OpenShift 3.2 Release Notes

[smarterclayton]

All release notes relevant for 3.2

[smarterclayton]

By default, services with externalIPs will be rejected since they can be used to allow services to pretend to act as nodes in some cases. A new config flag has been added to master-config.yaml, networkConfig.externalIPNetworkCIDR that controls the allowable values for external IPs. By default it will be empty which rejects all values. Admins can set it to 0.0.0.0/0 to emulate behavior in 3.1.

[pmorie]

FSGroup is now enabled by default in the restricted and hostaccess security context constraints. This means that pods matched against those SCCs will:

1. Have the pod.spec.securityContext.fsGroup field populated to a namespace-wide allocated value automatically
2. Have their emptyDir-derived (emptyDir, gitRepo, secret, configMap, downwardAPI) and block device volumes (basically every network volume except ceph and nfs) owned by the FSGroup
3. Run with the FSGroup in each container's list of supplemental groups

[jwforres]

Web console enhancements:

• Brand new theme that changes the look and feel of the navigation, tabs, and other page elements
• Form-based editor for build configurations for modifying commonly edited fields
• All browse resource pages (e.g viewing a particular pod) have a tab for Events related to that pod. All events pages now support filtering and sorting
• Add/edit resource constraints for your containers during "Add to Project" or later from the deployment configuration
• About page provides end users with information about the product version, oc CLI download locations, and a quick access to their current token to login using the CLI
• Customize CLI download URLs and documentation URLs through console extensions
• Edit a project's display name and description from the Settings page

[fabianofranz]

Web console:

• List existing persistent volume claims and attach them to deployments and deployment configs.

[0xmichalis]

• oc create route for creating secured routes in the cli

[danwinship]

The default values for pod networking have changed:

• clusterNetworkCIDR (osm_cluster_network_cidr in ansible) now defaults to 10.128.0.0/14 (10.128.0.0 - 10.131.255.255) rather than 10.1.0.0/16.
• hostSubnetLength (osm_host_subnet_length in ansible) now defaults to 9 rather than 8 (meaning each node will be assigned a /23 subnet rather than a /24)

[soltysh]

• image import changes, which allow specifying per tag import/reference
• allowing importing images from private repositories using secrets
• allowing scheduling image imports
• limiting no of imported images

[dobbymoodge]

Policy plugin:

• Added PodNodeConstraints admission control plugin
  • Constrains use of NodeName field in Pod spec to roles which have the pods/binding permission
  • Allows administrators, via NodeSelectorLabelBlacklist, to specify Node labels which can only be specified in the NodeSelector field in PodSpec by roles with the pods/binding permission

[pweil-]

Two new fields have been added to SCCs:

1. ReadOnlyRootFilesystem allows an admin to force containers to run with a read only root file system.
2. If set to true then containers will be required to run with a read only root file system by their SecurityContext. Containers that do not set this value to true will be defaulted. Containers that explicitly set this value to false will be rejected.
3. If set to false containers may use a read only root file system if they wish but will they will not be forced to run with a read only root file system
4. Volumes allows an admin full control over which volume plugins may be specified. In order to maintain backwards compatibility the AllowHostDirVolumePlugin field will have precedence over the Volumes field for the host mounts. You may use the value * to allow all volumes.

SCCs should be reconciled after the upgrade to pick up new defaults.

[miminar]

• Added an ability to restrict number of unique image references in the project using quota.
  • Using openshift.io/imagestreamtags and openshift.io/imagestreamimages resources.
• Allowed to restrict maximal size of image that can be pushed to project using limit ranges.
  • By setting a Max["storage"] on openshift.io/image-size limit type.