Skip to content

Latest commit

 

History

History
262 lines (184 loc) · 6.84 KB

EX380.md

File metadata and controls

262 lines (184 loc) · 6.84 KB

EX380 - Red Hat Certified Specialist in OpenShift Automation and Integration exam

oc

Extract File from a Secret or ConfigMap

oc extract secret/secret-name                # All files
oc extract secret/secret-name --keys=my-file # Specific files

Update Secret or ConfigMap file

oc set data secret/secret-name --from-file my-file=my-local-file

Get objects matching a label

oc get deployment -n some-namespace -l app=some-app

JSONPath Output

# Basic
oc get deployment some-app -o jsonpath='{.metadata.name}'

# Get specific item from list/array
oc get deployment some-app -o jsonpath='{.status.conditions[0].type'

# Loop through list/array
oc get deployment some-app -o jsonpath='{.status.conditions[*].type'

# Filter items in list
oc get deployment some-app -o jsonpath='{.status.conditions[?(@.type=="Available")].status}'

NOTE: Personally I think it's easier to filter outside of oc in a script but 🤷‍♂️

Service Accounts, [Cluster]Roles, and [Cluster]RoleBindings

  • It's easiest to copy an existing Role/ClusterRole, modify it, and save it as your own
  • Use the web console to make RoleBindings/ClusterRoleBindings
  • Alternatively use oc policy add-role-to-user with the -z flag for service accounts
  • Don't write YAML for RoleBindings (unless you hate yourself)

CronJobs

  • Examples in the OpenShift docs are in the Nodes section under Running tasks in pods using jobs

Create CronJob with CLI

oc create cronjob pi --image=perl --schedule='*/1 * * * *' -- perl -Mbignum=bpi -wle 'print bpi(2000)'

Script in Job

You can put a script in a job like this:

spec:
  template:
    spec:
      containers:
        - name: whatever
          command: ["/bin/sh", "-c"]
          args:
            - "oc get pods --all-namespaces
                | sort
                | uniq"

OpenShift/Kuberentes API

Authenticate to Kubernetes API

# Get the route for the oauth server
oc get route -n openshift-authentication

# This command will prompt for password
curl -k -u admin "https://<host-from-route-above>/oauth/authorize?client_id=openshift-challenging-client&response_type=token"

This is the method the DO380 course recommends, but more than likely this method won't work in a real environment because your cluster should be set up with external authentication (SSO, OIDC, etc.), not htpasswd.

What you should do instead is:

  • Go to OpenShift console
  • Select "Generate Login Command" (or whatever it's called)
  • Log in if needed
  • Grab the token shown

If it's an automated task, it should use a service account and the token assigned to a service account.

Query for available endpoints

curl -k \
  -H "Authorization: Bearer sha256~TOKEN" \
  https://api.cluster.domain:6443/openapi/v2 | jq

Figure out an endpoint being called by an oc command

oc get whatever -v 6 # Verbosity level 6 will print the API endpoint being called

Ansible

  • When in doubt, ansible-doc <whatever-module> (This is good advice for all things Ansible)

Authenticate with Ansible to OpenShift

- name: Log in to OpenShift
  hosts: localhost

  tasks:
    - name: Get access token for admin user
      redhat.openshift.openshift_auth:
        host: https://api.cluster.domain:6443
        username: admin
        password: admin
      register: auth_results

- name: Do something
  hosts: localhost

  module_defaults:
    group/redhat.openshift.openshift:
      namespace: some-namespace
      api_key: "{{ auth_results['openshift_auth']['api_key'] }}"
      host: https://api.cluster.domain.com:6443
    group/kubernetes.core.k8s:
      namespace: some-namespace
      api_key: "{{ auth_results['openshift_auth']['api_key'] }}"
      host: https://api.cluster.domain.com:6443

Operators

If you need to install an operator from YAML, the easiest way is to install through OperatorHub, grab the YAML it creates, and add that to your automation.

If the operator is installed to "All Namespaces", it will create a Subscription in the "openshift-operators" namespace.

If the operator is installed to a specific namespace, it will create an OperatorGroup and a Subscription in the targeted namespace.

NOTE: Some operators (like OpenShift GitOps) manage a specific namespace but are installed to "All Namespaces".

Jenkins

Jenkins is deployed from an OpenShift template in the openshift namespace!

List Jenkins Templates

oc get tempalte -n openshift | grep jenkins

List Jenkins Template Parameters

oc process jeknins-peristent --paramters -n openshift

Install Jenkins from Template

oc new-app --template jenkins-persistent

Allow Jenkins to Create Projects

self-provisioner is the role that allows users to create projects.

oc adm policy add-cluster-role-to-user self-provisioner -z jenkins

Set Git CA for Jenkins Agents

  • Open Jenkins UI
  • Select Manage Jenkins on left sidebar
  • Scroll down to Manage Nodes and Clouds
  • Select Configure Clouds on the left sidebar
  • Under the Kubernetes cloud named openshift, select Pod Templates...
  • Find the Pod Template your build will use (nodejs, java, maven, etc.)
  • Add an environment variable
    • Key: GIT_SSL_CAINFO
    • Value: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
  • Select Save at the bottom

Use Jenkins API token

  • Open Jenkins UI
  • Select your user in the top left
  • Select Configuration on the left sidebar
  • Under API token, select Add new token
  • Give the token an name and select Generate

Using Jenkins API

# Get the route for the Jenkins server
oc get route -n <jenkins-namespace>

# Replace jenkins-route, project-name, username, and token
curl "https://<jenkins-route>/job/<project-name>/job/main/lastBuild/api/json" \
    --user "<username>:<token>"

Jenkinsfile

  • Examples in the OpenShift docs are in the Builds section under Using Build Strategies.

Declarative State

YAML References

  • oc api-resources - Return resources available to OpenShift (Including CRDs)
  • oc api-versions <resource> - Return versions of resources
  • oc explain <resource> - Return details on a resource's expected fields

Kustomize

Kustomize is barely mentioned in the OCP docs. I have no idea if they give the Kustomize open-source docs in the exam environment.

Test Kustomize Output

oc kustomize        # Current directory
oc kustomize my-dir # Another directory

Apply Kustomize to Cluster

oc apply -k .      # Current directory
oc apply -k my-dir # Another directory

secretGenerator

Create secrets from files:

# kustomize.yaml
resources:
- whatever.yaml
secretGenerator:
- name: htpasswd
  namespace: openshift-config
  files:
  - htpasswd=my-file.htpasswd
generatorOptions:
  disableNameSuffixHash: true