Red Hat Enterprise Linux 8Why it’s time to moveAdrian KewardPrinciple Solution ArchitectOctober 15th 2019

3

Red Hat Enterprise Linux 8

Easier adoptionfor staff new to Linux®

More subscription valuewith Red Hat Insights, now included in allRed Hat Enterprise Linux subscriptions

A consistent experience

across bare-metal, virtual, and public and hybrid cloud environments

Eased transitionto and adoption of containerized workloads with community-driven, new container management tools

Increased speed and easeof deployment

Broad ecosystemof supported applications

4

Benefits of a consistent foundation withRed Hat Enterprise Linux

Deliver workloads faster with less effort

Increase agility and reduce time to market for critical workloads

Reduce IT friction and costs of dynamicbusiness changes

Deliver any application on any footprint at any time

5

Build your future on a stable, high-performing

platform that can scale to meet the needs of

your organization today and tomorrow.

Simplified Delivery

Reducing complexity is a key benefit that starts with being able to consume it easily

1. Provides the foundation of our operating system

2. Completely self contained operating system

3. Guaranteed 10 years of enterprise support

1. Provides flexible lifecycle options

2. Fully enterprise supported3. Common Red Hat Enterprise

Linux languages supported at launch

4. Defaults to 10 years of enterprise support

BASE OS APPLICATION STREAMS

=Note: RHEL subscriptions also provide access to additional content for Developer use. More details available at the developer.redhat.com

Value of the Red Hat Subscription

Enterprise product from community projects

❖Invest in the future of enterprise open source technology by paying Red Hat to represent your needs and contribute code to influential communities.

❖Take advantage of hardened, tested, certified enterprise-ready solutions identified and evolved by Red Hat.

A Familiar Experience

Enterprise OS on all footprints

Development Process (Fedora)

10-year lifecycle for most content

Offerings and Add-Ons

Managed by Satellite

Simpler delivery structure

Predictable release cadence

More life cycle options

More frequent application updates

What’s the same What’s different

RED HAT ENTERPRISE LINUX 8

9

At a glance

KERNEL VERSION 4.18+

SYSTEM COMPILER GCC 8.2, LLVM 6.0

HARDWARE ARCHITECTURES Intel/AMD 64-bit, IBM Power LE, IBM z Systems, ARM 64-bit

DEFAULT FILE SYSTEM XFS

PACKAGE MANAGEMENT Yum v4

TIME SYNCHRONIZATION Chrony

NETWORKING NetworkManager

INIT SYSTEM Systemd v239

ftrace kpatch

DYNAMIC KERNEL PATCHING

CALL

RETURN

Return

Originalfunction

NOOP

BEFORE PATCHING

Return

IMPROVEpredictability of maintenance.

DEFERreboots for critical kernel issues.

MINIMIZEdowntime for security patches.

Originalfunction

CALLCALL CALL

Replacementfunction

AFTER PATCHING

Hardware Architectures

Datacenter

Cloud

Scale-up/out

Database service

IoT

INTEL/AMD

Density in workload

OLTP

Scale-up

Database service

IBM Z

Supercomputing

Client

Big Data processing

Artificial Intelligence

IBM Power

Hyperscale computing

Edge computing

64-bit Server architecture (AARCH64)

IoT

ARM

RE

D H

AT EN

TER

PR

ISE

LINU

X 8

Developers need access to the latest tools.Operations needs to know those are stable and supported.

12

13

Plan with confidence

Remove uncertain from your platforms

Simpler deployment options

Standardized platforms for any environments

Latest stable tools

Combining open source innovation with enterprise reliability

Faster time to “Hello World”

Simpler deployment optionsUse standardized platforms for any environments

Ability to plan with confidenceRemove uncertainty from your platforms

Latest stable toolsCombine open source innovation with enterprise reliability

Predictable updates

14

6 monthsMinor updates

3 yearsMajor releases

2 phasesSupport life cycle

The newest yum package manager: version 4

15

New technologyMaintains the same experience while adding new tools

Better dependency managementOffers faster resolution and easier minimization of what's installed

Stable APIProvides new application programming interface (API) for extending yum that will progress into the future

Repository

rpm

rpm

rpm

rpm

rpm

rpm

metadata

rpm rpmrpm

system

yum

16

Power the adoption of containers

RE

D H

AT EN

TER

PR

ISE

LINU

X 8

Container Infrastructure

Docker Compatibility

skopeo

CONTAINERS ARE LINUX

18

Namespaces

CPU Memory Storage Network

Cgroups

Seccomp

SELinuxRu

n

Build

CONTAINERSApplication dependencies

Application binaries

Powering the adoption of containerized workloads

19

Red Hat Enterprise Linux(Podman/Buildah/Skopeo)

TRADITIONAL DEVELOPMENT

Find Run Build Share

CLOUD-NATIVE

Integrate Deploy

Quay Red Hat OpenShift®

(Kubernetes)

Manage containers with Podman

20

Fast and lightweightNo daemons required

Advanced namespace isolationRootless operations for container run and build

Open standards compliantCreates and maintains any standard Open Containers Initiative (OCI) -compliant containers and pods

Podman

RunC

Kernel

Images

Create images with Buildah

21

More controlScriptable tooling for fine-grained image control, and maximum control starting from base or scratch images

Minimization of imagesElimination of unneeded dependencies by using host-based tools

From base, multilayer From scratch, single layer

Java runtime and dependencies, and

application

OS update layer

Java™ runtime layer

Application layer

Base Red Hat Enterprise Linux

Inspect and transport images with Skopeo

22

Inspect images remotelyExamine image metadata without needing to download

Publish and transfer imagesCopy images from registries to hosts or directly between registries

Sign and verify imagesSupports GPG key signing on publish

Image registry Image registry

Image repositoryMetadata signature

Host

SKOPEO

23

Introducing Red Hat Enterprise CoreOS & UBI

RE

D H

AT EN

TER

PR

ISE

LINU

X 8

An immutable host, delivered with OpenShift○ Aligned lifecycle○ Aligned release cadence

Preserving the best from Container Linux and Atomic

● Container Linux○ User experience○ Minimal compose; decreased attack

surface○ Over-the-air automated updates○ Mission statement towards

containerizing all workloads● Atomic Host

○ Red Hat ecosystem

RED HAT ENTERPRISE LINUX CORE OS

24

RHEL ABI(Base image)

App / Service

containerlinux

25

WHY?Because containers ARE Linux.Developers & software vendors include Linux code inside the container. This enables a container ecosystem that when run on OpenShift, delivers a Red Hat Enterprise Linux experience.

WHAT?A subset of Red Hat® Enterprise Linux® that is freely available and redistributable, driving standardization on container (or base) images that are “RHEL-ready.”

RED HAT UNIVERSAL BASE IMAGEA bold change that will help us expand the ecosystem

CONTAINER CONTAINER CONTAINER

LINUX CONTAINER HOST (KERNEL)

LINUX OSDEPENDENCY

LINUX OSDEPENDENCY

LINUX OSDEPENDENCY

APP APP APP

Linux OS host spans every container

1 2Linux is in

every single container

Kubernetes services

THE UNIVERSAL BASE IMAGE

CONTAINER

RHEL BASE IMAGE

LANGUAGE RUNTIMES

APP

RED HAT PLATFORM

CONTAINER

RHEL BASE IMAGE

LANGUAGE RUNTIMES

APP

ANY CONTAINER PLATFORM

CONTAINER

RHEL BASE IMAGE

LANGUAGE RUNTIMES

PARTNER CONNECT CERTIFIED APP

RED HAT PLATFORM

Not Supported Enterprise support when run on Red Hat platforms

Certification provides the highest level of support

Default Configurations

Sensible out-of-the-box configuration

Supported tunables for MS SQL, SAP HANA, Oracle Database, NFV hosts and more!

TUNED PROFILES

Supported Ansible roles and modules providing a common configuration interface

Starting with networking, SELinux, time sync, and kdump

SYSTEM ROLES

Supported crypto policies to match your encryption needs

Current policies include Legacy, Default (PCI-DSS), FIPS, and Future

CRYPTO POLICIES

Performance Improvements

Range of improved performance with RHEL 8 (alpha) compared to RHEL 7

10%✲

30%✲

45%✲

✲ General guidance. Varies greatly with workload and system tuning.

29

The future of infrastructure is hybrid, multicloud

RE

D H

AT EN

TER

PR

ISE

LINU

X 8

Create images for all your environments with image builder

30

Single sourceLets you create gold images for any environment from the same blueprint increasing stability and consistency

Any footprintSupports public cloud, private cloud, enterprise hypervisors, and bare metal

Simple interfaceProvides web-based view within the web console for selecting packages and creating blueprints

Blueprint

Bare metal

Hypervisors

Public clouds

Private clouds

Create custom blueprints

IMAGE BUILDER

Target any platform:

+ other cloud platforms

“I need to quickly create customized OS images for my hybrid deployment environments, including physical, virtual, and private and public clouds.”

SYSTEMS/CLOUD ADMINISTRATOR

Image Builder

IMAGE BUILDER

Content out

DVD installers

Disk img

FileSystem img

Virtual img

Cloud img

Content in

Red Hat content

Custom

Third party

Third partyREST API

Backend builders

GUI CLI

SATELLITE

Bare metal

Private cloud

Virtual

Public cloud

Speed automation creation with system roles

33

Common automationManage multiple versions of Red Hat Enterprise Linux from a single role

Reduced reworkImport provided roles to eliminate task creation in playbooks

Easy switching of providersChange between default and optional tools quickly and safely

timesync

dbserver

SELinux

network

webserver

RED HAT ENTERPRISE LINUX SYSTEM ROLES

LoggingStorage

Metrics

6 7 8.x

Network SELinux TimeSync kdump

NFS

Tuned

Boot

Firewall

Identity

CURRENT ROLES

• Network• SELinux• TimeSync• Postfix• kdump

TARGETED ROLES

• Storage• Logging• Metrics• NFS• Tuned• Firewall• And more!

SYSTEM ROLES

ANSIBLE PLAYBOOKS

hosts: allrole: rhel-system-roles.network

35

New capabilities can’t come at the expense of security

RE

D H

AT EN

TER

PR

ISE

LINU

X 8

A highly secure platform

36

Latest protocol supportIncluding TLS 1.3 via OpenSSL 1.1.1

Hardened codeIncluding PIE and RELRO binaries and code analysis in our pipelines

Integrated identity managementAs a stand-alone provider or trusted member of an Active Directory, with expanded integrations to tools like the web console

Updated toolsIncluding the LUKS v2 on-disk format for encryption

Security policy, process, and procedures

DESIGN BUILD

RUN

MANAGE

ADAPT

Configuring systemwide cryptographic policies

37

Central configurationSet acceptable algorithms from a single tool

Improved consistencyCovers multiple cryptographic providers and consumers like TLS, kerberos, and Java

Built-in policiesIncluding legacy systems requiring 64-bit security and FIPS allowed or approved algorithms

Default

LegacyClient

Future

Encryption algorithm OpenSSL

httpdSecured

communications

Recording user terminal sessions

38

Audit activitiesCreate a record of actions taken for review against security policies

Create visual guidesBuild run books and training materials with demonstrations

Record and play backLogged via standard channels with multiple playback options

SESSION RECORDING

39

SSH

Login

NSS

tlog

CLI

Cockpit

Playback

User

Syslog

Journal

PAM

Auth

pty

Shell

Bash

Logging

Now you can record and Playback user terminal sessions

Improved firewall management with nftables

40

Consolidated filteringSupports IPv4, IPv6, ARP, and Bridge filtering in a single tool

Simpler rule creationMultiple matches and actions reduce the number of rules required

Improved tracingProvides easier debugging and verification of actions taken on any packet

41

Improved service delivery brings Linux to more new users

RE

D H

AT EN

TER

PR

ISE

LINU

X 8

Remote single-system views in the web console

42

Browser-based interfaceOffers remotely accessible user interface using host security mechanisms

Consolidated viewProvides single view of tasks to speed understanding and completion

Standard management toolsUses system tools to change state, not a separate workflow

New in the web console

43

Virtual machinesCreate and manage virtual machines

Network-bound disk encryptionEnroll disks with Tang server and manage LUKS keys

Single sign-on configurationAutomatically configure when joining a domain

44

Gain new capabilities while giving up nothing

RE

D H

AT EN

TER

PR

ISE

LINU

X 8

In-place upgrades for your systems

45

Reduced migrationsAnalyze systems to determine if upgrading in place can avoid a costly migration

Easy rollback optionsCombine with bootable LVM snapshots for safety

Improved frameworkGet better analysis and a simplified process with a more extensible framework

Upgrade framework

Applications

7 8

RUN LEAPP

CREATE BOOTABLE LVM SNAPSHOT

Can I upgrade this host?

46

PICK CANDIDATE

SERVER

ANALYZE CHECK OUTPUT

REBOOT TO FINISH UPGRADE

UPGRADECOMPLETE

MIGRATING TO RHEL 8

AUTOMATEDThe in-place upgrade tool is a completely automated framework that significantly reduces manual effort

SECURE AND RELIABLE This tool takes into account security configurations including OpenSCAP. It is also compatible with Boom.

EASY TO USE WITH GREAT REPORTINGUpgrade is possible through both a CLI today We are actively working on integration with the Red Hat Web Console

ONLINE AND OFFLINEThis tool can run both online as well as offline and perform an upgrade

Checkrequirements

Identify the version of RHEL you are running

Upgrade to RHEL 7.6

In-place upgrade to RHEL 8.0

Migrating to Red Hat Enterprise Linux 8

Doing a risk assessment before making any changes is critical to understanding what is about to happen

PRE-UPGRADE

Fully plugable and fully supported upgrade framework makes moving to new major releases of RHEL easy

UPGRADE

If anything goes wrong, BOOM will let you rollback to the previous snapshot - this is not a downgrade but instead a full byte-level rollback

ROLLBACK

CONFIDENTIAL - NDA REQUIRED4949

Find more at: https://www.redhat.com/rhel