Chapter 2. New features and enhancements

Google Cloud support for OpenShift sandboxed containers

You can now run OpenShift sandboxed containers workloads on Google Cloud. OpenShift sandboxed containers provides enhanced isolation for workloads, such as CI, that require elevated privileges.

initdata for Confidential Containers

Confidential Containers now support the initdata specification for configuring a peer pod at runtime, avoiding the need to embed sensitive data in the peer pod virtual machine image. This feature enhances security by reducing exposure of confidential information and improves flexibility by eliminating custom image builds. You can apply an initdata configuration globally or to a specific pod.

Custom peer pod VM image support

OpenShift sandboxed containers and Confidential Containers now support custom virtual machine images for peer pods. This feature enables you to select an image that is tailored to your workload requirements. The custom image is referenced by adding an annotation to the pod manifest and it overrides the default image specified in the peer pods config map.

Kata Agent policy customization

The Kata agent policy is a security mechanism that controls agent API requests for pods running with the Kata runtime. This policy determines which operations are allowed or denied. You can override the default policy with a custom policy for testing or development by adding an annotation to a peer pod manifest. In production environments, use initdata to change the policy.

Overriding default cluster credentials

Since version 1.7, OpenShift sandboxed containers uses the credentials of the OpenShift Container Platform cluster, which are provided by the Cloud Credentials Operator, by default. You can override the default credentials by creating a peer pods secret that specifies your cloud provider credentials. If you uninstall the Cloud Credentials Operator, you must create a peer pods secret.