OCP 4.4 Release Notes Tracker

[ahardin-rh]

Please leave comments here for anything that should be highlighted in the 4.4 release notes. Thank you!

Draft Preview: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html

[deads2k]

In 4.3 and before, the kube-apiserver checked tokens before client certificates for authentication. In 4.4 and after, the kube-apiserver will check client-certificates before tokens. As an example, this means that if you have a system:admin kubeconfig and run oc --token=foo get pod in 4.3 that would authenticate as a the user with token foo, in 4.4 and after it will authenticate as system:admin. The recommendation for many releases has been to use --as in such cases instead of overriding the token when using a client-certificate as well.

[soltysh]

oc build-logs was deprecated in 3.11 (openshift/origin#20322) and we are now removing it entirely from oc (openshift/oc#232). Users should use oc logs instead.

[stlaz]

As stated in 4.1 release notes, the deprecated /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt file will be removed in 4.5.

[soltysh]

oc's --config flag is being deprecated in 4.4, users should start using --kubeconfig, instead (openshift/oc#256).
OS_EDITOR is also being deprecated in 4.4, users should start using KUBE_EDITOR or EDITOR, instead.

[soltysh]

oc rsh --timeout flag is being deprecated in openshift/oc#260, users should use --request-timeout, instead.

[codyhoag]

The machineCIDR network parameter has been deprecated. It's recommended to use machineNetwork.cidr instead.

See #19212 for sample entry for release notes.

https://issues.redhat.com/browse/OSDOCS-877

[soltysh]

oc secrets subcommands (new, new-basicauth, new-dockercfg, new-sshauth) were deprecated in 3.9 (openshift/origin@5046e19), they are being removed entirely now. Users should use oc create secret command, instead (openshift/oc#271).

[jboxman]

So for 4.4, we support SCTP. The linux man page hilarious doesn't define the term, but it's Stream Control Transmission Protocol. This is a networking/SDN item.

[bergerhoffer]

Hopefully should be caught in the fixed issues bug query, but https://bugzilla.redhat.com/show_bug.cgi?id=1806620 should be included in the bug fixes section.

Edit: This should go in as a known issue (not a bug fix) for 4.4.

[codyhoag]

Installing a cluster on Microsoft Azure using user-provisioned infrastructure

OpenShift Container Platform 4.4 introduces support for installing a cluster on Azure using user-provisioned infrastructure. This allows you to deploy your own infrastructure hosted on Azure instead of being forced to use the opinionated installer-provisioned infrastructure. Running user-provisioned infrastructure on Azure lets you use customizations your environment might require, like regulatory, security, and operational control.

You can incorporate example Azure Resource Manager (ARM) templates provided by Red Hat to assist in the deployment process, or reference them to help model your own. You are also free to create the required resources through other methods; the ARM templates are just an example.

See Installing a cluster on Azure using ARM templates (link when published) for details.

[bergerhoffer]

Evicting Pods using the descheduler (Technology Preview)

The descheduler provides the ability to evict a running Pod so that the Pod can be rescheduled onto a more suitable node.

You can benefit from descheduling Pods in situations such as the following:

• Nodes are underutilized or overutilized.
• Pod and node affinity requirements, such as taints or labels, have changed and the original scheduling decisions are no longer appropriate for certain nodes.
• Node failure requires Pods to be moved.
• New nodes are added to clusters.

See Evicting Pods using the descheduler for more information.