Chapter 2. New features and enhancements
This section describes new features and enhancements introduced in OpenShift sandboxed containers 1.13.
- Multi-GPU support for NVIDIA DGX B200 with OpenShift sandboxed containers on bare metal
With this release, you can run multi-GPU workloads on NVIDIA DGX B200 systems with OpenShift sandboxed containers on bare metal. This feature supports both standard Kata workloads and confidential containers with Intel® Trust Domain Extensions (TDX).
The NVIDIA DGX B200 configuration differs from generic bare-metal GPU setups in the following ways:
- The NVIDIA driver runs inside a guest virtual machine (VM), not on the host.
- For multi-GPU NVLink workloads, Fabric Manager and NVLink Switch Manager (NVLSM) must be installed manually on the host.
- For a single confidential containers workload with 4 or more GPUs, extended kubelet and CRI-O timeouts are required.
- Red Hat build of Trustee supports Intel® TDX attestation in disconnected network environments
- Red Hat build of Trustee can now verify Intel® Trust Domain Extensions (TDX) quotes from bare metal-Kata virtual machines (VMs) in disconnected environments. To do so, Red Hat build of Trustee uses locally provisioned Data Center Attestation Primitives (DCAP) collateral. In disconnected deployments where the Intel Provisioning Certification Service (PCS) is unreachable, you can download the DCAP collateral on a connected workstation, transfer it to the disconnected cluster, and configure Red Hat build of Trustee to use the local collateral for Intel® Trust Domain Extensions (TDX) quote verification. The offline collateral is valid for a maximum of 30 days. To maintain uninterrupted attestation, refresh the collateral periodically by downloading updated data from Intel PCS.
- Intel® TDX DCAP Operator automates attestation infrastructure setup
You can now use the Intel® TDX DCAP Operator to automate per-node certificate provisioning and Quote Generation Service (QGS) deployment for Intel® TDX attestation. The Operator replaces the previous manual attestation infrastructure setup and supports both online and disconnected registration flows.
- Azure Workload Identity support for peer pods
With this release, the OpenShift sandboxed containers Operator supports Azure Workload Identity for peer pods on self-managed OpenShift Container Platform and Microsoft Azure Red Hat OpenShift clusters. Azure Workload Identity uses short-lived, federated tokens for Azure API authentication instead of long-lived static credentials.
- must-gather support for Red Hat build of Trustee
You can now use the
must-gathertool with Red Hat build of Trustee to collect diagnostic data and logs from your OpenShift Container Platform cluster. The collected data is required when opening a case with Red Hat Support.
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}