Chapter 2. Getting Started for administrators

Procedure

1. In the OpenShift web console, click Operators and then click Installed Operators.
2. In the Name column, click API Designer.

3. Under Provided APIs, click Create Instance.

   A default form with a minimal starting template for the API Designer instance opens.

4. Accept the default values or optionally edit the following values:

   • size: The number of pods for the API Designer instance.

     The default is three pods for three new resource types that contain logic specific to managing API Designer.

   • image: The API Designer image. If you change this image, the API Designer operator is automatically upgraded on the cluster.
5. Click Create to create a new apicurito-service. OpenShift starts up of the pods, services, and other components for the new API Designer service.

6. To verify that the API Designer service is available:

   1. Click Operators and then click Installed Operators.

   2. In the Provided APIs column, click Apicurito CRD.

      On the Operator Details page, the apicurito-service is listed.

7. To obtain the URL for the API Designer:

   1. Click Networking > Routes.
   2. Make sure that the correct project is selected.
   3. In the apicurito-service row, find the URL for the API Designer web console in the Location column.

Procedure

1. Login to OpenShift as a user with cluster admin access:

   oc login -u <user_with_cluster_admin_role>

2. Retrieve the service signing certificate authority keys, by executing the following commands:

   • To retrieve the certificate:

     oc get secrets/signing-key -n openshift-service-ca -o "jsonpath={.data['tls\.crt']}" | base64 --decode > ca.crt

   • To retrieve the private key:

     oc get secrets/signing-key -n openshift-service-ca -o "jsonpath={.data['tls\.key']}" | base64 --decode > ca.key

3. Generate the client certificate, as documented in Kubernetes certificates administration, using either easyrsa, openssl, or cfssl.

   Here are the example commands using openssl:

   1. Generate the private key:

      openssl genrsa -out server.key 2048

   2. Write the CSR config file.

      cat <<EOT >> csr.conf
        [ req ]
        default_bits = 2048
        prompt = no
        default_md = sha256
        distinguished_name = dn
      
        [ dn ]
        CN = fuse-console.fuse.svc
      
        [ v3_ext ]
        authorityKeyIdentifier=keyid,issuer:always
        keyUsage=keyEncipherment,dataEncipherment,digitalSignature
        extendedKeyUsage=serverAuth,clientAuth
      EOT

   3. Generate the CSR:

      openssl req -new -key server.key -out server.csr -config csr.conf

   4. Issue the signed certificate:

      openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 10000 -extensions v3_ext -extfile csr.conf

1. Log in to the OpenShift console in your web browser as a user with cluster admin access.
2. Select Home > Projects, and then select the project to which you want to add the Fuse Console.
3. Click Operators and then click OperatorHub.
4. In the search field window, type Fuse Console to filter the list of operators.
5. Click Fuse Console Operator.

6. In the Fuse Console Operator install window, click Install.

   The Create Operator Subscription form opens.

   • For Installation mode, you install the Fuse Console Operator to a specific namespace (the current OpenShift project).

     Note that after you install the operator, you can then choose to deploy the Fuse Console to monitor applications in all namespaces on the cluster or to monitor applications only in the namespace in which the Fuse Console operator is installed.

   • For the Approval Strategy, you can select Automatic or Manual to configure how OpenShift handles updates to the Fuse Console Operator.

     • If you select Automatic updates, when a new version of the Fuse Console Operator is available, the OpenShift Operator Lifecycle Manager (OLM) automatically upgrades the running instance of the Fuse Console without human intervention.
     • If you select Manual updates, when a newer version of an Operator is available, the OLM creates an update request. As a cluster administrator, you must then manually approve that update request to have the Fuse Console Operator updated to the new version.

7. Click Subscribe.

   OpenShift installs the Fuse Console Operator in the current namespace.

8. To verify the installation, click Operators and then click Installed Operators. You can see the Fuse Console in the list of operators.

9. In a Terminal window, use the certificate that you generated in Securing the Fuse Console on OpenShift 4.x to create the secret and mount it in the Fuse Console by using the following command where APP_NAME is the name of the Fuse Console Deployment (for example, fuse-console).

   oc create secret tls APP_NAME-tls-proxying --cert server.crt --key server.key

   For example, if the name of the Fuse Console application is fuse-console, type this command:

   oc create secret tls fuse-console-tls-proxying --cert server.crt --key server.key

   If successful, this command returns a response that confirms the secret was created, for example:

   secret/fuse-console-operator-tls-proxying created

10. To deploy the Fuse Console by using the OpenShift web console:

    1. In the list of Installed Operators, under the Name column, click Fuse Console.

    2. On the Overview page under Provided APIs, click Create Instance. A new Custom Resource Definition (CRD) file opens.

       By default, the Fuse Console is deployed to the current namespace.

    3. If you want to deploy the Fuse Console to discover and manage applications within the current namespace, skip to the next step.

       Optionally, if you want to deploy the Fuse Console to discover and manage applications across all namespaces that are on the cluster (and for which you are an authenticated user), edit the CRD file by changing the value of the spec.type field from namespace to cluster.

    4. Click Create.

       After you deploy the Fuse Console, the Fuse Console CRD page opens showing the new Fuse Console service.

1. For a namespace deployment, in the OpenShift web console, open the project in which you installed the Fuse Console operator, and then select Overview. In the Project Overview page, scroll down to the Launcher section and click the the Fuse Console URL to open it.

   For a cluster deployment, in the OpenShift web console’s title bar, click the grid icon ( ). In the popup menu, under Red Hat applications, click the Fuse Console URL link.

2. Log into the Fuse Console.

   An Authorize Access page opens in the browser listing the required permissions.

3. Click Allow selected permissions.

   The Fuse Console opens in the browser and shows the Fuse application pods that you have authorization to access.

4. Click Connect for the application that you want to view.

   A new browser window opens showing the application in the Fuse Console.

Procedure

1. Verify that the Fuse Console image stream is installed by using the following command to retrieve a list of all templates:

   oc get template -n openshift

2. Optionally, if you want to update the already installed image stream with new release tags, use the following command to import the Fuse Console image to the openshift namespace:

   oc import-image fuse7/fuse7-console:1.7 --from=registry.redhat.io/fuse7/fuse-console:1.7 --confirm -n openshift

3. Obtain the Fuse Console APP_NAME value by running the following command:

   oc process --parameters -f TEMPLATE-FILENAME

   where TEMPLATE-FILENAME is one of the following templates:

   • Cluster template:

     https://github.com/jboss-fuse/application-templates/blob/application-templates-2.1.0.fuse-sb2-7_11_1-00016-redhat-00002//fuse-console-cluster-os4.json

   • Cluster template with configurable RBAC:

     https://github.com/jboss-fuse/application-templates/blob/application-templates-2.1.0.fuse-sb2-7_11_1-00016-redhat-00002//fuse-console-cluster-rbac.yml

   • Namespace template:

     https://github.com/jboss-fuse/application-templates/blob/application-templates-2.1.0.fuse-sb2-7_11_1-00016-redhat-00002//fuse-console-namespace-os4.json

   • Namespace template with configurable RBAC:

     https://github.com/jboss-fuse/application-templates/blob/application-templates-2.1.0.fuse-sb2-7_11_1-00016-redhat-00002//fuse-console-namespace-rbac.yml

     For example, for the cluster template with configurable RBAC, run this command:

     oc process --parameters -f https://github.com/jboss-fuse/application-templates/blob/application-templates-2.1.0.fuse-sb2-7_11_1-00016-redhat-00002//fuse-console-cluster-rbac.yml

4. From the certificate that you generated in Securing the Fuse Console on OpenShift 4.x, create the secret and mount it in the Fuse Console by using the following command (where APP_NAME is the name of the Fuse Console application).

   oc create secret tls APP_NAME-tls-proxying --cert server.crt --key server.key

5. Create a new application based on your local copy of the Fuse Console template by running the following command (where myproject is the name of your OpenShift project, mytemp is the path to the local directory that contains the Fuse Console template, and myhost is the hostname to access the Fuse Console:

   • For the cluster template:

     oc new-app -n myproject -f {templates-base-url}/fuse-console-cluster-os4.json  -p ROUTE_HOSTNAME=myhost”

   • For the cluster with RBAC template:

     oc new-app -n myproject -f {templates-base-url}/fuse-console-cluster-rbac.yml -p ROUTE_HOSTNAME=myhost”

   • For the namespace template:

     {templates-base-url}/fuse-console-namespace-os4.json

   • For the namespace with RBAC template:

     oc new-app -n myproject -f {templates-base-url}/fuse-console-namespace-rbac.yml

6. To configure the Fuse Console so that it can open the OpenShift Web console, set the OPENSHIFT_WEB_CONSOLE_URL environment variable by running the following command:

   oc set env dc/${APP_NAME} OPENSHIFT_WEB_CONSOLE_URL=`oc get -n openshift-config-managed cm console-public -o jsonpath={.data.consoleURL}`

7. Obtain the status and the URL of your Fuse Console deployment by running this command:

   oc status

8. To access the Fuse Console from a browser, use the URL that is returned in Step 7 (for example, https://fuse-console.192.168.64.12.nip.io).

1. In a terminal window, use the following command to change the .spec.version field of the application custom resource definition:

   oc patch <project-name> <custom-resource-name> --type='merge' -p '{"spec":{"version":"1.7.1"}}'

   For example:

   oc patch myproject example-fuseconsole --type='merge' -p '{"spec":{"version":"1.7.1"}}'

2. Check that the application’s status has updated:

    oc get myproject

   The response shows information about the application, including the version number:

   NAME                  AGE   URL                                        IMAGE
   example-fuseconsole   1m    https://fuseconsole.192.168.64.38.nip.io   docker.io/fuseconsole/online:1.7.1

   When you change the value of the .spec.version field, OpenShift automatically redeploys the application.

3. To check the status of the redeployment that is triggered by the version change:

   oc rollout status deployment.v1.apps/example-fuseconsole

   A successful deployment shows this response:

   deployment "example-fuseconsole" successfully rolled out

Procedure

1. Login to OpenShift with administrator permissions:

   oc login -u system:admin

2. Install the custom resource definitions necessary for running the Prometheus operator, where {$templates-base-url} is the location of the Fuse on OpenShift template files:

   oc create -f {$templates-base-url}\fuse-prometheus-crd.yml

   The Prometheus operator is now available to any namespace on the cluster.

3. Install the Prometheus operator to your namespace by using the following command syntax:

   oc process -f {$templates-base-url}/fuse-prometheus-operator.yml -p NAMESPACE=<YOUR NAMESPACE> | oc create -f -

   For example, use this command for a project (namespace) named myproject:

   oc process -f {$templates-base-url}/fuse-prometheus-operator.yml -p NAMESPACE=myproject | oc create -f -

   Note

   The first time that you install the Prometheus operator into a namespace, it might take a few minutes for the Prometheus resource pods to start. Subsequently, if you install it to other namespaces on your cluster, the Prometheus resource pods start much faster.

4. Instruct the Prometheus operator to monitor the Fuse application in the project by using the following command syntax::

   oc process -f {$templates-base-url}/fuse-servicemonitor.yml -p NAMESPACE=<YOUR NAMESPACE> -p FUSE_SERVICE_NAME=<YOUR FUSE SERVICE> | oc apply -f -

   For example, use this command for an OpenShift project (namespace) named myproject that includes a Fuse application named myfuseapp:

   oc process -f {$templates-base-url}/fuse-servicemonitor.yml -p NAMESPACE=myproject -p FUSE_SERVICE_NAME=myfuseapp | oc apply -f -

5. To open the Prometheus dashboard:

   1. Login to the OpenShift console.
   2. Open the project to which you added Prometheus.

   3. In the left pane, select Applications Routes.

      

   4. Click the Prometheus Hostname URL to open the Prometheus dashboard in a new browser tab or window.

      

   5. For information about getting started with Prometheus, go to: https://prometheus.io/docs/prometheus/latest/getting_started/

1. Create a custom Prometheus configuration file. You can use the contents of the default file (prometheus-config.yml https://raw.githubusercontent.com/jboss-fuse/application-templates/master/prometheus/prometheus-config.yml) as a guide for the format.

   You can use any name for the custom configuration file, for example: my-prometheus-config.yml.

2. Add your prometheus configuration file (for example, my-prometheus-config.yml) to your application’s src/main/fabric8-includes directory.

3. Create a src/main/fabric8/deployment.xml file within your application and add an entry for the AB_JMX_EXPORTER_CONFIG environment variable with its value set to your configuration file. For example:

   spec:
     template:
       spec:
         containers:
           -
             resources:
               requests:
                 cpu: "0.2"
               limits:
                 cpu: "1.0"
             env:
             - name: SPRING_APPLICATION_JSON
               value: '{"server":{"tomcat":{"max-threads":1}}}'
             - name: AB_JMX_EXPORTER_CONFIG
               value: "my-prometheus-config.yml"

   This environment variable applies to your application at the pod level.

4. Rebuild and deploy your application.