As we prepare to split the OpenShift API server into multiple binaries, several new images have been created:
openshift/origin-hypershift - A new hypershift binary that launches OpenShift specific components
openshift/origin-hyperkube - The Kubernetes hyperkube binary
openshift/origin-cli - The OpenShift CLI oc
openshift/origin-tests - The extended test suite for OpenShift
Some existing images have been renamed
openshift/origin is now openshift/origin-control-plane
openshift/node is now openshift/origin-node
The openshift/openvswitch image has been folded into openshift/origin-node
A new binary openshift-node-config takes a node-config.yaml file and converts it to kubelet arguments in the openshift/origin-node image
CLI changes
Some client-side deletion support has been removed in favor of the controller-driven deletion mechanisms #19616
oc export is deprecated and oc get --export should be used instead.
The router has separate liveness and readiness probes for use with upstream load balancers #19009
XFS quota for emptyDir volumes is now configured via a config file in the volume directory #19533
Changes to oc cluster up
The cluster launched by oc cluster up is now launched as a set of individual processes running in images, instead
of the previous single large container. This more closely mimics real production environments.
Docker machine support in oc cluster up has been removed
oc cluster up now only supports launching a cluster of the same version as the oc binary.
In order to better adapt ingress objects to routes, a new controller has been added to OpenShift that
maps Kubernetes Ingress objects (in their v1beta1 form) to OpenShift Routes automatically. This
allows the HAProxy router to report status, perform host overrides, support multi-tenant protection on
hostnames, and securely manage Ingress secrets.
The controller converts each Ingress rule into its own route, as long as the rule has a hostname or TLS
hostname. Any referenced secrets are copied into the final Route and kept up to date. If a generated route
is deleted it will be recreated by the controller. Once a route is created, any annotations or route
specific fields will not be altered unless the route is deleted (such as weighted service backends). A
route with a TLS endpoint will be set to Reencrypt termination, but that may be changed after creation.
The router process itself no longer needs to watch Ingress or Secret resources.
router: Replace router support for ingress with an ingress-to-route controller #18658
Builds using the Dockerfile build strategy can now build multi-stage Docker images. The from field continues to target
the last image stage in the Dockerfile, but the new as attribute on imageSources allows other stages to be replaced
with triggered images.
Support multi-stage dockerbuilds via imagebuilder #18741, #19494
Support external OAuth token authenticators
OpenShift can now be configured to delegate login flows to a remote OAuth capable endpoint like Keycloak. This allows
a central Keycloak server to authenticate multiple clusters. See the documentation for more details about configuring
this option.
auth: Add option to configure an external OAuth server #18969
auth: Support WebhookTokenAuthenticators for using external servers as token authenticators #18868
Other Features
auth: Add oc adm prune role command to clean up rolebindings that are not bound to valid roles #19619
cli: Add server-side column printer support for openshift objects #19934