What’s new with Red Hat OpenShift Service on AWS

rosa create network command added for ROSA with HCP clusters. You can now use the rosa create network command when creating ROSA with HCP clusters to create networks using AWS CloudFormation templates. This helper command is intended to help create and configure a VPC for use with ROSA with HCP. This command also supports zero egress clusters. For more information, see create network.

Create additional security groups in ROSA with HCP clusters. Starting with ROSA CLI version 1.2.47, you can now create additional security groups using the ROSA CLI when creating ROSA with HCP clusters. Note that additional security group IDs attached to the machine pool cannot be modified. To remove or add more security group IDs, replace the entire machine pool with a new one.

ROSA CLI update. The ROSA CLI (rosa) was updated to a new version. For information about what has changed in this release, see the ROSA CLI release notes. For more information about the ROSA CLI (rosa), see About the ROSA CLI.

VolumeDetachTimeout configuration applied to machine pools for ROSA with HCP. ROSA is applying a VolumeDetachTimeout configuration of 5 minutes to all machine pools. This prevents issues with node deletion when volumes fail to detach. This only applies to ROSA with HCP.

Configure machine pool disk volume for ROSA with HCP clusters. You can now configure the disk volume size for machine pools in ROSA with HCP clusters. The default disk size is 300 GiB, and you can configure it from a minimum of 75 GiB to a maximum of 16,384 GiB. For more information, see Configuring machine pool disk volume.

ROSA with HCP multi-architecture cluster update. Red Hat OpenShift Service on AWS (ROSA) with hosted control planes (HCP) clusters created before 25 July, 2024 will migrate to a multi-architecture image on their next upgrade allowing you to use Amazon Web Services (AWS) Arm-based Graviton instance types for your workloads. For more information, see Upgrading ROSA with HCP clusters.

ROSA with HCP cluster node limit update. ROSA with HCP clusters can now scale to 500 worker nodes. This is an increase from the previous limit of 250 nodes. The 250 node limit is an increase from the previous limit 90 nodes on 26 August, 2024. For more information, see ROSA with HCP cluster maximums.

IMDSv2 support in ROSA with HCP. You can now enforce the use of the IMDSv2 endpoint for default machine pool worker nodes on new ROSA with HCP clusters and for new machine pools on existing clusters. For more information, see Creating a default ROSA cluster using Terraform.

Upgrade multiple nodes simultaneously. You can now configure a machine pool to upgrade multiple nodes simultaneously. Two new machine pool parameters, max-surge and max-unavailable, give you greater control over how machine pool upgrades occur. For more information, see Upgrading ROSA with HCP clusters.

ROSA with HCP Graviton Arm-based instance types. You can now use Amazon Web Services (AWS) Arm-based Graviton instance types for your workloads in Red Hat OpenShift Service on AWS (ROSA) with hosted control planes (HCP) clusters created after 24 July, 2024. For more information, see AWS Graviton Arm-based instance types.

ROSA CLI update. The ROSA CLI (rosa) was updated to a new version. For information about what has changed in this release, see the ROSA CLI release notes. For more information about the ROSA CLI (rosa), see About the ROSA CLI.

Approve additional principals for ROSA with HCP clusters. You can approve additional user-roles to connect to your cluster’s private API server endpoint. For more information, see Additional principals on your ROSA with HCP cluster.

ROSA CLI update. The ROSA CLI (rosa) was updated to a new version. For information about what has changed in this release, see the ROSA CLI release notes. For more information about the ROSA CLI (rosa), see About the ROSA CLI.

Approved Access for ROSA clusters. Red Hat Site Reliability Engineering (SRE) managing and proactively supporting ROSA Clusters will typically not require elevated access to customer clusters as part of the normal operations. In the unlikely event should Red Hat SRE (Site Reliability Engineer) need elevated access, the Approved Access functionality provides an interface for customers to review and approve or deny access requests.

ROSA command enhancement. The rosa describe command has a new optional argument, --get-role-policy-bindings. This new argument allows users to view the policies attached to STS roles assigned to the selected cluster. For more information, see describe cluster.

Expanded customer-managed policy capabilities. You can now attach customer-managed policies to the IAM roles required to run both ROSA (classic architecture) and ROSA clusters. Furthermore, these customer-managed policies, including the permissions attached to those policies, are not modified during cluster or role upgrades. For more information, see Customer-managed policies.

Permission boundaries for the installer role policy. You can apply a policy as a permissions boundary on the ROSA installer role. The combination of policy and boundary policy limits the maximum permissions for the Amazon Web Services(AWS) Identity and Access Management (IAM) entity role. ROSA includes a set of three prepared permission boundary policy files, with which you can restrict permissions for the installer role since changing the installer policy itself is not supported. For more information, see Permission boundaries for the installer role. This is applicable only to Red Hat OpenShift Service on AWS (classic architecture).

Cluster delete protection. You can now enable the cluster delete protection option, which helps to prevent you from accidentally deleting a cluster. For more information on using the cluster delete protection option with the ROSA CLI, see edit cluster. For more information on using the cluster delete protection option in the UI, see Creating a cluster with the default options using OpenShift Cluster Manager.

ROSA with HCP regions added. Red Hat OpenShift Service on AWS (ROSA) with hosted control planes (HCP) is now available in the following regions:

Added support for external authentication providers. You can now create clusters configured with external authentication providers, such as Microsoft Entra ID and KeyCloak. For more information, see Creating ROSA with HCP clusters with external authentication.

Longer cluster names enhancement. You can now specify a cluster name that is longer than 15 characters. For cluster names that are longer than 15 characters, you can customize the domain prefix for the cluster URL by using the domain-prefix flag in the ROSA CLI (rosa) or by selecting the Create custom domain prefix checkbox in the Red Hat Hybrid Cloud Console. For more information, see create cluster in Managing objects with the ROSA CLI.

Additional Security Groups for ROSA with HCP. Starting with ROSA CLI version 1.2.37, you can now use the --additional-security-group-ids <sec_group_id> when creating machine pools on ROSA with HCP clusters. For more information, see Creating a machine pool using the ROSA CLI and the create machinepool section of the ROSA CLI reference.

Node management improvements. Now, you can perform specific tasks to make clusters more efficient. You can cordon, uncordon, and drain a specific node. For more information, see Working with nodes.

Node drain grace periods. You can now configure node drain grace periods in Red Hat OpenShift Service on AWS (ROSA) with hosted control planes (HCP) clusters with the rosa CLI.

Machine pool update. You can now upgrade machine pools that are configured on ROSA with HCP clusters. For more information, see upgrade machinepool.

ROSA with HCP regions added. Red Hat OpenShift Service on AWS (ROSA) with hosted control planes (HCP) is now available in the following regions:

ROSA CLI update. The ROSA CLI (rosa) was updated to a new version. For information about what has changed in this release, see the ROSA CLI release notes. For more information about the ROSA CLI (rosa), see About the ROSA CLI.

Log linking is enabled by default. Beginning with Red Hat OpenShift Service on AWS 4.15, log linking is enabled by default. Log linking gives you access to the container logs for your pods.

Availability zone update. You can now optionally select a single availability zone (AZ) for machine pools when you have a multi-AZ cluster. For more information, see Creating a machine pool using the ROSA CLI.

Log linking is enabled by default - Beginning with Red Hat OpenShift Service on AWS 4.15, log linking is enabled by default. Log linking gives you access to the container logs for your pods.

Availability zone update. You can now optionally select a single availability zone (AZ) for machine pools when you have a multi-AZ cluster. For more information, see Creating a machine pool using the ROSA CLI.

Delete cluster command enhancement. With the release of ROSA CLI (rosa) version 1.2.31, the --best-effort argument was added, which allows you to force-delete clusters when using the rosa delete cluster command. For more information, see delete cluster.

ROSA CLI update. The ROSA CLI (rosa) was updated to a new version. For information about what has changed in this release, see the ROSA CLI release notes. For more information about the ROSA CLI (rosa), see About the ROSA CLI.

Delete cluster command enhancement. With the release of ROSA CLI (rosa) version 1.2.31, the --best-effort argument was added, which allows you to force-delete clusters when using the rosa delete cluster command. For more information, see delete cluster.

Red Hat OpenShift Service on AWS (ROSA) with hosted control planes (HCP). ROSA with HCP is now generally available. For more information, see Creating ROSA with HCP clusters using the default options.

Configurable process identifier (PID) limits. With the release of ROSA CLI (rosa) version 1.2.31, administrators can use the rosa create kubeletconfig and rosa edit kubeletconfig commands to set the maximum PIDs for an existing cluster. For more information, see Changing the maximum number of process IDs per pod (podPidsLimit) for ROSA.

Configure custom security groups. With the release of ROSA CLI (rosa) version 1.2.31, administrators can use the rosa create command or the OpenShift Cluster Manager to create a new cluster or a new machine pool with up to 5 additional custom security groups. Configuring custom security groups gives administrators greater control over resource access in new clusters and machine pools. For more information, see Security groups.

Command update. With the release of ROSA CLI (rosa) version 1.2.28, a new command, rosa describe machinepool, was added that allows you to check detailed information regarding a specific ROSA cluster machine pool. For more information, see describe machinepool.

Documentation update. The Operators section was added to the ROSA documentation. Operators are the preferred method of packaging, deploying, and managing services on the control plane. For more information, see Operators overview.

OpenShift Virtualization support. The release of OpenShift Virtualization 4.14 added support for running OpenShift Virtualization on ROSA Classic clusters. For more information, see OpenShift Virtualization on AWS bare metal in the OpenShift Container Platform documentation.

ROSA CLI update. The ROSA CLI (rosa) was updated to a new version. For information about what has changed in this release, see the ROSA CLI release notes. For more information about the ROSA CLI (rosa), see About the ROSA CLI.

Cluster autoscaling. You can now enable cluster autoscaling using ROSA clusters. Cluster autoscaling automatically adjusts the size of a cluster so that all pods have a place to run, and there are no unneeded nodes. You can enable autoscaling during and after cluster creation using either OpenShift Cluster Manager or the ROSA CLI (rosa). For more information, see Cluster autoscaling.

Shared virtual private clouds. ROSA now supports installing clusters into VPCs shared among AWS accounts that are part of AWS organizations. AWS account installing ROSA cluster can now use shared subnets owned by a management account. For more information, see Configuring a shared virtual private cloud for ROSA clusters.

Machine pool disk volume size. You can now configure your machine pool disk volume size for additional flexibility. You can select your own sizing for the disk volumes of their worker machine pool nodes. For more information, see Configuring machine pool disk volume.

Machine pool update. You can now add taints to the machine pool that is automatically generated during cluster creation. You can also delete this machine pool. This new feature provides more flexibility and cost-effectiveness for cluster administrators, specifically in regards to scaling infrastructure based on changing resource requirements. For more information, see Creating a machine pool.

ROSA regions added. Red Hat OpenShift Service on AWS (ROSA) is now available in the following regions:

Documentation update. The CLI Tools section was added to the ROSA documentation and includes more detailed information to help you fully use all of the supported CLI tools. The ROSA CLI section can now be found nested inside the CLI Tools heading. For more information, see CLI tools overview.

Documentation update. The Monitoring section in the documentation was expanded and now includes more detailed information to help you conveniently manage your ROSA clusters. For more information, see About Red Hat OpenShift Service on AWS monitoring.

ROSA CLI update. The ROSA CLI (rosa) was updated to a new version. For information about what has changed in this release, see the ROSA CLI release notes. For more information about the ROSA CLI (rosa), see About the ROSA CLI.

ROSA region added. Red Hat OpenShift Service on AWS (ROSA) is now available in the United Arab Emirates (me-central-1) region. For more information on region availability, see Regions and availability zones.

Hosted control planes. Red Hat OpenShift Service on AWS (ROSA) with hosted control planes (HCP) clusters are now available as a Technology Preview feature. This new architecture provides a lower-cost, more resilient ROSA architecture. For more information, see Creating ROSA with HCP clusters using the default options.

OIDC provider endpoint URL update. Starting with ROSA CLI version 1.2.7, all new cluster OIDC provider endpoint URLs are no longer regional. Amazon CloudFront is part of this implementation to improve access speed, reduce latency, and improve resiliency. This change is only available for new clusters created with ROSA CLI 1.2.7 or later. There are no supported migration paths for existing OIDC provider configurations.