joy of Openshift SCC

if you do

oc describe project

you will see 2 annotations

openshift.io/sa.scc.supplemental-groups=1000800000/10000
openshift.io/sa.scc.uid-range=1000800000/10000


Even if you specify a "USER 10001" in your Dockerfile, your actual uid will be remapped withing the range specified by those 2 annotations (the second parameter "/10000" is the block length! meaning that you can have 10000 different users starting from uid 1000800000 ) :

sh-4.2$ id
uid=1000800000(root) gid=0(root) groups=0(root),1000800000
sh-4.2$ id root
uid=0(root) gid=0(root) groups=0(root)

and in order for this new user to be a first class citizen in your Linux, you must run a uid_entrypoint script to append it to /etc/passwd

for more details:

https://docs.openshift.com/enterprise/3.1/architecture/additional_concepts/authorization.html

https://docs.openshift.com/container-platform/3.11/creating_images/guidelines.html#openshift-specific-guidelines

Learn OpenShift!

https://learn.openshift.com


This is a cool katacoda-based collection of laboratories.

OpenShift CI/CD

https://www.youtube.com/watch?v=65BnTLcDAJI good video on CI/CD, part 1


https://www.youtube.com/watch?v=wSFyg6Etwx8 part 2



https://www.youtube.com/watch?v=kbbK0VEy2qM OpenShift 4 CI/CD

essential is to have installed in Jenkins the "OpenShift Jenkins Pipeline (DSL) Plugin" https://github.com/openshift/jenkins-client-plugin



https://www.youtube.com/watch?v=pMDiiW1UqLo Openshift Pipelines with Tekton https://cloud.google.com/tekton/ and here is the code https://github.com/openshift/pipelines-tutorial

Openshift RedHat plugin for Intellij

https://plugins.jetbrains.com/plugin/12030-openshift-connector-by-red-hat

Sample video on how to use it https://www.youtube.com/watch?v=kCESA7a5i3M


I keep getting the message "odo not found, do you want to download it?" , I click "yes" and nothing visible happens.... even if I have odo.exe on the PATH, I still get the error message....

https://github.com/openshift/odo

It doesn't seem very popular though.... very few downloads.... but I don 't want to use Eclipse with its JBoss Openshift Client, I hate Eclipse...

However, Intellij has its own Cloud support for Openshift https://www.jetbrains.com/help/idea/working-with-clouds.html

CTRL-ALT-S, Cloud, Openshift

see also https://www.jetbrains.com/help/idea/run-debug-configuration-openshift-deployment.html

Openshift 4, interesting readings

https://computingforgeeks.com/red-hat-openshift-4-new-features/

https://cloudowski.com/articles/10-differences-between-openshift-and-kubernetes/

https://cloudowski.com/articles/honest-review-of-openshift-4/

https://cloudowski.com/articles/why-managing-container-images-on-openshift-is-better-than-on-kubernetes/

https://computingforgeeks.com/setup-openshift-origin-local-cluster-on-centos/ ( not working for me.... ) see also https://github.com/openshift/origin/blob/v4.0.0-alpha.0/docs/cluster_up_down.md


I have deployed https://github.com/vernetto/sbhello with OpenShift Online,
using the Catalog option "Red Hat OpenJDK 8".

.\oc.exe new-app openshift/java:8~https://github.com/vernetto/sbhello.git --name=sbhwpv3
.\oc.exe expose service sbhwpv3

https://github.com/fabric8io-images/run-java-sh



This makes still a very good Developer introducton https://www.youtube.com/watch?v=cY7KIEajqx4 (a bit outdated) by Grant Shipley, really intense and focused.


https://www.youtube.com/watch?v=-xJIvBpvEeE amazing on Openshift infrastructure management


https://coreos.com/ignition/docs/latest/ what is ignition

https://www.terraform.io/intro/index.html what is terraform

Openshift Online getting started

Create yourself an Openshift Online account (account creation seems to me a bit buggish)

https://docs.openshift.com/online/getting_started/basic_walkthrough.html

I follow the instructions and create my first mongodb / nodejs Openshift project


I download the CLI https://console.starter-ca-central-1.openshift.com/console/command-line

oc login https://api.starter-ca-central-1.openshift.com --token=4zlxeYZvlO9FdfvcBEEVZpMca-JA5UftBzShxdkGITI

oc project vernetto-example

.\oc.exe status
In project vernetto-example on server https://api.starter-ca-central-1.openshift.com:443

svc/mongodb - 172.30.171.215:27017
  dc/mongodb deploys openshift/mongodb:3.2
    deployment #1 deployed 15 minutes ago - 1 pod

http://nodejs-mongo-persistent-vernetto-example.193b.starter-ca-central-1.openshiftapps.com (svc/nodejs-mongo-persistent)
  dc/nodejs-mongo-persistent deploys istag/nodejs-mongo-persistent:latest <-
    bc/nodejs-mongo-persistent source builds https://github.com/vernetto/nodejs-ex.git on openshift/nodejs:6
    deployment #1 deployed 13 minutes ago - 1 pod

View details with 'oc describe /' or list everything with 'oc get all'.

.\oc.exe config view
apiVersion: v1
clusters:
- cluster:
    api-version: v1
    server: https://api.starter-ca-central-1.openshift.com:443
  name: api-starter-ca-central-1-openshift-com:443
contexts:
- context:
    cluster: api-starter-ca-central-1-openshift-com:443
    namespace: vernetto-example
    user: publicpierre/api-starter-ca-central-1-openshift-com:443
  name: vernetto-example/api-starter-ca-central-1-openshift-com:443/publicpierre
current-context: vernetto-example/api-starter-ca-central-1-openshift-com:443/publicpierre
kind: Config
preferences: {}
users:
- name: publicpierre/api-starter-ca-central-1-openshift-com:443
  user:
    token: 4zlxeYZvlO9FdbvcBEEVZpMca-JA5UftBzShxdkGVTI

.\oc.exe project
Using project "vernetto-example" on server "https://api.starter-ca-central-1.openshift.com:443".

.\oc.exe get svc
NAME                      CLUSTER-IP       EXTERNAL-IP   PORT(S)     AGE
mongodb                   172.30.171.215           27017/TCP   3h
nodejs-mongo-persistent   172.30.187.89            8080/TCP    3h

The file C:\Users\publi\.kube\config contains the authentication info:

apiVersion: v1
clusters:
- cluster:
    api-version: v1
    server: https://api.starter-ca-central-1.openshift.com:443
  name: api-starter-ca-central-1-openshift-com:443
contexts:
- context:
    cluster: api-starter-ca-central-1-openshift-com:443
    namespace: vernetto-example
    user: publicpierre/api-starter-ca-central-1-openshift-com:443
  name: vernetto-example/api-starter-ca-central-1-openshift-com:443/publicpierre
current-context: vernetto-example/api-starter-ca-central-1-openshift-com:443/publicpierre
kind: Config
preferences: {}
users:
- name: publicpierre/api-starter-ca-central-1-openshift-com:443
  user:
    token: 4zlxeYZvlO9FdbacBEEVqpMca-JA5UftBfShxdkGVTI

with the 4 sections clusters, contexts, current-context, users

.\oc.exe get quota
NAME                          AGE
compute-resources             5h
compute-resources-timebound   5h
object-counts                 5h

.\oc.exe describe quota compute-resources
Name:           compute-resources
Namespace:      vernetto-example
Scopes:         NotTerminating
 * Matches all pods that do not have an active deadline. 
These pods usually include long running pods whose container command is not expected to terminate.
Resource        Used    Hard
--------        ----    ----
limits.cpu      2       2
limits.memory   1Gi     1Gi

.\oc.exe export services
apiVersion: v1
items:
- apiVersion: v1
  kind: Service
  metadata:
    annotations:
      description: Exposes the database server
    creationTimestamp: null
    labels:
      app: nodejs-mongo-persistent
      template: nodejs-mongo-persistent
    name: mongodb
  spec:
    ports:
    - name: mongodb
      port: 27017
      protocol: TCP
      targetPort: 27017
    selector:
      name: mongodb
    sessionAffinity: None
    type: ClusterIP
  status:
    loadBalancer: {}
- apiVersion: v1
  kind: Service
  metadata:
    annotations:
      description: Exposes and load balances the application pods
      service.alpha.openshift.io/dependencies: '[{"name": "mongodb", "kind": "Service"}]'
    creationTimestamp: null
    labels:
      app: nodejs-mongo-persistent
      template: nodejs-mongo-persistent
    name: nodejs-mongo-persistent
  spec:
    ports:
    - name: web
      port: 8080
      protocol: TCP
      targetPort: 8080
    selector:
      name: nodejs-mongo-persistent
    sessionAffinity: None
    type: ClusterIP
  status:
    loadBalancer: {}
kind: List
metadata: {}

to manually start a build:

oc start-build nodejs-mongo-persistent -n vernetto-example

Openshift "Could not resolve host: github.com; Unknown error"

if you get the error

"Could not resolve host: github.com; Unknown error"

when building your POD, the solution is simply:

sudo oc cluster down
sudo iptables -F
sudo oc cluster up

https://github.com/openshift/origin/issues/12110

https://github.com/openshift/origin/issues/10139

Pathetic

openshift create project

oc login
oc new-project pippo
oc new-app centos/ruby-22-centos7~https://github.com/openshift/ruby-ex.git

https://hub.docker.com/r/centos/ruby-22-centos7/ "This container image includes Ruby 2.2 as a S2I base image for your Ruby 2.2 applications."


https://github.com/openshift/ruby-ex "This is a basic ruby application for OpenShift v3 that you can use as a starting point to develop your own application and deploy it on an OpenShift cluster."

docker insecure registry

I have been tortured for a long time by this:

sudo oc cluster up

[sudo] password for centos:
Starting OpenShift using openshift/origin:v3.7.0 ...
-- Checking OpenShift client ... OK
-- Checking Docker client ... OK
-- Checking Docker version ... OK
-- Checking for existing OpenShift container ... OK
-- Checking for openshift/origin:v3.7.0 image ... OK
-- Checking Docker daemon configuration ... FAIL
Error: did not detect an --insecure-registry argument on the Docker daemon
Solution:

Ensure that the Docker daemon is running with the following argument:
--insecure-registry 172.30.0.0/16





"docker info" will output you a wealth of information, including this:

Insecure Registries:
127.0.0.0/8


( you can use docker info | grep -A 4 -i insecure )

So the only way to start Openshift Cluster was

sudo oc cluster up --skip-registry-check=true


It turned out that https://stackoverflow.com/questions/42211380/add-insecure-registry-to-docker to add the extra entry for insecure-registry one should

sudo vi /etc/docker/daemon.json

and enter this:

{
"insecure-registries" : [ "172.30.0.0/16" ]
}


sudo systemctl daemon-reload
sudo systemctl restart docker
sudo oc cluster down
sudo oc cluster up



and no more errors! Great!

To the Openshift lazy developers: in future please provide also a hint how to troubleshoot the issue... it would save a LOT of time to us frustrated users.

The more I use Openshift the more it feels like a huge Goldberg machine, a Zeppelin.

oc cluster up : how to enable admin privileges

Once you install OpenShift with "oc cluster up", you are confronted with a frustrating situation: you are told to login as

oc login -u system -p admin

to be a cluster administrator, but in reality you are just a regular user.

If you try to do

oc adm policy add-cluster-role-to-user cluster-admin system

you get a

Error from server (Forbidden): User "system" cannot list clusterrolebindings.authorization.openshift.io at the cluster scope: User "system" cannot list all clusterrolebindings.authorization.openshift.io in the cluster (get clusterrolebindings.authorization.openshift.io)


After zillion of desperate attempts (including reinstalling everything a few times) I have found a way:

#become root
sudo su -
#login as admin, not as system
oc login -u admin -p admin
#grant yourself superhuman rights
oc adm policy add-cluster-role-to-user cluster-admin admin --config=/var/lib/origin/openshift.local.config/master/admin.kubeconfig
cluster role "cluster-admin" added: "admin"
#login again
oc login -u admin -p admin
Login successful.

You have access to the following projects and can switch between them with 'oc project ':

* default
kube-public
kube-system
myproject
openshift
openshift-infra
openshift-node

Using project "default".




and when I log into https://127.0.0.1:8443/console/ as admin/admin I can see all the Openshift internal projects.

Openshift REST Client API written in Java

https://github.com/openshift/openshift-restclient-java/

immensely more usable than the CLI...

I ask myself who wants to learn by heart the hyper-complicated Openshift command line interface, when you can easily wrap all that crap in a nice fluent Java API....

Life is short, I am too busy, no time to learn all the freaking CLIs of the planet... please give me simple and powerful programming tools... I don't want to type any commands...

To get started, create a Maven Java Project, add this in pom.xml:

  <dependencies>
   <dependency>
    <groupId>com.openshift</groupId>
    <artifactId>openshift-restclient-java</artifactId>
    <version>5.9.3.Final</version>
   </dependency>
 </dependencies>

then run this:

package org.pierre.ocpclient;

import com.openshift.restclient.ClientBuilder;
import com.openshift.restclient.IClient;
import com.openshift.restclient.ResourceKind;
import com.openshift.restclient.model.IProject;
import com.openshift.restclient.model.IResource;

public class CreateProject {
 public static void main(String[] args) {
  IClient client = new ClientBuilder("https://localhost:8443")
    .withUserName("admin")
    .withPassword("admin")
    .build();
  
  IResource request = client.getResourceFactory().stub(ResourceKind.PROJECT_REQUEST, "myfirstproject");
  IProject project =  (IProject)client.create(request);
  
 }

}

Great OpenShift presentation : OpenShift 3 Walkthrough

Here the code https://github.com/gshipley/openshift3mlbparks


In case you want to take the DO280 certification.... https://www.redhat.com/en/services/training/do280-red-hat-openshift-administration-i

I was able to deploy the project on Openshift Online and run it.... impressive, but the configuration effort is really huge, when compared to docker-compose....


this is older video repeating more or less same concepts




and the famous "instant gratification with Openshift"



Grant Shipley is a great guy. Here another great talk by him - more philosophical than technical

Install Openshift Container Platform on Ubuntu 16.4

download oc here

https://github.com/openshift/origin/releases/tag/v3.7.0-alpha.1

untar the oc executable and put it somewhere in the path (e.g. /usr/local/bin )

install docker:

sudo apt install docker.io
#sudo groupadd docker // this should not be necessary!
sudo usermod -aG docker $(whoami)
sudo reboot now
sudo service docker start
docker ps

oc cluster up

if it comes up with an error related to --insecure-registry, you can start with "oc cluster up --skip-registry-check=true"

It's really a struggle to make all this work... the whole integration Openshift-Docker is very environment-dependent, for instance on Ubuntu 17.4 I could not even install Docker... .pathetic... always something going wrong...

OpenShift 3 templates

https://blog.openshift.com/part-1-from-app-to-openshift-runtimes-and-templates/

https://blog.openshift.com/part-2-creating-a-template-a-technical-walkthrough/

https://docs.openshift.org/3.6/welcome/index.html

Installing Openshift Origin on your CentOS 7 VM

sudo yum install centos-release-openshift-origin

sudo yum install wget git net-tools bind-utils iptables-services bridge-utils bash-completion origin-clients

sudo oc cluster up

at this point, you get a terrifying

-- Checking Docker daemon configuration ... FAIL
   Error: did not detect an --insecure-registry argument on the Docker daemon
   Solution:

     Ensure that the Docker daemon is running with the following argument:
      --insecure-registry 172.30.0.0/16

after some googling, I start with :

sudo oc cluster up --skip-registry-check=true

Starting OpenShift using openshift/origin:v3.6.0 ...
OpenShift server started.

The server is accessible via web console at:
    https://127.0.0.1:8443

You are logged in as:
    User:     developer
    Password: 

To login as administrator:
    oc login -u system:admin

I open the console at https://127.0.0.1:8443 (add security exception) and login with system/admin

go to overview

If you see an error in the logs "Could not resolve host: github.com", you are screwed !
Haha no, just "sudo systemctl restart docker" , then "oc start-build --from-build=yourbuildid"




create a new project, java, wildfly, copy git url, create project pvproject01

oc login https://127.0.0.1:8443

system/admin

oc project pvproject01

oc status




If you get this

[centos@localhost ~]$ oc cluster up --skip-registry-check=true 
-- Checking OpenShift client ... OK
-- Checking Docker client ... OK
-- Checking Docker version ... FAIL
   Error: Minor number must not contain leading zeroes "09"

it simply means that OpenShift developers are morons, and you have to wait the next release 1.5 for a fix. What a pathetic mess.



I have also followed these instructions https://fedoramagazine.org/experimenting-docker-openshift/ and they seem to work:

(at the beginning I am troubleshooting VirtualBox guest additions, which is also a good thing to record)


1 sudo shutdown now
2 cd /run/media/centos/VBOXADDITIONS_5.1.30_118389/
3 ls
4 sudo ./autorun.sh
5 less /var/log/VBoxGuestAdditions.log
6 less /var/log/vboxadd-install.log
7 sudo ./autorun.sh
8 sudo reboot now
9 less /var/log/vboxadd-install.log
10 sudo yum update
11 ping google.com
12 sudo vi /etc/sysconfig/network-scripts/ifcfg-enp0s3
13 sudo reboot now
14 sudo yum update
15 cd /run/media/centos/VBOXADDITIONS_5.1.30_118389
16 sudo ./autorun.sh
17 yum install kernel-devel gcc make patch
18 sudo yum install kernel-devel gcc make patch
19 sudo reboot now
20 cd /run/media/centos/VBOXADDITIONS_5.1.30_118389
21 sudo ./autorun.sh
22 sudo reboot now
23 sudo shutdown now
24 sudo yum install docker
25 sudo systemctl enable docker
26 sudo yum install origin docker-registry
27 vi /etc/sysconfig/docker
28 sudo vi /etc/sysconfig/docker
29 sudo systemctl daemon-reload
30 sudo systemctl restart docker
31 sudo systemctl status docker
32 sudo oc cluster up
33 cd
41 sudo ln -s /home/centos/oc /usr/sbin/oc
43 sudo oc cluster up
44 sudo oc login -u system:admin
45 sudo shutdown now
46 sudo oc cluster up

Getting started with OpenShift

you can try installing on your local machine: install Vagrant https://www.vagrantup.com/downloads.html

install virtualbox https://www.virtualbox.org/wiki/Downloads

clone this github repo https://github.com/openshift/origin and vagrant up... good luck! On Windows the clone fails because of a filename too long issue (hello Microsoft????  ) .

Another way is to test directly on AWS:

https://aws.amazon.com/about-aws/whats-new/2016/06/red-hat-openshift-on-the-aws-cloud-quick-start-reference-deployment/ , go through the AWS guide "red-hat-openshift-on-the-aws-cloud" https://s3.amazonaws.com/quickstart-reference/openshift/doc/red-hat-openshift-on-the-aws-cloud.pdf and discover that this quickstart is no longer available (hello, Amazon??? Why don't you tell it on the home page?? ).

Check out on https://aws.amazon.com/quickstart/ for available quickstarts - there is no Openshift quickstart! This world is a chaos, a Cambrian explosion of products which end up in a total mess, fish with wings and trunks like elephants, and survive only one generation or the space of a few months.

About AWS, I discover another document https://access.redhat.com/documentation/en-us/reference_architectures/2017/html/deploying_openshift_container_platform_3.5_on_amazon_web_services/ but it's a bit long reading...

Anyway in the meantime I discover that the Vagrantfile VirtualBox approach has been DROPPED https://blog.openshift.com/goodbye-openshift-all-in-one-vm-hello-minishift/ in favour of Minishift (one more extinct species, whose fossil debris still clutter the digital space...)... too bad that the online book "OpenShift for developers" has not been updated, and I have wasted 3 hours of my life to discover that the "all in one" approach is dead...Grant Shipley and Graham Dumpleton, how about taking care of your creation?

DevOps with OpenShift

reblogging the from the excellent friend and mentor Jan:
https://jvzoggel.com/2017/08/23/free-ebook-devops-with-openshift/

Also interesting the OpenShift for Developers:

oc project myproject

https://github.com/devops-with-openshift/cotd

oc new-app --name='cotd' --labels name='cotd' php~https://github.com/devopswith-openshift/cotd.git -e SELECTOR=cats


oc expose service cotd

OpenShift, Minishift, VirtualBox

Excellent VERY quick introduction to OpenShift:



I am following this nice introduction to OpenShift https://www.udemy.com/openshift-developers-workshop/ with github https://github.com/drizzleconsulting

Download and install VirtualBox https://www.virtualbox.org/wiki/Downloads

Install Docker https://docs.docker.com/docker-for-windows/

Download and unzip Minishift https://github.com/minishift/minishift/releases

If you get this error

.\minishift.exe start
-- Installing default add-ons ... OK
-- Checking if Hyper-V driver is configured ... FAIL
   Hyper-V virtual switch is not set

it means that maybe Docker is not installed

When I try to install Docker, it tells me "HyperV is not available on Home editions, please use Docker Toolbox" - which uses Oracle VirtualBox instead of HyperV

Since I have Windows 10 Home and I don't want to waste 170 USD to buy Windows Enterprise, I am installing Docker Toolbox https://docs.docker.com/toolbox/overview/#whats-in-the-box but it still doesn't work... it seems that really only the Windows 10 PRO using Hyper-V works.... what a waste of time to try to make stuff work on Windows...