Sandboxed Containers Support for OpenShift

Procedure

1. From the Administrator perspective in the web console, navigate to Operators → OperatorHub.
2. In the Filter by keyword field, type OpenShift sandboxed containers.
3. Select the OpenShift sandboxed containers tile.
4. Read the information about the Operator and click Install.

5. On the Install Operator page:

   1. Select preview-1.1 from the list of available Update Channel options.

   2. Verify that Operator recommended Namespace is selected for Installed Namespace. This installs the Operator in the mandatory openshift-sandboxed-containers-operator namespace. If this namespace does not yet exist, it is automatically created.

      Note

      Attempting to install the OpenShift sandboxed containers Operator in a namespace other than openshift-sandboxed-containers-operator causes the installation to fail.

   3. Verify that Automatic is selected for Approval Strategy. Automatic is the default value, and enables automatic updates to OpenShift sandboxed containers when a new z-stream release is available.
6. Click Install.

Verification

1. From the Administrator perspective in the web console, navigate to Operators → Installed Operators.
2. Verify that the OpenShift sandboxed containers Operator is listed in the in operators list.

Procedure

1. From the Administrator perspective in the web console, navigate to Operators → Installed Operators.
2. Select the OpenShift sandboxed containers Operator from the list of operators.
3. In the KataConfig tab, click Create KataConfig.
4. In the Create KataConfig page, select to configure the KataConfig CR via YAML view.

5. Copy and paste the following manifest into the YAML view:

   apiVersion: kataconfiguration.openshift.io/v1
   kind: KataConfig
   metadata:
     name: cluster-kataconfig

   If you want to install kata as a RuntimeClass only on selected nodes, include the label in the manifest:

    apiVersion: kataconfiguration.openshift.io/v1
    kind: KataConfig
    metadata:
      name: cluster-kataconfig
    spec:
      kataConfigPoolSelector:
        matchLabels:
         <label_key>: '<label_value>' 1

   1

   Labels in kataConfigPoolSelector only support single values; nodeSelector syntax is not supported.

6. Click Create.

Verification

1. In the KataConfig tab, select the new KataConfig CR.
2. In the KataConfig page, select the YAML tab.

3. Monitor the installationStatus field in the status.

   A message appears each time there is an update. Click Reload to view the updated KataConfig CR.

   Once the value of Completed nodes equals the number of worker or labeled nodes, the installation is complete. The status also contains a list of nodes where the installation is completed.

Procedure

1. From the Administrator perspective in the web console, expand Workloads and select the type of workload you want to create.
2. In the workload page, click to create the workload.

3. In the YAML file for the workload, in the spec field where the container is listed, add runtimeClassName: kata.

   Example for Pod

       apiVersion: v1
       kind: Pod
       metadata:
         name: example
         labels:
           app: httpd
         namespace: openshift-sandboxed-containers-operator
       spec:
         runtimeClassName: kata
         containers:
           - name: httpd
             image: 'image-registry.openshift-image-registry.svc:5000/openshift/httpd:latest'
             ports:
               - containerPort: 8080

   Example for Deployment

       apiVersion: apps/v1
       kind: Deployment
       metadata:
         name: example
         namespace: openshift-sandboxed-containers-operator
       spec:
         selector:
           matchLabels:
             app: httpd
         replicas: 3
         template:
           metadata:
             labels:
               app: httpd
           spec:
             runtimeClassName: kata
             containers:
               - name: httpd
                 image: >-
                   image-registry.openshift-image-registry.svc:5000/openshift/httpd:latest
                 ports:
                   - containerPort: 8080

4. Click Save.

Procedure

1. Create the Namespace object for the OpenShift sandboxed containers Operator.

   1. Create a Namespace object YAML file that contains the following manifest:

      apiVersion: v1
      kind: Namespace
      metadata:
        name: openshift-sandboxed-containers-operator

   2. Create the Namespace object:

      $ oc create -f Namespace.yaml

2. Create the OperatorGroup object for the OpenShift sandboxed containers Operator.

   1. Create an OperatorGroup object YAML file that contains the following manifest:

      apiVersion: operators.coreos.com/v1
      kind: OperatorGroup
      metadata:
        name: openshift-sandboxed-containers-operator
        namespace: openshift-sandboxed-containers-operator
      spec:
        targetNamespaces:
        - openshift-sandboxed-containers-operator

   2. Create the OperatorGroup object:

      $ oc create -f OperatorGroup.yaml

3. Create the Subscription object to subscribe the Namespace to the OpenShift sandboxed containers Operator.

   1. Create a Subscription object YAML file that contains the following manifest:

      apiVersion: operators.coreos.com/v1alpha1
      kind: Subscription
      metadata:
        name: openshift-sandboxed-containers-operator
        namespace: openshift-sandboxed-containers-operator
      spec:
        channel: "preview-1.1"
        installPlanApproval: Automatic
        name: sandboxed-containers-operator
        source: redhat-operators
        sourceNamespace: openshift-marketplace
        startingCSV: sandboxed-containers-operator.v1.1.0

   2. Create the Subscription object:

      $ oc create -f Subscription.yaml

Procedure

1. Create a YAML file with the following manifest:

   apiVersion: kataconfiguration.openshift.io/v1
   kind: KataConfig
   metadata:
     name: cluster-kataconfig

2. (Optional) If you want to install kata as a RuntimeClass only on selected nodes, create a YAML file that includes the label in the manifest:

   apiVersion: kataconfiguration.openshift.io/v1
   kind: KataConfig
   metadata:
     name: cluster-kataconfig
   spec:
     kataConfigPoolSelector:
       matchLabels:
         <label_key>: '<label_value>' 1

   1

   Labels in kataConfigPoolSelector only support single values; nodeSelector syntax is not supported.

3. Create the KataConfig resource:

   $ oc create -f <file name>.yaml

Procedure

1. Delete all pods that use runtimeClassName with the value of kata.
2. From the OpenShift Container Platform web console, select openshift-sandboxed-containers from the Projects list.
3. Navigate to the Operators → Installed Operators page.
4. Click OpenShift sandboxed containers.
5. Click the OpenShift sandboxed containers Operator tab.
6. Click the scroll-down list in the Operator Details, and then click Delete KataConfig.
7. Click Delete in the confirmation window.

Procedure

1. Navigate to the Operators → OperatorHub page.
2. Search for OpenShift sandboxed containers and then select the Operator.
3. Click Uninstall.
4. Delete the openshift-sandboxed-containers-operator namespace.

Procedure

1. Delete the KataConfig custom resource by running the following command:

   $ oc delete kataconfig <KataConfig_CR_Name>

2. Delete the KataConfig custom resource definition by running the following command:

   $ oc delete crd kataconfigs.kataconfiguration.openshift.io

Procedure

1. Delete the OpenShift sandboxed containers Operator subscription from Operator Lifecyle Manager (OLM) by running the following command:

   $ oc delete subscription openshift-sandboxed-containers-subscription -n openshift-sandboxed-containers-operator

2. Set the cluster service version (CSV) name for OpenShift sandboxed containers as an environment variable by running the following command:

   CSV_NAME=$(oc get csv -n openshift-sandboxed-containers-operator -o=custom-columns=:metadata.name)

3. Delete the CSV name for OpenShift sandboxed containers by running the following command:

   $ oc delete csv ${CSV_NAME} -n openshift-sandboxed-containers-operator