SCOS - Release/Lifecycle Info

[nate-duke]

Our Security people are asking about support/lifecycle information for Stream CentOS CoreOS (Stream CoreOS CentOS? both?).

Is there somewhere official that I can point them to?

[BeardOverflow]

Check out SCOS website: https://www.centos.org/about/

CentOS Stream defines Enterprise Linux.

CentOS Stream is derived from Fedora Linux. It has a new major version release every three years, and each release is maintained for five years, matching the full support phase of RHEL. CentOS Stream development is open to all, but because CentOS Stream only has updates intended for RHEL, it is maintained by the RHEL team. Learn how to contribute.

CentOS Stream can serve as a production operating system, a development environment, or a preview of the next minor RHEL release. It also serves as a foundation for the work from our Special Interest Groups (SIGs).

You could find more context here:

• https://access.redhat.com/support/policy/updates/errata/#Life_Cycle_Dates
• https://www.redhat.com/en/blog/faq-centos-stream-updates
• https://www.redhat.com/en/blog/centos-stream-building-innovative-future-enterprise-linux
• https://blog.centos.org/

OKD is also trying to align with SCOS/Openshift release cycle: https://okd.io/docs/project/faq#what-are-the-relations-with-ocp-project-is-okd4-an-upstream-of-ocp

What are the relations with OCP project? Is OKD4 an upstream of OCP?

In 3.x release time OKD was used as an upstream project for Openshift Container Platform. OKD could be installed on Fedora/CentOS/RHEL and used CentOS based images to install the cluster. OCP, however, could be installed only on RHEL and its images were rebuilt to be RHEL-based.

Universal Base Image project has enabled us to run RHEL-based images on any platform, so the full image rebuild is no longer necessary, allowing OKD4 project to reuse most images from OCP4. There is another critical part of OCP - Red Hat Enterprise Linux CoreOS. Although RHCOS is an open source project (much like RHEL8) it's not a community-driven project. As a result, OKD workgroup has made a decision to use Fedora CoreOS - open source and community-driven project - as a base for OKD4. This decision allows end-users to modify all parts of the cluster using prepared instructions.

It should be noted that OKD4 is being automatically built from OCP4 ci stream, so most of the tests are happening in OCP CI and being mirrored to OKD. As a result, OKD4 CI doesn't have to run a lot of tests to ensure the release is valid.

These relationships are more complex than "upstream/downstream", so we use "sibling distributions" to describe its state.

OKD is an upstream derivate of OCP, never forget it. Despite being technically correct to say "sibling", it does not describe the true OKD purpose, so I prefer to continue saying "upstream" to be cleaner. So, although the release cycle of OCP cannot be directly applied to OKD, just use it as reference because OKD will always try to be ahead of OCP: https://access.redhat.com/support/policy/updates/openshift/#dates

Unlike SCOS, OKD does not have a SIG (Special Interest Groups) but a single WG (Working Group), more limited in terms of support. For support issues, WG members will refer you to OKD community support (most of community members are here and we use issues/discussions to find help).

For news about OKD, recently the blog was completely updated and is being well maintained. Anyway, I would recommend you to follow the issues/discussions to stay up to date on possible new changes.

As last words, OKD is in excelent condition now, being truly an upstream version of OCP. The biggest recent handicap was the migration to CoreOS-like images (as OCP already did) where there was about 1 year without updates (stucked on 4.15, while OCP continued to advance). Today, all handicaps were overcome and we can compare their CI pages to see how to OKD is released before OCP:

• (OCP) https://openshift-release.apps.ci.l2s4.p1.openshiftapps.com/
• (OKD) https://amd64.origin.releases.ci.openshift.org/

A faithfully community user 👍

P.S.: A question, is your security team sure to allow the use of a community project? OKD is focused on enthusiasts, but if it is a strong requirement to meet security rules, go to OCP better.

[nate-duke]

Thanks @BeardOverflow, I know about the OKD WG but will look around the CentOS Cloud SIG. I have spent some time digging around in the various repos related to building it enough to know that it's based on stream9 so i can say with some confidence the loose expectation that it won't be abandoned before that (and consequently RHEL 9) is. Obviously because the way that SCOS is being bundled with a specific OKD release the timeframe will be much tighter than that.

Practically the concern is some sky is actually falling for real this time CVE in the RHEL9/Stream Centos 9/SCOS and being able to address it. This came up because SCOS identifies itself to our infrastructure as "CentOS Stream CoreOS 417" rather than "CentOS Stream CoreOS 9" which would have been more easily identified as "Stream CentOS 9" despite the words being scrambled some.

Maybe if we just had a way to surface similar lifecycle information for OKD releases or SCOS releases that would help?

[BeardOverflow]

This came up because SCOS identifies itself to our infrastructure as "CentOS Stream CoreOS 417" rather than "CentOS Stream CoreOS 9" which would have been more easily identified as "Stream CentOS 9" despite the words being scrambled some.

Recently they changed the identifier. They took advantage of ending number 9 (of OKD 419) to start applying the right CentOS version.

OKD Version	/etc/os-release
4.16.0-okd-scos.1	416.9.202411211032-0
4.17.0-okd-scos.3	417.9.202501302032-0
4.18.0-okd-scos.10	418.9.202504300632-0
4.19.0-okd-scos.1	9.0.20250515-0
4.20.0-okd-scos.ec.1	9.0.20250515-0

[nate-duke]

That'll probably help it be less mysterious for sure since it'll return search results that aren't just artifacts in a CI pipeline 🤣

[JaimeMagiera]

Hello,

We talked about SCOS release cadence at our last Working Group meeting. I'm in the process of collating our thoughts and putting them to paper. Stay tuned and thanks for your patience.

Jaime
OKD Working Group

[nate-duke]

Thanks @JaimeMagiera. I've been meaning to join the Working Group but always run into time allocation issues!