docs: enabling RHCOS extensions using MachineConfig
@@ -51,6 +51,7 @@ type MachineConfigSpec struct {
// Config is a Ignition Config object.
Config ign.Config `json:"config"`
KernelArguments []string `json:"kernelArguments"`
+ Extensions []string `json:"extensions"`
Fips bool `json:"fips"`
KernelType string `json:"kernelType"`
}
@@ -180,6 +181,29 @@ spec:
**Note:** The RT kernel lowers throughput (performance) in return for improved worst-case latency bounds. This feature is intended only for use cases that require consistent low latency. For more information, see the [Linux Foundation wiki](https://wiki.linuxfoundation.org/realtime/start) and the [RHEL RT portal](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux_for_real_time/8/).
+### RHCOS Extensions
+RHCOS is a minimal OCP focused OS which provides capabilities common across all the platforms. With extensions support, OCP 4.6 and onward users can enable a limited set of additional functionality on the RHCOS nodes. In OCP 4.6 the supported extensions are `usbguard` and `kernel-devel`.
+
+**Note:** `kernel-devel` extension should be installed only when you are using compatible traditional kernel (kernleType: default). If a user tries to install on an incompatible kernel (e.g. kernelType: realtime), MachineConfig will not be rendered and relevant errors can be seen in the machine-config-controller pod.
+
+Extensions can be installed by creating a MachineConfig object. Extensions can be enabled as both day1 and day2. Check [installer guide](https://github.com/openshift/installer/blob/master/docs/user/customization.md#Enabling-RHCOS-Extensions) to enable extensions during cluster install.
+
+Example MachineConfig to install usbguard on an existing cluster on worker nodes:
+```
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+metadata:
+ labels:
+ machineconfiguration.openshift.io/role: worker
+ name: worker-extensions
+spec:
+ config:
+ ignition:
+ version: 3.1.0
+ extensions:
+ - usbguard
+```
+
### FIPS
This allows to enable/disable [FIPS mode](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-federal_standards_and_regulations). If any of the configuration has FIPS enabled, it'll be set. A similar restriction applies to this as for `KernelArguments` above.
