Chapter 1. Release notes for Red Hat Advanced Cluster Management Learn about new features and enhancements, support, deprecations, removals, and Errata bug fixes. Important: Cluster lifecycle components and features are within the multicluster engine operator, which is a software operator that enhances cluster fleet management. Release notes for multicluster engine operator-specific features are found in at Release notes for Cluster lifecycle with multicluster engine operator . What's new for Red Hat Advanced Cluster Management Errata updates for Red Hat Advanced Cluster Management Known issues and limitations for Red Hat Advanced Cluster Management Deprecations and removals for Red Hat Advanced Cluster Management Red Hat Advanced Cluster Management for Kubernetes considerations for GDPR readiness FIPS readiness Observability support Important: OpenShift Container Platform release notes are not documented in this product documentation. For your OpenShift Container Platform cluster, see OpenShift Container Platform release notes . Deprecated: Red Hat Advanced Cluster Management 2.8 and earlier versions are no longer supported. The documentation might remain available, but without any Errata or other updates. Best practice: Upgrade to the most recent version. The documentation references the earliest supported Red Hat OpenShift Container Platform versions, unless the component in the documentation is created and tested with only a specific version of OpenShift Container Platform. For full support information, see the Red Hat Advanced Cluster Management Support Matrix and the Lifecycle and update policies for Red Hat Advanced Cluster Management for Kubernetes . If you experience issues with one of the currently supported releases, or the product documentation, go to Red Hat Support where you can troubleshoot, view Knowledgebase articles, connect with the Support Team, or open a case. You must log in with your credentials. You can also learn more about the Customer Portal documentation at Red Hat Customer Portal FAQ . 1.1. What's new for Red Hat Advanced Cluster Management Red Hat Advanced Cluster Management for Kubernetes provides visibility of your entire Kubernetes domain with built-in governance, cluster lifecycle management, and application lifecycle management, along with observability. Important: Red Hat Advanced Cluster Management now supports all providers that are certified through the Cloud Native Computing Foundation (CNCF) Kubernetes Conformance Program. Choose a vendor that is recognized by CNFC for your hybrid cloud multicluster management. See the following information about using CNFC providers: Learn how CNFC providers are certified at Certified Kubernetes Conformance . For Red Hat support information about CNFC third-party providers, see Red Hat support with third party components , or Contact Red Hat support . If you bring your own CNFC conformance certified cluster, you need to change the OpenShift Container Platform CLI oc command to the Kubernetes CLI command, kubectl . 1.1.1. New features and enhancements for components Learn specific details about new features for components within Red Hat Advanced Cluster Management: Installation Console Clusters multicluster global hub Observability Governance Backup and restore Some features and components are identified and released as Technology Preview . Access the Red Hat Advanced Cluster Management Support matrix to learn about hub cluster and managed cluster requirements and support for each component. For lifecycle information, see Red Hat OpenShift Container Platform Life Cycle policy . 1.1.2. Installation You can enable the SiteConfig component from the MultiClusterHub custom resource that is deployed on your cluster. By default, the SiteConfig component is disabled. Learn more at MultiClusterHub advanced configuration . Learn more about SiteConfig operator at SiteConfig . Now when the MultiClusterHub resource prepares to install the multicluster engine operator, it implements CatalogSource priority as criteria. The Red Hat Advanced Cluster Management MultiClusterHub resource seeks the CatalogSource that contains the desired multicluster engine operator version that is compatible with the current Red Hat Advanced Cluster Management version. Learn more in the Catalog source priority section in Install in disconnected network environments . 1.1.3. Console Learn about what is new in the Red Hat Advanced Cluster Management integrated console. Command line interface (CLI) downloads are now available in the console, which are available from the acm-cli container image and are specified with the operating system and architecture. See Command line tools to access command line interface (CLI) downloads, such as the PolicyGenerator and policytools . View more information about your cluster when you enable the Fleet view switch. Many summary cards are redesigned, such as Cluster , Application types , Policies , and Nodes cards. Additionally, there are two new summary cards available, such as Cluster version and Worker core count . See the numerous changes to summary cards in the product console. You can now export data in a CSV file by using selecting the Export button. See Accessing your console . You can now view virtual machine resources from the console and your search results. Configure actions for the virtual machine resources. See Enabling virtual machine actions (Technology Preview) . See Search in the console for more information. 1.1.4. Clusters Important: Cluster lifecycle components and features are within the multicluster engine operator, which is a software operator that enhances cluster fleet management. Release notes for multicluster engine operator-specific features are found in at Release notes for Cluster lifecycle with multicluster engine operator . You can now enable and use SiteConfig operator as a template-driven cluster provisioning solution, which allows you to provision clusters with all available installation methods. Learn more about SiteConfig operator at SiteConfig . View other Cluster lifecycle tasks and support information at Cluster lifecycle with multicluster engine operator overview . 1.1.5. multicluster global hub You can now enable the local-cluster on your managed hub clusters by importing your managed hub cluster in hosted mode. See Importing a managed hub cluster in the hosted mode (Technology Preview) . For other multicluster global hub topics, see multicluster global hub . 1.1.6. Applications You can now use the Red Hat Advanced Cluster Management GitOpsCluster to register a non-OpenShift Container Platform cluster to a Red Hat OpenShift GitOps cluster, giving you more ways to deploy your application. For more information, see: Registering non-OpenShift Container Platform clusters to Red Hat OpenShift GitOps . For other Application topics, see Managing applications . 1.1.7. Observability For more environment stability with default settings, the default CPU request is increased to 500m and memory request is increased to 1024Mi for the thanos-compact pod. See Observability pod capacity requests for more details. To create and mount secrets to your alertmanager pods for access to arbitrary content, you can add the contents to your MultiClusterObservability resource. See Mounting secrets within the Alertmanager pods . Grafana is updated to version 11.1.5. See Using Grafana dashboards . You can now use the Advanced search option from the console by selecting the Advanced search drop-down button. Specify your query and receive results that match the exact strings that you enter and range-based search parameters. See Search customization and configurations . Technology Preview : Use the new workers parameter in the ObservabilityAddOn custom resource definition to add more worker nodes into the metric collector procress to shard federate requests made to your hub cluster. See Enabling the observability service . See Observability service introduction . 1.1.8. Governance To configure a cluster based on the available node roles, you can now use the getNodesWithExactRoles function to receive a list of nodes, and use the hasNodesWithExactRoles function to receive confirmation about clusters that contain nodes with only the roles that you specified. See Template functions for more details. You can now define additional health checks and customize status messages for your resource kinds by configuring your ArgoCD resource. See Configuring policy health checks in Red Hat OpenShift GitOps for more information. To add more clarity for compliance messages in your configuration policies, you can now customize compliance messages by using the spec.customMessage fields. See the Kubernetes configuration policy controller . You can use the .PolicyMetadata hub cluster template variable now to access the metadata of a root policy. See the Comparison of hub cluster and managed cluster templates . You can now use the hubTemplateOptions.serviceAccountName field to specify a service account to expand and control access for all hub cluster template lookups. See the Comparison of hub cluster and managed cluster templates . To specify containerArguments in the Gatekeeper operator, provide a list of argument names and values to pass to the container. See the Gatekeeper custom resource sample . The default value for spec.evaluationInterval.compliant and spec.evaluationInterval.noncompliant is watch , so now you can use Kubernetes API watches instead of polling the Kubernetes API server. See Configuration policy YAML table for more information. With the new command-line tools, you can download the PolicyGenerator to generate policies with Kustomize from Kubernetes manifests. You can also use policytools with a template-resolver subcommand to resolve templates locally. See Policy Generator to learn more about the policy generator. See Policy command line interface for more details about policytools . As you directly apply Red Hat Advanced Cluster Management policies and Gatekeeper constraints on your managed clusters, you can now view the deployment of the policies in the Discovered policies tab from the console. See Policy deployment with external tools . See Governance to learn more about the dashboard and the policy framework. 1.1.9. Backup and restore You now have a scenario where you can run a disaster recovery test. By simulating a disaster, you can practice the following actions: restoring hub cluster data on a new hub cluster, verifying that data is recovered, and returning to the initial hub cluster by using the primary hub cluster as a the active hub cluster. See Returning to the initial hub cluster after a restore . You can now use an existing hub cluster as a restore hub cluster by tagging user-created resources on the restore hub cluster with the velero.io/backup-name: backupName label. See Constraints for using an existing hub cluster as a restore hub cluster and Tagging resources . You can now customize the OADP version by setting an annotation on your MultiClusterHub resource. See Installing a custom OADP version . You can now temporarily pause the BackupSchedule resource instead of deleting it. By using the BackupSchedule paused property on the backup hub cluster, you can avoid a backup collision. See Preventing backup collisions . You can now keep the primary hub cluster active during a restore operation. See Keeping the primary hub cluster active during a restore process . With Red Hat Advanced Cluster Management restore resources, you can set more velero.io.restore spec options. See Using other restore samples . To learn about disaster recovery solutions for your hub cluster, see Backup and restore . 1.1.10. multicluster engine operator with Red Hat Advanced Cluster Management integration If you later installed Red Hat Advanced Cluster Management after using stand-alone multicluster engine operator, you get access to all Red Hat Advanced Cluster Management features. You can enable the SiteConfig component from the MultiClusterHub custom resource that is deployed on your cluster. Learn more at MultiClusterHub advanced configuration . Learn more about SiteConfig operator at SiteConfig . 1.1.11. Learn more about this release Get an overview of Red Hat Advanced Cluster Management for Kubernetes from Welcome to Red Hat Advanced Cluster Management for Kubernetes . See more release notes, such as Known Issues and Limitations in the Release notes for Red Hat Advanced Cluster Management . See the Multicluster architecture topic to learn more about major components of the product. See support information and more in the Red Hat Advanced Cluster Management Troubleshooting guide. Access the open source Open Cluster Management repository for interaction, growth, and contributions from the open community. To get involved, see open-cluster-management.io . Visit the GitHub repository for more information. 1.2. Errata updates for Red Hat Advanced Cluster Management By default, Errata updates are automatically applied when released. The details are published here when the release is available. If no release notes are listed, the product does not have an Errata release at this time. Important: For reference, Jira links and Jira numbers might be added to the content and used internally. Links that require access might not be available for the user. See Upgrading by using the operator for more information about upgrades. Important: Cluster lifecycle components and features are within the multicluster engine operator, which is a software operator that enhances cluster fleet management. Release notes for multicluster engine operator-specific features are found in at Release notes for Cluster lifecycle with multicluster engine operator . 1.2.1. Errata 2.12.2 Delivers updates to one or more product container images. Ensures that the observability operator fails to reconcile if it cannot find the Red Hat Advanced Cluster Management 2.12 version of the image from the imagestream . ( ACM-15525 ) Configures the alertmanager high availability (HA) to make Prometheus send requests to all the alertmanagers . ( ACM-16211 ) Deletes the deployment of the observability-observatorium-operator and recreates the compact statefulset . ( ACM-14867 ) Checks for the existence of image pull secrets on the serviceaccount during the reconcile loop and updates the serviceaccount by replacing it with a serviceaccount without the search-pull-secret secret. ( ACM-15056 ) Reports the status of an existing subscription for the OperatorPolicy . ( ACM-15394 ) Changes the system so that the network time protocol (NTP) server specified in the InfraEnv gets used as a fallback. ( ACM-16163 ) Prevents buttons that check user permissions in namespaces from changing between Enabled and Disabled states. ( ACM-16019 ) Detects if the MultiClusterHub made any changes that need to be applied to the container images. ( ACM-16517 ) 1.2.2. Errata 2.12.1 Delivers updates to one or more product container images. Fixes the multicluster global hub search operator so that it can enable the globalSearchFeatureFlag , even when the multicluster engine operator target namespace is not the default. ( ACM-15075 ) Fixes the OpenShift Data Foundation Operator so that it can install comma-separated values (CSVs) with the OperatorPolicy . ( ACM-14540 ) 1.3. Known issues and limitations for Red Hat Advanced Cluster Management Review the known issues for application management. The following list contains known issues for this release, or known issues that continued from the release. Important: Cluster lifecycle components and features are within the multicluster engine operator, which is a software operator that enhances cluster fleet management. Release notes for multicluster engine operator-specific features are found in at Release notes for Cluster lifecycle with multicluster engine operator . Installation known issues Business continuity known issues Console known issues Cluster management known issues Application known issues Observability known issues Governance known issues Networking known issues Global Hub known issues Important: OpenShift Container Platform release notes are not documented in this product documentation. For your OpenShift Container Platform cluster, see OpenShift Container Platform release notes . For more about deprecations and removals, see Deprecations and removals for Red Hat Advanced Cluster Management . 1.3.1. Installation known issues Review the known issues for installing and upgrading. The following list contains known issues for this release, or known issues that continued from the release. For your Red Hat OpenShift Container Platform cluster, see OpenShift Container Platform known issues . For more about deprecations and removals, see Deprecations and removals for Red Hat Advanced Cluster Management . 1.3.1.1. Uninstalling and reinstalling earlier versions with an upgrade can fail Uninstalling Red Hat Advanced Cluster Management from OpenShift Container Platform can cause issues if you later want to install earlier versions and then upgrade. For instance, when you uninstall Red Hat Advanced Cluster Management, then install an earlier version of Red Hat Advanced Cluster Management and upgrade that version, the upgrade might fail. The upgrade fails if the custom resources were not removed. Follow the Cleaning up artifacts before reinstalling procedure to prevent this problem. 1.3.1.2. Infrastructure operator error with ARM converged flow When you install the infrastructure-operator , converged flow with ARM does not work. Set ALLOW_CONVERGED_FLOW to false to resolve this issue. Run the following command to create a ConfigMap resource: Apply your file by running oc apply -f . See the following file sample with ALLOW_CONVERGED_FLOW set to false : apiVersion: v1 kind: ConfigMap metadata: name: my-assisted-service-config namespace: assisted-installer data: ALLOW_CONVERGED_FLOW: false Annotate the agentserviceconfig with the following command: The agent appears in the inventory when the issue is resolved. 1.3.2. Business continuity known issues Review the known issues for Red Hat Advanced Cluster Management for Kubernetes. The following list contains known issues for this release, or known issues that continued from the release. For your Red Hat OpenShift Container Platform cluster, see OpenShift Container Platform known issues . For more about deprecations and removals, see Deprecations and removals for Red Hat Advanced Cluster Management . 1.3.2.1. Backup and restore known issues Backup and restore known issues and limitations are listed here, along with workarounds if they are available. 1.3.2.1.1. The open-cluster-management-backup namespace is stuck in the Terminating state When the cluster-backup component is disabled on the MultiClusterHub resource, the open-cluster-management-backup namespace is stuck in the Terminating state if you have a Velero restore resource created by a Red Hat Advanced Cluster Management restore operation. The Terminating state is a result of the Velero restore resources waiting on the restores.velero.io/external-resources-finalizer to complete. To workaround this issue, complete the following steps: Delete all Red Hat Advanced Cluster Management restore resources and wait for the Velero restore to be cleaned up before you disable the cluster backup option on the MultiClusterHub resource. If your open-cluster-management-backup namespace is already stuck in the Terminating state, edit all the Velero restore resources and remove the finalizers. Allow the Velero resources to delete the namespaces and resources. 1.3.2.1.2. Bare metal hub resource no longer backed up by the managed clusters backup If the resources for the bare metal cluster are backed up and restored to a secondary hub cluster by using the Red Hat Advanced Cluster Management back up and restore feature, the managed cluster reinstalls on the nodes, which destroys the existing managed cluster. Note: This only affects bare metal clusters that were deployed by using zero touch provisioning, meaning that they have BareMetalHost resources that manage powering on and off bare metal nodes and attaching virtual media for booting. If a BareMetalHost resource was not used in the deployment of the managed cluster, there is no negative impact. To work around this issue, the BareMetalHost resources on the primary hub cluster are no longer backed up with the managed cluster backup. If you have a different use case and want the managed BareMetalHost resources on the primary hub cluster to be backed up, add the following backup label to the BareMetalHost resources on the primary hub cluster: cluster.open-cluster-management.io/backup . To learn more about using this backup label to backup generic resources, see the topic, Resources that are backed up . 1.3.2.1.3. Velero restore limitations A new hub cluster can have a different configuration than the active hub cluster if the new hub cluster, where the data is restored, has user-created resources. For example, this can include an existing policy that was created on the new hub cluster before the backup data is restored on the new hub cluster. Velero skips existing resources if they are not part of the restored backup, so the policy on the new hub cluster remains unchanged, resulting in a different configuration between the new hub cluster and active hub cluster. To address this limitation, the cluster backup and restore operator runs a post restore operation to clean up the resources created by the user or a different restore operation when a restore.cluster.open-cluster-management.io resource is created. For more information, see the Cleaning the hub cluster after restore topic. 1.3.2.1.4. Passive configurations do not display managed clusters Managed clusters are only displayed when the activation data is restored on the passive hub cluster. 1.3.2.1.5. Managed cluster resource not restored When you restore the settings for the local-cluster managed cluster resource and overwrite the local-cluster data on a new hub cluster, the settings are misconfigured. Content from the hub cluster local-cluster is not backed up because the resource contains local-cluster specific information, such as the cluster URL details. You must manually apply any configuration changes that are related to the local-cluster resource on the restored cluster. See Prepare the new hub cluster in the Installing the backup and restore operator topic. 1.3.2.1.6. Restored Hive managed clusters might not be able to connect with the new hub cluster When you restore the backup of the changed or rotated certificate of authority (CA) for the Hive managed cluster, on a new hub cluster, the managed cluster fails to connect to the new hub cluster. The connection fails because the admin kubeconfig secret for this managed cluster, available with the backup, is no longer valid. You must manually update the restored admin kubeconfig secret of the managed cluster on the new hub cluster. 1.3.2.1.7. Imported managed clusters show a Pending Import status Managed clusters that are manually imported on the primary hub cluster show a Pending Import status when the activation data is restored on the passive hub cluster. For more information, see Connecting clusters by using a Managed Service Account . 1.3.2.1.8. The appliedmanifestwork is not removed from managed clusters after restoring the hub cluster When the hub cluster data is restored on the new hub cluster, the appliedmanifestwork is not removed from managed clusters that have a placement rule for an application subscription that is not a fixed cluster set. See the following example of a placement rule for an application subscription that is not a fixed cluster set: spec: clusterReplicas: 1 clusterSelector: matchLabels: environment: dev As a result, the application is orphaned when the managed cluster is detached from the restored hub cluster. To avoid the issue, specify a fixed cluster set in the placement rule. See the following example: spec: clusterSelector: matchLabels: environment: dev You can also delete the remaining appliedmanifestwork manually by running the folowing command: 1.3.2.1.9. The appliedmanifestwork not removed and agentID is missing in the specification When you are using Red Hat Advanced Cluster Management 2.6 as your primary hub cluster, but your restore hub cluster is on version 2.7 or later, the agentID is missing in the specification of appliedmanifestworks because the field is introduced in the 2.7 release. This results in the extra appliedmanifestworks for the primary hub on the managed cluster. To avoid the issue, upgrade the primary hub cluster to Red Hat Advanced Cluster Management 2.7, then restore the backup on a new hub cluster. Fix the managed clusters by setting the spec.agentID manually for each appliedmanifestwork . Run the following command to get the agentID : Run the following command to set the spec.agentID for each appliedmanifestwork : 1.3.2.1.10. The managed-serviceaccount add-on status shows Unknown The managed cluster appliedmanifestwork addon-managed-serviceaccount-deploy is removed from the imported managed cluster if you are using the Managed Service Account without enabling it on the multicluster engine for Kubernetes operator resource of the new hub cluster. The managed cluster is still imported to the new hub cluster, but the managed-serviceaccount add-on status shows Unknown . You can recover the managed-serviceaccount add-on after enabling the Managed Service Account in the multicluster engine operator resource. See Enabling automatic import to learn how to enable the Managed Service Account. 1.3.2.2. Volsync known issues 1.3.2.2.1. Manual removal of the VolSync CSV required on managed cluster when removing the add-on When you remove the VolSync ManagedClusterAddOn from the hub cluster, it removes the VolSync operator subscription on the managed cluster but does not remove the cluster service version (CSV). To remove the CSV from the managed clusters, run the following command on each managed cluster from which you are removing VolSync: 1.3.2.2.2. Restoring the connection of a managed cluster with custom CA certificates to its restored hub cluster might fail After you restore the backup of a hub cluster that manages a cluster with custom CA certificates, the connection between the managed cluster and the hub cluster might fail. This is because the CA certificate was not backed up on the restored hub cluster. To restore the connection, copy the custom CA certificate information that is in the namespace of your managed cluster to the <managed_cluster>-admin-kubeconfig secret on the restored hub cluster. Note: If you copy this CA certificate to the hub cluster before creating the backup copy, the backup copy includes the secret information. When you use the backup copy to restore in the future, the connection between the hub cluster and managed cluster automatically completes. 1.3.3. Console known issues Review the known issues for the console. The following list contains known issues for this release, or known issues that continued from the release. For your Red Hat OpenShift Container Platform cluster, see OpenShift Container Platform known issues . For more about deprecations and removals, see Deprecations and removals for Red Hat Advanced Cluster Management . 1.3.3.1. Cannot upgrade OpenShift Dedicated in console From the console you can request an upgrade for OpenShift Dedicated clusters, but the upgrade fails with the Cannot upgrade non openshift cluster error message. Currently there is no workaround. 1.3.3.2. Search PostgreSQL pod is in CrashLoopBackoff state The search-postgres pod is in CrashLoopBackoff state. If Red Hat Advanced Cluster Management is deployed in a cluster with nodes that have the hugepages parameter enabled and the search-postgres pod gets scheduled in these nodes, then the pod does not start. Complete the following steps to increase the memory of the search-postgres pod: Pause the search-operator pod with the following command: oc annotate search search-v2-operator search-pause=true Update the search-postgres deployment with a limit for the hugepages parameter. Run the following command to set the hugepages parameter to 512Mi : oc patch deployment search-postgres --type json -p '[{"op": "add", "path": "/spec/template/spec/containers/0/resources/limits/hugepages-2Mi", "value":"512Mi"}]' Before you verify the memory usage for the pod, make sure your search-postgres pod is in the Running state. Run the following command: oc get pod <your-postgres-pod-name> -o jsonpath="Status: {.status.phase}" Run the following command to verify the memory usage of the search-postgres pod: oc get pod <your-postgres-pod-name> -o jsonpath='{.spec.containers[0].resources.limits.hugepages-2Mi}' The following value appears, 512Mi . 1.3.3.3. Cannot edit namespace bindings for cluster set When you edit namespace bindings for a cluster set with the admin role or bind role, you might encounter an error that resembles the following message: ResourceError: managedclustersetbindings.cluster.open-cluster-management.io "<cluster-set>" is forbidden: User "<user>" cannot create/delete resource "managedclustersetbindings" in API group "cluster.open-cluster-management.io" in the namespace "<namespace>". To resolve the issue, make sure you also have permission to create or delete a ManagedClusterSetBinding resource in the namespace you want to bind. The role bindings only allow you to bind the cluster set to the namespace. 1.3.3.4. Horizontal scrolling does not work after provisioning hosted control plane cluster After provisioning a hosted control plane cluster, you might not be able to scroll horizontally in the cluster overview of the Red Hat Advanced Cluster Management console if the ClusterVersionUpgradeable parameter is too long. You cannot view the hidden data as a result. To work around the issue, zoom out by using your browser zoom controls, increase your Red Hat Advanced Cluster Management console window size, or copy and paste the text to a different location. 1.3.3.5. EditApplicationSet expand feature repeats When you add multiple label expressions or attempt to enter your cluster selector for your ApplicationSet , you might receive the following message repeatedly, "Expand to enter expression". You can enter your cluster selection despite this issue. 1.3.3.6. Unable to log out from Red Hat Advanced Cluster Management When you use an external identity provider to log in to Red Hat Advanced Cluster Management, you might not be able to log out of Red Hat Advanced Cluster Management. This occurs when you use Red Hat Advanced Cluster Management, installed with IBM Cloud and Keycloak as the identity providers. You must log out of the external identity provider before you attempt to log out of Red Hat Advanced Cluster Management. 1.3.3.7. Issues with entering the cluster-ID in the OpenShift Cloud Manager console If you did not access the cluster-ID in the OpenShift Cloud Manager console, you can still get a description of your OpenShift Service on AWS cluster-ID from the terminal. You need the OpenShift Service on AWS command line interface. See Getting started with the OpenShift Service on AWS CLI documentation. To get the cluster-ID , run the following command from the OpenShift Service on AWS command line interface: rosa describe cluster --cluster=<cluster-name> | grep -o '^ID:.* 1.3.4. Cluster management known issues and limitations Review the known issues for cluster management with Red Hat Advanced Cluster Management. The following list contains known issues and limitations for this release, or known issues that continued from the release. For Cluster lifecycle with the multicluster engine for Kubernetes operator known issues, see Cluster lifecycle known issues and limitations in the multicluster engine operator documentation. 1.3.4.1. Hub cluster communication limitations The following limitations occur if the hub cluster is not able to reach or communicate with the managed cluster: You cannot create a new managed cluster by using the console. You are still able to import a managed cluster manually by using the command line interface or by using the Run import commands manually option in the console. If you deploy an Application or ApplicationSet by using the console, or if you import a managed cluster into ArgoCD, the hub cluster ArgoCD controller calls the managed cluster API server. You can use AppSub or the ArgoCD pull model to work around the issue. The console page for pod logs does not work, and an error message that resembles the following appears: 1.3.4.2. The local-cluster might not be automatically recreated If the local-cluster is deleted while disableHubSelfManagement is set to false , the local-cluster is recreated by the MulticlusterHub operator. After you detach a local-cluster, the local-cluster might not be automatically recreated. To resolve this issue, modify a resource that is watched by the MulticlusterHub operator. See the following example: To properly detach the local-cluster, set the disableHubSelfManagement to true in the MultiClusterHub . 1.3.4.3. Local-cluster status offline after reimporting with a different name When you accidentally try to reimport the cluster named local-cluster as a cluster with a different name, the status for local-cluster and for the reimported cluster display offline . To recover from this case, complete the following steps: Run the following command on the hub cluster to edit the setting for self-management of the hub cluster temporarily: Add the setting spec.disableSelfManagement=true . Run the following command on the hub cluster to delete and redeploy the local-cluster: Enter the following command to remove the local-cluster management setting: Remove spec.disableSelfManagement=true that you previously added. 1.3.4.4. Hub cluster and managed clusters clock not synced Hub cluster and manage cluster time might become out-of-sync, displaying in the console unknown and eventually available within a few minutes. Ensure that the OpenShift Container Platform hub cluster time is configured correctly. See Customizing nodes . 1.3.5. Application known issues and limitations Review the known issues for application management. The following list contains known issues for this release, or known issues that continued from the release. For your Red Hat OpenShift Container Platform cluster, see OpenShift Container Platform known issues . For more about deprecations and removals, see Deprecations and removals for Red Hat Advanced Cluster Management . See the following known issues for the Application lifecycle component. 1.3.5.1. Application topology displays invalid expression When you use the Exist or DoesNotExist operators in the Placement resource, the application topology node details display the expressions as #invalidExpr . This display is wrong, and the expression is still valid and works in the Placement resource. To workaround this issue, edit the expression inside the Placement resource YAML. 1.3.5.2. Editing subscription applications with PlacementRule does not display the subscription YAML in editor After you create a subscription application that references a PlacementRule resource, the subscription YAML does not display in the YAML editor in the console. Use your terminal to edit your subscription YAML file. 1.3.5.3. Helm Chart with secret dependencies cannot be deployed by the Red Hat Advanced Cluster Management subscription Using Helm Chart, you can define privacy data in a Kubernetes secret and refer to this secret within the value.yaml file of the Helm Chart. The username and password are given by the referred Kubernetes secret resource dbsecret . For example, see the following sample value.yaml file: credentials: secretName: dbsecret usernameSecretKey: username passwordSecretKey: password The Helm Chart with secret dependencies is only supported in the Helm binary CLI. It is not supported in the operator SDK Helm library. The Red Hat Advanced Cluster Management subscription controller applies the operator SDK Helm library to install and upgrade the Helm Chart. Therefore, the Red Hat Advanced Cluster Management subscription cannot deploy the Helm Chart with secret dependencies. 1.3.5.4. Topology does not correctly display for Argo CD pull model ApplicationSet application When you use the Argo CD pull model to deploy ApplicationSet applications and the application resource names are customized, the resource names might appear different for each cluster. When this happens, the topology does not display your application correctly. 1.3.5.5. Local cluster is excluded as a managed cluster for pull model The hub cluster application set deploys to target managed clusters, but the local cluster, which is a managed hub cluster, is excluded as a target managed cluster. As a result, if the Argo CD application is propagated to the local cluster by the Argo CD pull model, the local cluster Argo CD application is not cleaned up, even though the local cluster is removed from the placement decision of the Argo CD ApplicationSet resource. To work around the issue and clean up the local cluster Argo CD application, remove the skip-reconcile annotation from the local cluster Argo CD application. See the following annotation: annotations: argocd.argoproj.io/skip-reconcile: "true" Additionally, if you manually refresh the pull model Argo CD application in the Applications section of the Argo CD console, the refresh is not processed and the REFRESH button in the Argo CD console is disabled. To work around the issue, remove the refresh annotation from the Argo CD application. See the following annotation: annotations: argocd.argoproj.io/refresh: normal 1.3.5.6. Argo CD controller and the propagation controller might reconcile simultaneously Both the Argo CD controller and the propagation controller might reconcile on the same application resource and cause the duplicate instances of application deployment on the managed clusters, but from the different deployment models. For deploying applications by using the pull model, the Argo CD controllers ignore these application resources when the Argo CD argocd.argoproj.io/skip-reconcile annotation is added to the template section of the ApplicationSet . The argocd.argoproj.io/skip-reconcile annotation is only available in the GitOps operator version 1.9.0, or later. To prevent conflicts, wait until the hub cluster and all the managed clusters are upgraded to GitOps operator version 1.9.0 before implementing the pull model. 1.3.5.7. Resource fails to deploy All the resources listed in the MulticlusterApplicationSetReport are actually deployed on the managed clusters. If a resource fails to deploy, the resource is not included in the resource list, but the cause is listed in the error message. 1.3.5.8. Resource allocation might take several minutes For large environments with over 1000 managed clusters and Argo CD application sets that are deployed to hundreds of managed clusters, Argo CD application creation on the hub cluster might take several minutes. You can set the requeueAfterSeconds to zero in the clusterDecisionResource generator of the application set, as it is displayed in the following example file: apiVersion: argoproj.io/v1alpha1 kind: ApplicationSet metadata: name: cm-allclusters-app-set namespace: openshift-gitops spec: generators: - clusterDecisionResource: configMapRef: ocm-placement-generator labelSelector: matchLabels: cluster.open-cluster-management.io/placement: app-placement requeueAfterSeconds: 0 1.3.5.9. Application ObjectBucket channel type cannot use allow and deny lists You cannot specify allow and deny lists with ObjectBucket channel type in the subscription-admin role. In other channel types, the allow and deny lists in the subscription indicates which Kubernetes resources can be deployed, and which Kubernetes resources should not be deployed. 1.3.5.9.1. Argo Application cannot be deployed on 3.x OpenShift Container Platform managed clusters Argo ApplicationSet from the console cannot be deployed on 3.x OpenShift Container Platform managed clusters because the Infrastructure.config.openshift.io API is not available on on 3.x. 1.3.5.10. Changes to the multicluster_operators_subscription image do not take effect automatically The application-manager add-on that is running on the managed clusters is now handled by the subscription operator, when it was previously handled by the klusterlet operator. The subscription operator is not managed the multicluster-hub , so changes to the multicluster_operators_subscription image in the multicluster-hub image manifest ConfigMap do not take effect automatically. If the image that is used by the subscription operator is overrided by changing the multicluster_operators_subscription image in the multicluster-hub image manifest ConfigMap, the application-manager add-on on the managed clusters does not use the new image until the subscription operator pod is restarted. You need to restart the pod. 1.3.5.11. Policy resource not deployed unless by subscription administrator The policy.open-cluster-management.io/v1 resources are no longer deployed by an application subscription by default for Red Hat Advanced Cluster Management version 2.4. A subscription administrator needs to deploy the application subscription to change this default behavior. See Creating an allow and deny list as subscription administrator for information. policy.open-cluster-management.io/v1 resources that were deployed by existing application subscriptions in Red Hat Advanced Cluster Management versions remain, but are no longer reconciled with the source repository unless the application subscriptions are deployed by a subscription administrator. 1.3.5.12. Application Ansible hook stand-alone mode Ansible hook stand-alone mode is not supported. To deploy Ansible hook on the hub cluster with a subscription, you might use the following subscription YAML: apiVersion: apps.open-cluster-management.io/v1 kind: Subscription metadata: name: sub-rhacm-gitops-demo namespace: hello-openshift annotations: apps.open-cluster-management.io/github-path: myapp apps.open-cluster-management.io/github-branch: master spec: hooksecretref: name: toweraccess channel: rhacm-gitops-demo/ch-rhacm-gitops-demo placement: local: true However, this configuration might never create the Ansible instance, since the spec.placement.local:true has the subscription running on standalone mode. You need to create the subscription in hub mode. Create a placement rule that deploys to local-cluster . See the following sample where local-cluster: "true" refers to your hub cluster: apiVersion: apps.open-cluster-management.io/v1 kind: PlacementRule metadata: name: <towhichcluster> namespace: hello-openshift spec: clusterSelector: matchLabels: local-cluster: "true" Reference that placement rule in your subscription. See the following sample: apiVersion: apps.open-cluster-management.io/v1 kind: Subscription metadata: name: sub-rhacm-gitops-demo namespace: hello-openshift annotations: apps.open-cluster-management.io/github-path: myapp apps.open-cluster-management.io/github-branch: master spec: hooksecretref: name: toweraccess channel: rhacm-gitops-demo/ch-rhacm-gitops-demo placement: placementRef: name: <towhichcluster> kind: PlacementRule After applying both, you should see the Ansible instance created in your hub cluster. 1.3.5.13. Application not deployed after an updated placement rule If applications are not deploying after an update to a placement rule, verify that the application-manager pod is running. The application-manager is the subscription container that needs to run on managed clusters. You can run oc get pods -n open-cluster-management-agent-addon |grep application-manager to verify. You can also search for kind:pod cluster:yourcluster in the console and see if the application-manager is running. If you cannot verify, attempt to import the cluster again and verify again. 1.3.5.14. Subscription operator does not create an SCC Learn about Red Hat OpenShift Container Platform SCC at Managing security context constraints , which is an additional configuration required on the managed cluster. Different deployments have different security context and different service accounts. The subscription operator cannot create an SCC CR automatically.. Administrators control permissions for pods. A Security Context Constraints (SCC) CR is required to enable appropriate permissions for the relative service accounts to create pods in the non-default namespace. To manually create an SCC CR in your namespace, complete the following steps: Find the service account that is defined in the deployments. For example, see the following nginx deployments: Create an SCC CR in your namespace to assign the required permissions to the service account or accounts. See the following example, where kind: SecurityContextConstraints is added: apiVersion: security.openshift.io/v1 defaultAddCapabilities: kind: SecurityContextConstraints metadata: name: ingress-nginx namespace: ns-sub-1 priority: null readOnlyRootFilesystem: false requiredDropCapabilities: fsGroup: type: RunAsAny runAsUser: type: RunAsAny seLinuxContext: type: RunAsAny users: - system:serviceaccount:my-operator:nginx-ingress-52edb - system:serviceaccount:my-operator:nginx-ingress-52edb-backend 1.3.5.15. Application channels require unique namespaces Creating more than one channel in the same namespace can cause errors with the hub cluster. For instance, namespace charts-v1 is used by the installer as a Helm type channel, so do not create any additional channels in charts-v1 . Ensure that you create your channel in a unique namespace. All channels need an individual namespace, except GitHub channels, which can share a namespace with another GitHub channel. 1.3.5.16. Ansible Automation Platform job fail Ansible jobs fail to run when you select an incompatible option. Ansible Automation Platform only works when the -cluster-scoped channel options are chosen. This affects all components that need to perform Ansible jobs. 1.3.5.17. Ansible Automation Platform operator access Ansible Automation Platform outside of a proxy The Red Hat Ansible Automation Platform operator cannot access Ansible Automation Platform outside of a proxy-enabled OpenShift Container Platform cluster. To resolve, you can install the Ansible Automation Platform within the proxy. See install steps that are provided by Ansible Automation Platform. 1.3.5.18. Application name requirements An application name cannot exceed 37 characters. The application deployment displays the following error if the characters exceed this amount. status: phase: PropagationFailed reason: 'Deployable.apps.open-cluster-management.io "_long_lengthy_name_" is invalid: metadata.labels: Invalid value: "_long_lengthy_name_": must be no more than 63 characters/n' 1.3.5.19. Application console table limitations See the following limitations to various Application tables in the console: From the Applications table on the Overview page and the Subscriptions table on the Advanced configuration page, the Clusters column displays a count of clusters where application resources are deployed. Since applications are defined by resources on the local cluster, the local cluster is included in the search results, whether actual application resources are deployed on the local cluster or not. From the Advanced configuration table for Subscriptions , the Applications column displays the total number of applications that use that subscription, but if the subscription deploys child applications, those are included in the search result, as well. From the Advanced configuration table for Channels , the Subscriptions column displays the total number of subscriptions on the local cluster that use that channel, but this does not include subscriptions that are deployed by other subscriptions, which are included in the search result. 1.3.5.20. No Application console topology filtering The Console and Topology for Application changes for the 2.12. There is no filtering capability from the console Topology page. 1.3.5.21. Allow and deny list does not work in Object storage applications The allow and deny list feature does not work in Object storage application subscriptions. 1.3.6. Observability known issues Review the known issues for Red Hat Advanced Cluster Management for Kubernetes. The following list contains known issues for this release, or known issues that continued from the release. For your Red Hat OpenShift Container Platform cluster, see link:https://docs.redhat.com/documentation/en-us/openshift_container_platform/4.15/html/release_notes#ocp-4-15-known-issues [OpenShift Container Platform known issues]. For more about deprecations and removals, see Deprecations and removals for Red Hat Advanced Cluster Management . 1.3.6.1. Grafana dashboard missing A Grafana dashboard might fail to load after you run the Grafana instance. Complete the following steps: To verify whether a dashboard failed to load, check the logs by running the following command: oc logs observability-grafana-68f8489659-m79rv -c grafana-dashboard-loader -n open-cluster-management-observability ... E1017 12:55:24.532493 1 dashboard_controller.go:147] dashboard: sample-dashboard could not be created after retrying 40 times To fix the dashboard failure, redeploy Grafana by scaling the number of replicas to 0 . The multicluster-observability-operator pod automatically scales the deployment to the desired number of replicas that is defined in the MultiClusterObservability resource. Run the following command: oc scale deployment observability-grafana -n open-cluster-management-observability --replicas=0 To verify that the dashboard loads correctly after redployment, run the following command to check the logs of all Grafana pods and ensure no error message appears: oc logs observability-grafana-68f8489659-h6jd9 -c grafana-dashboard-loader -n open-cluster-management-observability | grep "could not be created" 1.3.6.2. Retention change causes data loss The default retention for all resolution levels, such as retentionResolutionRaw , retentionResolution5m , or retentionResolution1h , is 365 days ( 365d ). This 365d default retention means that the default retention for a 1 hour resolution has decreased from indefinite, 0d to 365d . This retention change might cause you to lose data. If you did not set an explicit value for the resolution retention in your MultiClusterObservability spec.advanced.retentionConfig parameter, you might lose data. For more information, see Adding advanced configuration for retention . 1.3.6.3. Observatorium API gateway pods in a restored hub cluster might have stale tenant data The Observatorium API gateway pods in a restored hub cluster might contain stale tenant data after a backup and restore procedure because of a Kubernetes limitation. See Mounted ConfigMaps are updated automatically for more about the limitation. As a result, the Observatorium API and Thanos gateway rejects metrics from collectors, and the Red Hat Advanced Cluster Management Grafana dashboards do not display data. See the following errors from the Observatorium API gateway pod logs: Thanos receives pods logs with the following errors: See the following procedure to resolve this issue: Scale down the observability-observatorium-api deployment instances from N to 0 . Scale up the observability-observatorium-api deployment instances from 0 to N . Note: N = 2 by default, but might be greater than 2 in some custom configuration environments. This restarts all Observatorium API gateway pods with the correct tenant information, and the data from collectors start displaying in Grafana in between 5-10 minutes. 1.3.6.4. Permission to add PrometheusRules and ServiceMonitors in openshift-monitoring namespace denied Starting with Red Hat Advanced Cluster Management 2.9, you must use a label in your defined Red Hat Advanced Cluster Management hub cluster namespace. The label, openshift.io/cluster-monitoring: "true" causes the Cluster Monitoring Operator to scrape the namespace for metrics. When Red Hat Advanced Cluster Management 2.9 is deployed or an installation is upgraded to 2.9, the Red Hat Advanced Cluster Management Observability ServiceMonitors and PrometheusRule resources are no longer present in the openshift-monitoring namespace. 1.3.6.5. Lack of support for proxy settings The Prometheus AdditionalAlertManagerConfig resource of the observability add-on does not support proxy settings. You must disable the observability alert forwarding feature. Complete the following steps to disable alert forwarding: Go to the MultiClusterObservability resource. Update the mco-disabling-alerting parameter value to true The HTTPS proxy with a self-signed CA certificate is not supported. 1.3.6.6. Duplicate local-clusters on Service-level Overview dashboard When various hub clusters deploy Red Hat Advanced Cluster Management observability using the same S3 storage, duplicate local-clusters can be detected and displayed within the Kubernetes/Service-Level Overview/API Server dashboard. The duplicate clusters affect the results within the following panels: Top Clusters , Number of clusters that has exceeded the SLO , and Number of clusters that are meeting the SLO . The local-clusters are unique clusters associated with the shared S3 storage. To prevent multiple local-clusters from displaying within the dashboard, it is recommended for each unique hub cluster to deploy observability with a S3 bucket specifically for the hub cluster. 1.3.6.7. Observability endpoint operator fails to pull image The observability endpoint operator fails if you create a pull-secret to deploy to the MultiClusterObservability CustomResource (CR) and there is no pull-secret in the open-cluster-management-observability namespace. When you import a new cluster, or import a Hive cluster that is created with Red Hat Advanced Cluster Management, you need to manually create a pull-image secret on the managed cluster. For more information, see Enabling observability . 1.3.6.8. There is no data from ROKS clusters Red Hat Advanced Cluster Management observability does not display data from a ROKS cluster on some panels within built-in dashboards. This is because ROKS does not expose any API server metrics from servers they manage. The following Grafana dashboards contain panels that do not support ROKS clusters: Kubernetes/API server , Kubernetes/Compute Resources/Workload , Kubernetes/Compute Resources/Namespace(Workload) 1.3.6.9. There is no etcd data from ROKS clusters For ROKS clusters, Red Hat Advanced Cluster Management observability does not display data in the etcd panel of the dashboard. 1.3.6.10. Metrics are unavailable in the Grafana console Annotation query failed in the Grafana console: When you search for a specific annotation in the Grafana console, you might receive the following error message due to an expired token: "Annotation Query Failed" Refresh your browser and verify you are logged into your hub cluster. Error in rbac-query-proxy pod: Due to unauthorized access to the managedcluster resource, you might receive the following error when you query a cluster or project: no project or cluster found Check the role permissions and update appropriately. See Role-based access control for more information. 1.3.6.11. Prometheus data loss on managed clusters By default, Prometheus on OpenShift uses ephemeral storage. Prometheus loses all metrics data whenever it is restarted. When observability is enabled or disabled on OpenShift Container Platform managed clusters that are managed by Red Hat Advanced Cluster Management, the observability endpoint operator updates the cluster-monitoring-config ConfigMap by adding additional alertmanager configuration that restarts the local Prometheus automatically. 1.3.6.12. Error ingesting out-of-order samples Observability receive pods report the following error message: The error message means that the time series data sent by a managed cluster, during a metrics collection interval is older than the time series data it sent in the collection interval. When this problem happens, data is discarded by the Thanos receivers and this might create a gap in the data shown in Grafana dashboards. If the error is seen frequently, it is recommended to increase the metrics collection interval to a higher value. For example, you can increase the interval to 60 seconds. The problem is only noticed when the time series interval is set to a lower value, such as 30 seconds. Note, this problem is not seen when the metrics collection interval is set to the default value of 300 seconds. 1.3.6.13. Grafana deployment fails after upgrade If you have a grafana-dev instance deployed in earlier versions before 2.6, and you upgrade the environment to 2.6, the grafana-dev does not work. You must delete the existing grafana-dev instance by running the following command: Recreate the instance with the following command: 1.3.6.14. klusterlet-addon-search pod fails The klusterlet-addon-search pod fails because the memory limit is reached. You must update the memory request and limit by customizing the klusterlet-addon-search deployment on your managed cluster. Edit the ManagedclusterAddon custom resource named search-collector , on your hub cluster. Add the following annotations to the search-collector and update the memory, addon.open-cluster-management.io/search_memory_request=512Mi and addon.open-cluster-management.io/search_memory_limit=1024Mi . For example, if you have a managed cluster named foobar , run the following command to change the memory request to 512Mi and the memory limit to 1024Mi : 1.3.6.15. Enabling disableHubSelfManagement causes empty list in Grafana dashboard The Grafana dashboard shows an empty label list if the disableHubSelfManagement parameter is set to true in the mulitclusterengine custom resource. You must set the parameter to false or remove the parameter to see the label list. See disableHubSelfManagement for more details. 1.3.6.15.1. Endpoint URL cannot have fully qualified domain names (FQDN) When you use the FQDN or protocol for the endpoint parameter, your observability pods are not enabled. The following error message is displayed: Endpoint url cannot have fully qualified paths Enter the URL without the protocol. Your endpoint value must resemble the following URL for your secrets: endpoint: example.com:443 1.3.6.15.2. Grafana downsampled data mismatch When you attempt to query historical data and there is a discrepancy between the calculated step value and downsampled data, the result is empty. For example, if the calculated step value is 5m and the downsampled data is in a one-hour interval, data does not appear from Grafana. This discrepancy occurs because a URL query parameter must be passed through the Thanos Query front-end data source. Afterwards, the URL query can perform additional queries for other downsampling levels when data is missing. You must manually update the Thanos Query front-end data source configuration. Complete the following steps: Go to the Query front-end data source. To update your query parameters, click the Misc section. From the Custom query parameters field, select max_source_resolution=auto . To verify that the data is displayed, refresh your Grafana page. Your query data appears from the Grafana dashboard. 1.3.6.16. Metrics collector does not detect proxy configuration A proxy configuration in a managed cluster that you configure by using the addonDeploymentConfig is not detected by the metrics collector. As a workaround, you can enable the proxy by removing the managed cluster ManifestWork . Removing the ManifestWork forces the changes in the addonDeploymentConfig to be applied. 1.3.6.17. Limitations when using custom managed cluster Observatorium API or Alertmanager URLs Custom Observatorium API and Alertmanager URLs only support intermediate components with TLS passthrough. If both custom URLs are pointing to the same intermediate component, you must use separate sub-domains because OpenShift Container Platform routers do not support two separate route objects with the same host. 1.3.6.17.1. Search does not display node information from the managed cluster Search maps RBAC for resources in the hub cluster. Depending on user RBAC settings, users might not see node data from the managed cluster. Results from search might be different from what is displayed on the Nodes page for a cluster. 1.3.7. Governance known issues Review the known issues for Governance. The following list contains known issues for this release, or known issues that continued from the release. For your Red Hat OpenShift Container Platform cluster, see OpenShift Container Platform known issues . For more about deprecations and removals, see Deprecations and removals for Red Hat Advanced Cluster Management . 1.3.7.1. Configuration policy listed complaint when namespace is stuck in Terminating state When you have a configuration policy that is configured with mustnothave for the complianceType parameter and enforce for the remediationAction parameter, the policy is listed as compliant when a deletion request is made to the Kubernetes API. Therefore, the Kubernetes object can be stuck in a Terminating state while the policy is listed as compliant. 1.3.7.2. Operators deployed with policies do not support ARM While installation into an ARM environment is supported, operators that are deployed with policies might not support ARM environments. The following policies that install operators do not support ARM environments: Red Hat Advanced Cluster Management policy for the Quay Container Security Operator Red Hat Advanced Cluster Management policy for the Compliance Operator 1.3.7.3. ConfigurationPolicy custom resource definition is stuck in terminating When you remove the config-policy-controller add-on from a managed cluster by disabling the policy controller in the KlusterletAddonConfig or by detaching the cluster, the ConfigurationPolicy custom resource definition might get stuck in a terminating state. If the ConfigurationPolicy custom resource definition is stuck in a terminating state, new policies might not be added to the cluster if the add-on is reinstalled later. You can also receive the following error: Use the following command to check if the custom resource definition is stuck: If a deletion timestamp is on the resource, the custom resource definition is stuck. To resolve the issue, remove all finalizers from configuration policies that remain on the cluster. Use the following command on the managed cluster and replace <cluster-namespace> with the managed cluster namespace: The configuration policy resources are automatically removed from the cluster and the custom resource definition exits its terminating state. If the add-on has already been reinstalled, the custom resource definition is recreated automatically without a deletion timestamp. 1.3.7.4. Policy status shows repeated updates when enforced If a policy is set to remediationAction: enforce and is repeatedly updated, the Red Hat Advanced Cluster Management console shows repeated violations with successful updates. Repeated updates produce multiple policy events, which can cause the governance-policy-framework-addon pod to run out of memory and crash. See the following two possible causes and solutions for the error: Another controller or process is also updating the object with different values. To resolve the issue, disable the policy and compare the differences between objectDefinition in the policy and the object on the managed cluster. If the values are different, another controller or process might be updating them. Check the metadata of the object to help identify why the values are different. The objectDefinition in the ConfigurationPolicy does not match because of Kubernetes processing the object when the policy is applied. To resolve the issue, disable the policy and compare the differences between objectDefinition in the policy and the object on the managed cluster. If the keys are different or missing, Kubernetes might have processed the keys before applying them to the object, such as removing keys containing default or empty values. 1.3.7.5. Duplicate policy template names create inconstistent results When you create a policy with identical policy template names, you receive inconsistent results that are not detected, but you might not know the cause. For example, defining a policy with multiple configuration policies named create-pod causes inconsistent results. Best practice: Avoid using duplicate names for policy templates. 1.3.7.6. Database and policy compliance history API outage There is built-in resilience for database and policy compliance history API outages, however, any compliance events that cannot be recorded by a managed cluster are queued in memory until they are successfully recorded. This means that if there is an outage and the governance-policy-framework pod on the managed cluster restarts, all queued compliance events are lost. If you create or update a new policy during a database outage, any compliance events sent for this new policy cannot be recorded since the mapping of policies to database IDs cannot be updated. When the database is back online, the mapping is automatically updated and future compliance events from those policies are recorded. 1.3.7.7. PostgreSQL data loss If there is data loss to the PostgreSQL server such as restoring to a backup without the latest data, you must restart the governance policy propagator on the Red Hat Advanced Cluster Management hub cluster so that it can update the mapping of policies to database IDs. Until you restart the governance policy propagator, new compliance events associated with policies that once existed in the database are no longer recorded. To restart the governance policy propagator, run the following command on the Red Hat Advanced Cluster Management hub cluster: oc -n open-cluster-management rollout restart deployment/grc-policy-propagator 1.3.7.8. Kyverno policies no longer report a status for the latest version Kyverno policies generated by the Policy Generator report the following message in your Red Hat Advanced Cluster Management cluster: The cause is that the PolicyReport API version is incorrect in the generator and does not match what Kyverno has deployed. 1.3.8. Known issues for networking Review the known issues for Submariner. The following list contains known issues for this release, or known issues that continued from the release. For your Red Hat OpenShift Container Platform cluster, see OpenShift Container Platform known issues . For more about deprecations and removals, see Deprecations and removals for Red Hat Advanced Cluster Management . 1.3.8.1. Submariner known issues See the following known issues and limitations that might occur while using networking features. 1.3.8.1.1. Without ClusterManagementAddon submariner add-on fails For versions 2.8 and earlier, when you install Red Hat Advanced Cluster Management, you also deploy the submariner-addon component with the Operator Lifecycle Manager. If you did not create a MultiClusterHub custom resource, the submariner-addon pod sends an error and prevents the operator from installing. The following notification occurs because the ClusterManagementAddon custom resource definition is missing: The ClusterManagementAddon resource is created by the cluster-manager deployment, however, this deployment becomes available when the MultiClusterEngine components are installed on the cluster. If there is not a MultiClusterEngine resource that is already available on the cluster when the MultiClusterHub custom resource is created, the MultiClusterHub operator deploys the MultiClusterEngine instance and the operator that is required, which resolves the error. 1.3.8.1.2. Submariner add-on resources not cleaned up properly when managed clusters are imported If the submariner-addon component is set to false within MultiClusterHub (MCH) operator, then the submariner-addon finalizers are not cleaned up properly for the managed cluster resources. Since the finalizers are not cleaned up properly, this prevents the submariner-addon component from being disabled within the hub cluster. 1.3.8.1.3. Submariner install plan limitation The Submariner install plan does not follow the overall install plan settings. Therefore, the operator management screen cannot control the Submariner install plan. By default, Submariner install plans are applied automatically, and the Submariner addon is always updated to the latest available version corresponding to the installed Red Hat Advanced Cluster Management version. To change this behavior, you must use a customized Submariner subscription. 1.3.8.1.4. Limited headless services support Service discovery is not supported for headless services without selectors when using Globalnet. 1.3.8.1.5. Deployments that use VXLAN when NAT is enabled are not supported Only non-NAT deployments support Submariner deployments with the VXLAN cable driver. 1.3.8.1.6. Self-signed certificates might prevent connection to broker Self-signed certificates on the broker might prevent joined clusters from connecting to the broker. The connection fails with certificate validation errors. You can disable broker certificate validation by setting InsecureBrokerConnection to true in the relevant SubmarinerConfig object. See the following example: apiVersion: submarineraddon.open-cluster-management.io/v1alpha1 kind: SubmarinerConfig metadata: name: submariner namespace: <managed-cluster-namespace> spec: insecureBrokerConnection: true 1.3.8.1.7. Submariner only supports OpenShift SDN or OVN Kubernetes Submariner only supports Red Hat OpenShift Container Platform clusters that use the OpenShift SDN or the OVN-Kubernetes Container Network Interface (CNI) network provider. 1.3.8.1.8. Command limitation on Microsoft Azure clusters The subctl diagnose firewall inter-cluster command does not work on Microsoft Azure clusters. 1.3.8.1.9. Automatic upgrade not working with custom CatalogSource or Subscription Submariner is automatically upgraded when Red Hat Advanced Cluster Management for Kubernetes is upgraded. The automatic upgrade might fail if you are using a custom CatalogSource or Subscription . To make sure automatic upgrades work when installing Submariner on managed clusters, you must set the spec.subscriptionConfig.channel field to stable-0.15 in the SubmarinerConfig custom resource for each managed cluster. 1.3.8.1.10. Submariner conflicts with IPsec-enabled OVN-Kubernetes deployments IPsec tunnels that are created by IPsec-enabled OVN-Kubernetes deployments might conflict with IPsec tunnels that are created by Submariner. Do not use OVN-Kubernetes in IPsec mode with Submariner. 1.3.8.1.11. Uninstall Submariner before removing ManagedCluster from a ManageClusterSet If you remove a cluster from a ClusterSet , or move a cluster to a different ClusterSet , the Submariner installation is no longer valid. You must uninstall Submariner before moving or removing a ManagedCluster from a ManageClusterSet . If you don't uninstall Submariner, you cannot uninstall or reinstall Submariner anymore and Submariner stops working on your ManagedCluster . 1.3.9. Multicluster global hub Operator known issues Review the known issues for the multicluster global hub Operator. The following list contains known issues for this release, or known issues that continued from the release. For your OpenShift Container Platform cluster, see OpenShift Container Platform known issues . 1.3.9.1. The detached managed hub cluster deletes and recreates the namespace and resources If you import a managed hub cluster in the hosted mode and detach this managed hub cluster, then it deletes and recreates the open-cluster-management-agent-addon namespace. The detached managed hub cluster also deletes and recreates all the related addon resources within this namespace. There is currently no workaround for this issue. 1.3.9.2. Kafka operator keeps restarting In the Federal Information Processing Standard (FIPS) environment, the Kafka operator keeps restarting because of the out-of-memory (OOM) state. To fix this issue, set the resource limit to at least 512M . For detailed steps on how to set this limit, see amq stream doc . 1.3.9.3. Backup and restore known issues If your original multicluster global hub cluster crashes, the multicluster global hub loses its generated events and cron jobs. Even if you restore the new multicluster global hub cluster, the events and cron jobs are not restored. To workaround this issue, you can manually run the cron job, see Running the summarization process manually . 1.3.9.4. Managed cluster displays but is not counted A managed cluster that is not created successfully, meaning clusterclaim id.k8s.io does not exist in the managed cluster, is not counted in the policy compliance dashboards, but shows in the policy console. 1.3.9.5. The multicluster global hub is installed on OpenShift Container Platform 4.13 hyperlinks might redirect home If the multicluster global hub Operator is installed on OpenShift Container Platform 4.13, all hyperlinks that link to the managed clusters list and detail pages in dashboards might redirect to the Red Hat Advanced Cluster Management home page. You need to manually go to your target page. 1.3.9.6. The standard group filter cannot pass to the new page In the Global Hub Policy Group Compliancy Overview hub dashboards, you can check one data point by clicking View Offending Policies for standard group , but after you click this link to go to the offending page, the standard group filter cannot pass to the new page. This is also an issue for the Cluster Group Compliancy Overview . 1.4. Deprecations and removals for Red Hat Advanced Cluster Management Learn when parts of the product are deprecated or removed from Red Hat Advanced Cluster Management for Kubernetes. Consider the alternative actions in the Recommended action and details, which display in the tables for the current release and for two prior releases. Deprecated: Red Hat Advanced Cluster Management 2.8 and earlier versions are no longer supported. The documentation might remain available, but without any Errata or other updates. Best practice: Upgrade to the most recent version. Important: Cluster lifecycle components and features are within the multicluster engine operator, which is a software operator that enhances cluster fleet management. Release notes for multicluster engine operator-specific features are found in at Release notes for Cluster lifecycle with multicluster engine operator . 1.4.1. API deprecations and removals Red Hat Advanced Cluster Management follows the Kubernetes deprecation guidelines for APIs. See the Kubernetes Deprecation Policy for more details about that policy. Red Hat Advanced Cluster Management APIs are only deprecated or removed outside of the following timelines: All V1 APIs are generally available and supported for 12 months or three releases, whichever is greater. V1 APIs are not removed, but can be deprecated outside of that time limit. All beta APIs are generally available for nine months or three releases, whichever is greater. Beta APIs are not removed outside of that time limit. All alpha APIs are not required to be supported, but might be listed as deprecated or removed if it benefits users. 1.4.2. Red Hat Advanced Cluster Management deprecations A deprecated component, feature, or service is supported, but no longer recommended for use and might become obsolete in future releases. Consider the alternative actions in the Recommended action and details that are provided in the following table: Product or category Affected item Version Recommended action More details and links Overview page Red Hat Advanced Cluster Management for Kubernetes search 2.12 Enable the Fleet view switch to view the new default Overview page. The layout of the Red Hat Advanced Cluster Management Overview page is deprecated. Policy compliance history API Governance 2.12 Use the existing policy metrics to see the compliance status changes. You can also view the config-policy-controller and cert-policy-controller pod logs to get a detailed compliance history for each managed cluster. For more information, see Policy controller advanced configuration . Installer ingress.sslCiphers field in operator.open-cluster-management.io_multiclusterhubs_crd.yaml 2.9 None See Advanced Configuration for configuring install. If you uppgrade your Red Hat Advanced Cluster Management for Kubernetes version and originally had a MultiClusterHub custom resource with the spec.ingress.sslCiphers field defined, the field is still recognized, but is deprecated and has no effect. Applications and Governance PlacementRule 2.8 Use Placement anywhere that you might use PlacementRule . While PlacementRule is still available, it is not supported and the console displays Placement by default. 1.4.3. Removals A removed item is typically function that was deprecated in releases and is no longer available in the product. You must use alternatives for the removed function. Consider the alternative actions in the Recommended action and details that are provided in the following table: Product or category Affected item Version Recommended action More details and links Governance IAM policy controller 2.11 None 1.5. Red Hat Advanced Cluster Management platform considerations for GDPR readiness 1.5.1. Notice This document is intended to help you in your preparations for General Data Protection Regulation (GDPR) readiness. It provides information about features of the Red Hat Advanced Cluster Management for Kubernetes platform that you can configure, and aspects of the product's use, that you should consider to help your organization with GDPR readiness. This information is not an exhaustive list, due to the many ways that clients can choose and configure features, and the large variety of ways that the product can be used in itself and with third-party clusters and systems. *Clients are responsible for ensuring their own compliance with various laws and regulations, including the European Union General Data Protection Regulation. Clients are solely responsible for obtaining advice of competent legal counsel as to the identification and interpretation of any relevant laws and regulations that may affect the clients' business and any actions the clients may need to take to comply with such laws and regulations.* The products, services, and other capabilities described herein are not suitable for all client situations and may have restricted availability. Red Hat does not provide legal, accounting, or auditing advice or represent or warrant that its services or products will ensure that clients are in compliance with any law or regulation. 1.5.2. GDPR Product Configuration for GDPR Data Life Cycle Data Collection Data Storage Data Access Data Processing Data Deletion Capability for Restricting Use of Personal Data Appendix 1.5.3. GDPR General Data Protection Regulation (GDPR) has been adopted by the European Union (EU) and applies from May 25, 2018. 1.5.3.1. Why is GDPR important? GDPR establishes a stronger data protection regulatory framework for processing personal data of individuals. GDPR brings: New and enhanced rights for individuals Widened definition of personal data New obligations for processors Potential for significant financial penalties for non-compliance Compulsory data breach notification 1.5.3.2. Read more about GDPR EU GDPR Information Portal Red Hat GDPR website 1.5.4. Product Configuration for GDPR The following sections describe aspects of data management within the Red Hat Advanced Cluster Management for Kubernetes platform and provide information on capabilities to help clients with GDPR requirements. 1.5.5. Data Life Cycle Red Hat Advanced Cluster Management for Kubernetes is an application platform for developing and managing on-premises, containerized applications. It is an integrated environment for managing containers that includes the container orchestrator Kubernetes, cluster lifecycle, application lifecycle, and security frameworks (governance, risk, and compliance). As such, the Red Hat Advanced Cluster Management for Kubernetes platform deals primarily with technical data that is related to the configuration and management of the platform, some of which might be subject to GDPR. The Red Hat Advanced Cluster Management for Kubernetes platform also deals with information about users who manage the platform. This data will be described throughout this document for the awareness of clients responsible for meeting GDPR requirements. This data is persisted on the platform on local or remote file systems as configuration files or in databases. Applications that are developed to run on the Red Hat Advanced Cluster Management for Kubernetes platform might deal with other forms of personal data subject to GDPR. The mechanisms that are used to protect and manage platform data are also available to applications that run on the platform. Additional mechanisms might be required to manage and protect personal data that is collected by applications run on the Red Hat Advanced Cluster Management for Kubernetes platform. To best understand the Red Hat Advanced Cluster Management for Kubernetes platform and its data flows, you must understand how Kubernetes, Docker, and the Operator work. These open source components are fundamental to the Red Hat Advanced Cluster Management for Kubernetes platform. You use Kubernetes deployments to place instances of applications, which are built into Operators that reference Docker images. The Operator contain the details about your application, and the Docker images contain all the software packages that your applications need to run. 1.5.5.1. What types of data flow through Red Hat Advanced Cluster Management for Kubernetes platform As a platform, Red Hat Advanced Cluster Management for Kubernetes deals with several categories of technical data that could be considered as personal data, such as an administrator user ID and password, service user IDs and passwords, IP addresses, and Kubernetes node names. The Red Hat Advanced Cluster Management for Kubernetes platform also deals with information about users who manage the platform. Applications that run on the platform might introduce other categories of personal data unknown to the platform. Information on how this technical data is collected/created, stored, accessed, secured, logged, and deleted is described in later sections of this document. 1.5.5.2. Personal data used for online contact Customers can submit online comments, feedback, and requests for information about in a variety of ways, primarily: The public Slack community if there is a Slack channel The public comments or tickets on the product documentation The public conversations in a technical community Typically, only the client name and email address are used, to enable personal replies for the subject of the contact, and the use of personal data conforms to the Red Hat Online Privacy Statement . 1.5.6. Data Collection The Red Hat Advanced Cluster Management for Kubernetes platform does not collect sensitive personal data. It does create and manage technical data, such as an administrator user ID and password, service user IDs and passwords, IP addresses, and Kubernetes node names, which might be considered personal data. The Red Hat Advanced Cluster Management for Kubernetes platform also deals with information about users who manage the platform. All such information is only accessible by the system administrator through a management console with role-based access control or by the system administrator though login to a Red Hat Advanced Cluster Management for Kubernetes platform node. Applications that run on the Red Hat Advanced Cluster Management for Kubernetes platform might collect personal data. When you assess the use of the Red Hat Advanced Cluster Management for Kubernetes platform running containerized applications and your need to meet the requirements of GDPR, you must consider the types of personal data that are collected by the application and aspects of how that data is managed, such as: How is the data protected as it flows to and from the application? Is the data encrypted in transit? How is the data stored by the application? Is the data encrypted at rest? How are credentials that are used to access the application collected and stored? How are credentials that are used by the application to access data sources collected and stored? How is data collected by the application removed as needed? This is not a definitive list of the types of data that are collected by the Red Hat Advanced Cluster Management for Kubernetes platform. It is provided as an example for consideration. If you have any questions about the types of data, contact Red Hat. 1.5.7. Data storage The Red Hat Advanced Cluster Management for Kubernetes platform persists technical data that is related to configuration and management of the platform in stateful stores on local or remote file systems as configuration files or in databases. Consideration must be given to securing all data at rest. The Red Hat Advanced Cluster Management for Kubernetes platform supports encryption of data at rest in stateful stores that use dm-crypt . The following items highlight the areas where data is stored, which you might want to consider for GDPR. Platform Configuration Data: The Red Hat Advanced Cluster Management for Kubernetes platform configuration can be customized by updating a configuration YAML file with properties for general settings, Kubernetes, logs, network, Docker, and other settings. This data is used as input to the Red Hat Advanced Cluster Management for Kubernetes platform installer for deploying one or more nodes. The properties also include an administrator user ID and password that are used for bootstrap. Kubernetes Configuration Data: Kubernetes cluster state data is stored in a distributed key-value store, etcd . User Authentication Data, including User IDs and passwords: User ID and password management are handled through a client enterprise LDAP directory. Users and groups that are defined in LDAP can be added to Red Hat Advanced Cluster Management for Kubernetes platform teams and assigned access roles. Red Hat Advanced Cluster Management for Kubernetes platform stores the email address and user ID from LDAP, but does not store the password. Red Hat Advanced Cluster Management for Kubernetes platform stores the group name and upon login, caches the available groups to which a user belongs. Group membership is not persisted in any long-term way. Securing user and group data at rest in the enterprise LDAP must be considered. Red Hat Advanced Cluster Management for Kubernetes platform also includes an authentication service, Open ID Connect (OIDC) that interacts with the enterprise directory and maintains access tokens. This service uses ETCD as a backing store. Service authentication data, including user IDs and passwords: Credentials that are used by Red Hat Advanced Cluster Management for Kubernetes platform components for inter-component access are defined as Kubernetes Secrets. All Kubernetes resource definitions are persisted in the etcd key-value data store. Initial credentials values are defined in the platform configuration data as Kubernetes Secret configuration YAML files. For more information, see Secrets in the Kubernetes documentation. 1.5.8. Data access Red Hat Advanced Cluster Management for Kubernetes platform data can be accessed through the following defined set of product interfaces. Web user interface (the console) Kubernetes kubectl CLI Red Hat Advanced Cluster Management for Kubernetes CLI oc CLI These interfaces are designed to allow you to make administrative changes to your Red Hat Advanced Cluster Management for Kubernetes cluster. Administration access to Red Hat Advanced Cluster Management for Kubernetes can be secured and involves three logical, ordered stages when a request is made: authentication, role-mapping, and authorization. 1.5.8.1. Authentication The Red Hat Advanced Cluster Management for Kubernetes platform authentication manager accepts user credentials from the console and forwards the credentials to the backend OIDC provider, which validates the user credentials against the enterprise directory. The OIDC provider then returns an authentication cookie ( auth-cookie ) with the content of a JSON Web Token ( JWT ) to the authentication manager. The JWT token persists information such as the user ID and email address, in addition to group membership at the time of the authentication request. This authentication cookie is then sent back to the console. The cookie is refreshed during the session. It is valid for 12 hours after you sign out of the console or close your web browser. For all subsequent authentication requests made from the console, the front-end NGINX server decodes the available authentication cookie in the request and validates the request by calling the authentication manager. The Red Hat Advanced Cluster Management for Kubernetes platform CLI requires the user to provide credentials to log in. The kubectl and oc CLI also requires credentials to access the cluster. These credentials can be obtained from the management console and expire after 12 hours. Access through service accounts is supported. 1.5.8.2. Role Mapping Red Hat Advanced Cluster Management for Kubernetes platform supports role-based access control (RBAC). In the role mapping stage, the user name that is provided in the authentication stage is mapped to a user or group role. The roles are used when authorizing which administrative activities can be carried out by the authenticated user. 1.5.8.3. Authorization Red Hat Advanced Cluster Management for Kubernetes platform roles control access to cluster configuration actions, to catalog and Helm resources, and to Kubernetes resources. Several IAM (Identity and Access Management) roles are provided, including Cluster Administrator, Administrator, Operator, Editor, Viewer. A role is assigned to users or user groups when you add them to a team. Team access to resources can be controlled by namespace. 1.5.8.4. Pod Security Pod security policies are used to set up cluster-level control over what a pod can do or what it can access. 1.5.9. Data Processing Users of Red Hat Advanced Cluster Management for Kubernetes can control the way that technical data that is related to configuration and management is processed and secured through system configuration. Role-based access control (RBAC) controls what data and functions can be accessed by users. Data-in-transit is protected by using TLS . HTTPS ( TLS underlying) is used for secure data transfer between user client and back end services. Users can specify the root certificate to use during installation. Data-at-rest protection is supported by using dm-crypt to encrypt data. These same platform mechanisms that are used to manage and secure Red Hat Advanced Cluster Management for Kubernetes platform technical data can be used to manage and secure personal data for user-developed or user-provided applications. Clients can develop their own capabilities to implement further controls. 1.5.10. Data Deletion Red Hat Advanced Cluster Management for Kubernetes platform provides commands, application programming interfaces (APIs), and user interface actions to delete data that is created or collected by the product. These functions enable users to delete technical data, such as service user IDs and passwords, IP addresses, Kubernetes node names, or any other platform configuration data, as well as information about users who manage the platform. Areas of Red Hat Advanced Cluster Management for Kubernetes platform to consider for support of data deletion: All technical data that is related to platform configuration can be deleted through the management console or the Kubernetes kubectl API. Areas of Red Hat Advanced Cluster Management for Kubernetes platform to consider for support of account data deletion: All technical data that is related to platform configuration can be deleted through the Red Hat Advanced Cluster Management for Kubernetes or the Kubernetes kubectl API. Function to remove user ID and password data that is managed through an enterprise LDAP directory would be provided by the LDAP product used with Red Hat Advanced Cluster Management for Kubernetes platform. 1.5.11. Capability for Restricting Use of Personal Data Using the facilities summarized in this document, Red Hat Advanced Cluster Management for Kubernetes platform enables an end user to restrict usage of any technical data within the platform that is considered personal data. Under GDPR, users have rights to access, modify, and restrict processing. Refer to other sections of this document to control the following: Right to access Red Hat Advanced Cluster Management for Kubernetes platform administrators can use Red Hat Advanced Cluster Management for Kubernetes platform features to provide individuals access to their data. Red Hat Advanced Cluster Management for Kubernetes platform administrators can use Red Hat Advanced Cluster Management for Kubernetes platform features to provide individuals information about what data Red Hat Advanced Cluster Management for Kubernetes platform holds about the individual. Right to modify Red Hat Advanced Cluster Management for Kubernetes platform administrators can use Red Hat Advanced Cluster Management for Kubernetes platform features to allow an individual to modify or correct their data. Red Hat Advanced Cluster Management for Kubernetes platform administrators can use Red Hat Advanced Cluster Management for Kubernetes platform features to correct an individual's data for them. Right to restrict processing Red Hat Advanced Cluster Management for Kubernetes platform administrators can use Red Hat Advanced Cluster Management for Kubernetes platform features to stop processing an individual's data. 1.5.12. Appendix As a platform, Red Hat Advanced Cluster Management for Kubernetes deals with several categories of technical data that could be considered as personal data, such as an administrator user ID and password, service user IDs and passwords, IP addresses, and Kubernetes node names. Red Hat Advanced Cluster Management for Kubernetes platform also deals with information about users who manage the platform. Applications that run on the platform might introduce other categories of personal data that are unknown to the platform. This appendix includes details on data that is logged by the platform services. 1.6. FIPS readiness Red Hat Advanced Cluster Management for Kubernetes is designed for FIPS. When running on Red Hat OpenShift Container Platform in FIPS mode, OpenShift Container Platform uses the Red Hat Enterprise Linux cryptographic libraries submitted to NIST for FIPS Validation on only the architectures that are supported by OpenShift Container Platform. For more information about the NIST validation program, see Cryptographic Module Validation Program . For the latest NIST status for the individual versions of the RHEL cryptographic libraries submitted for validation, see Compliance Activities and Government Standards . If you plan to manage clusters with FIPS enabled, you must install Red Hat Advanced Cluster Management on an OpenShift Container Platform cluster configured to operate in FIPS mode. The hub cluster must be in FIPS mode because cryptography that is created on the hub cluster is used on managed clusters. To enable FIPS mode on your managed clusters, set fips: true when you provision your OpenShift Container Platform managed cluster. You cannot enable FIPS after you provision your cluster. For more information, see Do you need extra security for your cluster? in the OpenShift Container Platform documentation. 1.6.1. Limitations Read the following limitations with Red Hat Advanced Cluster Management and FIPS. Persistent Volume Claim (PVC) and S3 storage that is used by the search and observability components must be encrypted when you configure the provided storage. Red Hat Advanced Cluster Management does not provide storage encryption, see the OpenShift Container Platform documentation, Configuring persistent storage . When you provision managed clusters using the Red Hat Advanced Cluster Management console, select the following checkbox in the Cluster details section of the managed cluster creation to enable the FIPS standards: 1.7. Observability support Red Hat Advanced Cluster Management is tested with and fully supported by Red Hat OpenShift Data Foundation, formerly Red Hat OpenShift Container Platform. Red Hat Advanced Cluster Management supports the function of the multicluster observability operator on user-provided third-party object storage that is S3 API compatible. The observability service uses Thanos supported, stable object stores. Red Hat Advanced Cluster Management support efforts include reasonable efforts to identify root causes. If you open a support ticket and the root cause is the S3 compatible object storage that you provided, then you must open an issue using the customer support channels.

Commands:
create -f
apiVersion: v1 kind: ConfigMap metadata: name: my-assisted-service-config namespace: assisted-installer data: ALLOW_CONVERGED_FLOW: false
annotate --overwrite AgentServiceConfig agent unsupported.agent-install.openshift.io/assisted-service-configmap=my-assisted-service-config
spec: clusterReplicas: 1 clusterSelector: matchLabels: environment: dev
spec: clusterSelector: matchLabels: environment: dev
delete appliedmanifestwork <the-left-appliedmanifestwork-name>
get klusterlet klusterlet -o jsonpath='{.metadata.uid}'
patch appliedmanifestwork <appliedmanifestwork_name> --type=merge -p '{"spec":{"agentID": "'USDAGENT_ID'"}}'
delete csv -n openshift-operators volsync-product.v0.6.0
annotate search search-v2-operator search-pause=true
patch deployment search-postgres --type json -p '[{"op": "add", "path": "/spec/template/spec/containers/0/resources/limits/hugepages-2Mi", "value":"512Mi"}]'
get pod <your-postgres-pod-name> -o jsonpath="Status: {.status.phase}"
get pod <your-postgres-pod-name> -o jsonpath='{.spec.containers[0].resources.limits.hugepages-2Mi}'
rosa describe cluster --cluster=<cluster-name> | grep -o '^ID:.*
Error querying resource logs: Service unavailable
delete deployment multiclusterhub-repo -n <namespace>
edit mch -n open-cluster-management multiclusterhub
delete managedcluster local-cluster
edit mch -n open-cluster-management multiclusterhub
credentials: secretName: dbsecret usernameSecretKey: username passwordSecretKey: password
annotations: argocd.argoproj.io/skip-reconcile: "true"
annotations: argocd.argoproj.io/refresh: normal
apiVersion: argoproj.io/v1alpha1 kind: ApplicationSet metadata: name: cm-allclusters-app-set namespace: openshift-gitops spec: generators: - clusterDecisionResource: configMapRef: ocm-placement-generator labelSelector: matchLabels: cluster.open-cluster-management.io/placement: app-placement requeueAfterSeconds: 0
apiVersion: apps.open-cluster-management.io/v1 kind: Subscription metadata: name: sub-rhacm-gitops-demo namespace: hello-openshift annotations: apps.open-cluster-management.io/github-path: myapp apps.open-cluster-management.io/github-branch: master spec: hooksecretref: name: toweraccess channel: rhacm-gitops-demo/ch-rhacm-gitops-demo placement: local: true
apiVersion: apps.open-cluster-management.io/v1 kind: PlacementRule metadata: name: <towhichcluster> namespace: hello-openshift spec: clusterSelector: matchLabels: local-cluster: "true"
apiVersion: apps.open-cluster-management.io/v1 kind: Subscription metadata: name: sub-rhacm-gitops-demo namespace: hello-openshift annotations: apps.open-cluster-management.io/github-path: myapp apps.open-cluster-management.io/github-branch: master spec: hooksecretref: name: toweraccess channel: rhacm-gitops-demo/ch-rhacm-gitops-demo placement: placementRef: name: <towhichcluster> kind: PlacementRule
nginx-ingress-52edb nginx-ingress-52edb-backend
apiVersion: security.openshift.io/v1 defaultAddCapabilities: kind: SecurityContextConstraints metadata: name: ingress-nginx namespace: ns-sub-1 priority: null readOnlyRootFilesystem: false requiredDropCapabilities: fsGroup: type: RunAsAny runAsUser: type: RunAsAny seLinuxContext: type: RunAsAny users: - system:serviceaccount:my-operator:nginx-ingress-52edb - system:serviceaccount:my-operator:nginx-ingress-52edb-backend
status: phase: PropagationFailed reason: 'Deployable.apps.open-cluster-management.io "_long_lengthy_name_" is invalid: metadata.labels: Invalid value: "_long_lengthy_name_": must be no more than 63 characters/n'
logs observability-grafana-68f8489659-m79rv -c grafana-dashboard-loader -n open-cluster-management-observability E1017 12:55:24.532493 1 dashboard_controller.go:147] dashboard: sample-dashboard could not be created after retrying 40 times
scale deployment observability-grafana -n open-cluster-management-observability --replicas=0
logs observability-grafana-68f8489659-h6jd9 -c grafana-dashboard-loader -n open-cluster-management-observability | grep "could not be created"
level=error name=observatorium caller=logchannel.go:129 msg="failed to forward metrics" returncode="500 Internal Server Error" response="no matching hashring to handle tenant\n"
caller=handler.go:551 level=error component=receive component=receive-handler tenant=xxxx err="no matching hashring to handle tenant" msg="internal server error"
Error on ingesting out-of-order samples
./setup-grafana-dev.sh --clean
./setup-grafana-dev.sh --deploy
annotate managedclusteraddon search-collector -n foobar addon.open-cluster-management.io/search_memory_request=512Mi addon.open-cluster-management.io/search_memory_limit=1024Mi
Endpoint url cannot have fully qualified paths
endpoint: example.com:443
template-error; Failed to create policy template: create not allowed while custom resource definition is terminating
get crd configurationpolicies.policy.open-cluster-management.io -o=jsonpath='{.metadata.deletionTimestamp}'
get configurationpolicy -n <cluster-namespace> -o name | xargs oc patch -n <cluster-namespace> --type=merge -p '{"metadata":{"finalizers": []}}'
-n open-cluster-management rollout restart deployment/grc-policy-propagator
violation - couldn't find mapping resource with kind ClusterPolicyReport, please check if you have CRD deployed; violation - couldn't find mapping resource with kind PolicyReport, please check if you have CRD deployed
graceful termination failed, controllers failed with error: the server could not find the requested resource (post clustermanagementaddons.addon.open-cluster-management.io)
apiVersion: submarineraddon.open-cluster-management.io/v1alpha1 kind: SubmarinerConfig metadata: name: submariner namespace: <managed-cluster-namespace> spec: insecureBrokerConnection: true
FIPS with information text: Use the Federal Information Processing Standards (FIPS) modules provided with Red Hat Enterprise Linux CoreOS instead of the default Kubernetes cryptography suite file before you deploy the new managed cluster.