OpenShift
RHCA - EX180/EX280
Red Hat Certified Specialist in Containers and Kubernetes
Notes, tips and tricks for the EX180 and EX280 exams.
Podman host setup
dnf module install container-tools
dnf install -y buildah
Podman basics
Registry file: /etc/containers/registries.conf
Login to a registry
podman login registry.access.redhat.com
Search for images
podman search mariadb
Inspect images without downloading
skopeo inspect docker://registry.access.redhat.com/rhscl/mariadb-102-rhel7
Download images
podman pull registry.access.redhat.com/rhscl/mariadb-102-rhel7
List images
podman images
Inspect images. *Useful for locating config.user
podman inspect registry.access.redhat.com/rhscl/mariadb-102-rhel7:latest
Configure container volume path
sudo mkdir /srv/mariadb
sudo chown -R 27:27 /srv/mariadb # UID found in podman inspect
sudo semanage fcontext -a -t container_file_t "/srv/mariadb(/.*)"
sudo restorecon -Rv /srv/mariadb
Run image
-d detached
-e per variable
-p local_port:container_port
-v local/path:/path/in/pod
podman run -d -e MYSQL_USER=user \
-e MYSQL_PASSWORD=pass -e MYSQL_DATABASE=db \
-p 33306:3306 \
-v /srv/mariadb:/var/lib/mysql:Z \ # :Z isn't needed if SELinux manually configured
rhscl/mariadb-102-rhel7
Basic pod status and names
podman ps
Enter container in interactive shell
podman exec -it container-name /bin/bash
Commit changes to running image
podman commit container-name image-name
Export image
podman save image-name > /path/to/image.tar
Remove images
podman rmi image-name --force
Restore/Load image
podman load -i /path/to/image.tar
Dockerfile Basics
Container for scanning a network.
# Start with a base image
FROM registry.access.redhat.com/ubi8
# Maintainer information
MAINTAINER ClusterApps <mail@clusterapps.com>
# Run commands to build the container
# Do as much with the fewest RUN lines
RUN yum --assumeyes update && \
yum --assumeyes install \
nmap iproute procps-ng && \
bash && \
yum clean all
# Entrypoint is the command that run when the ccontainer starts
ENTRYPOINT ["/usr/bin/nmap"]
# The arguments for the entrypoint
CMD ["-sn", "192.168.252.0/24"]
Build the image with a tag
podman build -t notes180 .
List images
podman images
Run the image
podman run localhost/notes180
OpenShift Basics
Setup oc completion
source <(oc completion bash)
Create a new project
oc new-project nginx
Create a new application based on an image
oc new-app bitnami/nginx
Basic information about the project
oc status
Get more detailed information about the project
oc get all
Get full details about a pod
oc describe pod/nginx-84654f9574-9gpnt
Get full details about a deployment
oc describe deployment.apps/nginx
Application deployments
Generate a YAML file to use as a base.
oc create deployment nginx --image=bitnami/nginx --dry-run=client -o yaml > newapp.yml
Create a temporary deployment using the YAML file,
oc create -f newapp.yml
Create the service by exposing the deployment
# dry run to add to YAML file
oc expose deployment --port=8080 --dry-run=client nginx -o yaml >> newapp.yml
# run to create the service
oc expose deployment --port=8080 nginx
Expose the service
oc expose svc nginx --dry-run=client -o yaml >> newapp.yml
New app with parameters, as a deployment-config, and with labels (app=database)
oc new-app --name mdb -l app=database -e MYSQL_USER=dbuser -e MYSQL_PASSWORD=SuperAwesomePassword -e MYSQL_DATABASE=dbname bitnami/mysql --as-deployment-config
Delete the temporary application
oc delete all --all
Edit the YAML file and break up the sections into proper YAML.
Add ---
at the beginning of a section
Add ...
at the end of a section.
The new nginx app YAML file.
---
apiVersion: apps/v1
kind: Deployment
metadata:
creationTimestamp: null
labels:
app: nginx
name: nginx
spec:
replicas: 1
selector:
matchLabels:
app: nginx
strategy: {}
template:
metadata:
creationTimestamp: null
labels:
app: nginx
spec:
containers:
- image: bitnami/nginx
name: nginx
resources: {}
status: {}
...
apiVersion: v1
kind: Service
metadata:
creationTimestamp: null
labels:
app: nginx
name: nginx
spec:
ports:
- port: 8080
protocol: TCP
targetPort: 8080
selector:
app: nginx
status:
loadBalancer: {}
...
apiVersion: route.openshift.io/v1
kind: Route
metadata:
creationTimestamp: null
labels:
app: nginx
name: nginx
spec:
port:
targetPort: 8080
to:
kind: ""
name: nginx
weight: null
status: {}
...
Delete API resources defined by a YAML file.
oc delete -f newapp.yml
Using Templates
Get a list of templates
oc get templates -n openshift
Get template details
Review the parameters section for a list of environment variables.
oc describe template -n openshift mariadb-persistent
Create a new application from a template
oc new-app --template=mariadb-persistent \
-p MYSQL_USER=jack -p MYSQL_PASSWORD=password \
-p MYSQL_DATABASE=jack
Check the status of the deployment.
oc get all
oc describe pod/mariadb-1-qlvrj
Source 2 Image
Gety a list of templates and streams
oc new-app -L
Deploy a new app from a git repo
oc new-app php~https://github.com/clusterapps/simpleapp.git
Watch the app get built
oc logs -f buildconfig/simpleapp
Review the deployment with oc get all
NAME READY STATUS RESTARTS AGE
pod/mariadb-1-deploy 0/1 Completed 0 16m
pod/mariadb-1-qlvrj 1/1 Running 0 16m
pod/simpleapp-1-build 0/1 Completed 0 2m10s
pod/simpleapp-fb5554fd9-4kgnb 1/1 Running 0 89s
NAME DESIRED CURRENT READY AGE
replicationcontroller/mariadb-1 1 1 1 16m
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/mariadb ClusterIP 10.217.5.246 <none> 3306/TCP 16m
service/simpleapp ClusterIP 10.217.4.16 <none> 8080/TCP,8443/TCP 2m11s
NAME READY UP-TO-DATE AVAILABLE AGE
deployment.apps/simpleapp 1/1 1 1 2m11s
NAME DESIRED CURRENT READY AGE
replicaset.apps/simpleapp-75c686cbb8 0 0 0 2m11s
replicaset.apps/simpleapp-fb5554fd9 1 1 1 89s
NAME REVISION DESIRED CURRENT TRIGGERED BY
deploymentconfig.apps.openshift.io/mariadb 1 1 1 config,image(mariadb:10.3-el8)
NAME TYPE FROM LATEST
buildconfig.build.openshift.io/simpleapp Source Git 1
NAME TYPE FROM STATUS STARTED DURATION
build.build.openshift.io/simpleapp-1 Source Git@26e2f16 Complete 2 minutes ago 41s
NAME IMAGE REPOSITORY TAGS UPDATED
imagestream.image.openshift.io/simpleapp default-route-openshift-image-registry.apps-crc.testing/nginx2/simpleapp latest About a minute ago
Using oc to manage OpenShift
The Basics
Examples of the basic need to know oc commands to deploy and manage containers on OpenShift. Set a few variables to prevent sensitive information in the terminal history.
export REGISTRY_USERNAME=YourUsername
export REGISTRY_PASSWORD=SomePassword
export REGISTRY_HOST=quay.io
export REGISTRY_EMAIL=mail@example.com
export OSU=developer
export OSP=SuperAw3SomePassrd
Pods
Using oc explain
it is simple to get the ducumentation for the running version of OpenShift. Here are a few basics.
Get built-in documentation for Pods
oc explain pod
Get the pod spec
oc explain pod.spec
Details on the pod's containers
oc explain pod.spec.containers
Details about the pod's containers images
oc explain pod.spec.containers.image
Example of a pod file
apiVersion: v1
kind: Pod
metadata:
name: hello-world-pod
labels:
app: hello-world-pod
spec:
containers:
- env:
- name: MESSAGE
value: Hi there! You've run a pod.
image: docker.io/mcleary/helloworld-go
imagePullPolicy: Always
name: hello-world-override
resources: {}
Create a Pod on OpenShift based on a file
oc create -f pod.yaml
Use oc get
to information from OpenShift
Get pods
oc get pods
Watch pods deploy
oc get pods --watch
Get all resources
oc get all
Access the shell of a running container. Use oc get pods
to get the pod name.
oc rsh <pod-name>
Use port forwards to interact with the pod on the local machine. Get the pod name from the oc get pods
.
oc port-forward <pod-name> <local_port>:pod_port>
Delete OpenShift resources use the following syntax
oc delete <resource type> <resource name>
Delete a pod
oc delete pod <pod-name>
Deployments
Deploy an existing image based on its tag
oc new-app mcleary/helloworld-go:latest --as-deployment-config
Deploy an application from Git
oc new-app https://github.com/clusterapps/helloworld-go.git --as-deployment-config
Follow build progress when using
oc logs -f bc/helloworld-go
Set the name for the DeploymentConfig
oc new-app mcleary/helloworld-go --name hello-app --as-deployment-config
DeploymentConfig with a parameter
oc new-app MESSAGE="This is a parameter" mcleary/helloworld-go --name hello-app --as-deployment-config
DeploymentConfig with many patameters
oc new-app mysql MYSQL_USER=user MYSQL_PASSWORD=pass MYSQL_DATABASE=testdb -l db=mysql
Get information about a DeploymentConfig
Describe the DC to get its labels
oc describe dc/hello-app
Get the full YAML definition
oc get -o yaml dc/hello-app
Roll out the latest version of the application
oc rollout latest dc/hello-app
Roll back to the previous version of the application
oc rollback dc/hello-app
Scaling
General Syntax
oc scale dc/<dc name> --replicas=<desired replicas>
Manual scale to 3 pods
oc scale dc/helloworld-go --replicas=3
Scale down to one
oc scale dc/helloworld-go --replicas=1
General Syntax to create a HorizontalPodAutoscaler
oc autoscale dc/<dc name> \
--min <desired minimum pods> \
--max <desired maximum pods> \
--cpu-percent=<desiredTargetCPU>
Auto scaling between 1 and 10 pods with an 80% CPU target
oc autoscale dc/helloworld-go \
--min 1 \
--max 10 \
--cpu-percent=80
Show the HPA
oc get hpa
Information on the HPA
oc describe hpa/helloworld-go
YAML for the HPA
oc get -o yaml hpa/helloworld-go
Deleting resources
Delete a single resource
oc delete <resource> <name>
oc delete dc hello-app # Delete deployment config
oc delete svc hello-app # Delete a service
Delete all application resources using labels (get labels from oc describe)
oc delete all -l app=app=hello-app
Delete everything in a project
oc delete all --all
Templates
Get a list of templates
Templates in the working namespace
oc get template
Get built-in templates
oc get templates -n openshift
Get template details
Full details of the template.
oc describe template -n openshift mariadb-persistent
Get just the parameters for a template.
oc process --parameters mysql-persistent -n openshift
Create a new application from a template
oc new-app --template=mariadb-persistent \
-p MYSQL_USER=jack -p MYSQL_PASSWORD=password \
-p MYSQL_DATABASE=jack
Check the status of the deployment and get the pod name
oc get all
Full details of a pod from a template.
oc describe pod/mariadb-1-qlvrj
Networking
Access oc explain documentation
oc explain service
Get information about Service spec
oc explain service.spec
Get YAML definition for a service
oc get -o yaml service/hello-world
Get YAML definition for a route
oc get -o yaml route/hello-world
Creating services
Create a service for a single pod
oc expose --port 8080 pod/hello-world-pod
Create a service for a DeploymentConfig
oc expose --port 8080 dc/hello-world
Check that the service and pod are connected properly
oc status
Using Pod environment variables to find service Virtual IPs
Log into a pod. Get pod name from oc get pods
oc rsh pod/helloworld-2
Inside the pod, get all environment variables
env
Testing connectivity using environment variables with wget
wget -qO- $HELLOWORLD_GO_PORT_8080_TCP_ADDR:$HELLOWORLD_GO_PORT_8080_TCP_PORT
Creating Routes
Create a Route based on a Service. Get the service name from oc get svc
oc expose svc/helloworld-go
Get the Route URL
oc status
Check the route
curl helloworld-go-lab1.apps.okd4.example.com
ConfigMaps
Create a ConfigMap using literal command line arguments
oc create configmap helloconfig --from-literal KEY="VALUE"
Create from a file
oc create configmap helloconfig --from-file=MESSAGE.txt
Create from a file with a key override
oc create configmap helloconfig --from-file=MESSAGE=MESSAGE.txt
Create using --from-file
with a directory
oc create configmap helloconfig --from-file pods
Verify
oc get -o yaml configmap/helloconfig
Consuming ConfigMaps as Environment Variables
Set environment variables
oc set env dc/hello-app --from cm/helloconfig
Secrets
Secrets use simalar syntax as ConfigMaps. Secrets are base64 encoded ConfigMaps
There are a few main types.
- Opaque
- Service Account Tokens
- Registry Authentication
- Simple Auth Types
A simple generic (Opaque) Secret. Key-Value pairs
oc create secret generic <secret-name> --from-literal KEY="VALUE"
Check the Secret
oc get -o yaml secret/<secret-name>
Consume the Secret as Environment Variables the same as ConfigMaps
oc set env dc/<dc-name> --from secret/<secret-name>
Create a default registry secret
oc create secret docker-registry secret_name
--docker-server=$REGISTRY_HOST \
--docker-username=$REGISTRY_USERNAME \
--docker-password=$REGISTRY_PASSWORD \
--docker-email=$REGISTRY_EMAIL
Link the secret to the service account named "default"
oc secrets link default secret_name --for=pull
Check that the service account has the secret associated
oc describe serviceaccount/default
Decoding secrets. First get the hash.
- mysecret = name of secret
- password = is the entry to decode
oc get secret mysecret -o yaml |grep password
Result simalar to password: cGFzc3dvcmQ=
Decode as base64
echo "cGFzc3dvcmQ=" |base64 -d
Images
ImageStreams
List ImageStreams
oc get is
oc get istag
Create the ImageStream but don't deploy
oc import-image --confirm quay.io/clearyme/helloworld-go
Importing any new images from the repository using the same command as importing a new.
oc import-image --confirm quay.io/clearyme/helloworld-go
Creating a new local tag : oc tag <original> <destination>
oc tag $REGISTRY_HOST/$REGISTRY_USERNAME/helloworld-go:latest helloworld-go:local-1
Deploy an application based on your new ImageStream (lab1 is the name of the oc project with the newly tagged image)
oc new-app lab1/helloworld-go:local-1
Build a custom image
From within the directory where the Dockerfile
is, build the image and tag it for the registry.
podman build -t $REGISTRY_HOST/$REGISTRY_USERNAME/helloworld-go:latest .
Log into a registry
podman login $REGISTRY_HOST
Push the image ti the registery
podman push $REGISTRY_HOST/$REGISTRY_USERNAME/helloworld-go
Builds and BuildConfigs
Create a new BuildConfig from a Git repository URL
oc new-build <git URL>
Example
oc new-build https://github.com/clusterapps/helloworld-go.git
Example new build from s branch
oc new-build https://github.com/clusterapps/helloworld-go.git#update
Example using --context-dir to build from a subdirectory
oc new-build https://github.com/clusterapps/openshift-playing.git --context-dir hello-world-go
Working with existing BuildConfigs
Get a list of BuildConfigs
oc get bc
Start a build
oc start-build bc/helloworld
Get the list of builds
oc get build
Get logs for a single build
oc logs -f build/helloworld-go-1
Get logs for the latest build for a BuildConfig
oc logs -f bc/helloworld-go
Use oc cancel-build
to stop a build
``
oc cancel-build build/helloworld-go-1
Working with WebHooks
Get the secret token
oc get -o yaml buildconfig/helloworld-go
Export the secret as a variable
export GENERIC_SECRET=G_eQdWP67Sa8y38qlo4l
Get the webhook URL
oc describe buildconfig/helloworld-go
Copy the webhook URL and replace
<secret>
with $GENERIC_SECRET
curl -X POST -k <webhook URL with secret replaced with $GENERIC_SECRET>
Set build hooks
Set a post-commit hook
oc set build-hook bc/helloworld-go \
--post-commit \
--script="echo Hello from build hook"
Check the logs output for "Hello from a build hook"
oc logs -f bc/helloworld-go
Check the events to see if it ran
oc get events
Remove a build hook
oc set build-hook bc/helloworld-go \
--post-commit \
--remove
Source to Image
The syntax is the same as normal builds. OpenShift uses S2I to guess the language when there is no Dockerfile. A language can also be specified at build time durring the oc new-app
.
Works with Java, Ruby, Node, PHP, Python and PERL,
Overriding S2I Scripts
Assemble and Run are the two main scripts
Overrides go in your source at .s2i/bin/assemble
or .s2i/bin/run
They need to call the original scripts, which are at /usr/libexec/s2i/assemble
or /usr/libexec/s2i/run
New app without a Dockerfile
.
oc new-app https://github.com/clusterapps/openshift-playing.git --context-dir s2i/ruby
New app specifying the language by adding language tilda to the new-app command.
oc new-app ruby~https://github.com/clusterapps/openshift-playing.git --context-dir s2i/ruby
New app from a git branch
oc new-app https://github.com/clusterapps/helloworld-go.git#updates
Volumes
Check out the built-in documentation
oc explain persistentvolume.spec
or the The official Kubernetes Documentation for Volumes
Most deployent of k8s and OpenShift may have a dynamic storageclass. You can just the dynamic storage by specifying the mountpoint and size. For manual storage, here are some examples.
Storage basics for containers.
Mount Volumes
emptyDir
oc set volume dc/<dc name> --add --type emptyDir --mount-path <path inside container>
Example: Add an emptyDir volume. An emptyDir is ephemeral. It will survive a pod reboot, but will be deleted when the pod is deleted. Only good for testing.
oc set volume dc/helloworld-go --add \
--type emptyDir \
--mount-path /emptydir
View the DeploymentConfig to view the volume information. Look for container.volumeMounts and volumes.
oc get -o yaml dc/helloworld-go
ConfigMaps
Basic example
oc set volume <DC name> --add --configmap-name <configmap name> -mount-path <path inside container>
Create the configmap to use as a Volume
oc create configmap volume-file --from-literal file.txt="Contents"
Mount the ConfigMap
oc set volume dc/helloworld-go --add --configmap-name volume-file --mount-path /configs/
NFS
NFS is a very common storage method. It's cheap and easy to manage, but does have its own pitfalls.
Create an NFS persistent volume(PV) defination. A regular user cannot create PV.
cat > nfs.yml <<EOF
apiVersion: v1
kind: PersistentVolume
metadata:
name: nfspv
spec:
capacity:
storage: 5Gi
accessModes:
- ReadWriteMany
nfs:
path: /nfsshare
server: 172.20.255.2
persistentVolumeReclaimPolicy: Retain
EOF
Map a PVC to a PV
Create the PVC YAML
cat > nfspvc.yml <<EOF
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
name: nfs001
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
volumeName: nfspv
storageClassName: ''
volumeMode: Filesystem
EOF
Mount the pvc to a directory
oc set volume dc/helloworld-go --add --name=nfs001 -t pvc --claim-name=nfs001 -m /data
Basic troubleshooting
Retrieve the logs from a build configuration
oc logs bc/<application-name>
If a build fails, after finding and fixing the issues, run the following command to request a new build:
oc start-build <application-name>
Deployment logs
oc logs dc/<application-name>
Temporarily access some of these missing commands is mounting the host binaries folders, such as /bin, /sbin, and /lib, as volumes inside the container
sudo podman run -it -v /bin:/bin image /bin/bash