OpenShift

OpenShift#

Red Hat OpenShift Container Platform is a Kubernetes distribution plus opinionated tooling and a paid support model. The control plane is upstream Kubernetes with Red Hat patches; on top sit a built-in image registry, a developer console, an integrated build / deploy pipeline (BuildConfig, Source-to-Image), opinionated RBAC defaults, a hardened ingress (HAProxy-based Routes), and operator-driven lifecycle management. The trade is more constraint and more cost in exchange for less self-service for security and ops teams.

For the underlying Kubernetes architecture and object model, see Architecture and Objects; they apply unchanged. This page covers the OpenShift deltas.

Architecture deltas#

Component

OpenShift specifics

Control plane

Standard Kubernetes (kube-apiserver, etcd, scheduler, controller-manager) plus the OpenShift API server (Routes, BuildConfigs, ImageStreams, Projects, SecurityContextConstraints).

Node OS

Red Hat CoreOS by default. Immutable, OSTree-based; updates ship through the Machine Config Operator.

Ingress

OpenShift Routes (HAProxy) instead of Ingress / Gateway API. oc expose creates them inline.

Networking

OVN-Kubernetes default. OpenShift SDN deprecated in OCP 4.14.

Storage

CSI drivers same as upstream. ODF (OpenShift Data Foundation, Rook-Ceph under the hood) for hyperconverged storage.

Auth

OAuth server in front of the API. Integrates with LDAP, OIDC, htpasswd, GitHub, Google.

Project

A namespace with an extra annotation and a default service-account set. oc new-project is the standard create path.

SCC

SecurityContextConstraints. OpenShift’s pod-security policy. restricted-v2 is the default; pods need an explicit binding to escalate.

Operators

Operator Lifecycle Manager (OLM) is bundled. Operators install through the Subscription / CatalogSource / Subscription / InstallPlan flow.

The CLI#

oc is a superset of kubectl with OpenShift-specific verbs.

$ oc login https://api.cluster.example.com:6443
$ oc new-project demo
$ oc new-app https://github.com/myorg/web --name web
$ oc expose svc/web --hostname web.apps.cluster.example.com
$ oc get routes,services,pods
$ oc logs -f deployment/web
$ oc rsh deployment/web
$ oc adm top nodes

oc explain is the local reference for any object kind, upstream or OpenShift-specific.

Routes vs. Ingress#

OpenShift predates the Ingress object and ships its own Route resource. Routes are simpler, support edge / passthrough / re-encrypt TLS in one field, and integrate with the bundled HAProxy router.

apiVersion: route.openshift.io/v1
kind: Route
metadata: { name: web }
spec:
  host: web.apps.cluster.example.com
  to: { kind: Service, name: web }
  port: { targetPort: 8080 }
  tls:
    termination: edge
    insecureEdgeTerminationPolicy: Redirect

Ingress and Gateway API resources also work; the OpenShift router translates them to Routes under the hood.

SecurityContextConstraints#

The default SCC restricted-v2 forbids running as root, host networking, host PID, privileged containers, and most capabilities. Workloads that need any of those bind a service account to a permissive SCC explicitly.

$ oc adm policy add-scc-to-user privileged -z my-sa -n my-ns

This is the most common friction point when porting upstream Helm charts into OpenShift; most charts assume root or arbitrary UIDs at first run.

Build, deploy, registry#

OpenShift ships its own image registry (in-cluster, exposed through a Route), an image-stream abstraction, and BuildConfigs that build from source or a Dockerfile.

$ oc new-build --binary --name=hello
$ oc start-build hello --from-dir=. --follow
$ oc new-app --image-stream=hello

Most teams skip this in favor of an external CI pipeline pushing to an external registry (Quay, ECR, Harbor). The in-cluster registry stays useful for ephemeral builds and air-gapped clusters.

Deploying OpenShift#

  • IPI (installer-provisioned infrastructure), the operator hands openshift-install a config and AWS / Azure / GCP / vSphere / OpenStack / bare-metal credentials; it provisions everything end to end.

  • UPI (user-provisioned infrastructure), the operator brings the nodes (VMs, bare metal) and lets the installer bootstrap Kubernetes on top.

  • OKD, the upstream open-source variant; same code, no Red Hat support contract.

  • Single Node OpenShift (SNO), control plane plus worker on one host, for edge and lab use.

$ openshift-install create install-config --dir=cluster
# edit cluster/install-config.yaml
$ openshift-install create cluster --dir=cluster --log-level=info

Operator catalog#

Operator Lifecycle Manager (OLM) is the cluster’s package manager. Operators ship as CatalogSources; the operator installs a Subscription, OLM resolves an InstallPlan, and the operator’s controllers run in their own namespace.

apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata: { name: cert-manager, namespace: operators }
spec:
  channel: stable-v1
  name: cert-manager
  source: redhat-operators
  sourceNamespace: openshift-marketplace

Operational gotchas#

  • Cluster upgrades flow through the Cluster Version Operator on channels (stable-4.16, fast-4.16, candidate-4.16). Pin the channel; bump deliberately.

  • MachineConfig changes reboot nodes one at a time. Plan around the rolling reboot when applying kernel-level changes.

  • Cluster-wide proxy must be configured in the cluster proxies.config.openshift.io object; setting HTTP_PROXY per-pod alone is insufficient.

  • The pull secret in openshift-config/pull-secret is what every node uses to fetch images. Rotate it carefully.

References#

Contents