Red Hat OpenShift for Windows Containers - Technical Overview

Windows Container Support for Red Hat OpenShift is a feature providing the ability to run Windows compute nodes in an OpenShift Container Platform cluster. This is now possible by using the Red Hat Windows Machine Config Operator (WMCO) to install and manage Windows nodes. With Windows nodes available, you can run Windows container workloads in OpenShift Container Platform. In this briefing, Red Hat's Anand Chandramohan will discuss the development of the WMCO, which provides all Windows container workload capabilities in OpenShift Container Platform and members of the technical staff will demonstrate how it all works.

Transcript

1. December 2020
   Red Hat OpenShift for Windows
   Containers - Technical Overview
   Anand Chandramohan, Product Manager
   Aravindh Puthiyaparambil, Windows Lead Engineer
   1
   

   View Slide

2. What we’ll
   discuss today
   Agenda
   2 Source:
   Insert source data here
   Insert source data here
   Insert source data here
   Introduction to Windows Containers
   Technical Overview
   .NET workloads to OpenShift
   Competitive differentiators
   Roadmap Overview
   Resources and Q&A
   

   View Slide

3. Introduction to
   Windows
   Containers
   3
   

   View Slide

4. Why run Windows Containers
   ● Windows Server still enjoys significant presence amongst
   server operating systems in the data center
   ● .NET has been and continues to be used widely for
   application development
   ● Traditionally Windows ran largely independent of Linux
   ● Adoption of microservices and containers requires
   Windows to embrace open source and Linux-based
   technologies
   ● To fully embrace containers and microservices Windows-
   based machines must now:
   ○ Lift legacy workloads
   ○ Containerize legacy Windows workloads
   ○ Strangle the monolith and support hybrid deployments
   Background
   

   View Slide

5. Benefits of Windows Containers
   Benefits
   Kubernetes for Windows Developers
   5
   Accelerate your
   public and
   hybrid cloud
   strategy
   Gain
   application
   portability,
   agility, control
   Reduce
   infrastructure
   and
   management
   costs
   

   View Slide

6. Why Red Hat OpenShift for Windows Containers
   6
   Realize the benefits of containers
   Application portability, speed, flexibility
   Modernize and gain efficiencies
   Support legacy workloads efficiently
   Developer Productivity
   Get exposure to Kubernetes without having to rebuild
   applications
   

   View Slide

7. Developer Productivity
   Cluster Services
   Automated Ops ⠇Over-The-Air Updates ⠇Monitoring ⠇Registry ⠇Networking ⠇Router ⠇KubeVirt ⠇OLM ⠇Helm
   8
   Red Hat Enterprise Linux & RHEL CoreOS
   Kubernetes
   Developer CLI ⠇VS Code
   extensions ⠇IDE Plugins
   Code Ready Workspaces
   CodeReady Containers
   Service Mesh ⠇Serverless
   Builds ⠇CI/CD Pipelines
   Full Stack Logging
   Chargeback
   Databases ⠇Languages
   Runtimes ⠇Integration
   Business Automation
   100+ ISV Services
   Platform Services Application Services Developer Services
   Introduction to the Offering: High Level Architecture/Design/Building
   Blocks
   Physical Virtual Private cloud Public cloud
   Build Cloud-Native Apps
   Manage Workloads
   Multi-cluster Management
   Discovery ⠇Policy ⠇Compliance ⠇Configuration ⠇Workloads
   Managed cloud
   (Azure, AWS, IBM, Red Hat)
   Windows Server
   Nodes
   

   View Slide

8. 9
   Control plane
   Windows traditional .NET
   framework containers
   Windows application
   Linux
   containers
   .NET core
   containers
   Windows
   containers
   Linux
   containers
   Windows
   virtual machine
   Red Hat OpenShift
   virtualization
   Red Hat Enterprise
   Linux CoreOS
   Microsoft Windows
   Mixed Windows
   and Linux
   workloads
   • Run Linux containers on RHEL
   • Run .NET core containers on RHEL
   • Run traditional .NET framework
   containers on Windows
   • Run Windows VMs with CNV
   (Container Native Virtualization)
   • All scheduled and managed
   by Red Hat OpenShift
   Mixed Windows and Linux workloads
   

   View Slide

9. OpenShift
   OpenShift
   Windows for Containers or Virtualization?
   10
   OpenShift Virtualization
   ▸ Rehost existing virtual machines within OpenShift with
   the goal of modernizing applications over time without
   having to rebuild
   Windows for Containers
   ▸ Refactor traditional .NET applications on Windows
   Server Containers and deploy to Windows nodes on
   OpenShift
   .NET Framework 3.5, 4.x
   (Legacy .NET)
   .NET Core
   (Modern .NET)
   Windows Server 2019 Core
   Red Hat Enterprise Linux CoreOS
   Red Hat Enterprise Linux
   Legacy
   virtualization
   (Weblogic, Apache,
   Database, .NET)
   Virtual Machine
   

   View Slide

10. Step OpenShift Feature Use case Advantages Trade Offs
    Rehost OpenShift Virtualization Lift & Shift Windows VMs to OpenShift Easy and low friction No benefits of containerization
    Refactor Windows Machine Config
    Operator
    Containerize and run traditional .NET
    framework apps on Windows Server
    Containers and deploy to Windows
    worker nodes on OCP
    Benefits of containerization &
    OpenShift
    Evolving Windows container
    ecosystem, supported only for newer
    version of Windows including Windows
    Server 2019
    Rearchitect RHEL/RHCOS containers Migrate traditional .NET frameworks
    apps to .NET Core and deploy to
    RHEL containers in OpenShift.
    Full benefit of containerization and
    OpenShift, highly evolved community
    Migration effort involved, time
    consuming
    Rebuild RHEL/RHCOS containers Build Cloud Native apps using Linux
    containers and deploy to
    RHEL/RHELCoreOS on OpenShift.
    Full benefit of containerization and
    OpenShift highly evolved community
    Net new development may not be an
    option for customers running in
    maintenance mode
    Use cases for Windows container workloads on OpenShift
    

    View Slide

11. Technical
    Overview
    12
    

    View Slide

12. Introducing the Windows Machine Config Operator: Available in Cluster
    Operator Hub
    13
    Entry Point
    The Windows Machine Config Operator (WMCO) is the entry point for
    OpenShift customers who want to run Windows workloads on their clusters.
    Day 2 Operations
    The intent of this feature is to allow a cluster administrator to add a
    Windows worker node as a day 2 operation with a prescribed configuration
    to an installer provisioned OpenShift 4.6 cluster and enable scheduling of
    Windows workloads.
    OVN-Hybrid
    The Prerequisite is an OpenShift 4.6+ cluster configured with hybrid OVN
    Kubernetes networking.
    

    View Slide

13. 14
    Windows Machine Config Operator Architecture
    WMCB
    CNI
    Kubelet
    Kube-proxy
    Hybrid-overlay
    Payload
    Windows machine
    config operator
    Watches
    Windows MachineSet Windows machine
    Kube-proxy
    CNI
    Hybrid-overlay
    Kubelet
    Windows virtual
    machine
    Windows machine config bootstrapper (WMCB)
    Configures
    Installs operator
    Results in creation of virtual machines
    Cluster admin On cluster OperatorHub
    Cluster admin
    Copy binaries
    configure services
    

    View Slide

14. 15
    ● Windows Machine Config Operator is Linux based operator that runs on Linux based
    master/worker nodes. It listens for machine objects that are of type Windows. And reaches
    out to them over SSH.
    ● Windows specific services installed on each node are the following.
    ○ Windows Machine Config Bootstrapper, kubelet, hybrid-overlay, kube-proxy, CNI
    package.
    ● The requirement to install everything as a services vs a pod is based on the way Windows
    containers contain a kernel and thus are operating systems.
    ● As part of CPaaS we will build all required code from openshift repositories. Windows
    based services are compiled using a cross compiling processes on Linux based systems.
    Building for Windows Container
    

    View Slide

15. Windows Machine Config Operator Workflow (WMCO)
    16
    ● Copies the following files Windows Machine Config Bootstrapper (WMCB), Worker ignition file from the
    cluster, kubelet, hybrid-overlay, kube-proxy, CNI package
    ● It then Remotely executes:
    ○ WMCB to configure the kubelet
    ○ hybrid-overlay
    ■ Creates the OpenShift HNS networks
    ○ WMCB to configure CNI
    ■ Configures the kubelet for the CNI plugin
    ○ Kube-proxy
    ■ Maintains network rules on nodes allowing outside communication
    ● Approve Certificate Signing Requests (CSRs)
    

    View Slide

16. Windows Machine Config Operator (WMCO) Workflow
    17
    Transfer binaries
    Includes Windows machine
    config bootstrapper
    Remotely execute WMCB
    to configure kubelet
    Configure kubelet Run hybrid-overlay
    Create Red Hat Openshift
    HNS network
    Configure kubelet
    for CNI plugin
    Configure CNI Set up kube-proxy
    Maintains network rules on
    nodes allowing outside
    communication
    

    View Slide

17. Red Hat OpenShift for Windows Containers Supported Platforms
    Platform Supported Coming Soon
    Azure Yes
    AWS Yes
    vSphere No ETA Jan 2021
    Bare metal No Q1 2021
    Red Hat Virtualization No Yes
    OpenStack No Yes
    Host Offerings (Azure
    Red Hat OpenShift
    etc)
    No Yes
    Supported Operating Systems for
    Windows Worker Nodes
    The following Windows Server operating
    systems are supported in the initial release of
    the WMCO: Windows Server Long-Term
    Servicing Channel (LTSC): Windows Server
    2019*
    * Has to be on version 10.0.17763.1457 or older
    

    View Slide

18. Windows Machine Config Operator Workflow
    Install Operator
    Navigate to the in-cluster
    Operator Hub and search
    for the Windows Operator
    and click “Install”
    1
    Create a MachineSet
    .
    2
    Operator configures machines
    to worker nodes
    ● The operator is configured to
    watch for Machines with a
    machine.openshift.io/os-id:
    Windows label.
    ● The operator will do all the
    necessary steps to configure
    the underlying VM so that it
    can join the cluster as a
    worker node.
    3
    ● The way a user will initiate
    the process is by creating a
    MachineSet which uses a
    Windows image with the
    Docker container runtime
    installed.
    ● It usually takes about 15
    minutes for the Windows
    Machine to be configured as
    a worker node. Ensure the
    Windows Node is in a Ready
    state before deploying a
    workload
    l
    

    View Slide

19. Windows Machine Config Operator Upgrade Process
    Verify Annotation
    Each Windows node is checked for
    the WMCO version annotation, if the
    annotated version of a Windows node
    does not match the WMCO version,
    and the number of unavailable
    Windows nodes is less than
    maxUnhealthy value, the associated
    Machine is deleted.
    Annotate
    The new WMCO reconciles as usual,
    ensuring that all unconfigured
    Windows Machines are configured
    and join the cluster as a node. Each of
    them are given an annotation
    indicating the WMCO version that
    configured them.
    New Version Released
    If the current cluster version fulfills
    the minimum Kubernetes version
    requirement, OLM upgrades WMCO.
    If the cluster version is not high
    enough, the WMCO upgrade will
    occur once it is.
    03
    01 02
    01
    02
    03
    04
    Detect Replacement
    When a replacement Machine is
    created by the Machine API Operator,
    WMCO will reconcile again and
    configure the VM. This will repeat until
    all Windows nodes have been
    configured by the upgraded WMCO.
    

    View Slide

20. Windows Machine Config Operator is not responsible for Windows operating
    system updates. The cluster administrator provides the Window image while
    creating the VMs and hence, the cluster administrator is responsible for providing
    an updated image. The cluster administrator can provide an updated image by
    changing the image in the MachineSet spec.
    

    View Slide

21. Benefits of Red Hat OpenShift for Windows Containers
    22
    ● Automated approach to make
    Windows node join OCP cluster
    ● Leverage out of the box OVN
    networking or replace it with Tigera
    solutions*
    ● Windows Kubernetes Lifecycling
    ● Console and oc integration*
    ● Logging and Monitoring*
    ● Complete Windows Coverage
    * Work in progress
    

    View Slide

22. .NET workloads
    on OpenShift
    23
    

    View Slide

23. 24
    What OS to target with .NET Containers?
    .NET Framework 3.5, 4.x
    (Legacy .NET)
    .NET Core
    (Modern .NET)
    Windows Server 2019 Core
    Windows Server 2019 Core
    Red Hat Enterprise Linux CoreOS
    Red Hat Enterprise Linux
    

    View Slide

24. Using .NET with Windows Containers (cont.)
    25
    ▸ These are Microsoft’s recommendations from the
    whitepaper: .NET Microservices: Architecture for
    Containerized .NET applications
    

    View Slide

25. Compatible
    version
    .NET
    Framework
    .NET Core
    Incompatible
    version
    Windows
    Nodes
    RHEL Nodes
    RHEL Nodes
    Windows
    Nodes
    Port to .NET
    core
    OpenShift
    Windows
    Containers
    Windows
    Nodes
    Decision Tree for targeting .NET workloads on OpenShift
    

    View Slide

26. .NET API Port tool/Analyze portability
    The .NET Portability Analyzer is a tool that analyzes assemblies and provides a
    detailed report on .NET APIs that are missing for the applications or libraries
    to be portable on your specified targeted .NET platforms. The Portability
    Analyzer is offered as a Visual Studio Extension, which analyzes one assembly
    per project, and as a ApiPort console app, which analyzes assemblies by
    specified files or directory.
    .NET API Port tool: https://github.com/microsoft/dotnet-apiport
    

    View Slide

27. Competitive
    differentiators
    28
    

    View Slide

28. Competitive Differentiators: Red Hat OpenShift for Windows
    Containers
    ● Support for numerous platforms
    ○ Clouds (AWS, Azure)
    ○ Incremental support planned for: vSphere, bare metal, Red Hat
    Virtualization, and OpenStack (on-premises) and ARO and AMRO (hosted
    services)
    ● An operator based experience for:
    ○ Provisioning new Windows worker nodes
    ○ MachineAPI support for autoscaling Windows server nodes in the cluster
    ○ Automatic and rolling upgrades and life cycling of Kube related software
    on Windows
    ● Better dashboard UX experience for managing Windows containers
    ● Out of box hybrid (cross between Windows and Linux) networking based on
    OVN
    ● Better automation of service and route creation for the container in the user
    flow from the web console
    Competitive Overview
    29
    OpenShift vs. Anthos/Rancher/Tanzu/*KS
    

    View Slide

29. Roadmap
    30
    

    View Slide

30. Red Hat OpenShift for Windows Containers
    GA Mid Term
    (6-9 months)
    Long Term
    (9+ months)
    31
    SUBJECT TO CHANGE
    WINDOWS
    `
    WINDOWS
    WINDOWS
    ● vSphere support
    ● Support for BYOH (BM, OpenStack)
    ● Harden Monitoring/Logging solution
    ● Harden storage solution
    ● Moving to containerd runtime
    ● Harden upgrade strategy (handle CVE fixes),
    cluster upgrade (4.6 - 4.7 etc), guidance for
    picking up Windows fixes
    ● Auto-scaling Windows nodes
    ● Some level of scale and performance testing
    ● Example of using GMSA
    ● Basic config [Bring up Windows instance,
    configure kubelet/network and joins cluster as
    worker node, bring up workloads]
    ● Support for MachineSet API
    ● Support AWS, Azure
    ● Delivering K8s component patches, update, drain,
    reboot
    ● Support for Hosted Platforms (ARO, AMRO, OSD
    etc)
    ● Pipeline Integration (Tekton, Octopus)
    ● Knative Automations
    ● Service Mesh Integrations
    ● Policy enforcement using OPA
    ● Templating of Multiple Images across operating
    system types
    ● Deeper UI changes
    ● Equal Resource Management Policies in
    Kubernetes
    

    View Slide

31. Red Hat OpenShift for Windows Containers
    Limitations
    32
    Windows containers does not have:
    ● Serverless
    ● OpenShift Pipelines (Jenkins of Tekton)
    ● Thanos User Workload Monitoring
    ● Service Mesh
    ● Cost Management
    ● CodeReady (Containers and Workspaces)
    ● Odo
    ● Builds v2 or BuildConfig or s2i
    ● An Operating System Red Hat ships
    

    View Slide

32. CTA
    33
    Visit Topic Page: https://www.openshift.com/learn/topics/windows-containers
    

    View Slide

33. Demo
    34
    https://www.pscp.tv/w/1ypKdwZQONYxW
    

    View Slide

34. Available
    Resources
    35
    

    View Slide

35. How can I learn more?
    36
    ○ Recorded demos:
    ■ Twitch: Ask the experts Windows for Containers hour
    ○ Red Hat OpenShift Blog: Technical and Business overview
    

    View Slide

36. linkedin.com/company/red-hat
    youtube.com/user/RedHatVideos
    facebook.com/redhatinc
    twitter.com/RedHat
    Red Hat is the world’s leading provider of enterprise
    open source software solutions. Award-winning
    support, training, and consulting services make
    Red Hat a trusted adviser to the Fortune 500.
    Thank you
    37
    

    View Slide