Ship a kernel errata to RHCOS nodes before it lands in an OpenShift z-stream, by building a custom layered image off-cluster and pointing a MachineConfig at it with osImageURL.

Reference: Image mode for OpenShift. Upstream projects: machine-config-operator, rpm-ostree, bootc.

Prerequisites

• oc logged in with cluster-admin.
• An entitled RHEL host matching the RHCOS base (same major/minor, EUS repo if applicable) with dnf and podman.
• The cluster pull secret saved as pull-secret.json (needed to pull the RHCOS base image).
• A container registry reachable from the nodes, and push credentials in registry-auth.json.

1. Identify the base image and kernel packages

The RHCOS image of the running release must be the FROM of the custom build.

Lab walkthrough: a Hosted Control Planes (HCP) cluster on the Agent platform with a worker VM on OpenShift Virtualization (persistent vTPM, static IPv4). Two independent customizations are applied from the hub, each in its own NodePool config ConfigMap:

• LUKS disk encryption: the worker root disk is encrypted with LUKS and unlocked by the TPM 2.0.
• core password: a console password for the core user, on the installed node and, separately, on the discovery image.

Either one can be used without the other.

High-level walkthrough of a guided lab that backs up a running Red Hat Advanced Cluster Management (ACM) 2.17 hub and restores it onto a brand-new Single Node OpenShift (SNO) hub while the primary stays up, in two scenarios: passive (copy the hub, the managed clusters stay where they are) and active (the managed clusters move to the new hub). The full lab (modules, manifests, scripts and an animated flow diagram) lives in the acm-dr repository.

Manifests to reproduce this lab: osus-lab.

Configuring the OpenShift Update Service (OSUS) for a cluster that pulls images through an Artifactory mirror, with the OSUS graph scrape served from a small dedicated repo. Built and validated on a Single-Node OpenShift (SNO) lab.

Core of this is OSUS + manifest-only mirroring (§0, §2-§10). §1 (DNS) is only needed if Artifactory doesn’t already resolve in your environment — skip it if yours does.

Reset the kubeadmin bootstrap password when the original credential is lost and no other cluster-admin identity provider is available.

Prerequisites

• SSH access to a control plane node (as core, with sudo if required).
• oc available on the node or copied in with the recovery kubeconfig.
• htpasswd available to generate the bcrypt hash (install httpd-tools on RHEL, or run from a toolbox/UBI container).
• A new password of at least 23 characters (required by the bootstrap authenticator).

1. SSH to a control plane node

Connect to any healthy control plane node in the cluster.

Deploy the Cluster Observability Operator with its Perses UI plugin, then apply a PersesDashboard that surfaces Red Hat OpenShift AI workbench, pipeline server, and model-serving metrics directly in the OpenShift web console.