live wire
▸JAVA · Quarkus 4.0.0.Beta1 moves to Java 21, adds HTTP/3 and starts extension migration (Oct. 1)Quarkus▸SECURITY · X41 shows shared /dev/shm can turn Envoy hot restart into cross-container lateral movementX41 D-Sec▸DATA · AWS and Red Hat map Confluent Platform on ROSA with HCP, CFK and OpenShift security controlsAWS IBM & Red Hat▸API · Red Hat resolves intermittent 3scale API Manager latencyRed Hat Status▸AI · IBM shows Maximo workflows exposed as approval-gated MCP tools on OpenShiftIBM Community▸AI · vLLM adds day-zero NVIDIA Vera Rubin support and reports 7.8× per-GPU throughputvLLM▸INTEGRATION · Apache Camel 4.23 makes Kamelets visible to AI tooling and validationApache Camel▸SECURITY · OpenShift 4.14.75 fixes five CVEs, including two SQLite code-execution flawsRed Hat Customer Portal▸SUPPLY CHAIN · Red Hat maps CRA-ready open source practices as EU reporting rules take effectRed Hat Blog▸AI · Red Hat AI Inference on IBM Cloud adds an OpenAI-compatible Embeddings APIIBM Cloud▸API · Red Hat investigates degraded 3scale API Management SaaS APIsRed Hat Status▸PLATFORM · Red Hat and Cloudera validate a 100-VM analytics stack on OpenShift VirtualizationRed Hat Blog▸DEVELOPER HUB · Red Hat maps a four-zone, quota-aware Dev Spaces architectureRed Hat Developer▸INTEGRATION · Camel 4.23 teaches agent tools to discover and validate KameletsApache Camel▸JAVA · Quarkus 4.0.0.Beta1 moves to Java 21, adds HTTP/3 and starts extension migration (Oct. 1)Quarkus▸SECURITY · X41 shows shared /dev/shm can turn Envoy hot restart into cross-container lateral movementX41 D-Sec▸DATA · AWS and Red Hat map Confluent Platform on ROSA with HCP, CFK and OpenShift security controlsAWS IBM & Red Hat▸API · Red Hat resolves intermittent 3scale API Manager latencyRed Hat Status▸AI · IBM shows Maximo workflows exposed as approval-gated MCP tools on OpenShiftIBM Community▸AI · vLLM adds day-zero NVIDIA Vera Rubin support and reports 7.8× per-GPU throughputvLLM▸INTEGRATION · Apache Camel 4.23 makes Kamelets visible to AI tooling and validationApache Camel▸SECURITY · OpenShift 4.14.75 fixes five CVEs, including two SQLite code-execution flawsRed Hat Customer Portal▸SUPPLY CHAIN · Red Hat maps CRA-ready open source practices as EU reporting rules take effectRed Hat Blog▸AI · Red Hat AI Inference on IBM Cloud adds an OpenAI-compatible Embeddings APIIBM Cloud▸API · Red Hat investigates degraded 3scale API Management SaaS APIsRed Hat Status▸PLATFORM · Red Hat and Cloudera validate a 100-VM analytics stack on OpenShift VirtualizationRed Hat Blog▸DEVELOPER HUB · Red Hat maps a four-zone, quota-aware Dev Spaces architectureRed Hat Developer▸INTEGRATION · Camel 4.23 teaches agent tools to discover and validate KameletsApache Camel
upstreambeat.ai
newsPLATFORM

RHCOS 10 makes OpenShift’s next worker-node baseline a compatibility decision

Red Hat plans to make RHCOS 10 the default for new OpenShift installations in Q4, requiring early checks for privileged containers, UBI7 workloads and older x86 hardware.

OpenShift worker node transition from RHCOS 9 to RHCOS 10.
AI-generated illustration
By The News Desk· Oct 3, 2026the quick take — two AI hosts go live when you do

Red Hat plans to make Red Hat Enterprise Linux CoreOS 10 the default worker-node operating system for new OpenShift installations in the fourth quarter of 2026, turning the next OpenShift baseline into a compatibility checkpoint for platform teams and software partners. Red Hat says all certified ISV containers and operators will be expected to support RHCOS 10 when it becomes generally available.

What changes

RHCOS is OpenShift’s purpose-built immutable node operating system, configured through OpenShift and Kubernetes APIs. RHCOS 10 carries the RHEL 10 kernel and hardware baseline into that layer. Red Hat says RHCOS 9 will remain available for newer OpenShift versions at least into mid-2027, providing a transition window rather than an immediate forced cutover.

The compatibility boundaries matter most for software that reaches into the host. Red Hat specifically calls out CSI and CNI drivers, host agents, kernel drivers and containers that alter host configuration files as candidates for additional testing. Ordinary workloads without privileged host access are less likely to encounter issues, although Red Hat still recommends testing.

Two other boundaries are explicit. OpenShift nodes moved to RHCOS 10 will no longer support containers based on UBI7, while nodes kept on RHCOS 9 will retain that compatibility. RHCOS 10 also drops support for x86-64-v2 and earlier instruction sets, so supported systems must provide x86-64-v3 or newer. For workloads requiring FIPS 140 compatibility, Red Hat currently recommends UBI9 because RHEL 10 and UBI10 cipher libraries are still undergoing certification.

What teams should do now

OpenShift 4.21 and 4.22 already expose RHCOS 10 and an “OS Streams” capability as Technology Preview. That gives platform teams a place to inventory and exercise host-integrated workloads before the default changes. The warning is consequential: enabling OpenShift Technology Preview features makes a cluster ineligible for future minor-version upgrades, so Red Hat says testing should happen only on disposable clusters using the latest patch release.

The practical sequence is to identify privileged containers and operators, check base images for UBI7, verify hardware certification against the RHEL 10 baseline, and run representative upgrades or fresh installs in a throwaway environment. That work is especially important for vendors whose OpenShift certification will be expected to cover RHCOS 10 at general availability.

The transition does not require every cluster to move immediately, but it does establish the operating-system assumptions that new OpenShift installations will carry. Platform teams that treat node images as an implementation detail may find the application and hardware consequences arriving together.

Filed by The News Desk. Corrections: desk@upstreambeat.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.