OpenShift Deployment Guide

Prerequisites

Before deploying to OpenShift, ensure you have:

• OpenShift CLI (oc) installed
• Access to an OpenShift cluster
• Helm 3.x installed

Cluster Setup

1. Login to OpenShift:

oc login --token=sha256~... --server=https://api.cluster.example.com:6443

2. Create a project:

oc new-project prime-edm

Installing Prime EDM Charts

1. Add the Helm repository:

helm repo add prime-edm https://charts.acx-sandbox.net --username $USER --password $PASSWORD
helm repo update

2. Create OpenShift-specific values:

# openshift-values.yaml
global:
  provider: openshift

security:
  securityContext:
    enabled: false
  
serviceAccount:
  annotations:
    serviceaccounts.openshift.io/oauth-redirectreference.primary: '{"kind":"OAuthRedirectReference","apiVersion":"v1","reference":{"kind":"Route","name":"prime-edm"}}'

route:
  enabled: true
  tls:
    termination: edge

3. Install the chart:

helm install prime-edm prime-edm/prime-edm -f openshift-values.yaml

OpenShift-Specific Configuration

Storage Classes

OpenShift provides several storage options:

storage:
  # Default storage class
  class: managed-nfs-storage
  
  # Block storage
  # class: managed-block-storage

Routes

Using OpenShift Routes instead of Ingress:

route:
  enabled: true
  host: prime-edm.apps.cluster.example.com
  tls:
    termination: edge
    insecureEdgeTerminationPolicy: Redirect

Security Context Constraints

Configure SCCs:

securityContext:
  enabled: false
  fsGroup: null
  runAsUser: null

Secrets Management

Vault Operator Setup

1. Install the Vault Operator:

oc new-project hashicorp
oc apply -f https://raw.githubusercontent.com/hashicorp/vault-helm/main/operator/deploy/crds.yaml
oc apply -f https://raw.githubusercontent.com/hashicorp/vault-helm/main/operator/deploy/operator.yaml

2. Deploy Vault:

helm repo add hashicorp https://helm.releases.hashicorp.com
helm repo update

helm install vault hashicorp/vault \
  --namespace hashicorp \
  --set "server.dev.enabled=true"

3. Install External Secrets Operator:

helm repo add external-secrets https://charts.external-secrets.io
helm repo update

helm install external-secrets \
  external-secrets/external-secrets \
  --namespace external-secrets \
  --create-namespace \
  --set installCRDs=true

4. Create SecretStore:

apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: vault-backend
spec:
  provider:
    vault:
      server: "http://vault.hashicorp:8200"
      path: "secret"
      version: "v2"
      auth:
        kubernetes:
          mountPath: "kubernetes"
          role: "prime-edm-role"
          serviceAccountRef:
            name: "prime-edm-sa"

5. Create ExternalSecret:

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: database-secret
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault-backend
    kind: SecretStore
  target:
    name: db-credentials
  data:
  - secretKey: username
    remoteRef:
      key: database/credentials
      property: username
  - secretKey: password
    remoteRef:
      key: database/credentials
      property: password

Monitoring

OpenShift Monitoring Integration

Enable cluster monitoring:

monitoring:
  serviceMonitor:
    enabled: true
    namespace: openshift-monitoring

Best Practices

1. Use node selectors:

nodeSelector:
  node-role.kubernetes.io/worker: ""

2. Configure resource limits:

resources:
  requests:
    cpu: 250m
    memory: 512Mi
  limits:
    cpu: 500m
    memory: 1Gi

3. Enable auto-scaling:

autoscaling:
  enabled: true
  minReplicas: 2
  maxReplicas: 10
  targetCPUUtilizationPercentage: 80

Troubleshooting

Common issues and solutions:

1. Route issues:

   • Check route configuration
   • Verify TLS settings
   • Validate DNS setup

2. Storage problems:

   • Confirm storage class exists
   • Check PVC status
   • Verify project quotas

3. Security issues:

   • Check SCC assignments
   • Verify service account permissions
   • Validate role bindings