Red Hat OpenShift

Commands

Command	Used for...	Notes
oc whoami	See who you are logged in as
oc login	Log in to the cluster	Defaults to using a web login, but user/pass can be provided over the command line
oc new-project	Create a new project (namespace)
oc describe	Get detailed information on a resource instance
oc explain	Get documentation on a resource object
oc api-resources	Get a list of all API resources	--api-group can be used to limit to certain API groups
oc adm top	Get resource usage on pods and similar	--sum will show a sum of resource usage
oc events	Get high-level logs	Helpful for things like image pull or pvc issues
oc debug	Open a shell session in the pod or node	Uses the first container by default, but as a copy; can also be used to log in to physical nodes
oc rsh	Open a shell session in a pod	Simpler version of `oc exec`
oc attach -it	Connect and create an interactive session with a pod
oc port-forward	Expose a pod's port on the localhost
oc image	Get info about an image
oc edit	Make an edit to a resource's YAML and apply it	Useful for modifying the resource easily or in multiple ways
oc patch	Make an edit to a resource's field and apply it	Useful for very specific edits
oc cp	Copy a file into or out of a pod
oc rsync	Copy a file into or out of a pod	Requires the rsync binary on both host and pod container
oc expose	Create a service for a deployment
skopeo list-tags	List all tags for a given image
skopeo inspect	Get image info like env variables and tags

Commands to avoid using:

Command	Used for	Use instead	Because
oc run	Create a single pod	oc create deployment	Includes replicas and other stuff
oc exec -it /bin/bash	Open remote connection	oc rsh	Simpler
oc create service		oc expose

Useful sub-commands:

Command	Used for
oc create secret generic secret_name --from-literal key1=secret1 --from-literal key2=secret2	Creating secrets of arbitrary strings
oc secret extract secret/secret_name --to /tmp/secret --confirm	Extract plaintext from secret
oc set data secret/secret_name --from-file /tmp/secret	Update secret from file

Important Resource Types

Resource	Description	Useful for...	OS Only?
template	YAML manifest of multiple resources	creating multiple resources at once	Yes
pod	One or more containers; represents a single app		No
Deployment	Represents pod templates along with replica sets	Deploying pods with replicas	No
StatefulSet	Create a set of unique pods	Databases	No
DaemonSet	Runs copies of pods on every node	storage daemons, log collectors, monitoring	No
project	OpenShift's namespaces	RBAC	Yes
service	pod-to-pod networking + DNS		No
PersistentVolumeClaim	persistent storage		No
ConfigMap	Configurations or other data	env vars, configuration files, small-ish files
Secret	Configs or other data that needs to be kept secure	SSH keys, API keys, OAuth tokens, passwords	No
Job	One-off tasks	Initialize database, create/restore from backup	No
CronJob	Scheduled tasks	Backups	No
EndpointSlices	IPs or FQDNs used by a service		No
Route	Public hostname for a service	HTTP or TLS based applications	Yes

Pods

• Runs a single app
• Can include multiple containers
• Containers within the pod can share storage/networking

Pod Networking

• Every container in a pod shares IP and MAC addresses
• Every container in a pod can access other containers via loopback addresses (localhost)
• By default, every pod can communicate with every other pod in the cluster

Services

• Fixes issues of direct-to-IP communication by adding a stable proxy-IP address that will update dynamically as the backing pods come and go
• Services use `selector` fields to identify which pods are included. The pods themselves use `labels`.
• Defaults to `svc-name.project-name.svc.cluster.local`
• Load balancing is round-robin by default

Service types:

Type	Description	Benefits	Drawbacks
ClusterIP	Default; cluster-internal IP address	Security	No external access
LoadBalancer	External IP address	External access	Potentially high-cost; extra security concerns
ExternalIP	Do not use unless specific requirements; Virtual, external IP assigned to a node with failover	External access	Security concerns; conflicts with most security policies
NodePort	Opens a specific port on each node between 30000 and 32767	External access	Require direct network connection to nodes; security concerns
ExternalName	Map service to external DNS; does not provide external access		No external access (but not designed for it)

Routes and Gateways

• HTTP stuff ONLY
• Gateways are basically Ingress 2.0
• More advanced than services but require HTTP
• Load balance by default but can be configured with sticky sessions using cookies
• Routes are probably fine for most use cases

Networking

Anki Questions

1. What is <resource>?
2. What command should be used to <action>?
3. Where is <resource> useful compared to similar ones?