Cloud Orchestration with OpenShift
Cloud Orchestration with OpenShift
This domain tests the enterprise Kubernetes layer: security, routes, builds, operators, and OpenShift networking. Know SCCs, Projects, Routes, BuildConfigs, ImageStreams, and OVN-Kubernetes.
Core rules
- OpenShift adds Projects, which are namespaced RBAC and quota scopes; Routes, which use the HAProxy ingress router with host, path, and TLS options; BuildConfigs for source-to-image or Docker builds; ImageStreams for image tracking; and an internal registry.
- Security Context Constraints constrain pod privileges. SCCs are cluster-scoped and evaluated before admission. A pod running as root may need anyuid, which weakens isolation.
- Networking defaults include OVN-Kubernetes or OpenShift SDN for the pod network and NetworkPolicy; the ingress router implements Routes; Multus adds secondary interfaces for NFV workloads.
- Operators package lifecycle automation; OLM manages install, upgrade, and RBAC for operators.
Worked example
A non-root container image must run and be reachable at app.example.com over TLS. Create a Project, deploy the app, bind a Role allowing route creation, and create a Route with host app.example.com and TLS termination edge. Reasoning: if the image needs a fixed UID, create a custom SCC or use a non-root image; do not grant anyuid unless required, because it allows root and bypasses the restricted SCC.
Traps
- Using a Route and an Ingress interchangeably. Routes are OpenShift-specific and support more TLS options.
- Granting anyuid by default. It bypasses the restricted SCC and increases risk.
- Treating Projects as identical to namespaces. Projects add annotations, RBAC defaults, and quota scope.