OpenShift in Action

by Jamie Duncan, John Osborne

Overview

Summary

OpenShift in Action is a full reference to Red Hat OpenShift that breaks down this robust container platform so you can use it day-to-day. Combining Docker and Kubernetes, OpenShift is a powerful platform for cluster management, scaling, and upgrading your enterprise apps. It doesn't matter why you use OpenShift—by the end of this book you'll be able to handle every aspect of it, inside and out!

Foreword by Jim Whitehurst, Red Hat.

Purchase of the print book includes a free eBook in PDF, Kindle, and ePub formats from Manning Publications.

About the Technology

Containers let you package everything into one neat place, and with Red Hat OpenShift you can build, deploy, and run those packages all in one place! Combining Docker and Kubernetes, OpenShift is a powerful platform for cluster management, scaling, and upgrading your enterprise apps.

About the Book

OpenShift in Action is a full reference to Red Hat OpenShift that breaks down this robust container platform so you can use it day-to-day. Starting with how to deploy and run your first application, you'll go deep into OpenShift. You'll discover crystal-clear explanations of namespaces, cgroups, and SELinux, learn to prepare a cluster, and even tackle advanced details like software-defined networks and security, with real-world examples you can take to your own work. It doesn't matter why you use OpenShift—by the end of this book you'll be able to handle every aspect of it, inside and out!

What's Inside

• Written by lead OpenShift architects
• Rock-solid fundamentals of Docker and Kubernetes
• Keep mission-critical applications up and running
• Manage persistent storage

About the Reader

For DevOps engineers and administrators working in a Linux-based distributed environment.

About the Authors

Jamie Duncan is a cloud solutions architect for Red Hat, focusing on large-scale OpenShift deployments. John Osborne is a principal OpenShift architect for Red Hat.

Table of Contents

PART 1 - FUNDAMENTALS
1. Getting to know OpenShift
2. Getting started
3. Containers are Linux
PART 2 - CLOUD-NATIVE APPLICATIONS
4. Working with services
5. Autoscaling with metrics
6. Continuous integration and continuous deployment
PART 3 - STATEFUL APPLICATIONS
7. Creating and managing persistent storage
8. Stateful applications
PART 4 - OPERATIONS AND SECURITY
9. Authentication and resource access
10. Networking
11. Security

Product Details

ISBN-13:	9781617294839
Publisher:	Manning
Publication date:	05/21/2018
Edition description:	1st Edition
Pages:	320
Product dimensions:	7.30(w) x 9.10(h) x 0.70(d)

About the Author

Jamie Duncan is a Cloud Solutions Architect for Red Hat, focusing on large-scale OpenShift deployments. 

John Osborne is a Lead Linux Container Architect for Red Hat with years of experience developing high-performance technologies using JBoss Middleware.

Table of Contents

Foreword xv

Preface xvii

Acknowledgments xix

About this book xx

About the authors xxiii

About the cover illustration xxiv

Part 1 Fundamentals 1

1 Getting to know OpenShift 3

1.1 What is a container platform? 4

Containers in OpenShift 4

Orchestrating containers 5

1.2 Examining the architecture 7

Integrating container images 7

Accessing applications 7

Handling network traffic in your cluster 9

1.3 Examining an application 9

Building applications 9

Deploying and serving applications 9

1.4 Use cases for container platforms 12

Technology use cases 12

Use cases for businesses 13

When containers aren't the answer 15

1.5 Solving container storage needs 15

1.6 Scaling applications 16

1.7 Integrating stateful and stateless applications 16

1.8 Summary 19

2 Getting started 20

2.1 Cluster options 21

2.2 Logging in 22

Using the oc command-line application 22

2.3 Creating projects 23

2.4 Application components 24

Custom container images 24

Build configs 26

Deployment configs 26

Image streams 27

2.5 Deploying an application 28

Providing consistent application access with services 28

Exposing services to the outside world with routes 30

2.6 Deploying applications using the web interface 32

Logging in to the OpenShift web interface 32

2.7 Deploying applications with the web interface 33

2.8 Summary 36

3 Containers are Linux 37

3.1 Defining containers 37

3.2 How OpenShift components work together 38

OpenShift manages deployments 38

Kubernetes schedules applications across nodes 40

Docker creates containers 41

Linux isolates and limits resources 42

Putting it all together 44

3.3 Application isolation with kernel namespaces 45

The mount namespace 47

The UTS namespace 52

PIDSin containers 53

Shared memory resources 55

Container networking 55

3.4 Summary 57

Part 2 Cloud-Native Applications 59

4 Working with services 61

4.1 Testing application resiliency 61

Understanding replication controllers 62

Labels and selectors 65

4.2 Scaling applications 68

Modifying the deployment config 70

4.3 Maintaining healthy applications 71

Creating liveness probes 72

Creating readiness probes 76

4.4 Summary 79

5 Autoscaling with metrics 80

5.1 Determining expected workloads is difficult 81

5.2 Installing OpenShift metrics 81

Understanding the metrics stack 83

5.3 Using pod metrics to trigger pod autoscaling 84

Creating an HPA object 84

Testing your autoscaling implementation 88

Avoiding thrashing 89

5.4 Summary 90

6 Continuous integration and continuous deployment 91

6.1 Container images as the centerpiece of a CI/CD pipeline 92

6.2 Promoting images 93

6.3 CI/CD part 1: creating a development environment 93

Invoking object triggers 98

Enabling automated and consistent deployments with image streams 100

6.4 CI/CD part 2: promoting dev images into a test environment 101

Service discovery 103

Automating image promotion with image stream triggers 107

6.5 CI/CD part 3: masking sensitive data in a production environment 109

Protecting sensitive data with secrets 112

Using config maps for environment-specific settings 113

6.6 Using Jenkins as the backbone of a CI/CD pipeline 116

Triggering Jenkins from Gogs 119

Native integration with a Jenkinsfile 120

6.7 Deployment strategies 121

6.8 Summary 124

Part 3 Stateful Applications 125

7 Creating and managing persistent storage 127

7.1 Container storage is ephemeral 129

7.2 Handling permanent data requirements 130

7.3 Creating a persistent volume 131

Logging in as the admin user 131

Creating new resources from the command line 132

Creating a physical volume 133

7.4 Using persistent storage 135

Creating a persistent volume claim using the command line 136

Adding a volume to an application on the command line 137

Adding persistent, storage to an application using the web interface 138

7.5 Testing applications after adding persistent storage 142

Data doesn't get mixed up 142

Forcing a pod restart 143

Investigating persistent volume mounts 144

7.6 Summary 145

8 Stateful applications 147

8.1 Enabling a headless service 148

Application clustering with Wildfly 149

Querying the OpenShift API server from a pod 151

Verifying Wildfly data replication 153

Other use cases for direct pod access 153

8.2 Demonstrating sticky sessions 154

Toggling sticky sessions 155

8.3 Shutting down applications gracefully 157

Setting a grace period for application cleanup 157

Using container lifecycle hooks 159

8.4 Native API object support for stateful applications with stateful sets 160

Deterministic sequencing of startup and shutdown order with stateful sets 161

Examining a stateful set 162

Predictable network identity 164

Consistent persistent storage mappings 165

Stateful set limitations 166

Stateful applications without native solutions 166

8.5 Summary 167

Part 4 Operations and Security 169

9 Authentication and resource access 171

9.1 Proper permissions vs. the Wild West 171

9.2 Working with user roles 173

Assigning new user roles 173

Creating administrators 174

Setting default user roles 175

9.3 Limit ranges 176

Defining resource limit ranges 178

9.4 Resource quotas 180

Creating compute quotas 181

Creating resource quotas 183

9.5 Working with quotas and limits 185

Applying quotas and limits to existing applications 185

Changing quotas for deployed applications 186

9.6 Using cgroups to limit resources 187

Cgroups overview 187

Identifying container cgroups 188

Confirming cgroup resource limits 190

9.7 Summary 193

10 Networking 194

10.1 OpenShift network design 194

10.2 Managing the OpenShift SDN 197

Configuring application node networks 197

Linking containers to host interfaces 200

Working with OVS 201

10.3 Routing application requests 202

Using HAProxy to route requests 203

Investigating the HAProxy pod 205

How HAProxy gets requests to the correct pods 206

10.4 Locating services with internal DNS 208

DNS resolution in the pod network 209

10.5 Configuring OpenShift SDN 211

Using the ovs-subnet plugin 212

Isolating traffice with the ovs-multitenant plugin 212

Creating advanced network designs with the ovs-networkpolicy plugin 214

Enabling the ovs-multitenant plugin 214

Testing the multitenant plugin 215

10.6 Summary 216

11 Security 217

11.1 Understanding SELinux core concepts 218

Working with SELinux labels 219

Applying labels with SELinux contexts 220

Enforcing SELinux with policies 221

Isolating pods with MCS levels 224

11.2 Investigating pod security contexts in OpenShift 224

Examining MCS levels in OpenShift 225

Managing pods Linux capabilities 227

Controlling the pod user ID 227

11.3 Scanning container images 228

Obtaining the image-scanning application 228

Deploying the image-scanning application 229

Viewing events on the command line 231

Changing SCCs for an application deployment 232

Viewing security scan results 234

11.4 Annotating images with security information 235

11.5 Summary 236

Appendix A Installing and configuring OpenShift 239

Appendix B Setting up a persistent storage source 268

Appendix C Working directly with Docker 276

Appendix D Configuring identity providers 279

Index 284