shpwrck

OpenShift 102: Advanced Deployment Techniques, Troubleshooting, and Tuning

Hands-On Workshop Agenda

Workshop Overview

Duration: Full Day (8 hours)
Prerequisites: OpenShift 101 or equivalent experience with basic OpenShift operations
Format: Hands-on lab with guided exercises

---

shpwrck

Steps

1. Identify ETCD Master

etcdctl endpoint status -w table

2. Shutdown non leader node and wait for node to report "Not Ready" and API Server to stabilize
3. Update Quorum Guard and wait for API Server to stabilize (control plane components should redeploy)

oc patch etcd/cluster --type=merge \

shpwrck

#!/bin/bash  

while true; do
  cat /etc/machine-config-daemon/currentconfig | jq -c '.metadata.annotations' | awk --field-separator ",|{|}|:|\"" '{print $9"="$12}' > /etc/kubernetes/node-feature-discovery/features.d/node-version;
  sleep 1;
done

shpwrck

---
apiVersion: networking.gloo.solo.io/v2
kind: VirtualDestination
metadata:
  name: ext-auth-service
  namespace: gloo-mesh-addons
spec:
  ports:
  - number: 8083
    protocol: GRPC

shpwrck

Requirements

Provide a mechanism to enforce network security across clusters where membership is defined through the use of labels.

Components

Pre-Installed Components

• Gloo Platform Control Plane Cluster, Gloo Agent Cluster A,B
  • Istio Deployment on Cluster A,B
• Shared Trust (Root Trust Policy)

shpwrck

#!/bin/bash

# LOAD ENV
cat >> /root/.bashrc << EOF

# RKE2 CONFIG
export PATH=$PATH:/var/lib/rancher/rke2/bin
export KUBECONFIG=/etc/rancher/rke2/rke2.yaml
EOF

shpwrck

I used vi/websocat, but v0.10.0 because v0.11.0 didn't seem to work. Once I deployed the k8s-resources.yaml and the gloo-resources.yaml ... I:

• Ran websocat ws://<<gateway_ip>> from within the websocat container
• Passed in some values
• Cancelled
• Checked the logs for connection information.

Otherwise you can leverage piesocket. *You'll have to run the extension because "browsers don't support ws).

shpwrck

  # Name allows overriding the release name. Generally this should not be set
  name: ""
  # revision declares which revision this gateway is a part of
  revision: "1-14-4"
  replicaCount: 1
  #kind: Deployment
  rbac:
    # If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed
    # when using http://gateway-api.org/.
    enabled: true

shpwrck

  # Name allows overriding the release name. Generally this should not be set
  name: ""
  # revision declares which revision this gateway is a part of
  revision: "1-14-4"
  replicaCount: 1
  #kind: Deployment
  rbac:
    # If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed
    # when using http://gateway-api.org/.
    enabled: true

shpwrck

My tests and test files

Content:

• scale-test.sh
• glooResources.yaml
• appResources.yaml

Notes:

• hardcoded cluster names (mgmt,worker-1,worker-2)
• replicas set to 0 by default