Master OpenShift
From Zero to Pro

# Containerfile (OCI-standard name; Dockerfile also works)
FROM registry.access.redhat.com/ubi9/ubi-minimal:latest
WORKDIR /app
COPY target/myapp.jar .
RUN microdnf install -y java-17-openjdk-headless && microdnf clean all
EXPOSE 8080
USER 1001          # Non-root — required by OpenShift SCCs
CMD ["java", "-jar", "myapp.jar"]

# Expose the registry (if not already exposed)
oc patch configs.imageregistry.operator.openshift.io cluster \
  --type merge --patch '{"spec":{"defaultRoute":true}}'

# Get the registry hostname
oc get route default-route -n openshift-image-registry

# Log in to the internal registry using your OpenShift token
podman login -u $(oc whoami) -p $(oc whoami -t) \
  default-route-openshift-image-registry.apps.mycluster.example.com

# minimal Pod manifest
apiVersion: v1
kind: Pod
metadata:
  name: my-app
  labels:
    app: my-app
spec:
  containers:
  - name: app
    image: quay.io/myorg/my-app:1.2.0
    ports:
    - containerPort: 8080
    resources:
      requests:
        memory: "128Mi"
        cpu: "250m"      # 250 millicores = 0.25 CPU
      limits:
        memory: "256Mi"
        cpu: "500m"
    livenessProbe:
      httpGet:
        path: /health/live
        port: 8080
      initialDelaySeconds: 15
    readinessProbe:
      httpGet:
        path: /health/ready
        port: 8080

initContainers:
- name: wait-for-db
  image: busybox:1.36
  command: ['sh', '-c',
    'until nc -z postgres-svc 5432; do echo waiting; sleep 2; done']

# List all Cluster Operators and their status
oc get clusteroperators

# Example output:
# NAME                      VERSION   AVAILABLE   PROGRESSING   DEGRADED
# authentication            4.21.0    True        False         False
# dns                       4.21.0    True        False         False
# image-registry            4.21.0    True        False         False
# ingress                   4.21.0    True        False         False
# monitoring                4.21.0    True        False         False

# Download from the cluster's Downloads page (always matches your cluster version)
# Or via the OpenShift mirror:
curl -L https://mirror.openshift.com/pub/openshift-v4/clients/ocp/latest/openshift-client-linux.tar.gz \
  | tar xz
sudo mv oc kubectl /usr/local/bin/

# Verify
oc version
# Client Version: 4.21.x   Server Version: 4.21.x   Kubernetes Version: v1.34.x

# Login with username/password
oc login https://api.mycluster.example.com:6443 \
  -u admin -p mypassword

# Login via web console token (copy from: user menu → Copy login command)
oc login --token=sha256~AbCdEf... --server=https://api.mycluster.example.com:6443

# Check who you are
oc whoami
oc whoami -t     # print token

# Projects
oc new-project my-app           # create & switch to project
oc project my-app               # switch to existing project
oc get projects                  # list all projects you can see

# Resources
oc get pods                      # list pods in current project
oc get pods -A                   # all namespaces
oc get pods -o wide              # show node and IP
oc describe pod my-pod           # full details + events
oc logs my-pod                   # container logs
oc logs -f my-pod               # follow (stream) logs
oc logs -c sidecar my-pod       # specific container

# Debug
oc exec -it my-pod -- /bin/sh   # shell into container
oc debug pod/my-pod              # debug copy of pod
oc debug node/worker-1           # shell on a node (as root)

# Apply / Delete
oc apply -f deployment.yaml      # create or update
oc delete -f deployment.yaml     # delete by manifest
oc delete pod my-pod             # delete specific resource

# Events (great for debugging)
oc get events --sort-by=.lastTimestamp

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  replicas: 3
  selector:
    matchLabels:
      app: my-app
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1         # 1 extra Pod during rollout
      maxUnavailable: 0   # no downtime
  template:
    metadata:
      labels:
        app: my-app
    spec:
      containers:
      - name: app
        image: quay.io/myorg/my-app:1.2.0
        ports:
        - containerPort: 8080

# Trigger a rollout (e.g. after a config change)
oc rollout restart deployment/my-app

# Watch rollout progress
oc rollout status deployment/my-app

# Rollback to previous version
oc rollout undo deployment/my-app

# See rollout history
oc rollout history deployment/my-app

apiVersion: v1
kind: Service
metadata:
  name: my-app-svc
spec:
  selector:
    app: my-app       # matches Pod labels
  ports:
  - name: http
    port: 80           # Service port (DNS: my-app-svc.my-ns.svc.cluster.local:80)
    targetPort: 8080  # container port

# Expose a service as a Route (auto-generates hostname)
oc expose svc/my-app-svc

# Create a TLS-terminated route with a custom hostname
oc create route edge my-app-tls \
  --service=my-app-svc \
  --hostname=my-app.example.com \
  --cert=tls.crt --key=tls.key

# Create from literals
oc create configmap app-config \
  --from-literal=DB_HOST=postgres \
  --from-literal=DB_PORT=5432

# Create from a file
oc create configmap app-config --from-file=application.properties

# Use in Deployment as environment variables
envFrom:
- configMapRef:
    name: app-config

# Or mount as files
volumes:
- name: config-vol
  configMap:
    name: app-config
volumeMounts:
- name: config-vol
  mountPath: /etc/config

# Create a generic secret
oc create secret generic db-creds \
  --from-literal=username=admin \
  --from-literal=password=s3cr3t

# Create a TLS secret from cert files
oc create secret tls my-tls \
  --cert=tls.crt --key=tls.key

# Create an image pull secret for a private registry
oc create secret docker-registry quay-pull \
  --docker-server=quay.io \
  --docker-username=myuser \
  --docker-password=mytoken

# PVC: request storage from the cluster
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: my-data
spec:
  accessModes: [ReadWriteOnce]
  resources:
    requests:
      storage: 10Gi
  storageClassName: ocs-storagecluster-ceph-rbd

# Mount the PVC in a Pod
volumes:
- name: data
  persistentVolumeClaim:
    claimName: my-data
volumeMounts:
- name: data
  mountPath: /var/lib/data

# Create app from Git using S2I (auto-detects Node.js)
oc new-app nodejs~https://github.com/myorg/my-node-app \
  --name=my-app

# The above creates: BuildConfig, ImageStream, Deployment, Service

# Trigger a new build manually
oc start-build my-app

# Follow build logs
oc logs -f bc/my-app

# List builds
oc get builds

apiVersion: build.openshift.io/v1
kind: BuildConfig
metadata:
  name: my-app
spec:
  source:
    type: Git
    git:
      uri: https://github.com/myorg/my-app.git
      ref: main
  strategy:
    type: Source
    sourceStrategy:
      from:
        kind: ImageStreamTag
        name: nodejs:18-ubi9
        namespace: openshift
  output:
    to:
      kind: ImageStreamTag
      name: my-app:latest
  triggers:
  - type: GitHub
    github:
      secret: my-webhook-secret
  - type: ImageChange   # rebuild when builder image updates

# Edge route (TLS at router, HTTP to pod)
oc create route edge --service=my-app --hostname=app.example.com

# Passthrough route (TLS goes all the way to the pod)
oc create route passthrough --service=my-app --hostname=secure.example.com

# Route with custom cert (edge)
oc create route edge my-tls-route \
  --service=my-app \
  --cert=tls.crt \
  --key=tls.key \
  --ca-cert=ca.crt \
  --hostname=app.example.com

# Allow only traffic from pods in same namespace with label app=frontend
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-only
spec:
  podSelector:
    matchLabels:
      app: backend
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 8080

# Label a namespace for EgressIP
oc label namespace my-ns k8s.ovn.org/egress-assignable=""

# Create the EgressIP object
apiVersion: k8s.ovn.org/v1
kind: EgressIP
metadata:
  name: prod-egress
spec:
  egressIPs: ["10.0.100.50"]
  namespaceSelector:
    matchLabels:
      kubernetes.io/metadata.name: my-ns

# Give user Alice edit access in my-project
oc adm policy add-role-to-user edit alice -n my-project

# Give group dev-team view access cluster-wide
oc adm policy add-cluster-role-to-group view dev-team

# Create a custom Role
oc create role pod-reader \
  --verb=get,list,watch \
  --resource=pods -n my-project

# Bind the custom Role to a ServiceAccount
oc create rolebinding pod-reader-binding \
  --role=pod-reader \
  --serviceaccount=my-project:my-sa -n my-project

# Grant a ServiceAccount the anyuid SCC (use sparingly)
oc adm policy add-scc-to-user anyuid \
  -z my-service-account -n my-project

# Check which SCC a Pod actually ran under
oc get pod my-pod -o jsonpath='{.metadata.annotations.openshift\.io/scc}'

# See which SCCs a ServiceAccount can use
oc adm policy who-can use scc anyuid

# Create a ServiceAccount
oc create sa my-app-sa -n my-project

# Use it in a Deployment
spec:
  serviceAccountName: my-app-sa

# List available operators in the catalog
oc get packagemanifests -n openshift-marketplace

# Create a Subscription to install an Operator
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: my-operator
  namespace: openshift-operators
spec:
  channel: stable
  name: my-operator
  source: redhat-operators
  sourceNamespace: openshift-marketplace
  installPlanApproval: Automatic   # or Manual for gated upgrades

# Check Operator installation status
oc get csv -n openshift-operators
oc get installplan -n openshift-operators

# After installing the Crunchy Postgres Operator, create a cluster CR:
apiVersion: postgres-operator.crunchydata.com/v1beta1
kind: PostgresCluster
metadata:
  name: my-pg
spec:
  postgresVersion: 16
  instances:
  - name: instance1
    replicas: 2
    dataVolumeClaimSpec:
      accessModes: [ReadWriteOnce]
      resources:
        requests:
          storage: 20Gi
  backups:
    pgbackrest:
      repos:
      - name: repo1
        volume:
          volumeClaimSpec:
            accessModes: [ReadWriteOnce]
            resources:
              requests:
                storage: 10Gi

# Enable user workload monitoring (one-time cluster-admin task)
oc apply -f - <<EOF
apiVersion: v1
kind: ConfigMap
metadata:
  name: cluster-monitoring-config
  namespace: openshift-monitoring
data:
  config.yaml: |
    enableUserWorkload: true
EOF

# Tell Prometheus to scrape your app's /metrics endpoint
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: my-app-monitor
  labels:
    app: my-app
spec:
  selector:
    matchLabels:
      app: my-app
  endpoints:
  - port: http
    path: /metrics
    interval: 30s

apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: my-app-alerts
spec:
  groups:
  - name: my-app.rules
    rules:
    - alert: HighErrorRate
      expr: rate(http_requests_total{status=~"5.."}[5m]) > 0.1
      for: 2m
      labels:
        severity: critical
      annotations:
        summary: "High error rate on {{ $labels.instance }}"

# Forward all application logs to an external Elasticsearch
apiVersion: logging.openshift.io/v1
kind: ClusterLogForwarder
metadata:
  name: instance
spec:
  outputs:
  - name: elastic-out
    type: elasticsearch
    url: https://my-elastic.example.com:9200
  pipelines:
  - name: app-logs
    inputRefs: [application]
    outputRefs: [elastic-out]

# Trigger a PipelineRun with the tkn CLI
tkn pipeline start build-deploy \
  --param git-url=https://github.com/myorg/my-app \
  --param image=quay.io/myorg/my-app:$(git rev-parse --short HEAD) \
  --workspace name=source,claimName=pipeline-pvc \
  -n my-project --showlog

# Watch pipeline runs
tkn pipelinerun list -n my-project
tkn pipelinerun logs -f build-deploy-run-xyz

apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: build-deploy
spec:
  params:
  - name: git-url
  - name: image
  workspaces:
  - name: source
  tasks:
  - name: clone
    taskRef:
      name: git-clone
      kind: ClusterTask
    params:
    - name: url
      value: $(params.git-url)
    workspaces:
    - name: output
      workspace: source
  - name: build
    runAfter: [clone]
    taskRef:
      name: buildah
      kind: ClusterTask
    params:
    - name: IMAGE
      value: $(params.image)
    workspaces:
    - name: source
      workspace: source

# Create an Argo CD Application
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-app
  namespace: openshift-gitops
spec:
  project: default
  source:
    repoURL: https://github.com/myorg/gitops-config
    targetRevision: main
    path: apps/my-app/overlays/production
  destination:
    server: https://kubernetes.default.svc
    namespace: my-app-prod
  syncPolicy:
    automated:
      prune: true
      selfHeal: true

# HPA targeting 70% CPU utilization
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: my-app-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: my-app
  minReplicas: 2
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70

# Scale based on Kafka consumer lag
apiVersion: keda.sh/v1alpha1
kind: ScaledObject
metadata:
  name: kafka-consumer-scaler
spec:
  scaleTargetRef:
    name: kafka-consumer
  minReplicaCount: 0    # scale to zero!
  maxReplicaCount: 20
  triggers:
  - type: kafka
    metadata:
      bootstrapServers: kafka:9092
      topic: my-topic
      lagThreshold: "50"

affinity:
  nodeAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
      nodeSelectorTerms:
      - matchExpressions:
        - key: node-role.kubernetes.io/infra
          operator: Exists

# Add a taint to a node
oc adm taint node worker-gpu gpu=true:NoSchedule

# Pod that tolerates the taint
tolerations:
- key: gpu
  operator: Equal
  value: "true"
  effect: NoSchedule

# VirtualService: 90% stable, 10% canary
apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: my-app
spec:
  hosts: [my-app]
  http:
  - route:
    - destination:
        host: my-app
        subset: stable
      weight: 90
    - destination:
        host: my-app
        subset: canary
      weight: 10

# Deploy a Knative Service (scales to zero automatically)
apiVersion: serving.knative.dev/v1
kind: Service
metadata:
  name: hello-serverless
spec:
  template:
    metadata:
      annotations:
        autoscaling.knative.dev/minScale: "0"
        autoscaling.knative.dev/maxScale: "10"
    spec:
      containers:
      - image: quay.io/myorg/hello:latest
        env:
        - name: TARGET
          value: World

# Check available update channels
oc get clusterversion

# List available updates
oc adm upgrade

# Trigger update to a specific version
oc adm upgrade --to=4.21.3

# Monitor update progress
oc get clusterversion -w
oc get clusteroperators     # all should be Available=True when done

# SSH to a master node and run the backup script (as root)
oc debug node/master-0

# Inside the debug pod:
chroot /host
/usr/local/bin/cluster-backup.sh /home/core/backup

# The backup creates:
# /home/core/backup/snapshot_TIMESTAMP.db  (etcd snapshot)
# /home/core/backup/static-pod-resources/  (static pod manifests)

apiVersion: v1
kind: ResourceQuota
metadata:
  name: project-quota
spec:
  hard:
    pods: "20"
    requests.cpu: "4"
    requests.memory: 8Gi
    limits.cpu: "8"
    limits.memory: 16Gi
    persistentvolumeclaims: "5"
    services: "10"

apiVersion: v1
kind: LimitRange
metadata:
  name: default-limits
spec:
  limits:
  - type: Container
    default:                   # applied if not set
      cpu: 500m
      memory: 512Mi
    defaultRequest:
      cpu: 100m
      memory: 128Mi
    max:                       # hard ceiling per container
      cpu: 2
      memory: 2Gi

# List nodes with role labels
oc get nodes -L node-role.kubernetes.io/worker

# Drain a node (evict pods) for maintenance
oc adm drain worker-1 --ignore-daemonsets --delete-emptydir-data

# Mark node as unschedulable (no new pods)
oc adm cordon worker-1

# Return node to service
oc adm uncordon worker-1

# Force-delete a stuck pod
oc delete pod stuck-pod --grace-period=0 --force

oc login <API_URL> -u <user> -p <pass>   # Login
oc logout                                    # Logout
oc whoami                                    # Current user
oc whoami --show-server                      # API URL
oc config get-contexts                       # List kubeconfig contexts
oc config use-context <name>                 # Switch context

oc new-project <name>                        # Create project
oc project <name>                            # Switch project
oc projects                                  # List accessible projects
oc delete project <name>                     # Delete project + all resources

oc get <resource>                            # List in current namespace
oc get <resource> -A                         # All namespaces
oc get <resource> -o yaml                    # Full YAML output
oc get <resource> -o json                    # JSON output
oc get <resource> -o wide                    # Extra columns
oc get <resource> --watch                    # Live updates
oc get <resource> -l app=my-app              # Filter by label
oc describe <resource> <name>               # Detailed info + events
oc explain pod.spec.containers               # Schema help

oc logs <pod>                               # Container logs
oc logs -f <pod>                            # Follow / stream
oc logs --previous <pod>                    # Previous (crashed) container
oc logs -c <container> <pod>               # Specific container in pod
oc exec -it <pod> -- bash                  # Shell into container
oc cp <pod>:/remote/path ./local/path        # Copy files from pod
oc port-forward <pod> 8080:8080             # Local port forwarding
oc debug pod/<pod>                          # Debug clone of pod
oc debug node/<node>                        # Root shell on node

oc rollout status deployment/<name>         # Watch rollout progress
oc rollout history deployment/<name>        # Rollout history
oc rollout undo deployment/<name>           # Rollback
oc rollout restart deployment/<name>        # Force restart all pods
oc scale deployment/<name> --replicas=5    # Manual scale
oc set image deployment/<name> app=img:tag  # Update image
oc set env deployment/<name> KEY=VALUE      # Set env var

oc start-build <bc-name>                    # Trigger a build
oc start-build <bc-name> --follow          # Trigger and tail logs
oc cancel-build <build-name>               # Cancel running build
oc get builds                               # List builds
oc logs build/<build-name>                  # Build logs

oc adm policy add-role-to-user edit <user>  # Grant edit role
oc adm policy add-scc-to-user anyuid -z <sa> # Grant SCC to SA
oc auth can-i create pods                    # Check own permission
oc auth can-i create pods --as=<user>       # Check another user's permission
oc get rolebindings -o wide                  # List role bindings

oc get nodes                                # List nodes
oc get clusteroperators                     # Health of cluster operators
oc get clusterversion                       # Cluster version + update status
oc adm upgrade                              # Check / trigger updates
oc adm drain <node> --ignore-daemonsets    # Drain node for maintenance
oc adm cordon <node>                        # Mark unschedulable
oc adm uncordon <node>                      # Return to service
oc get events -A --sort-by=.lastTimestamp   # Recent cluster events
oc top nodes                                # Node resource usage
oc top pods -A                              # Pod resource usage (all ns)