Support Openshift deployment (#13)

* Add support for SPIRE deployment on OpenShift 4.13 Signed-off-by: Mariusz Sabath <[email protected]> Co-authored-by: Trilok Geer <[email protected]> Co-authored-by: Andrew Block <[email protected]> * Render README Signed-off-by: Mariusz Sabath <[email protected]> * Fix tornjak HTTP/HTTPS port values Signed-off-by: Mariusz Sabath <[email protected]> * Update Frontend README Signed-off-by: Mariusz Sabath <[email protected]> * Add env. variable to Agent to inject node name Signed-off-by: Mariusz Sabath <[email protected]> * Implement Marco's suggestion on CSI CSS version Signed-off-by: Mariusz Sabath <[email protected]> * Add MY_NODE_NAME env. variable to agent for openshift example Signed-off-by: Mariusz Sabath <[email protected]> * Move Openshift examples to dedicated directory Signed-off-by: Mariusz Sabath <[email protected]> * Simplified the install instructions Signed-off-by: Mariusz Sabath <[email protected]> * Suggested changes Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Andrew Block <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Update docs, fix default for backwards compat Signed-off-by: Kevin Fox <[email protected]> * Don't recommend experimental features by default, dont debug helm install by default and explain how to add additional features Signed-off-by: Kevin Fox <[email protected]> * Add notes about openshift to the project for other reviewers. Signed-off-by: Kevin Fox <[email protected]> * Fix incorrectly reverted change Signed-off-by: Kevin Fox <[email protected]> * Correct notes Signed-off-by: Kevin Fox <[email protected]> * Update default Signed-off-by: Kevin Fox <[email protected]> * Fix issue created from bad merge conflict resolution Signed-off-by: kfox1111 <[email protected]> * Update examples/openshift/openshift-values.yaml Co-authored-by: kfox1111 <[email protected]> Signed-off-by: Mariusz Sabath <[email protected]> * Update examples/openshift/openshift-values.yaml Co-authored-by: kfox1111 <[email protected]> Signed-off-by: Mariusz Sabath <[email protected]> * Update examples/openshift/openshift-values.yaml Co-authored-by: kfox1111 <[email protected]> Signed-off-by: Mariusz Sabath <[email protected]> * Update examples/openshift/openshift-values.yaml Co-authored-by: kfox1111 <[email protected]> Signed-off-by: Mariusz Sabath <[email protected]> --------- Signed-off-by: Mariusz Sabath <[email protected]> Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Trilok Geer <[email protected]> Co-authored-by: Andrew Block <[email protected]> Co-authored-by: Kevin Fox <[email protected]>
2023-10-31 16:27:23 +00:00
parent ed23d8b714
commit 3b016841da
18 changed files with 432 additions and 40 deletions
@@ -0,0 +1,38 @@
+# OpenShift notes for K8S developers
+
+## SecurityContexts
+
+OpenShift automatically generates uid/gid's for pods. They should not be set to get this behavior.
+
+## CSIDriver issues
+
+A workload in a restricted namespace can not access a csidriver that isn't labeled:
+
+```yaml
+security.openshift.io/csi-ephemeral-volume-profile: restricted
+```
+
+If the CSIDriver doesn't exist, the workload is blocked from being uploaded into the cluster. This runs into ordering issues with helm install as it always loads regular workloads before CSIDriver objects.
+
+## Pod Security Standard
+
+Pod Security Standard (PSS) rules are automatically generated on openshift. Details at [https://docs.openshift.com/container-platform/4.13/authentication/understanding-and-managing-pod-security-admission.html](https://docs.openshift.com/container-platform/4.13/authentication/understanding-and-managing-pod-security-admission.html)
+
+The defaults though are too chatty. It puts audit/warn still at restricted.
+
+## Ingress
+
+Ingress objects automatically create Role objects in the same namespace, when the ingress object is viewed as valid by openshift, if not it is ignored. A missing Role object is a sure sign that something is wrong in the Ingress.
+
+Some things to watch out for.
+
+When the ingress is annotated:
+
+```yaml
+  "route.openshift.io/termination": "passthrough" 
+```
+
+The ingress object can not have a path specified and the pathType needs to be ImplementationSpecific
+
+Also, unless a secretName is specified, it can not have a tls section.
+