from (including session timeout) theweb interface, including unauthorised access attempts●Account creation, modification, or removal●Account role/policy assignment/de-assignment●Scaling of pods●Creation of new project or application●Creation of routes and services●Triggers of builds and/or pipelines How It Works:Setup auditing in the master-config file, and restart the master-config service:auditConfig:auditFilePath: "/var/log/audit-ocp.log"enabled: truemaximumFileRetentionDays: 10maximumFileSizeMegabytes: 10maximumRetainedFiles: 10logFormat: jsonpolicyConfiguration: nullpolicyFile: /etc/origin/master/audit-policy.yaml webHookKubeConfig: ""webHookMode: ""。