RHEL 8 New Features for Experienced Linux Administrators
Abstract
| Goal | Describe the major improvements and feature enhancements in the upcoming Red Hat Enterprise Linux 8 release. |
| Objectives |
|
| Sections |
|
Objectives
After completing this section, you should be able to provide a basic overview of key features in Red Hat Enterprise Linux 8.
About Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 8 (RHEL 8) is the latest major release of Red Hat's enterprise operating system. Deployable on physical hardware, virtual machines, in the cloud, and in containers, Red Hat Enterprise Linux 8 delivers advanced features required for next-generation IT architectures.
This course provides a hands-on opportunity to work with Red Hat Enterprise Linux 8, and explores selected features of this new version. The course authors have chosen these features based on their likely relevance to a wide audience. However, not every new feature in Red Hat Enterprise Linux 8 will be covered. For more information, review the product documentation and articles on http://access.redhat.com/, the Red Hat Customer Portal.
Supported Architectures
Red Hat Enterprise Linux 8 is supported on the following processor architectures:
Supported Processor Architectures
64-bit AMD/Intel (x86_64)
64-bit ARM (aarch64)
IBM POWER, little endian (ppc64le)
IBM Z (s390x)
Red Hat Enterprise Linux is no longer just about x86_64 servers.
Although x86_64 dominates datacenter deployments, there are reasons to deploy Linux on alternative architectures and new applications that benefit from non-traditional computing architectures.
Red Hat's multi-architecture initiative provides software support for a variety of processor and machine architectures, while still powered by a common operating platform based on Red Hat Enterprise Linux. Customers can deploy systems on a variety of server designs while taking advantage of commonality of management and application compatibility.
ARMv8 Support
Support for 64-bit ARM was piloted in Red Hat Enterprise Linux 7 and is now supported as a core component of Red Hat Enterprise Linux 8:
RHEL 8 for ARM64 Support
Red Hat Enterprise Linux for ARM (aarch64).
64-bit ARMv8 processors are supported.
Targeted at server-optimized SoCs for cloud, hyperscale, telco, HPC, and edge computing.
Goal is a single operating platform across multiple ARM suppliers.
Red Hat has been driving open standards in the ARM processor ecosystem for many years. Our goal has been to develop a single operating platform across multiple 64-bit ARMv8-A server-class system-on-chip (SoC) products designed for cloud, hyperscale, telco and edge computing, as well as high-performance computing (HPC) applications.
Note that 32-bit ARM processors (such as the armv7l architecture) are not supported.
Little Endian IBM POWER Support
Processor support for Red Hat Enterprise Linux 8 for IBM Power Systems has some changes:
RHEL 8 for IBM POWER
RHEL 8 for IBM Power Systems supports little endian mode only (ppc64le).
POWER8 and POWER9 processors are supported.
Can be a KVM guest on Red Hat Virtualization for Power, PowerVM, and PowerNV (bare metal).
Older versions of RHEL supported IBM Power Systems using the ppc64 big endian architecture. Red Hat Enterprise Linux 8 is no longer being built or delivered for big endian. Only the little endian ppc64le mode is supported.
A little endian system stores data in memory ordered least-significant byte first and most-significant byte last, opposite to the behavior of a big-endian system. The x86_64 architecture is also little endian. The advantage to running POWER processors in little endian mode is that it makes it simpler for programmers to port applications from x86_64 to POWER. Using the same endian mode for all processors supported by Red Hat Enterprise Linux helps programmers avoid bugs that would cause errors in the representation of data in the ported application, or when one application exchanges data with another.
New Features and Changes
There are too many enhancements, changes, and new features in Red Hat Enterprise Linux to cover them all in this course. The overview that follows discusses many of them, some of which will be investigated in detail later in this course. This list is not exhaustive. For more information, visit http://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/ and review the Release Notes and other documentation for Red Hat Enterprise Linux 8.
Selected Changes in RHEL 8
The following discussion is a review of selected changes in RHEL 8.
Not every change or new feature in RHEL 8 will be covered in this course.
For more information, see the Release Notes on https://access.redhat.com/.
Installation and Deployment
Some installer changes are discussed in detail later in this course. To summarize:
Overview of Installation Changes
Restructure of channels into "BaseOS" and "AppStream".
"System Purpose" to indicate planned purpose for entitlement and support level.
Enhancements to Kickstart directives.
Can install and boot from NVDIMM devices (using either Anaconda and Kickstart).
System Startup and Management
Changes to bootloader management:
BOOM Boot Manager
Simplifies process of creating boot entries.
Adds entries, does not modify them.
Simplified CLI and API.
BOOM is a Linux boot manager that simplifies the boot entry creation. BOOM can boot LVM based snapshot system images. Existing boot loader configuration is not modified, since BOOM only inserts additional entries. The existing configuration is maintained and functions as before. BOOM has both a command-line interface and an API for administrators to create boot entries.
Enabling Secure-boot Guests
RHEL 8 supports secure-boot guests which use cryptographically signed images.
RHEL 8 relies on the Open Virtual Machine Firmware (OVMF) using the
edk2codebase (edk2-ovmf) to provide support for secure firmware to virtual machines.Images are signed by trusted third-party organizations to ensure integrity.
Kernel
The current kernel supports 52-bit physical addressing for the 64-bit ARM architecture, 5-level paging, Control Group v2 mechanism, early kdump, the deadline process scheduler, and configuration of separate time namespaces.
Packaging Changes
kernel-core provides the core kernel.
kernel-modules and kernel-modules-extra contain kernel modules matching the kernel-core package version.
kernel is now a meta-package that ensures kernel-core and kernel-modules are installed.
This new approach to kernel packaging allows for more granular and modular kernel configuration. It is especially important in today's cloud-based deployments, where space is of high importance.
Memory Management
New 5-level paging model.
57-bit virtual memory addressing (128 PiB usable address space).
52-bit physical memory addressing (theoretically up to 4 PiB RAM).
Actual physical support limits might vary depending on hardware.
Memory addressing capacity has been extended to 57/52-bit of virtual/physical memory. To handle the expanded address range, memory management was extended to use a 5-level page table implementation.
Enabling Early Kdump at Boot
RHEL 7, and previous RHEL releases start the kdump.service as part of
multi-user.targetof the boot process. Problems that occur prior to this service event may not be able to be captured.RHEL 8 provides early Kdump, by storing the
vmlinuzandinitramfsof the crash kernel inside theinitramfsof the booting kernel. These components are loaded directly into reserved memory (crashkernel) during the earlyinitramfsstage, allowing kernel crash dump capture during all phases of booting.
Enhancing the Process Scheduler
The CFS process scheduler remains the default process scheduler in RHEL 8.
CFS in RHEL 8 provides a new process scheduling class,
SCHED_DEADLINE, which enables predictable task scheduling based on application deadlines.SCHED_DEADLINEis based on the Earliest Deadline First (EDF) and Constant Bandwidth Server (CBS) algorithms.SCHED_DEADLINEis suitable for real-time applications, such as multimedia or industrial control, and provides improved performance on machines with NUMA capabilities.Under
SCHED_DEADLINE, processes use specific system calls to inform the scheduler of their estimatedruntime,deadline, andperiod.
Networking
Enhancements and changes to networking features in RHEL 8 include:
Firewall Changes
nftables is the default firewall backend.
nftables is the successor to iptables, ip6tables, arptables, ebtables, and ipset.
Still recommend using
firewall-cmdto manage firewall; use nft directly only for complex configurations.iptables compatibility tools are available.
The iptables and ebtables toolsets are replaced by nftables in RHEL 8. The nftables framework, and its core tool nft, provides significant improvements in convenience, features, and performance. It unifies IPv4 and IPv6 tools, uses fast lookup tables instead of linear rule processing, supports debugging and tracing in the rule set, and has a more consistent and compact syntax. Compatibility tools based on the old command names are available, and tools to migrate rulesets from iptables and ip6tables to nft are documented in the xtables-translate(8) man page.
The firewalld system is still the recommended way to manage local firewall rules for typical use cases.
In RHEL 8, it uses nftables as its default backend rule system.
If the backend rule system changes again in a later Red Hat Enterprise Linux version, firewalld is designed to easily add and select a default amongst available rule back ends.
Firewall enhancements are covered in detail later in this course.
NetworkManager and Network Scripts
nmcli is the preferred tool to manage network configuration through NetworkManager.
New versions of ifup and ifdown require NetworkManager.
Legacy network scripts like ifup-local are deprecated and not available by default.
NetworkManager enhancements are discussed in detail later in this course.
NTP Time Synchronization
Chrony (
chronyd) is the default NTP service implementation.Chrony performs better in a wide range of conditions, and synchronizes faster with better accuracy.
Migration tools are available in
/usr/share/doc/chrony/.
In RHEL 8, Chrony is the default NTP implementation provided by the operating system. The ntpd package is no longer available.
Chrony performs better than ntpd in many real-world scenarios: when access to the time reference is intermittent, when the network is frequently congested, or when the system clock is subject to sudden changes in tick rate (due to changes in the temperature of the crystal oscillator).
It has a number of other enhancements as well.
A /usr/share/doc/chrony/ntp2chrony.py migration script is available to convert configurations from ntpd to Chrony.
Details on how to use it are provided in the RHEL 8 documentation at https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/configuring_basic_system_settings/index#migrating-to-chrony_using-chrony-to-configure-ntp.
Chrony is discussed in detail later in this course.
Enhancements to TCP
Update to version 4.16 of the TCP stack.
Improved performance for TCP server with high ingress connection rate.
New BBR and NV congestion control algorithms.
Removed Network Drivers
Certain obsolete network drivers have been removed or are no longer supported in RHEL 8.
The
e1000driver is no longer supported, bute1000eis still supported.The
tulipdriver has been removed, impacting "Generation 1" VMs on Microsoft Hyper-V.
Obsolete network drivers have been removed from RHEL 8 and are no longer supported. Review the Removed hardware support section of the release notes to see which ones are affected. Two particular drivers were widely used and may impact old hardware or virtualization environments.
The e1000 driver for PCI-based Intel Gigabit Ethernet devices is no longer supported.
This common family of network cards was the default driver for KVM virtual machines using the i440fx machine type.
Red Hat now recommends the q35 machine type in RHEL 8.
Important
The related e1000e driver for PCIe-based Intel Gigabit Ethernet devices is still available and supported.
The tulip driver for the DEC "Tulip" chip Fast Ethernet device family has been removed.
Microsoft Hyper-V "Generation 1" virtual machines emulate this device for their virtual network adapter.
Since RHEL 8 does not provide a driver for that device, PXE installation of RHEL 8 on a Hyper-V "Generation 1" virtual machine will fail.
The workaround is to use "Generation 2" virtual machines, or to install the virtual machine using an ISO image.
Software Management
A new Yum feature is the package grouping method called modules.
Modules
Modules are installed independently of the underlying Operating System major version.
The module system supports multiple versions of an application simultaneously.
A module is tied to an application stream.
Modularity and management of module streams with yum are covered in detail later in this course.
Updates to RPM and YUM
DNF is a technology rewrite of Yum and is the new standard package management functionality for RPM packages in RHEL 8.
The yum command (v4) is retained as the recommended command-line utility, symbolically linked to dnf to facilitate backward script and operator compatibility.
Yum v4 supports modules that enable software modularity.
Yum v4 now understands weak and boolean dependencies.
Yum v4 provides a broad collection of plug-ins and add-on tooling.
Storage
New local storage manager provides volume-managed file system using shared pools of storage.
Stratis Storage Manager
Ability to create pools of one or multiple block devices.
Create dynamic and flexible file systems within those pools.
Stratis supports file system snapshotting. Snapshots are independent from the source file systems.
Stratis Storage Manager is discussed in detail later in this course.
Virtual Data Optimizer (VDO)
VDO reduces data footprint on storage on three phases: zero-block elimination, deduplication of redundant blocks, and data compression.
VDO removes blocks which only include zeros, and keeps their metadata.
Virtual disks for virtual machines are a good use case of VDO volumes.
VDO is discussed in detail later in this course.
XFS Copy-on-Write Extents
Copy-on-Write (CoW) is enabled by default when file system is created.
Adds support to XFS to allow two or more files to share the same data blocks.
If one file changes, sharing is broken and separate blocks are tracked.
Efficient file cloning, per-file snapshots, and operation of NFS and Overlayfs.
RHEL 7 can only mount XFS with CoW extents in read-only mode.
The shared copy-on-write data extents functionality allows multiple files to share a common set of data blocks.
Supporting SCSI-3 Persistent Reservations with Virtio-SCSI
On RHEL 8, both qemu and libvirt support SCSI-3 persistent reservations on storage-devices presented to VMs through Virtio-SCSI backed by direct-attached LUNs.
Virtual machines can share Virtio-SCSI storage devices and use SCSI-3 PRs to control access.
Storage devices managed with device-mapper-multipath can be passed through to VMs to use SCSI-3 PRs, and the host manages PR actions across all paths.
Other Storage Features
New LUKS2 on-disk format for encrypted storage replaces LUKS1.
Block devices now use multiqueue scheduling and the
scsi-mqdriver is enabled by default for better SSD performance.
Removed Storage Features
Some old storage drivers have been entirely removed.
Some old storage drivers are no longer supported, but they are still available.
The Btrfs file system has been removed.
Software-managed Fibre Channel over Ethernet (FCoE) support has been removed.
Important
Offloading FCoE adapters that appear as Fibre Channel adapters in the operating system and do not use the fcoe-utils management tools continue to be supported.
This applies to select adapters from the lpfc and qla2xxx drivers.
Offloading FCoE adapters that do use the fcoe-utils management tools, but have their own drivers instead of fcoe.ko and manage DCBX configuration in their drivers or firmware, are also still supported unless Red Hat notes otherwise.
This includes the fnic, bnx2fs, and qedf drivers.
Security Features
Many new or enhanced Security related features are introduced in RHEL 8. Important changes include:
System-wide Cryptographic Policy
System-wide crypto policy for TLS/IPSec/SSH/DNSSEC/Kerberos.
Allows admin to update list of protocols and algorithms to follow recommended practice for many services consistently.
Several policies are provided and may be applied using the update-crypto-policies command.
DEFAULTpolicy provides reasonable default compatible with PCI-DSS.
For more information on system-wide cryptographic policies, see Consistent security by crypto policies in Red Hat Enterprise Linux 8 and the update-crypto-policies(8) man page.
Improving sosreport Capabilities
RHEL 8 includes the 3.6 version of the sosreport tool, which supports new profiles, for example containers, user and policy defined command line presets, and size limits for external commands
This version of sosreport also supports a large collection of new plugins, for example
ansible,buildah, andruncThe sos-collector utility is available in RHEL 8, and collects sosreports from multi-host environments like a RHV cluster, or a RHEL High Availability cluster
Other Security Changes
Audit subsystem updated to version 3.0.
rsyslog update to 8.37.0 with additional new features and fixes.
OpenSSH 7.8p1 rebase, removed support for weak ciphers and the obsolete SSH version 1 protocol.
OpenSCAP CLI improvements, draft OSPP profile version 4.2 for RHEL 8.
tcp_wrapperssupport has been removed.
User Environment
GNOME is now the only available display manager. KDE has been completely removed from the distribution. Wayland is the default display server, providing multiple advantages and improvements, including a stronger security model, improved multi-monitor handling, and improved user interface scaling.
Graphical Desktop Changes
Wayland is the default display server; Xorg is still available.
Updated to GNOME 3.28.
KDE removed from the distribution.
Virtualization
In this release, QEMU can now emulate the Intel Q35 motherboard chipset, which offers a better hardware platform for modern virtualized operating systems.
Virtual Machine Management
Packages for virtualization are in the
virtmodule stream.New interface in the web console to manage virtual machines.
virt-manager is deprecated but still available.
Using the web console to create and manage virtual machines is discussed in detail later in this course.
Updated KVM Hardware Model
KVM now defaults to Q35 hardware model (newer hardware emulation).
Better support of PCI Express passthrough, supports secure boot.
The previous Intel 440FX emulation is still available for older operating systems.
Similar concept to "Generation 1" and "Generation 2" virtual machines in Microsoft Hyper-V.
Selecting the KVM hardware model to use for virtual machines is discussed in detail later in this course.
Updates to HA Clustering
Pacemaker upgraded to version 2.0.0
pcs has new features, Corosync 3 support, some syntax changes
A detailed list of changes is available at https://access.redhat.com/articles/3681151/.
Linux Containers
RHEL 8 includes a new package module which provides a new container engine, named Podman, to replace Docker and Moby. In contrast to Docker, which depends on daemons to build and run containers, this new toolset and container engine allow building and running containers without daemons.
New Container Tools
The Podman container engine is daemonless and supports the execution of containers.
Buildah supports the build of containers images, including building those images from scratch, or from a Dockerfile.
You can copy and inspect container images in registries with Skopeo.
Containers are discussed in detail later in this course.
References
sched(7) man page.
/usr/share/doc/edk2-ovmf/README
For more information, refer to the RHEL 8.0 Release Notes at https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/8.0_release_notes/
Knowledgebase: "What is early kdump support and how do I configure it?"
Knowledgebase: "Pacemaker 2.0 upgrade in Red Hat Enterprise Linux 8"
Consistent security by crypto policies in Red Hat Enterprise Linux 8
chrony: Comparison of NTP implementations
BBR: Congestion-Based Congestion Control
TCP-NV: An Update to TCP-Vegas
