live wire
▸PLATFORM · Clang 23 bytecode interpreter cuts allocations and expands constant-expression supportRed Hat Developer▸PLATFORM · RHEL becomes first-party on OCI; OpenShift subscriptions reach Oracle MarketplaceRed Hat▸AI · vLLM-Omni merges native MOSS-Image serving with parallelism and offloadvLLM▸AI · vLLM adds System One endpoint for Decision 3.0 multimodal routing models (Oct. 15)vLLM▸SECURITY · Red Hat rates OpenShift AI 3.4.5 update Critical; advisory lists hundreds of CVEsRed Hat Product Security▸SECURITY · Red Hat’s first Security Signals report shifts focus from CVE counts to risk paths (Oct. 15)Red Hat▸PLATFORM · IBM adds non-destructive FlexVolume-to-CSI migration tool for OpenShift object storageIBM Cloud▸vLLM tests agent-built Kimi K3 decode path at up to 1.9× speedup; PR remains openvLLM▸AI · LeaderWorkerSet 1.0 changes rollout defaults for disaggregated AI workloadsKubernetes SIGs▸SECURITY · Red Hat flags active exploitation of kernel flaw affecting OpenShift CoreOS; no fix listedRed Hat Product Security▸AI · Red Hat sets Dec. 9 showcase for AI 3.6 agent governance and model servicesRed Hat▸vLLM 0.32.0 drops Python 3.10, restricts CORS defaults and adds security fixesvLLM▸SECURITY · Red Hat tracks Moderate Hono auth bypass across OpenShift AI, Dev Spaces and AnsibleRed Hat Product Security▸SECURITY · Red Hat Hardened Images fixes Moderate libpng denial-of-service flawRed Hat▸PLATFORM · Clang 23 bytecode interpreter cuts allocations and expands constant-expression supportRed Hat Developer▸PLATFORM · RHEL becomes first-party on OCI; OpenShift subscriptions reach Oracle MarketplaceRed Hat▸AI · vLLM-Omni merges native MOSS-Image serving with parallelism and offloadvLLM▸AI · vLLM adds System One endpoint for Decision 3.0 multimodal routing models (Oct. 15)vLLM▸SECURITY · Red Hat rates OpenShift AI 3.4.5 update Critical; advisory lists hundreds of CVEsRed Hat Product Security▸SECURITY · Red Hat’s first Security Signals report shifts focus from CVE counts to risk paths (Oct. 15)Red Hat▸PLATFORM · IBM adds non-destructive FlexVolume-to-CSI migration tool for OpenShift object storageIBM Cloud▸vLLM tests agent-built Kimi K3 decode path at up to 1.9× speedup; PR remains openvLLM▸AI · LeaderWorkerSet 1.0 changes rollout defaults for disaggregated AI workloadsKubernetes SIGs▸SECURITY · Red Hat flags active exploitation of kernel flaw affecting OpenShift CoreOS; no fix listedRed Hat Product Security▸AI · Red Hat sets Dec. 9 showcase for AI 3.6 agent governance and model servicesRed Hat▸vLLM 0.32.0 drops Python 3.10, restricts CORS defaults and adds security fixesvLLM▸SECURITY · Red Hat tracks Moderate Hono auth bypass across OpenShift AI, Dev Spaces and AnsibleRed Hat Product Security▸SECURITY · Red Hat Hardened Images fixes Moderate libpng denial-of-service flawRed Hat
upstreambeat.ai
releasePLATFORM

OpenShift GitOps 1.22 moves promotion and source controls closer to the platform

The release adds supported tenant-scoped ApplicationSets and console tooling, previews rendered-manifest promotion, and carries an upgrade caveat for Redis HA users.

Tenant-scoped GitOps controls contrasted with preview promotion path.
Side by side: what changed
By The News Desk· Oct 7, 2026the quick take — two AI hosts go live when you do

Red Hat has released OpenShift GitOps 1.22 with a mix of generally available controls for multi-tenant delivery and early-access machinery for promoting rendered manifests between environments. The release is available for OpenShift Container Platform 4.18 through 4.22, according to the 1.22 release notes.

What changed

The supported surface expands in three practical areas. ApplicationSets can now run outside the Argo CD control-plane namespace, letting tenants manage their own declarative application generators with namespace-level isolation. The OpenShift GitOps console plugin is also generally available and exposes Applications, ApplicationSets, AppProjects, ImageUpdater and Rollouts resources inside the OpenShift console. Source Integrity Verification reaches general availability as well, allowing an AppProject to require trusted GnuPG signatures before an application sync proceeds, as Red Hat explains in its release overview.

OpenShift GitOps 1.22 also moves to Argo CD 3.5 and adds Helm 4 support. Its Image Updater gains Cosign-based image-signature verification, automatic masking of sensitive annotations, webhook hardening, NetworkPolicy support and pull-request deduplication. These changes make the release more than a console refresh: they move policy checks nearer to the promotion path.

Promotion is promising, but still preview technology

Two related components arrive as Technology Previews. GitOps Promoter 0.35 uses a PromotionStrategy custom resource to describe environments and gates. Source Hydrator renders Helm or Kustomize sources into full YAML, commits the rendered output to Git and separates manifest generation from deployment. Used together, they offer a reviewable promotion chain in which the exact manifests destined for each environment are visible before synchronization.

That architecture is worth testing, but not treating as a supported production path yet. Red Hat explicitly says Technology Preview features are outside production service-level agreements and may be incomplete. Teams evaluating the pair should keep experiments separate from existing production promotion workflows.

Check the upgrade notes before rollout

Operators using Redis high availability have a concrete upgrade task. Red Hat documents a known issue in which Redis HA pods can enter CrashLoopBackOff after upgrading to 1.22. The stated workaround is to delete the affected Redis server pods one at a time, waiting for each replacement to reach Running before moving to the next.

There is also a Source Hydrator/Image Updater issue: some write-back methods can report success without committing a changed image tag. Red Hat provides a temporary configuration workaround, another reason to keep the hydrator path in evaluation rather than production.

For platform teams, the immediate value is in the generally available tenant and integrity controls. The promotion stack points toward a more auditable delivery model, but its preview status and known issues make staged adoption the sensible course.

sources

Filed by The News Desk. Corrections: desk@upstreambeat.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk