Skip to content

Commit fcc4265

Browse files
committed
OKD lab
1 parent 0bc6b36 commit fcc4265

File tree

8 files changed

+832
-34
lines changed

8 files changed

+832
-34
lines changed

README.md

Lines changed: 134 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1,66 +1,68 @@
11

22
![Overview](images/diagram_general.png)
33

4-
# MicroProfile Lab with Open Liberty and Minikube
4+
# MicroProfile Lab with Open Liberty and OKD
55

6-
This lab illustrates steps to deploy a MicroProfile application, running in a Open Liberty Docker container into [Minikube](https://kubernetes.io/docs/setup/minikube/)
6+
This lab illustrates steps to deploy a MicroProfile application, running in a Open Liberty Docker container into [OKD](https://www.okd.io) using Open Liberty Operator.
77

88
If you find an issue with the lab instruction you can [report it](https://github.com/microservices-api/kubernetes-microprofile-lab/issues) or better yet, [submit a PR](https://github.com/microservices-api/kubernetes-microprofile-lab/pulls).
99

10-
For questions/comments about Liberty's Docker container or Helm charts please email [Arthur De Magalhaes](mailto:arthurdm@ca.ibm.com).
10+
For questions/comments about Open Liberty Docker container or Open Liberty Operator please email [Arthur De Magalhaes](mailto:arthurdm@ca.ibm.com).
1111

1212
# Before you begin
1313

1414
You'll need a few different artifacts to this lab. Check if you have these installed by running:
1515

16-
```
16+
```bash
1717
git --help
1818
mvn --help
1919
java -help
2020
docker --help
2121
kubectl --help
22-
helm --help
23-
minikube --help
22+
oc --help
2423
```
2524

26-
If any of these is not installed:
25+
If any of these are not installed:
2726

2827
* Install [Git client](https://git-scm.com/download/mac)
2928
* Install [Maven](https://maven.apache.org/download.cgi)
3029
* Install [Docker engine](https://docs.docker.com/engine/installation/)
3130
* Install [Java 8](https://java.com/en/download/)
32-
* Install [kubectl](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.0/manage_cluster/cfc_cli.html)
33-
* Install [helm](https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.0/app_center/create_helm_cli.html)
34-
* Install [minikube](https://kubernetes.io/docs/tasks/tools/install-minikube/)
31+
* Install [kubectl](https://github.com/openshift/origin/releases/download/v3.11.0/openshift-origin-client-tools-v3.11.0-0cbc58b-linux-64bit.tar.gz)
32+
* Install [oc](https://github.com/openshift/origin/releases/download/v3.11.0/openshift-origin-client-tools-v3.11.0-0cbc58b-linux-64bit.tar.gz)
33+
34+
## What is OKD?
35+
36+
From [okd.io](https://www.okd.io):
37+
>OKD is a distribution of Kubernetes optimized for continuous application development and multi-tenant deployment. OKD adds developer and operations-centric tools on top of Kubernetes to enable rapid application development, easy deployment and scaling, and long-term lifecycle maintenance for small and large teams. OKD is the upstream Kubernetes distribution embedded in Red Hat OpenShift. OKD embeds Kubernetes and extends it with security and other integrated concepts. OKD is also referred to as Origin in github and in the documentation. An OKD release corresponds to the Kubernetes distribution - for example, OKD 1.10 includes Kubernetes 1.10. If you are looking for enterprise-level support, or information on partner certification, Red Hat also offers Red Hat OpenShift Container Platform.
38+
39+
## What are Operators?
3540

41+
From [Red Hat](https://www.redhat.com/en/blog/introducing-operator-framework-building-apps-kubernetes):
42+
> An Operator is a method of packaging, deploying and managing a Kubernetes application. A Kubernetes application is an application that is both deployed on Kubernetes and managed using the Kubernetes APIs and kubectl tooling. To be able to make the most of Kubernetes, you need a set of cohesive APIs to extend in order to service and manage your applications that run on Kubernetes. You can think of Operators as the runtime that manages this type of application on Kubernetes.
3643
37-
# Deploying a MicroProfile application in a Minikube cluster
44+
# Deploying a MicroProfile application in an OKD cluster
3845

39-
This lab will walk you through the deployment of our sample MicroProfile Application into a Minikube cluster, which is built on the open source Kubernetes framework. You'll build a MicroProfile application and package it inside a Open Liberty Docker container. You will then utilize a Helm chart that deploys the Liberty container to Minikube, with the appropriate service setup, while also deploying and configuring a CouchDB Helm chart that stands up the database that holds the data for this microservice.
46+
This lab will walk you through the deployment of our sample MicroProfile Application into an OKD cluster. You'll build a MicroProfile application and package it inside a Open Liberty Docker container. You will then utilize an operator that deploys an Open Liberty container to OKD, with the appropriate service setup, while also deploying and configuring a CouchDB operator that stands up the a database that holds data for this microservice.
4047

4148
## Setting up the cluster
4249

43-
1. Download and setup minikube
44-
1. Start minikube by running `minikube start`
45-
1. Enable ingress with the command `minikube addons enable ingress`.
46-
1. Set the Docker CLI to target the minikube Docker engine by running `eval $(minikube docker-env)`
47-
1. Set up helm and tiller by running `helm init`
48-
1. Wait until the following command indicates that the tiller-deploy deployment is available: `kubectl get deployment tiller-deploy --namespace kube-system` (Note: This could take a few minutes)
50+
To install OKD on RHEL or CentOS, follow instructions describe [here](https://github.com/gshipley/installcentos#installation). Ensure SELinux is set to _permissive_.
4951

5052
## Part 1A: Build the application and Docker container
5153

5254
### Vote Microservice
5355

54-
The vote microservice stores feedback from the sessions and displays how well all sessions were liked in a pie chart. If the vote service is configured (via server.xml) to connect to a CouchDB database, the votes will be persisted. Otherwise, the vote data will simply be stored in-memory. This sample application is one of the MicroProfile [showcase](https://github.com/eclipse/microprofile-conference/tree/master/microservice-vote) applications.
56+
The vote microservice stores feedback from the sessions and displays how well all sessions were liked in a pie chart. If the vote service is configured (via `server.xml`) to connect to a CouchDB database, the votes will be persisted. Otherwise, the vote data will simply be stored in-memory. This sample application is one of the MicroProfile [showcase](https://github.com/eclipse/microprofile-conference/tree/master/microservice-vote) applications.
5557

5658
You can clone the lab artifacts and explore the application:
5759

58-
1. Clone the project into your machine. This is already done on the laptop provided for you in this workshop, so you can skip this step. The cloned folder is under the Home directory (shortcut is on the desktop).
59-
```bash
60+
1. Clone the project into your machine.
61+
```console
6062
git clone https://github.com/microservices-api/kubernetes-microprofile-lab.git
6163
```
6264
1. Navigate into the sample application directory:
63-
```bash
65+
```console
6466
cd kubernetes-microprofile-lab/lab-artifacts/application
6567
```
6668
1. See if you can find where technologies described below are used in the application.
@@ -91,7 +93,7 @@ You can clone the lab artifacts and explore the application:
9193

9294
### Dockerizing Vote Microservice
9395

94-
By now you should have a general understanding about the application. Now you will see how you can package the sample application into a Docker container by using a Dockerfile that contains instructions on how the image is built.
96+
By now you should have a general understanding about the application. Now, you will see how you can package the sample application into a Docker container by using a Dockerfile that contains instructions on how the image is built.
9597

9698
In this lab we demonstrate a best-practice pattern which separates the concerns between the enterprise architect and the developer. We first build a Docker image that will act as our `enterprise base image`, which in a company would be the shared curated image that all developers must start from - this allows for consistent and compliance across the enterprise. We then build the developer's Docker image, which starts from the enterprise base image and adds only the application and related configuration.
9799

@@ -105,6 +107,10 @@ The following steps will build the sample application and create a Docker image
105107
```bash
106108
mvn clean package
107109
```
110+
1. Navigate into the `lab-artifacts` directory
111+
```bash
112+
cd ..
113+
```
108114
1. Build and tag the Enterprise Docker image:
109115
```bash
110116
cd ..
@@ -114,13 +120,38 @@ The following steps will build the sample application and create a Docker image
114120
```bash
115121
docker build -t microservice-vote:1.0.0 -f ApplicationDockerfile .
116122
```
117-
1. You can use the Docker CLI to verify that your image is built. Remember that this is querying Minikube's internal Docker registry.
123+
1. You can use the Docker CLI to verify that your image is built.
118124
```bash
119125
docker images
120126
```
121127

128+
## Part 1B: Upload the Docker image to OKD's internal registry
122129

123-
## Part 2: Deploy Liberty and CouchDB Helm charts
130+
We will use OKD's internal Docker registry to host our image.
131+
132+
1. Ensure your `oc` client is logged into OKD. Replace `<USERNAME>`, `<PASSWORD>` and `<CLUSTER_IP>` with appropriate values:
133+
```bash
134+
oc login --username=<USERNAME> --password=<PASSWORD> https://console.<CLUSTER_IP>.nip.io:8443
135+
```
136+
1. Create a new project in OKD which will host our application:
137+
```bash
138+
oc new-project myproject
139+
```
140+
1. Log into the Docker registry:
141+
```bash
142+
docker login -u $(oc whoami) -p $(oc whoami -t) docker-registry-default.apps.<CLUSTER_IP>.nip.io
143+
```
144+
1. Tag the Docker image:
145+
```bash
146+
docker tag microservice-vote:1.0.0 docker-registry-default.apps.<CLUSTER_IP>.nip.io/microservice-vote:1.0.0
147+
```
148+
1. Now that you're logged in the registry, you can `docker push` your tagged image (`microservice-vote`) into the ICP Docker registry:
149+
```bash
150+
docker push docker-registry-default.apps.<CLUSTER_IP>.nip.io/microservice-vote:1.0.0
151+
```
152+
1. Your image is now available in the Docker registry in OKD. You can verify this through the OKD's Registry Dashboard at `https://registry-console-default.apps.<CLUSTER_IP>.nip.io/registry`.
153+
154+
## Part 2: Deploy Liberty and CouchDB Operators
124155

125156
In this part of the lab you will use the Helm command line tool to install a Helm chart.
126157

@@ -129,26 +160,95 @@ First, let's see what are **Helm charts**. Helm is a package manager for Kuberne
129160
Now let's deploy our workload using Helm charts.
130161

131162
### Deploy CouchDB
163+
164+
In this section we will deploy CouchDB Helm chart. OKD does not come with tiller. So we need to install tiller first.
165+
166+
1. Create a project for Tiller
167+
```bash
168+
oc new-project tiller
169+
```
170+
If you already have `tiller` project, switch to the project:
171+
```bash
172+
oc project tiller
173+
```
174+
1. Download Helm CLI and install the Helm client locally:
175+
176+
Linux:
177+
```bash
178+
curl -s https://storage.googleapis.com/kubernetes-helm/helm-v2.14.1-linux-amd64.tar.gz | tar xz
179+
cd linux-amd64
180+
```
181+
OSX:
182+
```bash
183+
curl -s https://storage.googleapis.com/kubernetes-helm/ lm-v2.14.1-darwin-amd64.tar.gz | tar xz
184+
cd darwin-amd64
185+
```
186+
187+
Now configure the Helm client locally:
188+
```bash
189+
sudo mv helm /usr/local/bin
190+
sudo chmod a+x /usr/local/bin/helm
191+
./helm init --client-only
192+
```
193+
1. Install the Tiller server:
194+
```bash
195+
oc process -f https://github.com/openshift/origin/raw/master/examples/helm/tiller-template.yaml -p TILLER_NAMESPACE="tiller" -p HELM_VERSION=v2.14.1 | oc create -f -
196+
oc rollout status deployment tiller
197+
```
198+
1. If things go well, the following commands should run successfully:
199+
```bash
200+
helm version
201+
```
202+
203+
Now that the Helm is configured locally and on OKD, you can deploy CouchDB Helm chart.
204+
1. Navigate to `lab-artifacts/helm/database`:
205+
```bash
206+
cd lab-artifacts/helm/database
207+
```
132208
1. Deploy the CouchDB Helm chart:
133209
```bash
134-
cd helm/database
135210
helm repo add incubator https://kubernetes-charts-incubator.storage.googleapis.com/
136211
helm install incubator/couchdb -f db_values.yaml --name couchdb
137212
```
138213
Ensure the CouchDB pod is up and running by executing `kubectl get pods` command. Your output will look similar to the following:
139214
```bash
140-
NAME READY STATUS RESTARTS AGE
141-
couchdb-couchdb-0 2/2 Running 0 3m
215+
NAME READY STATUS RESTARTS AGE
216+
couchdb-couchdb-0 2/2 Running 0 3m
142217
```
143-
218+
144219
You need to wait until the value under `READY` column becomes `2/2`. Re-run the `kubectl get pods` command if necessary.
145220

146-
### Deploy Liberty
147-
1. Deploy the microservice using the Open Liberty Helm chart:
221+
### Deploy Liberty
222+
223+
#### Install Open Liberty artifacts
224+
225+
1. Navigate to Open Liberty Operator artifact directory:
226+
```bash
227+
cd lab-artifacts/operator/open-liberty-operator
228+
```
229+
1. Install Open Liberty Operator artifacts:
230+
```bash
231+
kubectl apply -f olm/open-liberty-crd.yaml
232+
kubectl apply -f deploy/service_account.yaml
233+
kubectl apply -f deploy/role.yaml
234+
kubectl apply -f deploy/role_binding.yaml
235+
kubectl apply -f deploy/operator.yaml
236+
```
237+
1. Creating a custom Security Context Constraints (SCC). SCC controls the actions that a pod can perform and what it has the ability to access.
238+
```bash
239+
kubectl apply -f deploy/ibm-open-liberty-scc.yaml --validate=false
240+
```
241+
1. Grant the default namespace's service account access to the newly created SCC, `ibm-open-liberty-scc`. Update `<namespace>` with the appropriate namespace:
242+
```bash
243+
oc adm policy add-scc-to-group ibm-open-liberty-scc system:serviceaccounts:<namespace>
244+
```
245+
246+
#### Deploy application
247+
248+
1. Deploy the microservice application using the provided CR:
148249
```bash
149250
cd ../application
150-
helm repo add ibm-charts https://raw.githubusercontent.com/IBM/charts/master/repo/stable/
151-
helm install ibm-charts/ibm-open-liberty -f app_overrides.yaml -f enterprise_overrides.yaml
251+
kubectl apply -f application-cr.yaml
152252
```
153253
1. You can view the status of your deployment by running `kubectl get deployments`. If the deployment is not coming up after a few minutes one way to debug what happened is to query the pods with `kubectl get pods` and then fetch the logs of the Liberty pod with `kubectl logs <pod>`.
154254
1. Use `kubectl get ing | awk 'FNR == 2 {print $3;}'` to determine the address of the application. Note: If the previous command is printing out a port, such as `80`, please wait a few more minutes for the `URL` to be available.
@@ -222,7 +322,7 @@ The steps below would guide you how to enable persistence for your database:
222322
You need to wait until the couchdb and Liberty pods become ready. The old pods may be terminating while the new ones start up.
223323

224324
For Liberty, you will now see 2 pods, since we increased the number of replicas.
225-
1. Refresh the page. You may need to add the security exception again. If you get `Failed to load API defintion` message then try refreshing again.
325+
1. Refresh the page. You may need to add the security exception again. If you get `Failed to load API definition` message then try refreshing again.
226326
1. Now add a new attendee through the OpenAPI UI as before.
227327
1. Now repeat Steps 1-5 in this section to see that even though you delete the couchdb database container, data still gets recovered from the PersistentVolume.
228328

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
apiVersion: openliberty.io/v1alpha1
2+
kind: OpenLiberty
3+
metadata:
4+
name: operator-demo-openliberty
5+
spec:
6+
image:
7+
# repository: quay.io/arthurdm/microservice-vote
8+
repository: microservice-vote
9+
tag: 1.0.0
10+
pullPolicy: IfNotPresent
11+
license: ""
12+
extraEnvs:
13+
- name: "dbUrl"
14+
value: "http://couchdb-svc-couchdb:5984"
15+
- name: dbUsername
16+
valueFrom:
17+
secretKeyRef:
18+
name: couchdb-couchdb
19+
key: adminUsername
20+
- name: dbPassword
21+
valueFrom:
22+
secretKeyRef:
23+
name: couchdb-couchdb
24+
key: adminPassword
25+
ingress:
26+
enabled: true
27+
rewriteTarget: "/"
28+
path: "/"
29+
microprofile:
30+
health:
31+
enabled: true
32+
pod:
33+
labels:
34+
application: conference
35+
monitoring:
36+
enabled: true
37+
arch:
38+
amd64: "3 - Most preferred"
39+
ppc64le: "0 - Do not use"
40+
s390x: "0 - Do not use"
Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
apiVersion: security.openshift.io/v1
2+
kind: SecurityContextConstraints
3+
metadata:
4+
annotations:
5+
name: ibm-open-liberty-scc
6+
allowHostDirVolumePlugin: false
7+
allowHostIPC: false
8+
allowHostNetwork: false
9+
allowHostPID: false
10+
allowHostPorts: false
11+
allowPrivilegedContainer: false
12+
allowedCapabilities: []
13+
allowedFlexVolumes: []
14+
defaultAddCapabilities: []
15+
fsGroup:
16+
type: MustRunAs
17+
ranges:
18+
- max: 65535
19+
min: 1
20+
readOnlyRootFilesystem: false
21+
requiredDropCapabilities:
22+
- ALL
23+
runAsUser:
24+
type: MustRunAsNonRoot
25+
seccompProfiles:
26+
- docker/default
27+
seLinuxContext:
28+
type: RunAsAny
29+
supplementalGroups:
30+
type: MustRunAs
31+
ranges:
32+
- max: 65535
33+
min: 1
34+
volumes:
35+
- configMap
36+
- downwardAPI
37+
- emptyDir
38+
- persistentVolumeClaim
39+
- projected
40+
- secret
41+
priority: 0
Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: open-liberty-operator
5+
spec:
6+
replicas: 1
7+
selector:
8+
matchLabels:
9+
name: open-liberty-operator
10+
template:
11+
metadata:
12+
labels:
13+
name: open-liberty-operator
14+
spec:
15+
serviceAccountName: open-liberty-operator
16+
containers:
17+
- name: open-liberty-operator
18+
image: openliberty/operator:0.0.1
19+
imagePullPolicy: Always
20+
env:
21+
- name: WATCH_NAMESPACE
22+
valueFrom:
23+
fieldRef:
24+
fieldPath: metadata.namespace
25+
- name: POD_NAME
26+
valueFrom:
27+
fieldRef:
28+
fieldPath: metadata.name
29+
- name: OPERATOR_NAME
30+
value: "open-liberty-operator"
31+
affinity:
32+
nodeAffinity:
33+
requiredDuringSchedulingIgnoredDuringExecution:
34+
nodeSelectorTerms:
35+
- matchExpressions:
36+
- key: beta.kubernetes.io/arch
37+
operator: In
38+
values:
39+
- amd64
40+
preferredDuringSchedulingIgnoredDuringExecution:
41+
- weight: 3
42+
preference:
43+
matchExpressions:
44+
- key: beta.kubernetes.io/arch
45+
operator: In
46+
values:
47+
- amd64

0 commit comments

Comments
 (0)