1. Installation and configuration on OpenShift Operations Training

1.1 Installation

Mon, 01 Jan 0001 00:00:00 +0000

In this lab, you are going to install an OpenShift 4 cluster on AWS.

Task 1.1.1: Preparing the environment

Using the information provided by your trainer, ssh into your bastion host and change into the ocp4-ops directory.

It is best practice to create a timestamped directory for each cluster installation, for example:

cd ~/ocp4-ops
mkdir $(date +"%Y-%m-%d")

Task 1.1.2: Customizing the installation

First, we need an SSH keypair. The public key will be used to grant us access to the OpenShift machines we are going to create. Either use an existing keypair or create a new one by executing:

1.2 Cluster inspection

Mon, 01 Jan 0001 00:00:00 +0000

Before diving headfirst into configuring the freshly set-up cluster, let’s first take a look at certain features. As we installed the OpenShift cluster on AWS, some components have already been configured for us to use right away, amongst them:

An AWS cloud provider, making it possible for controllers to, e.g., create and update AWS load balancers and do node lifecycle management
A storage class to provision AWS Elastic Block Store (EBS) volumes

Cloud provider

In order to understand what a cloud provider is or does, it’s easiest to look at the description of the AWS cloud provider :

1.3 Configuration

Mon, 01 Jan 0001 00:00:00 +0000

After the initial installation, we can start configuring the cluster. Because of the extended use of operators, nearly everything in OpenShift 4 is configured via custom resources. In some cases configmaps or templates are used, but this is clearly the minority.

Most of the configuration is done post-installation and can be used to better adapt the cluster to its environment or change its default behaviour. We are going to configure our own kubelet arguments and change the default project template in order to automatically create some NetworkPolicy resources.

1.4 Additional components

Mon, 01 Jan 0001 00:00:00 +0000

In this lab, you will install additional components that are commonly used in production.

Task 1.4.1: Install cert-manager

cert-manager massively simplifies certificate management for Kubernetes. It provides easy to use tools to issue, manage and automatically renew certificates and supports the ACME protocol. This allows us to easily and automatically get certificates signed by Let’s Encrypt for our cluster.

Install cert-manager as an Operator using the OperatorHub:

In the Administrator view, navigate to Operators -> OperatorHub
Enter cert-manager into the filter box
Select the cert-manager Operator for Red Hat OpenShift and click Install
Leave everything as it is, except that you set the Update approval to Manual
Click Install
As soon as it appears, approve the install plan presented to you by clicking Approve
Check for the existence of the cert-manager-operator pod

Hints

oc --namespace cert-manager-operator get pods

Also, the Operator should already have created at least the webhook and cainjector pods in the cert-manager namespace

Hints

oc --namespace cert-manager get pods

The Operator will also automatically create a CertManager custom resource named cluster. In order to use DNS01 challenges on OpenShift clusters installed on AWS, we need to add some configuration to cert-manager’s configuration :

1.5 Uptime app

Mon, 01 Jan 0001 00:00:00 +0000

In this lab you’re going to deploy an application on your freshly-installed OpenShift cluster.

The application’s availability will be monitored and recorded by an external monitoring system. Your main goal for the rest of this training is to keep this application up and running, no matter what you do.

Note

At any time you can view the availability of your cluster console and the uptime app on this dashboard. Credentials to login will be provided by your trainers.

Uptime app

The application you’re going to install is a simple Python app. It’s going to be scaled to 2 replicas in order to achieve high availability.

1.6 Backup

Mon, 01 Jan 0001 00:00:00 +0000

In this lab, you will create scheduled backups for the most important cluster components.

Task 1.6.1: Create user workload backups

First, check the backupStorageLocation’s health and name:

oc -n openshift-adp get backupstoragelocations.velero.io

The output should show you that you’ve got backupStorageLocation resource named default with PHASE Available. If the PHASE shows something else, there’s most probably a permissions or typo problem in your dataProtectionApplication resource.

NAME PHASE LAST VALIDATED AGE DEFAULT
default Available 4s 3m true

Now, create a daily backup of the resources in namespace uptime-app-prod with a lifetime of 5 days by creating the following Schedule manifest: