jkeam

#!/bin/bash

# create namespace
oc new-project vista

# sa
#   can use default, this is convenient but not best practice
#   oc adm policy add-scc-to-user anyuid -z default
oc create sa root
oc adm policy add-scc-to-user privileged -z root

jkeam

#!/bin/bash

# delete config map
oc delete configmap custom-ca -n openshift-config

# re-create it
oc create configmap custom-ca --from-file=ca-bundle.crt=</path/to/example-ca.crt> -n openshift-config

# make sure config map is being used
oc patch proxy/cluster --type=merge --patch='{"spec":{"trustedCA":{"name":"custom-ca"}}}'

jkeam

#!/bin/bash

# create admin and user1 with password `openshift`
#   -c for file, -n just for console
#   -B for bcrypt
#   -b for allowing password in command
htpasswd -c -B -b ./openshift.htpasswd admin openshift
htpasswd -B -b ./openshift.htpasswd user1 openshift

# add secret with username/passwords

jkeam

MAD Roadshow Links

Architecture

Nodes

The following is a good diagram of the various services running. Note, we can use infranodes to pull those cluster services from the compute nodes (things like registry, observability, monitoring, etc). Diagram from the docs.

jkeam

apiVersion: v1
kind: Pod
metadata:
 name: podman-priv
spec:
 containers:
   - name: priv
     image: quay.io/podman/stable:v4.4.1
     args:
       - sleep

jkeam

Setup for Demo for GitLab with Rancher and OpenShift runners

Git Repo

The code for this project is here [email protected]:jkeam/spring-petclinic-pac.git and the file we should be using is .gitlab-ci-kube.yml so in the repo that's in GitLab, make sure to blow away the original .gitlab-ci.yml and rename .gitlab-ci-kube.yml to .gitlab-ci.yml.

GitLab Variables

Something like below:

jkeam

Demo for GitLab with Rancher and OpenShift runners

Pre Demo

1. Generate new KUBE_CONFIG with fresh OCP token

Demo

jkeam

# Pod Security Admission Demo

## Part 1 - What is this

1. New Project:
oc new-project psa-test


2. Create deployment
oc create -f https://raw.githubusercontent.com/radikaled/psa/main/deploy/psa-test-deployment.yaml

jkeam

OpenShift Project Request Template

Automatically create an EgressNetworkPolicy (note this is for OpenShiftSDN, for OVNKubernetes use EgressFirewall)

Before

oc new-project before
oc get EgressNetworkPolicy  # notice nothing is returned

jkeam

#!/bin/bash

# create dir for container
mkdir -p /tmp/work

# give permissions to container user
podman unshare chown -R 1001:1001 /tmp/work

# relabel
sudo semanage fcontext -a -t container_file_t '/tmp/work(/.*)?'