Mastering OpenShift: Deploy, Manage, and Scale Applications on Kubernetes

Mastering OpenShift

Deploy, Manage, and Scale Applications on Kubernetes

Robert Johnson

© 2024 by HiTeX Press. All rights reserved.

No part of this publication may be reproduced, distributed, or transmitted in any form or by any means, including photocopying, recording, or other electronic or mechanical methods, without the prior written permission of the publisher, except in the case of brief quotations embodied in critical reviews and certain other noncommercial uses permitted by copyright law.

Published by HiTeX Press

For permissions and other inquiries, write to:

P.O. Box 3132, Framingham, MA 01701, USA

Contents

1 Introduction to OpenShift and Kubernetes

1.1 Overview of Kubernetes

1.2 OpenShift as an Enterprise Kubernetes Platform

1.3 Core Components of OpenShift

1.4 Benefits of Using OpenShift

1.5 OpenShift Versions and Release History

1.6 Setting up Your OpenShift Environment

1.7 Common Use Cases for OpenShift

2 Getting Started with OpenShift

2.1 Installing OpenShift on Your System

2.2 Navigating the OpenShift Web Console

2.3 Understanding OpenShift Command Line Interface (CLI)

2.4 Creating Your First Project in OpenShift

2.5 Deploying a Simple Application on OpenShift

2.6 Using Source-to-Image (S2I) Build Process

2.7 Configuring OpenShift for Development

3 Understanding OpenShift Architecture

3.1 Core Elements of OpenShift Architecture

3.2 OpenShift Master Components

3.3 Node Operations in OpenShift

3.4 ETCD: The Distributed Key-Value Store

3.5 Networking in OpenShift Architecture

3.6 OpenShift Authentication and Authorization

3.7 Scheduling and Resource Management

4 Deploying Applications on OpenShift

4.1 Understanding Deployment Strategies in OpenShift

4.2 Building and Deploying Applications with Jenkins

4.3 Managing Deployments with OpenShift Web Console

4.4 Configuring Environment Variables and Secrets

4.5 Working with Persistent Storage

4.6 Creating and Managing OpenShift Templates

4.7 Managing Application Lifecycle with Operators

5 Managing and Monitoring Applications in OpenShift

5.1 Managing Application Configurations

5.2 Handling Application Updates and Rollbacks

5.3 Monitoring Applications with OpenShift’s Built-in Tools

5.4 Implementing Logging with EFK Stack

5.5 Utilizing Metrics for Performance Monitoring

5.6 Automating Health Checks and Alerts

6 Scaling Applications with OpenShift

6.1 Fundamentals of Scaling in OpenShift

6.2 Manual Scaling of Applications

6.3 Implementing Auto-Scaling Policies

6.4 Configuring OpenShift Horizontal Pod Autoscaler

6.5 Best Practices for Scaling Stateful Applications

6.6 Load Balancing and Traffic Management

6.7 Troubleshooting Scaling Issues

7 Networking and Security in OpenShift

7.1 Understanding OpenShift Networking Model

7.2 Configuring Network Policies

7.3 Ingress and Egress Traffic Management

7.4 Service Mesh in OpenShift

7.5 Securing OpenShift with Role-Based Access Control (RBAC)

7.6 Integrating OpenShift with Organizational Security Practices

7.7 Encrypting Data in Transit and at Rest

8 Storage Solutions in OpenShift

8.1 Overview of Storage in OpenShift

8.2 Working with Persistent Volumes and Claims

8.3 Dynamic Storage Provisioning

8.4 Integrating with External Storage Providers

8.5 Managing Storage Classes

8.6 Data Backup and Recovery Strategies

8.7 Storage Best Practices for Stateful Applications

9 OpenShift Pipelines and Automation

9.1 Foundations of OpenShift Pipelines

9.2 Building a CI/CD Pipeline

9.3 Integrating Source Control and Image Registries

9.4 Automating Tests and Quality Assurance

9.5 Managing Pipeline Resources and Parameters

9.6 Using Triggers for Automated Pipeline Execution

9.7 Pipeline Monitoring and Debugging

10 Advanced OpenShift Features and Troubleshooting

10.1 Leveraging Custom Resource Definitions (CRDs)

10.2 Operator Framework and Building Custom Operators

10.3 Integrating OpenShift with Hybrid Cloud Environments

10.4 Performance Tuning and Optimization

10.5 Understanding and Managing Quotas and Limits

10.6 Troubleshooting Common OpenShift Issues

10.7 Using OpenShift Logs and Metrics for Diagnostics

Introduction

OpenShift has established itself as a leading open-source platform for automating the deployment, scaling, and management of applications. Standing on the shoulders of Kubernetes, OpenShift provides an enterprise-grade solution that simplifies the complexities of orchestrating containerized applications. As organizations continuously seek efficiency in their deployment pipelines and resilience in their application infrastructure, OpenShift emerges as an indispensable tool that merges the robustness of Kubernetes with additional capabilities tailored for enterprise needs.

This book, Mastering OpenShift: Deploy, Manage, and Scale Applications on Kubernetes, is designed to impart both foundational knowledge and practical skills required to harness the full potential of OpenShift. Whether you are a software developer, system administrator, or IT professional, this guide will equip you with the necessary insights and techniques to effectively deploy, manage, and scale applications using OpenShift.

The content is meticulously organized to cater to readers new to OpenShift, as well as those looking to deepen their proficiency. We begin by providing an overview of the fundamental concepts of Kubernetes and how OpenShift enhances and extends these capabilities. Subsequent chapters delve into various aspects of getting started with OpenShift, such as installation, using the command line interface, and creating projects. You will learn how to confidently navigate through the OpenShift architecture and understand its components, allowing you to effectively deploy applications and manage resources.

Additionally, this guide will explore advanced topics such as scaling applications, implementing robust security practices, managing networking configurations, and optimizing storage solutions within the OpenShift environment. Building on this foundation, the book further examines automation strategies with OpenShift Pipelines and provides actionable insights into managing complex deployments and overcoming common troubleshooting challenges.

Throughout this book, we prioritize a structured, fact-based approach to present OpenShift’s features and best practices. By maintaining a focus on clarity and precision, our aim is to provide a resource that is comprehensive in scope, yet approachable for individuals at various stages of their cloud-native journey.

In closing, Mastering OpenShift seeks not only to educate but also to serve as a reference that professionals can depend on as they design and maintain sophisticated application architectures. As OpenShift continues to evolve, embracing new technologies and methodologies, its continuous development ensures it remains at the forefront of cloud-native orchestration solutions. By immersing yourself in the content of this book, you will be well-prepared to leverage OpenShift’s capabilities in your organization’s pursuit of technological excellence.

Chapter 1

Introduction to OpenShift and Kubernetes

OpenShift enhances Kubernetes’s renowned container orchestration capabilities with enterprise-level offerings, making it a sought-after solution for efficient application deployment and management. By expanding upon Kubernetes’s robust infrastructure, OpenShift integrates vital features such as developer-friendly tools and enhanced operational controls. This chapter provides a foundational understanding of both technologies, detailing their components, benefits, versions, and use cases within enterprise environments. By setting up an initial OpenShift environment, readers will gain the essential knowledge required to navigate and utilize the platform effectively, laying the groundwork for deeper exploration into OpenShift’s advanced capabilities.

1.1

Overview of Kubernetes

Kubernetes, often abbreviated as K8s, is an open-source platform designed to automate deploying, scaling, and operating application containers. Developed by Google, and now managed by the Cloud Native Computing Foundation, it is a complete ecosystem that provides the fundamental building blocks for running containerized applications. To understand Kubernetes fully, one must delve into its architecture, key concepts, operational paradigms, and associated tooling.

Kubernetes Architecture

Kubernetes operates as a cluster management system that abstracts the underlying hardware infrastructure, offering a consistent platform for application deployment. It comprises several vital components categorized primarily into the Control Plane and the Worker Nodes.

Control Plane: This centralized coordination point is responsible for maintaining the desired state for the cluster. It consists of components like the API Server, etcd (a consistent and highly-available key-value store), Controller Manager, and Scheduler. These elements work together to ensure the system’s consistency and availability.

Worker Nodes: Also known as minions within the Kubernetes ecosystem, worker nodes execute the applications. Each node runs at least one Kubelet, a container runtime (such as Docker or containerd), and the Kube Proxy.

Pods and Containers: The smallest deployable units within Kubernetes are pods. A pod encapsulates one or more containers with shared storage and networking, representing a single instance of a running process in your application.

apiVersion: v1kind: Podmetadata:  name: my-podspec:  containers:  - name: my-container    image: nginx

Core Concepts

Kubernetes introduces several abstractions that allow developers and operations teams to manage the lifecycle and demands of containerized applications efficiently.

Deployments: This resource ensures declarative updates to applications and containers. A deployment specifies the desired state for applications, like image version, replicas, and strategies for updates.

apiVersion: apps/v1kind: Deploymentmetadata:  name: nginx-deploymentspec:  replicas: 3  selector:    matchLabels:      app: nginx  template:    metadata:      labels:        app: nginx    spec:      containers:      - name: nginx        image: nginx:1.14.2        ports:        - containerPort: 80

Services: Services provide stable endpoints to pods running within a cluster. They abstract the underlying details, such as IP addresses, enabling seamless interaction with the deployed applications.

Namespaces: These are utilized for organizing objects within a Kubernetes cluster. They facilitate environment-specific segmentation, resource allocation, and administration.

ConfigMaps and Secrets: ConfigMaps allow external configuration of application data, whereas Secrets store sensitive data like passwords and credentials in a secure manner.

Kubernetes Operational Paradigms

Operating Kubernetes involves understanding several paradigms and models that ensure a resilient and efficient container orchestration.

Desired State Management: Kubernetes operates based on the desired state model. Users declare the state of the application they desire, and the control plane works to maintain this state continuously.

Reconciliation Loop: This is a continuous process where the Kubernetes controllers manage the divergence between the current state and the desired state, ensuring systems become increasingly consistent.

Autoscaling: Kubernetes supports horizontal pod autoscaling, which automatically adjusts the number of pod replicas based on current demand. The Horizontal Pod Autoscaler is a built-in mechanism capable of scaling based on CPU utilization metrics.

apiVersion: autoscaling/v1kind: HorizontalPodAutoscalermetadata:  name: nginx-autoscalerspec:  scaleTargetRef:    apiVersion: apps/v1    kind: Deployment    name: nginx-deployment  minReplicas: 1  maxReplicas: 10  targetCPUUtilizationPercentage: 50

Ecosystem and Tooling

Kubernetes is complemented by an extensive ecosystem of tools and extensions designed to enhance its capabilities, streamline operations, and broaden its applicability.

Helm: Often referred to as the package manager for Kubernetes, Helm facilitates the management of complex Kubernetes applications. It allows for the efficient configuration, upgrade, and rollback of applications using Helm Charts.

Prometheus and Grafana: These are powerful open-source monitoring tools integrated into many Kubernetes clusters to provide insights into system health and performance metrics.

Istio: Providing service mesh capabilities, Istio manages service-to-service communications, often crucial in microservices architectures deployed within Kubernetes clusters.

Kubectl: The command-line utility kubectl allows users to interact with their Kubernetes cluster, manage resources, and retrieve information about their system state.

# Gets a list of all pods in the default namespacekubectl get pods# Describes a specific deploymentkubectl describe deployment nginx-deployment# Apply a configuration to a resource by filenamekubectl apply -f my-pod-definition.yaml

Security and Networking

Security and effective networking are core features baked into Kubernetes and require understanding and implementation to ensure robust deployment scenarios.

Network Policies: These define how pods communicate with each other and other network endpoints, enabling granular control over permitted connections and traffic.

Role-Based Access Control (RBAC): Kubernetes uses RBAC to specify permissions and regulate access to its resources. This ensures that users and applications can interact only with what they have explicit permissions for, safeguarding sensitive configuration and operational parameters.

Secrets Management: Kubernetes manages secrets efficiently, allowing encrypted storage and retrieval of confidential data, such as API tokens and passwords, within pods.

apiVersion: rbac.authorization.k8s.io/v1kind: Rolemetadata:  namespace: default  name: pod-readerrules:- apiGroups: []  resources: [pods]  verbs: [get, watch, list]---apiVersion: rbac.authorization.k8s.io/v1kind: RoleBindingmetadata:  name: read-pods  namespace: defaultsubjects:- kind: User  name: my-user  apiGroup: rbac.authorization.k8s.ioroleRef:  kind: Role  name: pod-reader  apiGroup: rbac.authorization.k8s.io

Multi-cloud and Hybrid Cloud Deployments

Kubernetes is pivotal in enabling multi-cloud and hybrid cloud deployment strategies. By providing a unified abstraction layer, Kubernetes facilitates the deployment of workloads across differing cloud providers, such as Amazon Web Services, Google Cloud Platform, and Microsoft Azure, or within a private cloud setting.

Federation is a critical component that allows for the management of multiple clusters as a single entity, providing benefits such as improved fault tolerance, load balancing, and disaster recovery.

The adoption of Kubernetes within these deployment models caters to contemporary demands for flexibility, resilience, and performance, contributing to its popularity as a de facto standard for container orchestration.

While Kubernetes offers unparalleled advantages in container orchestration, its complexity necessitates a comprehensive understanding of its architecture, components, and operations. This enables organizations and developers to leverage its full potential, facilitating scalable, resilient, and efficient application deployments within a rapidly evolving technological landscape.

1.2

OpenShift as an Enterprise Kubernetes Platform

OpenShift is a robust container application platform that builds upon Kubernetes, extending its capabilities with additional enterprise-level features. It is designed to facilitate a developer-friendly and operationally sound environment for building, deploying, and managing containerized applications. This section explores OpenShift’s unique attributes, enhancements over standard Kubernetes, and how it integrates into enterprise environments.

1. The OpenShift Architecture

OpenShift augments traditional Kubernetes architecture by introducing components and workflows that optimize both development and operations.

OpenShift Master and API Server: The OpenShift Master includes the Controller Master and etcd, similar to Kubernetes’s control plane, but also incorporates additional API endpoints for OpenShift-specific resources.

Nodes and Container Registry: OpenShift nodes run containerized applications and provide resources like CPU and memory. The integrated image registry stores and serves Docker-formatted container images, allowing images to be easily managed and deployed.

Networking Enhancements: OpenShift utilizes Software Defined Networking (SDN) to manage container networking processes, providing unique features like automatic DNS management and integrated router functionality for complex applications.

2. Developer Centric Enhancements

While Kubernetes provides foundational container orchestration capabilities, OpenShift extends these to improve developer productivity.

Source-to-Image (S2I): A standout feature, S2I automatically builds reproducible container images directly from source code repositories. Developers focus on coding, while OpenShift manages the intricacies of building and deploying application containers.

    s2i build https://github.com/myrepo/myapp.git centos/python-36-centos7 myapp:latest

Developer Tools Integration: OpenShift includes plugins for popular Integrated Development Environments (IDEs) such as Eclipse and Visual Studio Code, alongside command-line tools for seamless integration into the developer workflow.

Templates and Catalogs: OpenShift’s application templates streamline common development tasks. The OpenShift Service Catalog allows developers to browse and use services from a comprehensive marketplace.

3. Operational Enhancements

OpenShift integrates several features designed to simplify operational tasks and enhance platform security.

Automated Operations: Features such as automated scaling, health checks, and rolling updates minimize downtimes and maintain application availability. Operators automate the configuration, provisioning, and management of complex applications.

Logging and Monitoring: OpenShift aggregates, indexes, and displays logs using the EFK stack (Elasticsearch, Fluentd, Kibana). Integration with Prometheus provides detailed metrics and alerts, ensuring operational insights.

Security Context Constraints: These define the security conditions for pods, managing permissions and accessing sensitive data effectively. This feature enhances Kubernetes’s security capabilities, making it enterprise-ready.

    apiVersion: v1    kind: Pod    metadata:      name: secure-pod    spec:      containers:      - name: my-container        image: centos        securityContext:          runAsUser: 1000          runAsNonRoot: true

4. OpenShift on Multi-Cloud and Hybrid Cloud

Enterprises increasingly adopt multi-cloud and hybrid cloud strategies to optimize resource use and enhance resilience. OpenShift facilitates these strategies with its flexible deployment options.

Consistency Across Environments: OpenShift ensures consistent application deployment and management across on-premise and cloud environments, supporting a mix of public cloud providers including AWS, Azure, and Google Cloud Platform.

Centralized Management: With OpenShift’s centralized console, administrators can manage clusters and workloads across multiple environments seamlessly. This consolidation simplifies operations and provides a unified view for streamlined management.

OpenShift Federation: Enabling applications to span multiple clusters or clouds, OpenShift Federation manages these environments as a cohesive system, integrating seamlessly with Kubernetes Federation.

5. Use of CI/CD Pipelines

OpenShift excels in establishing and integrating Continuous Integration and Continuous Deployment (CI/CD) pipelines, critical for modern application development.

Jenkins Integration: OpenShift includes built-in integration with Jenkins, supporting pipelines as code. This facilitates the automated execution of defined build, test, and deployment stages for efficient developer workflows.

    pipeline {        agent any        stages {            stage(’Build’) {                steps {                    script {                        oc.startBuild(’my-app’)                    }                }            }            stage(’Deploy’) {                steps {                    script {                        openshiftDeploy deploymentConfig: ’my-app’                    }                }            }        }    }

Tekton Pipelines: For cloud-native CI/CD, Tekton provides a Kubernetes-native pipeline system. OpenShift integrates Tekton for creating event-driven workflows with cloud-first principles.

GitOps: OpenShift embraces GitOps practices, utilizing Git as the single source of truth for application and infrastructure definitions. Tools like ArgoCD facilitate GitOps, maintaining system state through Git repositories.

6. OpenShift and DevSecOps Integration

The emphasis on shifting security left, inherent in DevSecOps practices, is evident in OpenShift’s design. OpenShift integrates security measures seamlessly into development pipelines and operations.

Image Scanning: Integrated scanning capabilities identify vulnerabilities in container images. Regular scans and audits ensure that only secure and compliant images are deployed, addressing common attack vectors.

RBAC Policies: OpenShift enhances Kubernetes’s Role-Based Access Control (RBAC) with fine-grained policies, tailoring permissions to meet stringent enterprise security standards.

Service Mesh and Encryption: OpenShift Service Mesh integrates with Istio, offering advanced traffic management and security features like mutual TLS between services, supporting policy-based encryption and network observability.

7. Comprehensive User and Access Management

For enterprises, user and access management is paramount. OpenShift provides comprehensive tools for managing these concerns at scale.

Identity Providers: OpenShift supports numerous identity providers, from LDAP and Active Directory to OAuth and Google, ensuring flexible integration with existing enterprise identity management systems.

    apiVersion: config.openshift.io/v1    kind: OAuth    metadata:      name: cluster    spec:      identityProviders:      - name: my_ldap        mappingMethod: claim        type: LDAP        ldap:          url: ldaps://ldap.example.com/ou=people,dc=example,dc=com          bindDN: cn=Manager,dc=example,dc=com          bindPassword:            name: ldap-bind-password          insecure: false

Quota Management: OpenShift enforces resource quotas and limits to control consumable resources, safeguarding fair usage and preventing abuse in shared environments.

Audit Logs: OpenShift maintains comprehensive audit logs, tracking user actions and system events for compliance and troubleshooting.

OpenShift, as an enterprise Kubernetes platform, addresses the inherent complexities of container orchestration with advanced features tailored for scalability, security, and developer productivity. Its enhancements over Kubernetes help bridge the gap between development and operations teams, facilitating seamless deployment and management across diverse and complex environments. This integration into enterprise systems not only accelerates application delivery but also ensures that these applications meet rigorous standards for performance, security, and reliability.

1.3

Core Components of OpenShift

The OpenShift platform is built on top of Kubernetes and extends it with a set of components and tools that provide a comprehensive application lifecycle management experience. Understanding these core components is crucial for efficiently deploying and managing applications within OpenShift. This section delves into the roles and interactions of these components, explaining their significance in the infrastructure of OpenShift.

1. OpenShift Master

The OpenShift Master controls the entire platform cluster, managing workloads, and the overall ecosystem. It consists of several critical subcomponents that coordinate the system’s operations.

API Server: It exposes the Kubernetes API, interfacing with the OpenShift API tailored for enhanced features. The API server handles requests for resource definitions and updates, orchestrating interactions between different OpenShift components.

etcd: An integral component that acts as a highly available key-value store, etcd is responsible for storing all cluster data, including the state and configuration of all objects, such as pods, services, and deployments.

Controller Manager: It runs on the master node and manages various processes like node operations, managing state transitions, and controlling replication controllers.

Scheduler: It is tasked with assigning new containers to nodes based on resource requirements and policy constraints. The scheduler ensures optimal deployment, enhancing resource utilization and efficiency.

2. OpenShift Nodes

Nodes are the infrastructure that runs containerized workloads, interfacing directly with the containers.

Node Management: OpenShift nodes integrate deeply with Kubernetes nodes but include additional services optimizing application deployments. The node is responsible for launching container instances.

Kubelet: The primary node agent, Kubelet ensures that containers are running within each pod. It receives PodSpecs and ensures those specified containers are running and healthy.

Kube Proxy: This component runs on each node, maintaining network rules and facilitating network abstraction, managing pod-to-pod communication and services.

3. The Container Runtime and Image Registry

These components are essential for managing container images and running containers effectively in OpenShift.

Container Runtimes: OpenShift supports CRI-O and Docker as primary container runtimes. These runtimes manage the lifecycle of containers, ensuring seamless execution of containerized applications while interfacing with Kubernetes components.

Integrated Image Registry: OpenShift includes an integrated container image registry utilized for managing Docker-formatted images. It stores application images securely for deployments, easing image distribution across cluster nodes.

oc