×

Red Hat OpenShift support for Windows Containers provides built-in support for running Microsoft Windows Server containers on OKD. For those that administer heterogeneous environments with a mix of Linux and Windows workloads, OKD allows you to deploy Windows workloads running on Windows Server containers while also providing traditional Linux workloads hosted on Fedora CoreOS (FCOS) or Fedora.

Multi-tenancy for clusters that have Windows nodes is not supported. Hostile multi-tenant usage introduces security concerns in all Kubernetes environments. Additional security features like pod security policies, or more fine-grained role-based access control (RBAC) for nodes, make exploits more difficult. However, if you choose to run hostile multi-tenant workloads, a hypervisor is the only security option you should use. The security domain for Kubernetes encompasses the entire cluster, not an individual node. For these types of hostile multi-tenant workloads, you should use physically isolated clusters.

Windows Server Containers provide resource isolation using a shared kernel but are not intended to be used in hostile multitenancy scenarios. Scenarios that involve hostile multitenancy should use Hyper-V Isolated Containers to strongly isolate tenants.

Windows Machine Config Operator prerequisites

The following information details the supported platform versions, Windows Server versions, and networking configurations for the Windows Machine Config Operator. See the vSphere documentation for any information that is relevant to only that platform.

WMCO 6.0.0 supported platforms and Windows Server versions

The following table lists the Windows Server versions that are supported by WMCO 6.0.0, based on the applicable platform. Windows Server versions not listed are not supported and attempting to use them will cause errors. To prevent these errors, use only an appropriate version for your platform.

Platform Supported Windows Server version

Amazon Web Services (AWS)

Windows Server 2019, version 1809 Long-Term Servicing Channel (LTSC)

Microsoft Azure

  • Windows Server 2022 Long-Term Servicing Channel (LTSC). OS Build 20348.681 or later.

  • Windows Server 2019, version 1809 Long-Term Servicing Channel (LTSC)

VMware vSphere

Windows Server 2022 Long-Term Servicing Channel (LTSC). OS Build 20348.681 or later.

Bare metal or provider agnostic

Windows Server 2022 Long-Term Servicing Channel (LTSC). OS Build 20348.681 or later.

Supported networking

Hybrid networking with OVN-Kubernetes is the only supported networking configuration. See the additional resources below for more information on this functionality. The following tables outline the type of networking configuration and Windows Server versions to use based on your platform. You must specify the network configuration when you install the cluster. Be aware that OpenShift SDN networking is the default network for OKD clusters. However, OpenShift SDN is not supported by WMCO.

Table 1. Platform networking support
Platform Supported networking

Amazon Web Services (AWS)

Hybrid networking with OVN-Kubernetes

Microsoft Azure

Hybrid networking with OVN-Kubernetes

VMware vSphere

Hybrid networking with OVN-Kubernetes with a custom VXLAN port

Bare metal or provider agnostic

Hybrid networking with OVN-Kubernetes

Table 2. Hybrid OVN-Kubernetes Windows Server support
Hybrid networking with OVN-Kubernetes Supported Windows Server version

Default VXLAN port

  • Windows Server 2022 Long-Term Servicing Channel (LTSC)

  • Windows Server 2019, version 1809 Long-Term Servicing Channel (LTSC)

Custom VXLAN port

Windows Server 2022 Long-Term Servicing Channel (LTSC). OS Build 20348.681 or later.

Windows workload management

To run Windows workloads in your cluster, you must first install the Windows Machine Config Operator (WMCO). The WMCO is a Linux-based Operator that runs on Linux-based control plane and compute nodes. The WMCO orchestrates the process of deploying and managing Windows workloads on a cluster.