Openshift :: Tag :: Kubernetes training

Openshift 2days

Wed, 22 May 2024 14:15:26 +1000

Fundamentals Openshift Openshift Advanced modules D_01_Ingress.pdf D_03_Helm.pdf D_03_Prometheus_monitoring.pdf

Helm on OpenShift: Migrating to Security Context Constraints

Mon, 08 Jun 2026 14:15:26 +1000

Objective A Helm chart that works perfectly on vanilla Kubernetes often fails on OpenShift. In this guided lab you’ll deploy a generic nginx Helm chart step by step — from its default values (which fail) to an OpenShift-compatible configuration (which succeeds) — diagnosing each failure along the way with oc/kubectl. You’ll learn: Why OpenShift’s Security Context Constraints (SCC) prevent containers from running as root How OpenShift assigns a non-root UID per namespace, and why that breaks images that assume root How to adapt a chart (here, the official nginx image) to run under restricted-v2 Complete this lab in 20-30 minutes.

OpenShift Airgapped: Mirroring Container Images

Mon, 08 Jun 2026 14:15:26 +1000

Author: Fabrice JAMMES (LinkedIn). Duration: 25-35 minutes Objective Clusters running in restricted networks (“airgapped”) cannot pull images directly from the internet (i.e. docker.io). You must mirror the images you need into a registry the cluster can reach, and then make the cluster use that mirror. There are two fundamentally different ways to achieve this: A. Cluster-wide transparent redirection — configure OpenShift itself (ImageTagMirrorSet) to silently redirect every docker.io pull to your local mirror. Charts and Deployments stay untouched. B. Explicit reference — point each chart/Deployment directly at the mirror registry (image.registry=...). No cluster-level redirection is configured. In this guided lab you’ll deploy the same nginx chart both ways, observe how the resulting Pods differ, and weigh the trade-offs of each approach.

OpenShift Airgapped: Declarative Mirroring with oc-mirror v2

Wed, 10 Jun 2026 18:00:00 +1000

Author: Fabrice JAMMES (LinkedIn). Duration: 25-35 minutes Objective In the previous lab you mirrored a single image with skopeo copy and hand-wrote an ImageTagMirrorSet to redirect docker.io pulls to it. That works, but it doesn’t scale: every image needs its own skopeo copy, and the mirror-set YAML must be kept perfectly in sync with whatever you copied — get the library/ namespace wrong and pulls 404.

OpenShift Networking: From Ingress to Route

Mon, 15 Jun 2026 14:15:26 +1000

Author: Fabrice JAMMES (LinkedIn). Duration: 20-30 minutes Objective OpenShift predates the Kubernetes Ingress API by several years. Its native object for exposing HTTP(S) services is the Route (route.openshift.io/v1), handled by the HAProxy-based router. To stay compatible with portable Kubernetes manifests, OpenShift ships a controller — part of openshift-controller-manager / route-controller-manager — that watches every Ingress object cluster-wide and automatically creates a matching Route for it.

Kubelet and static pods

Sun, 30 Jun 2024 14:15:26 +1000

Exercice 1: retrieve static pod specifications in Kubernetes (kind-based) Switch to Kubernetes cluster using kubectx kind-kind and then access the control plane Node using docker exec -t -- sh and then access Kubelet configuration. Answer MASTER_NODE=$(kubectl get nodes '--selector=node-role.kubernetes.io/control-plane' -o jsonpath='{.items[0].metadata.name}') # Exit the ktbx-toolbox to run docker docker exec -t -- kind-control-plane sh -c 'ps -ef | grep "/usr/bin/kubelet"' docker exec -t -- kind-control-plane sh -c 'cat /var/lib/kubelet/config.yaml | grep -i staticPodPath' docker exec -t -- kind-control-plane sh -c 'ls /etc/kubernetes/manifests' Exercice 1: retrieve static pod specifications in Openshift Switch to Kubernetes cluster using kubectx and then access the control plane Node using oc debug node/ and then access Kubelet configuration.

etcd administration

Sun, 30 Jun 2024 14:15:26 +1000

Auteur: Fabrice JAMMES (LinkedIn). Exercice 1: display Kubernetes and Openshift resources Retrieve etcd pod name Answer # Wait for etcd pod to be u kubectl wait --timeout=240s --for=condition=Ready -n "openshift-etcd" pods -l "app=etcd,etcd=true,k8s-app=etcd" etcd_pod=$(kubectl get pods -n "openshift-etcd" -l "app=etcd,etcd=true,k8s-app=etcd" -o jsonpath='{.items[0].metadata.name}') Launch etcdctl --help inside etcd pod Answer # Display Kubernetes keys kubectl exec -t -n "openshift-etcd" "$etcd_pod" -- etcdctl --help