oc get clusteroperator machine-api
oc get pods -n openshift-machine-api

oc get clusteroperator machine-approver
oc get pods -n openshift-cluster-machine-approver

oc get clusteroperator machine-config
oc get pods,deployment,daemonset -n openshift-machine-config-operator
  # controller runs on the master and coordinates updates
  # daemon runs on all nodes to manage its updates
  # server hosts ignition configuration for new nodes
# rendered
oc get pods -n openshift-vsphere-infra # openshift-<provider>-infra
oc get nodes --label-columns=kubernetes.io/hostname,k8s.ovn.org/egress-assignable
oc get machineconfigs,machineconfigpools,containerruntimeconfigs,kubeletconfigs,controllerconfigs

apiVersion: machine.openshift.io/v1beta1
kind: MachineSet
metadata:
  name: xxx-infra
  namespace: openshift-machine-api
  labels:
    machine.openshift.io/cluster-api-cluster: xxx
spec:
  replicas: 2
  deletePolicy: Oldest
  selector:
    matchLabels:
      machine.openshift.io/cluster-api-cluster: xxx
      machine.openshift.io/cluster-api-machineset: xxx-infra
  template:
    metadata:
      labels:
        machine.openshift.io/cluster-api-cluster: xxx
        machine.openshift.io/cluster-api-machine-role: infra
        machine.openshift.io/cluster-api-machine-type: infra
        machine.openshift.io/cluster-api-machineset: xxx-infra
    spec:
      lifecycleHooks: {}
      metadata:
        labels:
          node-role.kubernetes.io/infra: ''
          k8s.ovn.org/egress-assignable: ''
      providerSpec:
        value:
          apiVersion: vsphereprovider.openshift.io/v1beta1
          credentialsSecret:
            name: vsphere-cloud-credentials
          diskGiB: 120
          kind: VSphereMachineProviderSpec
          memoryMiB: 16392
          metadata:
            creationTimestamp: null
          network:
            devices:
            - networkName: VLAN1234
          numCPUs: 4
          numCoresPerSocket: 2
          snapshot: ""
          template: xxx-rhcos
          userDataSecret:
            name: worker-user-data
          workspace:
            server: vcenter.example.com
            datacenter: DC1
            datastore: DS1
            folder: /DS1/vm/openshift/xxx/
            resourcePool: /DC1/host/DS1/Resources/openshift
      taints:
      - effect: NoSchedule
        key: node-role.kubernetes.io/infra
status:
  availableReplicas: 2
  fullyLabeledReplicas: 2
  observedGeneration: 2
  readyReplicas: 2
  replicas: 2

oc get machinesets,machine -n openshift-machine-api
# increase replicas to 2 (if replicas was 1)
oc scale machineset/xxx-worker --replicas=2 --current-replicas=1 -n openshift-machine-api

# only one cluster autoscaler per cluster
apiVersion: autoscaling.openshift.io/v1
kind: ClusterAutoscaler
metadata:
  name: default
spec:
  resourceLimits:
    maxNodesTotal: 10
  scaleDown: # waiting when scaling down
    enabled: true
    delayAfterAdd: 10s
    delayAfterDelete: 10s
    delayAfterFailure: 10s
---
# one machine autoscaler per machine set
apiVersion: autoscaling.openshift.io/v1beta1
kind: MachineAutoscaler
metadata:
  name: xxx-worker
  namespace: openshift-machine-api
spec:
  minReplicas: 1
  maxReplicas: 12
  scaleTargetRef:
    apiVersion: machine.openshift.io/v1beta1
    kind: MachineSet
    name: xxx-worker

# view available updates
oc adm upgrade
# show current cluster release information
oc adm release info
# check which versions can upgrade to 4.11.44
oc adm release info 4.11.44 | grep Upgrades

# upgrade cluster to a version on supported upgrade path
oc adm upgrade --to=4.11.44 # to a version available on current channel
oc adm upgrade --to-latest=true # to newest version available on channel

# extract client tools from new release
oc adm release extract --tools --command=oc

# change update channel (from stable-4.x to stable-4.y to upgrade minor version)
oc adm upgrade channel stable-4.12
# or
oc patch clusterversion version --type="merge" --patch '{"spec":{"channel":"stable-4.12"}}'

# check status that update download is starting (etcd begins updating as soon as files are available)
oc get clusterversion --watch
# wait for cluster operators to begin updating
oc wait co/etcd --for condition=Progressing --timeout 90s
oc wait co/kube-apiserver --for condition=Progressing --timeout 90s
oc wait co/kube-controller-manager --for condition=Progressing --timeout 90s
# watch all cluster operators get updated
oc get clusteroperators --watch
# machine-config is last to update and it restarts the nodes
oc wait co/machine-config --for condition=Progressing=False --timeout 90s
oc get nodes
# wait for completion until nodes are configured
oc get clusterversion --watch
oc wait clusterversion/version --for condition=Progressing=False --timeout 90s

oc logs --tail 200 deployment/cluster-version-operator -n openshift-cluster-version

# show resources with the Kubernetes version where they are removed
oc get apirequestcounts | awk '{if(NF==4){print $0}}'

oc get apirequestcounts --sort-by=.status.removedInRelease \
  -o jsonpath='{range .items[?(@.status.removedInRelease!="")]}{.status.removedInRelease}  {.metadata.name}{"\n"}{end}'

# check details of APIRequestCount
oc get apirequestcount cronjobs.v1beta1.batch -o yaml | less

# example of a update acknowledgement (described at upgrade prompt)
oc patch configmap admin-acks -n openshift-config --type=merge \
  --patch '{"data":{"ack-4.11-kube-1.25-api-removals-in-4.12":"true"}}'

kubectl get --raw /metrics | prom2json | jq '.[] | select(.name=="apiserver_requested_deprecated_apis").metrics[].labels'

oc get clusteroperator authentication
oc edit oauth cluster
oc get pods -n openshift-authentication
oc get pods -n openshift-oauth-apiserver # issues OAuth access tokens

apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
  name: cluster
spec:
  identityProviders:
  - name: <name> # prefix to user name to form identity
    type: <type> # e.g. LDAP or HTPasswd
    mappingMethod: <mapping> # mapping between provider identity and user objects
    <type-specific object> # e.g. ldap or htpasswd
  tokenConfig:
    accessTokenMaxAgeSeconds: 86400 # 24 h (default)
    accessTokenInactivityTimeout: 86400s # 24 h

# after updating OAuth tokenConfig
oc wait co/authentication --for condition=Progressing --timeout 90s
oc rollout status --timeout 60s deployment/oauth-openshift -n openshift-authentication
oc wait co/kube-apiserver --for condition=Progressing --timeout 90s
oc wait co/kube-apiserver --for condition=Progressing=False --timeout 90s

# get OAuth server metadata
oc exec mypod -- curl -k https://openshift.default.svc/.well-known/oauth-authorization-server

oc get identities,users
oc delete identity 'IDENTITY PROVIDER NAME:USERNAME'
oc delete user 'USERNAME'

# create ClusterRoleBinding for cluster-admin user
oc adm policy add-cluster-role-to-user cluster-admin alice \
  --rolebinding-name=cluster-admin-alice

# create cluster-admin group
oc adm groups new cluster-administrators
oc adm groups add-users cluster-administrators alice bob
# create ClusterRoleBinding for cluster-admin group
oc adm policy add-cluster-role-to-group cluster-admin cluster-administrators \
  --rolebinding-name=cluster-administrators

# remove kubeadmin
oc delete secret kubeadmin -n kube-system

# encrypt password without username
P="$(htpasswd -b -n -B -C 10 '' fDdBC-bfEdc-Afaee-caBEb)"
P=${P#:} # remove ':' prefix
oc set data secret/kubeadmin -n kube-system --from-literal kubeadmin="${P}"

# if there's an error check authentication logs
oc logs deployment/oauth-openshift -n openshift-authentication | grep kubeadmin

apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: myuser
spec:
  request: >-
    CSR_CONTENT_IN_BASE64
  signerName: kubernetes.io/kube-apiserver-client
  expirationSeconds: 86400 # requested duration of certificate validity
  usages:
  - client auth # required value

openssl genrsa -out myuser.key 4096
openssl req -new -key myuser.key -subj "/CN=myuser/O=users/O=test" -out myuser.csr
openssl req -noout -text -in myuser.csr # check csr
cat myuser.csr | base64 -w0 # CSR_CONTENT_IN_BASE64

# create the CertificateSigningRequest
oc create -f certificatesigningrequests-myuser.yaml
oc get certificatesigningrequests myuser
# approve CSR
oc adm certificate approve myuser
# export signed certificate
oc get certificatesigningrequests myuser -o jsonpath='{.status.certificate}' | base64 -d > myuser.crt

touch kubeconfig # file for storing context configuration

# create a user entry in kubeconfig
oc config set-credentials myuser --kubeconfig=kubeconfig \
  --client-key=myuser.key --client-certificate=myuser.crt --embed-certs

# create a cluster entry with API CA certificate in kubeconfig
openssl s_client -showcerts -connect api.DOMAIN:6443 </dev/null \
  | sed -n '/BEGIN CERTIFICATE/,/END CERTIFICATE/p' > ca.crt
oc config set-cluster mycluster --kubeconfig=kubeconfig \
  --server=https://api.DOMAIN:6443 --certificate-authority=ca.crt --embed-certs

# create a context entry in kubeconfig
oc config set-context mycontext --kubeconfig=kubeconfig \
  --cluster=mycluster --user=myuser --namespace=default

oc config use-context mycontext --kubeconfig=kubeconfig
oc whoami --kubeconfig=kubeconfig # myuser

# create an oc alias to use another kubeconfig
. <(echo "function oc
{
  /usr/local/bin/oc --kubeconfig=\"${PWD}/kubeconfig\" \${@}
}")
type oc
oc whoami # myuser
unset -f oc

apiVersion: v1
kind: ServiceAccount
metadata:
  name: example
  namespace: example
automountServiceAccountToken: true
---
apiVersion: v1
kind: Pod
metadata:
  name: example
spec:
  serviceAccount: example
  serviceAccountName: example
  # automatically mount a rotated service account token
  automountServiceAccountToken: true

apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token
metadata:
  name: example-token
  namespace: example
  annotations:
    kubernetes.io/service-account.name: example
# secret.data is automatically populated with ca.crt, namespace, service-ca.crt, token

SECRET=$(oc get secret -n example \
  -o=jsonpath='{.items[?(@.metadata.annotations.kubernetes\.io/service-account\.name=="example")].metadata.name}' \
  --field-selector type=kubernetes.io/service-account-token)

PASSWORD="$(oc extract secret/${SECRET} --keys=token --to=-)"

# get token
TOKEN="$(oc extract secret/${SECRET} --keys=token --to=-)"

# log in as system:serviceaccount:example:example
oc login --token "${TOKEN}" api.DOMAIN:6443

{
    "prop": {
        "appId": {
            "clientName": "{{kubernetesClientName}}",
            "instanceId": {{instanceId}}
        },
        "virtualServerInfo": {
            "hostName": "{{api-server-endpoint}}",
            "vendor": "KUBERNETES",
            "k8s": {
                "endpointurl": "{{api-server-endpoint}}",
                "secretName": "{{new-service-account}}",
                "secretKey": "{{token-value}}",
                "secretType": "ServiceAccount"
            }
        }
    }
}

# get endpoints
oc get --raw /
oc get --raw /apis | jq . | less
oc get --raw /apis/user.openshift.io/v1 | jq . | less
oc get --raw /apis/user.openshift.io/v1/users/~ | jq . # get self

# get API swagger
oc get --raw /openapi/v2 > swagger.json

oc get --raw /version
oc get --raw /api/v1/namespaces | jq .

oc exec mypod -- \
sh -c 'curl -sS "https://kubernetes.default.svc.cluster.local/api/v1" \
  -H "Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
  -H "Accept: application/yaml" \
  --cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt'

# add cluster role for access to read all resources
oc adm policy add-cluster-role-to-user cluster-reader -z myserviceaccount

# increase log level to 6 to show corresponding HTTP request line
oc get pod --loglevel 6
# increase log level to 9 to show both request and response body
oc create cm example  --loglevel 9

# get the API certificate bundle
openssl s_client -showcerts -connect api.DOMAIN:6443 </dev/null \
  | sed -n '/BEGIN CERTIFICATE/,/END CERTIFICATE/p' > ca.pem

# split the API certificate bundle to inspect each part in chain
T=$(mktemp -d)
csplit -s -z -f ${T}/crt- ca.pem '/-----BEGIN CERTIFICATE-----/' '{*}'
for CERT in ${T}/crt-*
do
  openssl x509 -in "${CERT}" -noout -subject -issuer -startdate -enddate -fingerprint -ext subjectAltName
done

# specify trusted chain
curl --cacert ca.pem $(oc whoami --show-server)/api/v1

oc get scc -o name

# output YAML for adding a SCC to users or service account
oc adm policy add-scc-to-user SCC (USER... | -z SERVICEACCOUNT)
oc adm policy remove-scc-from-user SCC USER...

oc adm policy add-scc-to-user privileged system:serviceaccount:example:example \
  --dry-run=client -o yaml # show ClusterRole+ClusterRolebinding

# show users and groups with permission to use each SCC
oc get scc -o jsonpath='{range .items[*]}
SCC: {.metadata.name}
Groups: {.groups}
Users: {.users}
{end}'

# show SCC annotation openshift.io/scc=<scc>
oc get pods -o jsonpath='{range .items[*]}{.metadata.name} {.metadata.annotations.openshift\.io/scc}{"\n"}{end}'
# list privileged pods (except build pods)
oc get pods --selector '!openshift.io/build.name' \
  -o jsonpath='{range .items[?(@.metadata.annotations.openshift\.io/scc == "privileged")]}{.metadata.name}{"\n"}{end}'

# show capability relevant state
oc exec POD -- capsh --print
oc exec POD -- ps -o seccomp
oc exec POD -- cat /proc/$$/status | grep -i seccomp
  # Seccomp: 0=SECCOMP_MODE_DISABLED, 1=SECCOMP_MODE_STRICT, 2=SECCOMP_MODE_FILTER

# Linux capabilities documentation
man 7 capabilities

apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
  name: nonrootbuilder
  annotations:
    kubernetes.io/description: >-
      nonrootbuilder provides all features of the nonroot
      SCC but allows users to run with any non-root UID and multiple namespaces for
      nonroot building of images with podman and buildah
allowHostPorts: false
allowPrivilegeEscalation: true
allowPrivilegedContainer: false
allowedCapabilities: null
defaultAddCapabilities: null
fsGroup:
  type: RunAsAny
groups: []
priority: 5 # higher value is higher priority
readOnlyRootFilesystem: false
requiredDropCapabilities:
- KILL
- MKNOD
runAsUser:
  type: MustRunAs
  uid: 1000
seLinuxContext:
  type: MustRunAs
supplementalGroups:
  type: RunAsAny
users: []
volumes:
- configMap
- downwardAPI
- emptyDir
- persistentVolumeClaim
- projected
- secret

apiVersion: v1
kind: Pod
metadata:
  name: example
spec:
  serviceAccount: example
  serviceAccountName: example
  securityContext:
    seLinuxOptions: # SELinux context
      level: null # s0:c26,c20
    seccompProfile:
      type: RuntimeDefault
    runAsNonRoot: true
    runAsUser: 1001 # UID
    runAsGroup: 1001 # primary GID
    supplementalGroups: # secondary groups
    - 0
    fsGroup: 1001 # set group owner on volumes
    sysctl: # namespaced sysctls
    - name: net.core.somaxconn # max. connection queue for listen()
      value: '1024'
  containers:
  - securityContext:
      privileged: false
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
      privileged: false
      runAsNonRoot: true
      seccompProfile:
        type: RuntimeDefault

# check if user in group can create a pod
oc adm policy scc-subject-review -u USERNAME -g GROUP -f pod.yaml

# check if default service account can admit a pod specified in resource.yaml
oc adm policy scc-review -z system:serviceaccount:NAMESPACE:default -f pod.yaml

# set serviceaccount for deployment
oc set serviceaccount deployment/NAME SERVICEACCOUNT

# show prevailing capability and related state
oc exec POD capsh --print

# check the ClusterRoleBinding for self-provisioner
oc get clusterrolebinding self-provisioners -o wide
oc describe clusterrole self-provisioner

# if the ClusterRoleBinding has been deleted, recreate it with:
oc adm policy add-cluster-role-to-group self-provisioner system:authenticated:oauth \
  --rolebinding-name self-provisioners
# and annotate to refresh its default values when oauthserver resstarts
oc annotate clusterrolebinding self-provisioners rbac.authorization.kubernetes.io/autoupdate=true

# delete ClusterRoleBinding/self-provisioners
oc adm policy remove-cluster-role-from-group self-provisioner system:authenticated:oauth
# or
oc delete clusterrolebinding self-provisioners

# if the clusterrolebinding should remain modified add annotation to prevent reconciliation
oc annotate clusterrolebinding self-provisioners rbac.authorization.kubernetes.io/autoupdate=false --overwrite
oc patch clusterrolebinding self-provisioners --type=json --patch '[{"op": "remove", "path": "/subjects"}]'

# update the message shown when sending a project request after it's disabled.
oc patch project.config.openshift.io cluster --type=merge --patch \
  '{"spec": {
    "projectRequestTemplate": null,
    "projectRequestMessage": "Self-provisioning of projects is disabled. Creating projects requires cluster-admin."
    }}'

# generate project request template, edit it, create it in openshift-config
oc adm create-bootstrap-project-template -o yaml > project-template.yaml
oc apply -f project-template.yaml -n openshift-config
# specify template name in configuration
oc patch project.config.openshift.io cluster --type=merge --patch \
  '{"spec": {"projectRequestTemplate": {"name": "project-request"}}}'

# wait for pods to be replaced
watch oc get pods -n openshift-apiserver

# create project request
oc new-project NAME --as=user1 --as-group=system:authenticated --as-group=system:authenticated:oauth
oc new-project NAME

oc adm new-project NAME --admin=user1 --node-selector='' \
  --description='User project' --display-name='NAME'

oc create clusterrole example --aggregation-rule='rbac.example.com/aggregate-to-example=true'
oc label clusterrole example-rules-0 rbac.example.com/aggregate-to-example=true
oc label clusterrole example-rules-1 rbac.example.com/aggregate-to-example=true

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: example
aggregationRule:
  clusterRoleSelectors:
  - matchLabels:
      rbac.example.com/aggregate-to-example: 'true'
# rules are automatically combined with clusterroles labeled rbac.example.com/aggregate-to-example=true
rules:
- ...

# list cluster roles that use aggregation rule
oc get clusterrole \
  -o jsonpath='{range .items[?(@.aggregationRule)]}{.metadata.name}{"\n"}{end}'

# list cluster roles that are aggregated into admin cluster role
oc get clusterrole --selector rbac.authorization.k8s.io/aggregate-to-admin=true

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: permission-escalation
rules:
- apiGroups:
  - rbac.authorization.k8s.io
  resources:
  - roles
  - clusterroles
  verbs:
  - escalate
  - bind

oc create clusterrolebinding myuser-sudoer --clusterrole=sudoer --user=myuser
oc whoami --as system:admin
oc create clusterrolebinding mygroup-sudoer --clusterrole=sudoer --user=mygroup
oc whoami --as system:admin --as-group mygroup

# set registry to read-only
oc patch config.imageregistry.operator.openshift.io/cluster \
  --patch '{"spec":{"readOnly":true}}' --type=merge

# add system:image-pruner to the service account of the image registry
SA=$(oc get deployment/image-registry -n openshift-image-registry \
  -o jsonpath='{.spec.template.spec.serviceAccountName}')
oc adm policy add-cluster-role-to-user -n openshift-image-registry \
  system:image-pruner -z ${SA} --rolebinding-name image-pruner-image-registry

# dry run hard prune
oc exec deploy/image-registry -n openshift-image-registry \
  -- /bin/sh -c 'REGISTRY_LOG_LEVEL=info /usr/bin/dockerregistry -prune=check'

# perform hard prune
oc exec deploy/image-registry -n openshift-image-registry \
  -- /bin/sh -c '/usr/bin/dockerregistry -prune=delete'

# unset read-only on registry
oc patch config.imageregistry.operator.openshift.io/cluster \
  --patch '{"spec":{"readOnly":false}}' --type=merge

# remove system:image-pruner cluster role binding
oc delete clusterrole image-pruner-image-registry

apiVersion: config.openshift.io/v1
kind: Image
metadata:
  name: cluster
spec:
  additionalTrustedCA: # additional trusted certificates when pushing/pulling images
    name: additional-trusted-ca # ConfigMap in namespace openshift-config
  registrySources:
    insecureRegistries:
    - example.com..5000

REGISTRY='example.com..5000' # format is hostname[..port]
# add insecure trust of a registry
oc patch image.config.openshift.io/cluster --type=merge \
  --patch '{"spec":{"registrySources":{"insecureRegistries":["'${REGISTRY}'"]}}}'

# add certificate authorities (CA)
oc create configmap additional-trusted-ca -n openshift-config \
oc set data configmap/additional-trusted-ca -n openshift-config \
  --from-file="example1.com=ca.crt" \
  --from-file="example2.com..5000=ca.crt"

# set configmap name in Image configuration
oc patch image.config.openshift.io/cluster --type=merge \
  --patch '{"spec":{"additionalTrustedCA":{"name":"additional-trusted-ca"}}}'

# enable public registry route
oc patch config.imageregistry cluster \
  --type merge --patch '{"spec":{"defaultRoute":true}}'

oc get route default-route -n openshift-image-registry

oc registry info --public # show public route
oc registry info --internal # show internal service

oc get image.config.openshift.io/cluster \
  -o jsonpath='
  INTERNAL: {.status.internalRegistryHostname}
  EXTERNAL: {.status.externalRegistryHostnames}
'

ROUTE="$(oc registry info --public)"
# download the *.apps certificate (unless --tls-verify=false)
openssl s_client -showcerts -connect "${ROUTE}:443" < /dev/null \
  | sed -n '/BEGIN CERTIFICATE/,/END CERTIFICATE/p' > ca.crt

# user configuration
mkdir -p "${HOME}/.config/containers/certs.d/${ROUTE}"
mv ca.crt "${HOME}/.config/containers/certs.d/${ROUTE}/"

# system configuration
mkdir -p "/etc/containers/certs.d/${ROUTE}"
mv ca.crt "/etc/containers/certs.d/${ROUTE}/"

# add role to service account within a namespace
oc create serviceaccount registry-sa -n example
oc policy add-role-to-user registry-editor -z registry-sa -n example
podman login "${ROUTE}" --username "$(oc whoami)" \
  --password "$(oc serviceaccounts get-token registry-sa -n example)"

podman push myimage:123 "${ROUTE}/example/myimage:latest"
skopeo inspect "docker://${ROUTE}/example/myimage:latest"
oc describe imagestreamtag myimage:latest -n example  # imagestreamtag was created
skopeo copy "docker://${ROUTE}/example/myimage:latest" containers-storage:localhost/myimage:latest

# import an image every 15 minutes
oc import-image IMAGESTREAM:TAG --from=IMAGE --confirm --scheduled
oc import-image IMAGESTREAM:TAG # re-import tag
oc import-image IMAGESTREAM # re-import all tags

# create another ImageStreamTag (oc tag SOURCE DESTINATION...)
oc tag --source=docker REGISTRY/REPONAME:TAG2 NAMESPACE/IMAGESTREAM:TAG2 --reference-policy=local
oc tag NAMESPACE1/IMAGESTREAM:TAG NAMESPACE2/IMAGESTREAM:TAG --alias # reference another ImageStreamTag
oc tag NAMESPACE1/IMAGESTREAM:TAG NAMESPACE2/IMAGESTREAM:TAG # reference ImageStreamImage
oc tag NAMESPACE/IMAGESTREAM:TAG --delete # delete tag

oc set image-lookup IMAGESTREAM:TAG # set lookupPolicy.local to true
oc set image-lookup --enabled=false IMAGESTREAM:TAG # set lookupPolicy.local to false
oc set image-lookup # list lookup policies for each imagestream in namespace

apiVersion: v1
kind: ImageStream
metadata:
  name: ubi
  namespace: example
spec:
  lookupPolicy:
    # enable Kubernetes resources in the same namespace to reference imagestreamtags by name
    local: true
  tags:
  - name: "9.2"
    from:
      kind: DockerImage
      name: registry.access.redhat.com/ubi9:9.2
    annotations:
      iconClass: icon-openshift
      openshift.io/display-name: Red Hat Universal Base Image 9
      openshift.io/provider-display-name: Red Hat, Inc.
      tags: base # for Console developer catalog categories
    importPolicy:
      scheduled: true
    referencePolicy:
      type: Local
  - name: latest
    from: # points to other tag (alias)
      kind: ImageStreamTag
      name: "9.2"
      namespace: example
    importPolicy: {}
    referencePolicy:
      type: Source

# re-deploy pods when imagestreamtag updates with a new SHA
oc set triggers deployment/DEPLOYMENT --from-image NAMESPACE/IMAGESTREAM:TAG --containers CONTAINER

oc set triggers deployment/DEPLOYMENT --manual  # pause triggers
oc set triggers deployment/DEPLOYMENT --auto    # resume triggers
oc set triggers deployment/DEPLOYMENT --from-image IMAGESTREAM:TAG --remove  # remove trigger

apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    image.openshift.io/triggers: >-
      [
        {
          "from": {
            "kind":"ImageStreamTag",
            "name":"NAME:TAG"
          },
          "fieldPath":"spec.template.spec.containers[?(@.name==\"CONTAINER\")].image",
          "paused": true
        }
      ]

{
  "auths": {
    "registry.redhat.io": {
      "auth": "<base64>"
    },
    "registry.connect.redhat.com": {
      "auth": "<base64>"
    }
  }
}

# .dockerconfigjson format (kubernetes.io/dockerconfigjson)
oc create secret docker-registry redhat --from-file .dockerconfigjson=auth.json
oc create secret docker-registry redhat --docker-username '1234567|name' --docker-password 'abc'

# old .dockercfg format
oc create secret generic redhat --type=kubernetes.io/dockercfg \
  --from-file=.dockercfg=dockercfg.json

# create imagestream from registry image automatically uses docker secret in namespace
oc import-image NAMESPACE/IMAGESTREAM:TAG --from=registry.redhat.io/REPONAME:TAG --confirm

# --- either ---
# let service account automatically use docker-secret for pods
oc secrets link myserviceaccount redhat --for=pull
oc set serviceaccount myserviceaccount deployment/mydeploy
# --- or ---
# specify pull secret on pod
oc run mypod --image-pull-policy=Always --restart Never \
  --image registry.redhat.io/REPONAME:TAG \
  --overrides='{"spec":{"imagePullSecrets":[{"name":"redhat"}]}}'

# grant serviceaccount imagestream access to other namespace
oc policy add-role-to-user -n NAMESPACE1 \
  image-puller system:serviceaccount:NAMESPACE2:SERVICEACCOUNT

oc get clusteroperator ingress
oc edit ingress.config.openshift.io/cluster
oc get ingresscontroller -n openshift-ingress-operator

apiVersion: config.openshift.io/v1
kind: Ingress
metadata:
  name: cluster
spec:
  domain: apps.DOMAIN # default domain; cannot be modified after installation
  appsDomain: abc.DOMAIN # (optional) default domain for user-created routes (instead of "apps")

apiVersion: operator.openshift.io/v1
kind: IngressController
metadata:
  name: default
  namespace: openshift-ingress-operator
spec:
  domain: apps.DOMAIN # defaults to ingress.config.openshift.io/cluster .spec.domain
  defaultCertificate:
    name: custom-apps-certificate # TLS Secret in namespace openshift-ingress
  clientTLS:
    clientCA:
      name: ""
    clientCertificatePolicy: ""
  httpEmptyRequestsPolicy: Respond
  httpErrorCodePages:
    name: ""
  replicas: 2
  nodePlacement:
    nodeSelector:
      matchLabels:
        node-role.kubernetes.io/infra: ""
    tolerations:
    - effect: NoSchedule
      key: node-role.kubernetes.io/infra
      value: reserved
    - effect: NoExecute
      key: node-role.kubernetes.io/infra
      value: reserved
    - effect: NoSchedule
      key: node.kubernetes.io/memory-pressure
      operator: Exists

# generate private key
openssl genrsa -out tls.key 2048
# check key
openssl rsa -in tls.key -text -noout

# Create an OpenSSL configuration file for creating the certificate signing request
cat <<<'
HOME = .

[req]
default_bits       = 4096
default_md         = sha512
string_mask        = utf8only
distinguished_name = req_distinguished_name

[req_distinguished_name]
countryName                     = Country Name (2 letter code)
countryName_default             = .
countryName_min                 = 2
countryName_max                 = 2
stateOrProvinceName             = State or Province Name (full name)
stateOrProvinceName_default     = .
localityName                    = Locality Name (eg, city)
localityName_default            = .
0.organizationName              = Organization Name (eg, company)
0.organizationName_default      = .
organizationalUnitName          = Organizational Unit (eg, division)
organizationalUnitName_default  = .
commonName                      = Common Name (e.g. server FQDN or YOUR name)
emailAddress                    = Email Address
emailAddress_max                = 64

[req_apps_ext]
# add intended usages for CA to copy or change
basicConstraints = critical, CA:FALSE
keyUsage         = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName   = @apps_alt_names

[apps_alt_names]
DNS = *.apps.DOMAIN
' > req.cnf

# generate certificate signing request with inline ad hoc config
openssl req -new -sha256 \
  -key tls.key \
  -subj "/CN=*.apps.DOMAIN" \
  -config req.cnf -reqexts req_apps_ext \
  -out tls.csr
# check csr
openssl req -noout -text -in tls.csr

cat tls.crt ca.crt > fullchain.crt # full certificate chain
oc create secret tls custom-apps-certificate -n openshift-ingress \
  --cert=fullchain.crt --key=tls.key
oc patch ingresscontroller/default \
  --patch='{"spec":{"defaultCertificate":{"name": "custom-apps-certificate"}}}'