OpenShift

Deploy and manage applications on Red Hat OpenShift Container Platform.

在Red Hat OpenShift Container Platform上部署和管理应用。

When to Use This Skill

何时使用该技能

Use this skill when:

Deploying applications to OpenShift clusters
Using OpenShift-specific features (Routes, BuildConfigs)
Managing projects and RBAC in OpenShift
Implementing S2I (Source-to-Image) builds
Working with OpenShift Operators

在以下场景使用本技能：

向OpenShift集群部署应用
使用OpenShift专属功能（Routes、BuildConfigs）
在OpenShift中管理项目与RBAC
实现S2I（Source-to-Image）构建
使用OpenShift Operators

Prerequisites

前置条件

OpenShift cluster access
oc CLI installed
Basic Kubernetes knowledge

拥有OpenShift集群访问权限
已安装oc CLI
具备基础Kubernetes知识

CLI Basics

CLI基础操作

Authentication

身份验证

bash

undefined

bash

undefined

Login to cluster

oc login https://api.cluster.example.com:6443 -u admin -p password

Login with token

oc login --token=sha256~xxxx --server=https://api.cluster.example.com:6443

Check current context

oc whoami oc whoami --show-server oc whoami --show-context

Logout

oc logout

undefined

oc logout

undefined

Project Management

项目管理

bash

undefined

bash

undefined

Create project (namespace)

oc new-project myapp --display-name="My App" --description="My Application"

Switch project

oc project myapp

List projects

oc projects

Delete project

oc delete project myapp

undefined

oc delete project myapp

undefined

Deploying Applications

部署应用

From Image

从镜像部署

bash

undefined

bash

undefined

Deploy from container image

oc new-app --image=nginx:latest --name=webserver

Deploy from Docker Hub

oc new-app docker.io/library/nginx:latest

Deploy with environment variables

oc new-app myimage:latest
-e DATABASE_URL=postgres://localhost/db
-e APP_ENV=production

undefined

oc new-app myimage:latest
-e DATABASE_URL=postgres://localhost/db
-e APP_ENV=production

undefined

From Source (S2I)

从源码部署（S2I）

bash

undefined

bash

undefined

Deploy from Git repository

oc new-app https://github.com/org/myapp.git

Specify builder image

oc new-app nodejs:18~https://github.com/org/nodejs-app.git

With context directory

oc new-app https://github.com/org/monorepo.git
--context-dir=backend
--name=backend-api

undefined

oc new-app https://github.com/org/monorepo.git
--context-dir=backend
--name=backend-api

undefined

From Template

从模板部署

bash

undefined

bash

undefined

List available templates

oc get templates -n openshift

Deploy from template

oc new-app postgresql-persistent
-p POSTGRESQL_USER=user
-p POSTGRESQL_PASSWORD=secret
-p POSTGRESQL_DATABASE=mydb

undefined

oc new-app postgresql-persistent
-p POSTGRESQL_USER=user
-p POSTGRESQL_PASSWORD=secret
-p POSTGRESQL_DATABASE=mydb

undefined

Routes

路由

Creating Routes

创建路由

yaml

apiVersion: route.openshift.io/v1
kind: Route
metadata:
  name: myapp
spec:
  host: myapp.apps.cluster.example.com
  to:
    kind: Service
    name: myapp
    weight: 100
  port:
    targetPort: 8080
  tls:
    termination: edge
    insecureEdgeTerminationPolicy: Redirect

bash

undefined

yaml

apiVersion: route.openshift.io/v1
kind: Route
metadata:
  name: myapp
spec:
  host: myapp.apps.cluster.example.com
  to:
    kind: Service
    name: myapp
    weight: 100
  port:
    targetPort: 8080
  tls:
    termination: edge
    insecureEdgeTerminationPolicy: Redirect

bash

undefined

Create route via CLI

oc expose svc/myapp

Create with custom hostname

oc create route edge myapp
--service=myapp
--hostname=myapp.apps.cluster.example.com

Create passthrough route (TLS termination at pod)

oc create route passthrough myapp-secure --service=myapp

undefined

oc create route passthrough myapp-secure --service=myapp

undefined

A/B Testing

A/B测试

yaml

apiVersion: route.openshift.io/v1
kind: Route
metadata:
  name: myapp
spec:
  to:
    kind: Service
    name: myapp-v1
    weight: 90
  alternateBackends:
    - kind: Service
      name: myapp-v2
      weight: 10

yaml

apiVersion: route.openshift.io/v1
kind: Route
metadata:
  name: myapp
spec:
  to:
    kind: Service
    name: myapp-v1
    weight: 90
  alternateBackends:
    - kind: Service
      name: myapp-v2
      weight: 10

Build Configurations

构建配置

BuildConfig

yaml

apiVersion: build.openshift.io/v1
kind: BuildConfig
metadata:
  name: myapp
spec:
  source:
    type: Git
    git:
      uri: https://github.com/org/myapp.git
      ref: main
  strategy:
    type: Docker
    dockerStrategy:
      dockerfilePath: Dockerfile
  output:
    to:
      kind: ImageStreamTag
      name: myapp:latest
  triggers:
    - type: ConfigChange
    - type: GitHub
      github:
        secret: webhook-secret

yaml

apiVersion: build.openshift.io/v1
kind: BuildConfig
metadata:
  name: myapp
spec:
  source:
    type: Git
    git:
      uri: https://github.com/org/myapp.git
      ref: main
  strategy:
    type: Docker
    dockerStrategy:
      dockerfilePath: Dockerfile
  output:
    to:
      kind: ImageStreamTag
      name: myapp:latest
  triggers:
    - type: ConfigChange
    - type: GitHub
      github:
        secret: webhook-secret

S2I Build

S2I构建

yaml

apiVersion: build.openshift.io/v1
kind: BuildConfig
metadata:
  name: myapp
spec:
  source:
    type: Git
    git:
      uri: https://github.com/org/myapp.git
  strategy:
    type: Source
    sourceStrategy:
      from:
        kind: ImageStreamTag
        namespace: openshift
        name: nodejs:18-ubi8
      env:
        - name: NPM_RUN
          value: start
  output:
    to:
      kind: ImageStreamTag
      name: myapp:latest

yaml

apiVersion: build.openshift.io/v1
kind: BuildConfig
metadata:
  name: myapp
spec:
  source:
    type: Git
    git:
      uri: https://github.com/org/myapp.git
  strategy:
    type: Source
    sourceStrategy:
      from:
        kind: ImageStreamTag
        namespace: openshift
        name: nodejs:18-ubi8
      env:
        - name: NPM_RUN
          value: start
  output:
    to:
      kind: ImageStreamTag
      name: myapp:latest

Build Commands

构建命令

bash

undefined

bash

undefined

Start build

oc start-build myapp

Start build from local source

oc start-build myapp --from-dir=.

Follow build logs

oc start-build myapp --follow

View build logs

oc logs -f bc/myapp

Cancel build

oc cancel-build myapp-1

undefined

oc cancel-build myapp-1

undefined

Image Streams

镜像流

yaml

apiVersion: image.openshift.io/v1
kind: ImageStream
metadata:
  name: myapp
spec:
  lookupPolicy:
    local: true
  tags:
    - name: latest
      from:
        kind: DockerImage
        name: registry.example.com/myapp:latest
      importPolicy:
        scheduled: true

bash

undefined

yaml

apiVersion: image.openshift.io/v1
kind: ImageStream
metadata:
  name: myapp
spec:
  lookupPolicy:
    local: true
  tags:
    - name: latest
      from:
        kind: DockerImage
        name: registry.example.com/myapp:latest
      importPolicy:
        scheduled: true

bash

undefined

Create image stream

oc create imagestream myapp

Import image

oc import-image myapp:latest
--from=docker.io/library/nginx:latest
--confirm

Tag image

oc tag myapp:latest myapp:production

undefined

oc tag myapp:latest myapp:production

undefined

Deployment Configs

部署配置

yaml

apiVersion: apps.openshift.io/v1
kind: DeploymentConfig
metadata:
  name: myapp
spec:
  replicas: 3
  selector:
    app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
        - name: myapp
          image: myapp:latest
          ports:
            - containerPort: 8080
          resources:
            requests:
              memory: "128Mi"
              cpu: "100m"
            limits:
              memory: "256Mi"
              cpu: "500m"
  triggers:
    - type: ConfigChange
    - type: ImageChange
      imageChangeParams:
        automatic: true
        containerNames:
          - myapp
        from:
          kind: ImageStreamTag
          name: myapp:latest
  strategy:
    type: Rolling
    rollingParams:
      maxSurge: 25%
      maxUnavailable: 25%

yaml

apiVersion: apps.openshift.io/v1
kind: DeploymentConfig
metadata:
  name: myapp
spec:
  replicas: 3
  selector:
    app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
        - name: myapp
          image: myapp:latest
          ports:
            - containerPort: 8080
          resources:
            requests:
              memory: "128Mi"
              cpu: "100m"
            limits:
              memory: "256Mi"
              cpu: "500m"
  triggers:
    - type: ConfigChange
    - type: ImageChange
      imageChangeParams:
        automatic: true
        containerNames:
          - myapp
        from:
          kind: ImageStreamTag
          name: myapp:latest
  strategy:
    type: Rolling
    rollingParams:
      maxSurge: 25%
      maxUnavailable: 25%

ConfigMaps and Secrets

ConfigMap与Secret

bash

undefined

bash

undefined

Create ConfigMap

oc create configmap myapp-config
--from-literal=APP_ENV=production
--from-file=config.yaml

Create Secret

oc create secret generic myapp-secrets
--from-literal=password=secret123

Mount as volume

oc set volume dc/myapp
--add --name=config
--type=configmap
--configmap-name=myapp-config
--mount-path=/etc/config

Set as environment

oc set env dc/myapp --from=secret/myapp-secrets

undefined

oc set env dc/myapp --from=secret/myapp-secrets

undefined

Security Context Constraints

安全上下文约束（SCC）

bash

undefined

bash

undefined

List SCCs

oc get scc

View SCC details

oc describe scc restricted

Grant SCC to service account

oc adm policy add-scc-to-user anyuid -z myapp-sa -n myproject

Create service account

oc create serviceaccount myapp-sa

undefined

oc create serviceaccount myapp-sa

undefined

Custom SCC

自定义SCC

yaml

apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
  name: myapp-scc
allowPrivilegedContainer: false
runAsUser:
  type: MustRunAsNonRoot
seLinuxContext:
  type: MustRunAs
fsGroup:
  type: RunAsAny
volumes:
  - configMap
  - secret
  - persistentVolumeClaim
users:
  - system:serviceaccount:myproject:myapp-sa

yaml

apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
  name: myapp-scc
allowPrivilegedContainer: false
runAsUser:
  type: MustRunAsNonRoot
seLinuxContext:
  type: MustRunAs
fsGroup:
  type: RunAsAny
volumes:
  - configMap
  - secret
  - persistentVolumeClaim
users:
  - system:serviceaccount:myproject:myapp-sa

Operators

Operator

bash

undefined

bash

undefined

List available operators

oc get packagemanifests -n openshift-marketplace

Subscribe to operator

cat <<EOF | oc apply -f - apiVersion: operators.coreos.com/v1alpha1 kind: Subscription metadata: name: prometheus namespace: openshift-operators spec: channel: stable name: prometheus source: community-operators sourceNamespace: openshift-marketplace EOF

View installed operators

oc get csv -n openshift-operators

undefined

oc get csv -n openshift-operators

undefined

Monitoring

监控

bash

undefined

bash

undefined

View pod logs

oc logs -f pod/myapp-1-xyz

View events

oc get events --sort-by='.lastTimestamp'

Resource usage

oc adm top pods oc adm top nodes

Debug pod

oc debug pod/myapp-1-xyz

undefined

oc debug pod/myapp-1-xyz

undefined

Common Issues

常见问题

Issue: Build Fails

问题：构建失败

Problem: S2I build cannot find dependencies Solution: Check builder image, verify source repository access

问题描述：S2I构建无法找到依赖项 解决方案：检查构建镜像，验证源码仓库的访问权限

Issue: Pod Security Violation

问题：Pod安全违规

Problem: Pod fails to start due to SCC Solution: Use appropriate SCC or modify container security context

问题描述：Pod因SCC限制无法启动 解决方案：使用合适的SCC或修改容器安全上下文

Issue: Route Not Working

问题：路由无法访问

Problem: Cannot access application via route Solution: Verify service selector, check router pods, validate DNS

问题描述：无法通过路由访问应用 解决方案：验证服务选择器，检查路由Pod状态，验证DNS配置

Issue: Image Pull Error

问题：镜像拉取失败

Problem: Cannot pull image from registry Solution: Create image pull secret, link to service account

bash

oc create secret docker-registry regcred \
  --docker-server=registry.example.com \
  --docker-username=user \
  --docker-password=pass

oc secrets link default regcred --for=pull

问题描述：无法从镜像仓库拉取镜像 解决方案：创建镜像拉取Secret，并关联到服务账户

bash

oc create secret docker-registry regcred \
  --docker-server=registry.example.com \
  --docker-username=user \
  --docker-password=pass

oc secrets link default regcred --for=pull

Best Practices

最佳实践

Use Projects for isolation (not just namespaces)
Leverage ImageStreams for image management
Use BuildConfigs for CI/CD integration
Implement proper SCCs (avoid privileged)
Use Routes instead of Ingress
Leverage OpenShift templates for repeatability
Monitor with built-in Prometheus
Use Operators for complex applications

使用Project进行隔离（而非仅依赖Namespace）
利用ImageStream进行镜像管理
使用BuildConfigs集成CI/CD
配置合适的SCC（避免特权模式）
使用Route替代Ingress
利用OpenShift模板实现可重复性部署
通过内置Prometheus进行监控
为复杂应用使用Operator

openshift

Original

Translation

OpenShift

OpenShift

When to Use This Skill

何时使用该技能

Prerequisites

前置条件

CLI Basics

CLI基础操作

Authentication

身份验证

Login to cluster

Login to cluster

Login with token

Login with token

Check current context

Check current context

Logout

Logout

Project Management

项目管理

Create project (namespace)

Create project (namespace)

Switch project

Switch project

List projects

List projects

Delete project

Delete project

Deploying Applications

部署应用

From Image

从镜像部署

Deploy from container image

Deploy from container image

Deploy from Docker Hub

Deploy from Docker Hub

Deploy with environment variables

Deploy with environment variables

From Source (S2I)

从源码部署（S2I）

Deploy from Git repository

Deploy from Git repository

Specify builder image

Specify builder image

With context directory

With context directory

From Template

从模板部署

List available templates

List available templates

Deploy from template

Deploy from template

Routes

路由

Creating Routes

创建路由

Create route via CLI

Create route via CLI

Create with custom hostname

Create with custom hostname

Create passthrough route (TLS termination at pod)

Create passthrough route (TLS termination at pod)

A/B Testing

A/B测试

Build Configurations

构建配置

BuildConfig

BuildConfig

S2I Build

S2I构建

Build Commands

构建命令

Start build

Start build

Start build from local source

Start build from local source

Follow build logs