Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-75886

[Documentation][Security and compliance] Clarify node.openshift.io/os_id usage for RHCOS nodes in OpenShift 4.19 or newer

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Major Major
    • None
    • 4.19.z, 4.20.z, 4.21.z
    • Documentation
    • None
    • None
    • False
    • Hide

      None

      Show
      None
    • None
    • Important
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      Description of problem:

      Starting from OpenShift 4.19, RHCOS is built on top of a shared RHEL base image [1].
      In recent OpenShift 4.19+/4.20-based RHCOS builds, /etc/os-release reports ID="rhel" even though the product remains Red Hat Enterprise Linux CoreOS (VARIANT=CoreOS).
      As a result, nodes may be labeled with "node.openshift.io/os_id=rhel”

      [metal3@testsv01 dev-scripts]$ oc debug node/master-0
      ...
      sh-5.1# cat /etc/os-release 
      NAME="Red Hat Enterprise Linux CoreOS"
      VERSION="9.6.20260117-0 (Plow)"
      ID="rhel"
      ID_LIKE="fedora"
      VERSION_ID="9.6"
      PLATFORM_ID="platform:el9"
      PRETTY_NAME="Red Hat Enterprise Linux CoreOS 9.6.20260117-0 (Plow)"
      ...'
      VARIANT=CoreOS
      VARIANT_ID=coreos
      OPENSHIFT_VERSION="4.20"
      sh-5.1# 
      metal3@testsv01 dev-scripts]$ oc get clusterversions
      NAME      VERSION   AVAILABLE   PROGRESSING   SINCE   STATUS
      version   4.20.12   True        False         6m47s   Cluster version is 4.20.12
      [metal3@testsv01 dev-scripts]$ oc get nodes -o yaml | yq '.items[].metadata.labels."node.openshift.io/os_id"'
      "rhel"
      "rhel"
      "rhel"
      [metal3@testsv01 dev-scripts]${code}
       
      
      The current documentation uses a fixed example with {color:#de350b}node.openshift.io/os_id: "rhcos":{color}
      https://docs.redhat.com/es/documentation/openshift_container_platform/4.19/html/security_and_compliance/file-integrity-operator#important-file-integrity-object-attributes_file-integrity-operator
      {code:java}
      6.7.2. Important attributes 
      node.openshift.io/os_id: "rhcos"  schedules on all Red Hat Enterprise Linux CoreOS (RHCOS) nodes.
      

      In such environments, this example prevents AIDE pods from being scheduled on RHCOS nodes.

      The documentation should either:
      use node-role based selectors, or clarify that node.openshift.io/os_id may be rhel even for RHCOS nodes.

      [1] https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/release_notes/index#ocp-4-19-rhcos-split-layers_release-notes

      1.4.5. Red Hat Enterprise Linux CoreOS (RHCOS) versioning uses Red Hat Enterprise Linux (RHEL) instead of OpenShift Container Platform 
      
      As part of aligning with Image Mode for RHEL, RHCOS is now built as a layer on top of a shared RHEL base image. The most noticeable change for users is around versioning. For example, VERSION_ID in /etc/os-release now reflects the version of RHEL, such as RHEL 9.6, rather than the version of OpenShift Container Platform, such as OpenShift Container Platform 4.19. This version change might show up in other places, such as in the output of the command rpm-ostree status, or in boot loader entries. OPENSHIFT_VERSION in /etc/os-release on the node image still uses the version of OpenShift Container Platform and is unaffected by this change.

       

      Version-Release number of selected component (if applicable):

      4.19
      6.7.2. Important attributes 
      https://docs.redhat.com/es/documentation/openshift_container_platform/4.19/html/security_and_compliance/file-integrity-operator#important-file-integrity-object-attributes_file-integrity-operator
      
      4.20
      6.7.2. Important attributes 
      https://docs.redhat.com/es/documentation/openshift_container_platform/4.20/html/security_and_compliance/file-integrity-operator#important-file-integrity-object-attributes_file-integrity-operator
      
      4.21    
      6.7.2. Important attributes 
      https://docs.redhat.com/es/documentation/openshift_container_platform/4.21/html/security_and_compliance/file-integrity-operator#important-file-integrity-object-attributes_file-integrity-operator
       

              ocp-docs-bot OCP DocsBot
              rhn-support-tsaito Takeshi Saito
              None
              None
              None
              None
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated: