docs(install): Document how to install on OpenShift (#2784)

* docs(install): Document how to install on OpenShift Signed-off-by: Kalya Subramanian <42158129+ksubrmnn@users.noreply.github.com> Signed-off-by: Jon Huhn <johuhn@microsoft.com>
openservicemesh · Mar 12, 2021 · 1a9633a · 1a9633a
1 parent 64077c0
commit 1a9633a
Show file tree

Hide file tree

Showing 4 changed files with 26 additions and 3 deletions.
diff --git a/demo/README.md b/demo/README.md
@@ -27,11 +27,11 @@
     We will use images from [Docker Hub](https://hub.docker.com/r/openservicemesh/osm-controller). Ensure you can pull these containers using: `docker pull openservicemesh/osm-controller`
 
 ### OpenShift
+If you are running the demo on an OpenShift cluster, there are additional prerequisites.
 
-If you are running the demo on an OpenShift cluster, there are additional prerequisites. 
-
-1. Set `DEPLOY_ON_OPENSHIFT=true` in your `.env` file.
 1. Install the [oc CLI](https://docs.openshift.com/container-platform/4.7/cli_reference/openshift_cli/getting-started-cli.html).
+1. Set `DEPLOY_ON_OPENSHIFT=true` in your `.env` file.
+    - This enables privileged init containers and links the image pull secrets to the service accounts. Privileged init containers are needed to program iptables on OpenShift.
 
 ## Run the Demo
 From the root of this repository execute:

diff --git a/demo/run-osm-demo.sh b/demo/run-osm-demo.sh
@@ -36,6 +36,7 @@ DEPLOY_PROMETHEUS="${DEPLOY_PROMETHEUS:-false}"
 ENABLE_PROMETHEUS_SCRAPING="${ENABLE_PROMETHEUS_SCRAPING:-true}"
 DEPLOY_WITH_SAME_SA="${DEPLOY_WITH_SAME_SA:-false}"
 ENVOY_LOG_LEVEL="${ENVOY_LOG_LEVEL:-debug}"
+DEPLOY_ON_OPENSHIFT="${DEPLOY_ON_OPENSHIFT:-false}"
 
 # For any additional installation arguments. Used heavily in CI.
 optionalInstallArgs=$*
@@ -78,6 +79,10 @@ if [ "$CERT_MANAGER" = "cert-manager" ]; then
     ./demo/deploy-cert-manager.sh
 fi
 
+if [ "$DEPLOY_ON_OPENSHIFT" = true ] ; then
+    optionalInstallArgs+=" --set=OpenServiceMesh.enablePrivilegedInitContainer=true"
+fi
+
 make docker-push
 ./scripts/create-container-registry-creds.sh "$K8S_NAMESPACE"
 

diff --git a/docs/content/docs/install/_index.md b/docs/content/docs/install/_index.md
@@ -54,6 +54,21 @@ The `mesh-name` should follow [RFC 1123](https://tools.ietf.org/html/rfc1123) DN
 - start with an alphanumeric character
 - end with an alphanumeric character
 
+### OpenShift
+
+To install OSM on OpenShift:
+1. Enable privileged init containers so that they can properly program iptables. The NET_ADMIN capability is not sufficient on OpenShift.
+    ```shell
+    osm install --set="OpenServiceMesh.enablePrivilegedInitContainer=true"
+    ```
+    - If you have already installed OSM without enabling privileged init containers, set `enable_privileged_init_container` to `true` in the [OSM ConfigMap](../osm_config_map.md) and restart any pods in the mesh.
+1. Add the `privileged` [security context constraint](https://docs.openshift.com/container-platform/4.7/authentication/managing-security-context-constraints.html) to each service account in the mesh.
+    - Install the [oc CLI](https://docs.openshift.com/container-platform/4.7/cli_reference/openshift_cli/getting-started-cli.html).
+    - Add the security context constraint to the service account
+       ```shell
+        oc adm policy add-scc-to-user privileged -z <service account name> -n <service account namespace>
+       ```
+
 ## Inspect OSM Components
 
 A few components will be installed by default into the `osm-system` Namespace. Inspect them by using the following `kubectl` command:

diff --git a/docs/content/docs/install/manual_demo/_index.md b/docs/content/docs/install/manual_demo/_index.md
@@ -41,6 +41,9 @@ osm install --deploy-prometheus --deploy-grafana --deploy-jaeger
 ```
 See the [observability documentation](../../patterns/observability/_index.md) for more details.
 
+### OpenShift
+For details on how to install OSM on OpenShift, refer to the [installation guide](../#openshift)
+
 ## Deploy the Bookstore Demo Applications
 
 The demo consists of the following resources: