Part 2

Openshift Authentication and Authorization

• Htpasswd Configuration:

yum install httpd*
htpasswd -c -B -b /tmp/htpasswd student redhat123
htpasswd  -B -b /tmp/htpasswd student2  redhat123

oc create secret generic htpasswd-secret --from-file htpasswd=/tmp/htpasswd -n openshift-config

vi oauth.yaml
apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
 name: cluster
spec:
 identityProviders:
 - name: ldap
 mappingMethod: claim
 type: HTPasswd
 htpasswd:
 fileData:
 name: htpasswd-secret

• Conplete this as well

https://gitlab.com/gcpnirpendra/openshift-280-training/-/issues/7

Project

• How to create a project

oc new-project myapp

• Check all the project you have got access to

oc get projects

• Check your current project

oc project

• Give access to Project from UI
• How to create a pod

oc run <name> --image=nginx

• Another example

vi pod.yanl
apiVersion: v1
kind: Pod
metadata:
  name: firstpod
spec:
 containers:
  - name: firstcontainer
    image: nginx

• How to check all pods

oc get pods

• How to check all pods in all namespaces

oc get pods -A

• How to check the name of all pods

oc get pods -o name

• How to check the labels of all pods running

oc get pods --show-lables

• How to login to a pods

oc exec -it podname sh 

• How to check the logs of a pods

oc logs podname

• How to login to a pod

oc exec -it podname sh

• How to delete a pod

oc delete pod <podname>

• How to delete a pod forcefully

oc delete pod --force --grace-period=0

• How to delete multiple pod in one go

for i in $(oc get pods -o name ); do oc delete pod $i ;done 

• How to check the logs for a specific container

oc logs podname -c <container-name>

• How to login to specific container

oc exec -it podname -c <container-name>

Service

• How to check all services

oc get svc

• How to create a service

oc expose pod/deployment  deployment/myapp --port=80

• Service with yaml manifest

apiVersion: v1
kind: Service
metadata:
  name: my-service
spec:
  selector:
    app: MyApp
  ports:
    - protocol: TCP
      port: 80
      targetPort: 9376

• How to check the labels where the service is forwarding requests

oc describe svc <svcname>

• How to check the endpoints of a service

oc get ep

Deployments

• How to create a deployment

oc create deployment myapp --image=nginx

• Rolling update “www” containers of “frontend” deployment, updating the image

oc set image deployment/frontend www=image:v2 

• Check the history of deployments including the revision

oc rollout history deployment/frontend 

• Rollback to the previous deployment

oc rollout undo deployment/frontend  

• Rollback to a specific revision

oc rollout undo deployment/frontend --to-revision=2   

• Watch rolling update status of “frontend” deployment until completion

oc rollout status -w deployment/frontend 

• Rolling restart of the “frontend” deployment

oc rollout restart deployment/frontend                     

Secrets

• Check all secrets

oc get secrets

• How to create secret

oc create secret tls my-tls-secret \
  --cert=path/to/cert/file \
  --key=path/to/key/file

• Create Secret for username and password

oc create secret generic creds --from-literal=name=nippy --from=literal=pass=123

• List the environment variables defined on all pods

oc set env pods --all --list

• Import environment from a secret

  oc set env --from=secret/mysecret dc/myapp

• Import environment from a config map with a prefix

  oc set env --from=configmap/myconfigmap --prefix=MYSQL_ dc/myapp

• Remove the environment variable ENV from container ‘c1’ in all deployment configs

  oc set env deployments --all --containers="c1" ENV-

ConfigMaps

• List all configmaps

oc get cm

• Create a new configmap

oc create configmap game-config --from-file=configure-pod-container

• Get the yaml file for the configmap

oc get configmaps game-config -o yaml

• Use configmap as a volume in pod

apiVersion: v1
kind: Pod
metadata:
  name: dapi-test-pod
spec:
  containers:
    - name: test-container
      image: k8s.gcr.io/busybox
      command: [ "/bin/sh", "-c", "ls /etc/config/" ]
      volumeMounts:
      - name: config-volume
        mountPath: /etc/config
  volumes:
    - name: config-volume
      configMap:
        # Provide the name of the ConfigMap containing the files you want
        # to add to the container
        name: special-config
  restartPolicy: Never

Volumes

• emptyDir Example

apiVersion: v1
kind: Pod
metadata:
  name: test-pd
spec:
  containers:
  - image: registry.k8s.io/test-webserver
    name: test-container
    volumeMounts:
    - mountPath: /cache
      name: cache-volume
  volumes:
  - name: cache-volume
    emptyDir:
      sizeLimit: 500Mi

• Check all pvcs

oc get pvc

• Create a pvc

apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv0001 
spec:
  capacity:
    storage: 5Gi 
  accessModes:
    - ReadWriteOnce 

• use pvc inside a pod

kind: Pod
apiVersion: v1
metadata:
  name: mypod
spec:
  containers:
    - name: myfrontend
      image: dockerfile/nginx
      volumeMounts:
      - mountPath: "/var/www/html" 
        name: mypd 
  volumes:
    - name: mypd
      persistentVolumeClaim:
        claimName: myclaim 

Kubernetes Trobleshooting

• Check the nodes status

oc get nodes

• Check the status of pods

oc get pods 

• Check the pods where are they scheduled

oc get pod -o wide

• check the events for a particular namepsace

oc get events

• Look for any error in pod

oc logs podname

• Describe pod if the pod status is pending

oc describe pod podname

• How to login to private image registry

docker login

• Create a secret for imagePull secret

oc create secret generic regcred \
    --from-file=.dockerconfigjson=<path/to/.docker/config.json> \
    --type=kubernetes.io/dockerconfigjson

• Use Imagepull secret in pod

apiVersion: v1
kind: Pod
metadata:
  name: private-reg
spec:
  containers:
  - name: private-reg-container
    image: <your-private-image>
  imagePullSecrets:
  - name: regcred

• Check the ip address of pod with specifice label

oc get pods -l app=hostnames \
    -o go-template='{{range .items}}{{.status.podIP}}{{"\n"}}{{end}}'

• Try to check the connectivity from a pod

for ep in 10.244.0.5:9376 10.244.0.6:9376 10.244.0.7:9376; do
    wget -qO- $ep
done