Release notes

• Previous releases allowed you to expose services from other namespaces, however if the target of the service became unavailable skupper service status was unable to report the failure. With this release, skupper init --enable-cluster-permissions and skupper expose --target-namespace <ns> allows you to expose and monitor services with targets in other namespaces. See Exposing services from other namespaces for more information.
• You can now encrypt traffic from the pod to the Skupper router.
• You can now expose deploymentconfig objects from OpenShift 3.11 clusters.
• By default, a console is not provisioned when you create a site. To enable a console, see Using the Skupper console.

• The LTS release stream provides only bug fixes. No new enhancements will be added to this stream.
• To remain in a supported configuration, you must upgrade to the latest micro release in the LTS release stream.
• The LTS version will be supported for at least 12 months from the time of the Red Hat Service Interconnect 1.4.1 GA.

Command-line interface

• RHEL 8 x86-64
• RHEL 9 x86-64

• RHEL 8 x86-64
• RHEL 9 x86-64

OpenShift versions

• OpenShift 3.11
• OpenShift 4.10, 4.11 and 4.12
• ROSA and ARO
• OpenShift Container Platform and OpenShift Dedicated

Ingress types

• LoadBalancer
• OpenShift Routes

CPU architecture

• x86-64

Ingress types

• Contour
• Nginx - This requires configuration for TLS passthrough
• NodePort

• SKUPPER-1723 - Connection and status behaviors for 1.4 release

  Some behaviors of service networks are unexpected:

  • Unexposing a service does not terminate established connections.
  • The 'skupper network status' command displays output for services that have been unexposed.

  Workaround

  Manually close all connections associated with the service before unexposing that service.

  Note

  This issue is resolved for release 1.5.

• SKUPPER-306 - Skupper network status doesn’t work with a large number of sites

  Depending on the topology of the service network, skupper network status might time-out and not provide the information required.

  Workaround

  You can extend the time-out to provide more time for the command to resolve, for example:

  skupper network status --timeout 10m

  Alternatively, upgrade to Red Hat Service Interconnect 1.5 which has a different mechanism for resolving network status.

• SKUPPER-1069 - skupper init fails on non-OpenShift clusters

  If you create a site on a non-OpenShift cluster you might encounter a problem creating sites, with skupper status reporting pending.

  If you check the pods, you might see status similar to the following:

  $ kubectl get pods
  NAME                                         READY   STATUS                       RESTARTS   AGE
  skupper-router-698478664c-6xq72              0/2     CreateContainerConfigError   0          17s
  skupper-service-controller-698c785d7-dqc8m   0/1     CreateContainerConfigError   0          10s

  To confirm you are encountering this problem, search for a Kubernetes event similar to the following:

  $ kubectl get events| grep Warning
  
  Warning  Failed          17m (x4 over 17m)     kubelet            Error: container has runAsNonRoot and image will run as root

  Workaround

  Specify a user id as follows:

  $ skupper init --run-as-user 2000

  where 2000 is the id of the user you want to run the containers. You can assign any non-zero number as id.

  If you are creating sites using YAML, you specify the user in the data section:

    data:
      name: my-site
      run-as-user: "2000"

  Note

  This workaround does not enable you to deploy the Red Hat Service Interconnect console component on this site. You must deploy the console component on an OpenShift site until this issue is resolved.

• SKUPPER-869 - Enable idle connection timeouts for the TCP transport

  If an endpoint is terminated, for example a client is killed, the other endpoint observes a half-closed connection. If the other endpoint does not close the connection or attempt to send data to the connection, the Skupper router does not release the memory allocated to that connection

  Workaround

  Avoid client server configurations that use this behavior if possible. For example, if a server automatically closes dormant connections, or attempts to communicate with client, the Skupper router frees the memory when a client is terminated.

• SKUPPER-805 - skupper init doesn’t work for ordinary user on OCP 3.11

  Workaround

  Two workarounds are available:

  • Use YAML to configure a site.
  • Create a service account with the following permissions to run the skupper CLI:

  ---
  apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    name: skupper-non-admin
  rules:
  - apiGroups:
    - ""
    resources:
    - configmaps
    - pods
    - pods/exec
    - services
    - secrets
    - serviceaccounts
    verbs:
    - get
    - list
    - watch
    - create
    - update
    - delete
  - apiGroups:
    - apps
    resources:
    - deployments
    - statefulsets
    - daemonsets
    verbs:
    - get
    - list
    - watch
    - create
    - update
    - delete
  - apiGroups:
    - route.openshift.io
    resources:
    - routes
    verbs:
    - get
    - list
    - watch
    - create
    - delete
  - apiGroups:
    - networking.k8s.io
    resources:
    - ingresses
    - networkpolicies
    verbs:
    - get
    - list
    - watch
    - create
    - delete
  - apiGroups:
    - projectcontour.io
    resources:
    - httpproxies
    verbs:
    - get
    - list
    - watch
    - create
    - delete
  - apiGroups:
    - rbac.authorization.k8s.io
    resources:
    - rolebindings
    - roles
    verbs:
    - get
    - list
    - watch
    - create
    - delete

  You can save the YAML above to role.yaml, apply it and bind the role to a username using:

  $ oc apply -f role.yaml
  $  oc policy add-role-to-user skupper-non-admin <username> -n <namespace-name> --role-namespace=<namespace-name>