Guidance when installing on Open Shift?

[Alexander_Nitu]

Hello!

We are going to do an installation in an OpenShift environment. We usually just go with embedded installations so we don’t know much about this. Are there any guidance you can share when doing such a type of installation? Any general questions it would be helpful to ask the customer before so that we are better prepared? Any specific things we can do or need to pay attention to? Any help would be appreciated.

Thanks!

[dex]

I can say that a lot of problems that may seem “unique to openshift” often are less “openshift specific” problems, and more like “locked-down security postures that could happen in any cluster, but are much more likely to show up in openshift clusters”. These include:

• Requiring use of an existing service account instead one created by the KOTS CLI
• Requiring airgap
• Requiring a specific namespace, and that all workloads and service accounts be scoped to that one single namespace

There are, of course, some openshift-specific things that are almost certain to come up

• Requiring containers to run as non-root
• Blocking privileged and other flags that open the door to container privilege escalation

In all cases, please ensure you provision and test in an Openshift cluster internally, or you’re certainly in for some surprises on launch day. Start drafting your documentation before you go to install with the customer. Have someone on your team playtest the documentation to make sure they can follow and succeed with it.

As for resources, this won’t be comprehensive, but I’d check out

Existing Cluster Install: Using Custom RBAC roles

Question from this week about using custom / BYO RBAC roles when installing App Manager (KOTS) into an existing kubernetes cluster – specifically Openshift in this case. Our Openshift cluster has a built-in role admin that we’d like to use instead of the role created by kubectl kots install --use-minimal-rbac or oc kots install --use-minimal-rbac. Because the admin account permissions are slightly more narrow than the kots-created RBAC role, the installation fails if a user with the admin role…

Online Installation in Existing Clusters | Replicated Docs

Managing Custom Namespaces in a secured environment

Great Question from today: We are trying to template below toggles under the kots-app config with no success, requireMinimalRBACPrivileges additionalNamespaces We need to be able to let our customer to control these toggle on deployment, and specify the namespace accordingly for minimal RBAC permissions Put another way, at least as I understand it, this comes down to “My customer only wants to give me access to one or more specific namespaces, and I want to make this customizable for them” …

There are many vendor documentation examples in Help creating Replicated Documentation For end user Kubernetes installs?, and a few openshift-specific deep-links provided below from industry leaders:

• https://docs.swimlane.com/install/Swimlane_Platform_Installer/Existing_Cluster_Install/Install_Into_an_Online_OpenShift_Cluster
• https://support.smartbear.com/swaggerhub/docs/enterprise/latest/install/cluster/online-openshift.html

[bco]

One major gotcha with OpenShift is that containers run as an arbitrary uid. The uid is injected into /etc/passwd at container startup and the user is a member of the root group. The behavior can be disabled but our customers generally have policies preventing this.

The effect of this is that any files or folders that need to be writable within the container must be writable by the root group. See “Support Arbitrary User IDs” in the OpenShift docs: Guidelines | Creating Images | OpenShift Container Platform 3.11