Chapter 3. JWS Operator for OpenShift
The Operator Framework is a toolkit to manage Kubernetes-native applications, which are called Operators, in an effective, automated, and scalable way. Operators make it easy to manage complex stateful applications that are running on top of Kubernetes. All Operators are based around three key components, which are the Operator SDK, the Operator Lifecycle Manager, and OperatorHub.io. These tools allow you to develop your own Operators, manage any Operators that you are using on your Kubernetes cluster, and discover or share any Operators that the community creates.
3.1. JBoss Web Server operator Copy linkLink copied to clipboard!
Red Hat JBoss Web Server (JWS) provides an Operator that you can use to manage JWS for OpenShift images. You can build, test, and package the JWS Operator for OpenShift.
The JWS Operator uses different environment variables than a standard JWS for OpenShift setup. For more information about the environment variables that the JWS Operator uses, see Parameters to use in CRD.
In this release, the Use Session Clustering functionality is available as a Technology Preview feature only. The session clustering is set to Off by default. The current Operator version uses the DNS Membership Provider, which is limited because of DNS limitations. InetAddress.getAllByName() results are cached, which means session replications might not work while scaling up.
You can follow the instructions in this document to install the JWS Operator, deploy an existing JWS image, and delete Operators from a cluster. For a faster but less detailed guide to deploying a prepared image or building an image from an existing image stream, see the QuickStart guide.
Red Hat supports images for JWS 5.4 or later versions. Support is not available for images earlier than JWS 5.4.
3.2. Operator groups Copy linkLink copied to clipboard!
An Operator group is an Operator Lifecycle Manger (OLM) resource that provides multitenant configuration to OLM-installed Operators. An Operator group selects target namespaces in which to generate role-based access control (RBAC) for all Operators that are deployed in the same namespace as the OperatorGroup object.
When you subscribe the Operator to a namespace, you must ensure that the namespace has an OperatorGroup object that uses the same InstallModeType setting as the Operator. The InstallModeType settings are AllNamespaces and SingleNamespace.
Consider the following guidelines:
-
If the Operator you want to install uses
AllNamespacesmode, theopenshift-operatorsnamespace already provides an appropriate Operator group. -
If the Operator you want to install uses
SingleNamespacemode, you must create only one Operator group in that namespace.
3.3. What is new in the JWS Operator 2.0 release? Copy linkLink copied to clipboard!
The JWS Operator 2.0 release provides level-2 Operator capabilities such as seamless integration. JWS Operator 2.0 also supports Red Hat JBoss Web Server metering labels and includes some enhanced Custom Resource Definition (CRD) parameters.
Level-2 Operator capabilities
JWS Operator 2.0 provides the following level-2 Operator capability features:
- Enables seamless upgrades
- Supports patch and minor version upgrades
- Manages web servers deployed by the JWS Operator 1.1.x.
Enabling level-2 seamless integration for new images
The DeploymentConfig object definition includes a trigger that OpenShift uses to deploy new pods when a new image is pushed to the image stream. The image stream can monitor the repository for new images or you can instruct the image stream that a new image is available for use.
Procedure
In your project namespace, create an image stream by using the
oc import-imagecommand to import the tag and other information for an image.For example:
oc import-image <my-image>-imagestream:latest \ --from=quay.io/$user/<my-image>:latest \ --confirm
oc import-image <my-image>-imagestream:latest \ --from=quay.io/$user/<my-image>:latest \ --confirmCopy to Clipboard Copied! Toggle word wrap Toggle overflow In the preceding example, replace each occurrence of
<my-image>with the name of the image that you want to import.The preceding command creates an image stream named
<my-image>-imagestreamby importing information for thequay.io/$user/<my-image>image. For more information about the format and management of image streams, see Managing image streams.Create a custom resource of the
WebServerkind for the web application that you want the JWS Operator to deploy whenever the image stream is updated. You can define the custom resource in YAML file format.For example:
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Trigger an update to the image stream by using the
oc tagcommand.For example:
oc tag quay.io/$user/<my-image> <my-image>-imagestream:latest --scheduled
oc tag quay.io/$user/<my-image> <my-image>-imagestream:latest --scheduledCopy to Clipboard Copied! Toggle word wrap Toggle overflow The preceding command causes OpenShift Container Platform to update the specified image stream tag periodically. This period is a cluster-wide setting that is set to 15 minutes by default.
Level-2 seamless integration for rebuilding existing images
The BuildConfig object definition includes a trigger for image stream updates and a webhook, which is either a GitHub or Generic webhook, that enables the rebuilding of images when the webhook is triggered by Git or GitHub.
For more information about creating a secret for a webhook and configuring a generic or GitHub webhook in a custom resource WebServer file, see Parameters to use in CRD.
Support for Red Hat JBoss Web Server metering labels
JWS Operator 2.0 supports the ability to add metering labels to the Red Hat JBoss Web Server pods that the JWS Operator creates.
Red Hat JBoss Web Server can use the following metering labels:
-
com.company: Red_Hat -
rht.prod_name: Red_Hat_Runtimes -
rht.prod_ver: 2022-Q2 -
rht.comp: JBoss_Web_Server -
rht.comp_ver: 5.6.2 -
rht.subcomp: Tomcat 9 -
rht.subcomp_t: application
You can add labels under the metadata section in the custom resource WebServer file for a web application that you want to deploy. For example:
If you change any label key or label value for a deployed web server, the JWS Operator redeploys the web server application. If the deployed web server was built from source code, the JWS Operator also rebuilds the web server application.
Enhanced webImage parameter
In the JWS Operator 2.0 release, the webImage parameter in the CRD contains the following additional fields:
imagePullSecretThe secret that the JWS Operator uses to pull images from the repository
NoteThe secret must contain the key
.dockerconfigjson. The JWS Operator mounts and uses the secret (for example,--authfile /mount_point/.dockerconfigjson) to pull the images from the repository. TheSecretobject definition file might contain server username and password values or tokens to allow access to images in the image stream, the builder image, and images built by the JWS Operator.webAppA set of parameters that describe how the JWS Operator builds the web server application
Enhanced webApp parameter
In the JWS Operator 2.0 release, the webApp parameter in the CRD contains the following additional fields:
nameThe name of the web server application
sourceRepositoryURLThe URL where the application source files are located
sourceRepositoryRefThe branch of the source repository that the Operator uses
sourceRepositoryContextDirThe subdirectory where the
pom.xmlfile is located and where themvn installcommand must be runwebAppWarImageThe URL of the images where the JWS Operator pushes the built image
webAppWarImagePushSecretThe secret that the JWS Operator uses to push images to the repository
builderA set of parameters that contain all the information required to build the web application and create and push the image to the image repository
NoteTo ensure that the builder can operate successfully and run commands with different user IDs, the builder must have access to the
anyuidsecurity context constraint (SCC).To grant the builder access to the
anyuidSCC, enter the following command:oc adm policy add-scc-to-user anyuid -z builderThe
builderparameter contains the following fields:imageThe image of the container where the web application is built (for example,
quay.io/$user/tomcat10-buildah)imagePullSecretThe secret (if specified) that the JWS Operator uses to pull the builder image from the repository
applicationBuildScriptThe script that the builder image uses to build the application
.warfile and move it to the/mntdirectoryNoteIf you do not specify a value for this parameter, the builder image uses a default script that uses Maven and Buildah.
3.4. JWS Operator installation Copy linkLink copied to clipboard!
You can install the JBoss Web Server (JWS) Operator for OpenShift by using either of the following methods:
3.4.1. Installing the JWS Operator by using the web console Copy linkLink copied to clipboard!
You can install the JWS Operator by using the OpenShift web console.
Prerequisites
-
You have deployed an OpenShift Container Platform cluster using an account with
cluster adminand Operator installation permissions.
Procedure
Open the web console and navigate to the Operators tab.
The OpenShift OperatorHub opens.
Search for JWS and select the JWS Operator.
A new menu displays.
- Select the Capacity Level that you want to use.
- To install the Operator, at the start of the console, click Install.
To set up the Operator installation, perform the following steps:
Specify the installation mode by specifying the namespace on your cluster where you want to install the Operator.
NoteIf you do not specify a namespace, the Operator is installed to all namespaces on your cluster by default.
Specify the update channel where the JWS Operator is available.
NoteThe JWS Operator is currently available only through one channel.
Specify the approval strategy by selecting Automatic or Manual updates.
NoteIf you select Automatic updates, when a new version of the Operator is available, the Operator Lifecycle Manager (OLM) upgrades the running instance of your Operator automatically.
If you select Manual updates, when a newer version of the Operator is available, the OLM creates an update request. As a cluster administrator, you must then manually approve the update request to ensure that the Operator is updated to the new version.
Click Install.
NoteIf you have selected a Manual approval strategy, you must approve the install plan before the installation is complete. The JWS Operator now appears in the Installed Operators section of the Operators tab.
3.4.2. Installing the JWS Operator from the command line Copy linkLink copied to clipboard!
You can install the JWS Operator by using the oc command-line tool. The steps to install the JWS Operator from the command line include verifying the supported installModes and available channels for the Operator, creating an Operator group, and creating a Subscription object.
When you install the JWS Operator by using the web console, and the Operator is using SingleNamespace mode, the OperatorGroup and Subscription objects are installed automatically
Prerequisites
- You have deployed an OpenShift Container Platform cluster using an account with Operator installation permissions.
-
You have installed the
octool on your local system.
Procedure
To inspect the JWS Operator, perform the following steps:
To verify the supported installation modes for the JWS Operator, enter the following command:
oc get packagemanifests -n openshift-marketplace | grep jws
$ oc get packagemanifests -n openshift-marketplace | grep jwsCopy to Clipboard Copied! Toggle word wrap Toggle overflow The preceding command produces the following type of output:
jws-operator Red Hat Operators 16h
jws-operator Red Hat Operators 16hCopy to Clipboard Copied! Toggle word wrap Toggle overflow To verify the available channels for the JWS Operator, enter the following command:
oc describe packagemanifests jws-operator -n openshift-marketplace | grep "Catalog Source"
$ oc describe packagemanifests jws-operator -n openshift-marketplace | grep "Catalog Source"Copy to Clipboard Copied! Toggle word wrap Toggle overflow The preceding command produces the following type of output:
Catalog Source: redhat-operators
Catalog Source: redhat-operatorsCopy to Clipboard Copied! Toggle word wrap Toggle overflow
To create an Operator group, perform the following steps:
To check the actual list of Operator groups, enter the following command:
oc get operatorgroups -n <project_name>
$ oc get operatorgroups -n <project_name>Copy to Clipboard Copied! Toggle word wrap Toggle overflow NoteIn the preceding example, replace <project_name> with your OpenShift project name.
The preceding command produces the following type of output:
NAME AGE mygroup 17h
NAME AGE mygroup 17hCopy to Clipboard Copied! Toggle word wrap Toggle overflow Create a YAML file for the
OperatorGroupobject.For example:
Copy to Clipboard Copied! Toggle word wrap Toggle overflow NoteIn the preceding example, replace
<project_name>with the namespace of the project where you want to install the Operator (oc project -q). and replace`<operatorgroup_name>with the name of theOperatorGroupobject.Create the
OperatorGroupobject from the YAML file:oc apply -f <filename>.yaml
$ oc apply -f <filename>.yamlCopy to Clipboard Copied! Toggle word wrap Toggle overflow NoteIn the preceding example, replace
<filename>.yamlwith the name of the YAML file that you have created for theOperatorGroupobject.
To create a Subscription object, perform the following steps:
Create a YAML file for the
Subscriptionobject.For example:
Copy to Clipboard Copied! Toggle word wrap Toggle overflow NoteIn the preceding example, replace
<project_name>with the namespace of the project where you want to install the Operator (oc project -q). If the Operator is usingAllNamespacesmode, replace<project_name>withopenshift-operators.Ensure that the
sourcesetting matches theCatalog sourcevalue based on the command-line output when you verified the available channels for the Operator (for example,redhat-operators).Create the
Subscriptionobject from the YAML file:oc apply -f <filename>.yaml
$ oc apply -f <filename>.yamlCopy to Clipboard Copied! Toggle word wrap Toggle overflow NoteIn the preceding example, replace
<filename>.yamlwith the name of the YAML file that you have created for theSubscriptionobject.
Verification
To verify that the JWS Operator is installed successfully, enter the following command:
oc get csv -n <project_name>
$ oc get csv -n <project_name>Copy to Clipboard Copied! Toggle word wrap Toggle overflow NoteIn the preceding example, replace
<project_name>with the namespace of the project where have installed the Operator.The preceding command produces the following type of output:
Expand NAME DISPLAY VERSION REPLACES PHASE jws-operator.V<version>
JBoss Web Server Operator
<version>
Succeeded
NoteIn the preceding example,
<version>refers to the Operator version (for example,1.1.0).
3.5. Deploying an existing JWS image Copy linkLink copied to clipboard!
You can deploy an existing JWS image by using the OpenShift web console.
Prerequisites
You have installed the JWS Operator by using the web console or from the command line.
To ensure that the JWS Operator is installed, enter the following command:
oc get deployment.apps/jws-operator
$ oc get deployment.apps/jws-operatorCopy to Clipboard Copied! Toggle word wrap Toggle overflow The preceding command produces the following type of output:
NAME READY UP-TO-DATE AVAILABLE AGE jws-operator 1/1 1 1 15h
NAME READY UP-TO-DATE AVAILABLE AGE jws-operator 1/1 1 1 15hCopy to Clipboard Copied! Toggle word wrap Toggle overflow NoteIf you want to view more detailed output, you can use the following command:
oc describe deployment.apps/jws-operator
Procedure
-
Prepare your image and push it to the location where you want to display the image (for example,
quay.io/<USERNAME>/tomcat-demo:latest). To create a YAML file for a
Custom Resourceweb server, perform the following steps:-
Create a file named, for example,
webservers_cr.yaml. Enter details in the following format:
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
-
Create a file named, for example,
To deploy your web application, perform the following steps:
- Go to the directory where you have created the web application.
Enter the following command:
oc apply -f webservers_cr.yaml
$ oc apply -f webservers_cr.yamlCopy to Clipboard Copied! Toggle word wrap Toggle overflow The preceding command produces the following output:
webserver/example-image-webserver created
webserver/example-image-webserver createdCopy to Clipboard Copied! Toggle word wrap Toggle overflow NoteThe Operator creates a route automatically.
Verify the route that the Operator creates:
oc get routes
$ oc get routesCopy to Clipboard Copied! Toggle word wrap Toggle overflow Optional: Delete the
webserverthat you created in the preceding step:oc delete webserver example-image-webserver
$ oc delete webserver example-image-webserverCopy to Clipboard Copied! Toggle word wrap Toggle overflow NoteAlternatively, you can delete the
webserverby deleting the YAML file. For example:oc delete -f webservers_cr.yaml
3.6. JWS Operator deletion Copy linkLink copied to clipboard!
You can delete the JWS Operator from a cluster by using either of the following methods:
3.6.1. Deleting the JWS Operator by using the web console Copy linkLink copied to clipboard!
You can delete the JWS Operator from a cluster by using the OpenShift web console.
Prerequisites
You have deployed an OpenShift Container Platform cluster using an account with
cluster adminpermissions.NoteIf you do not have
cluster adminpermissions, you can circumvent this requirement. For more information, see Allowing non-cluster administrators to install Operators.
Procedure
- Open the web console and click Operators > Installed Operators.
Select the Actions menu and click Uninstall Operator.
NoteThe Uninstall Operator option automatically removes the Operator, any Operator deployments, and Pods.
Deleting the Operator does not remove any custom resource definitions or custom resources for the Operator, including CRDs or CRs. If the Operator has deployed applications on the cluster, or if the Operator has configured off-cluster resources, you must clean up these applications and resources manually.
3.6.2. Deleting the JWS Operator from the command line Copy linkLink copied to clipboard!
You can delete the JWS Operator from a cluster by using the oc command-line tool.
Prerequisites
You have deployed an OpenShift Container Platform cluster using an account with
cluster adminpermissions.NoteIf you do not have
cluster adminpermissions, you can circumvent this requirement. For more information, see Allowing non-cluster administrators to install Operators.-
You have installed the
octool on your local system.
Procedure
Check the current version of the subscribed Operator:
oc get subscription jws-operator -n <project_name> -o yaml | grep currentCSV
$ oc get subscription jws-operator -n <project_name> -o yaml | grep currentCSVCopy to Clipboard Copied! Toggle word wrap Toggle overflow NoteIn the preceding command, replace
<project_name>with the namespace of the project where you installed the Operator. If your Operator was installed to all namespaces, replace<project_name>withopenshift-operators.The preceding command produces the following output, where
v<version>refers to the Operator version (for example,v1.1.0):f:currentCSV: {} currentCSV: jws-operator.v<version>f:currentCSV: {} currentCSV: jws-operator.v<version>Copy to Clipboard Copied! Toggle word wrap Toggle overflow Delete the subscription for the Operator:
oc delete subscription jws-operator -n <project_name>
$ oc delete subscription jws-operator -n <project_name>Copy to Clipboard Copied! Toggle word wrap Toggle overflow NoteIn the preceding command, replace
<project_name>with the namespace of the project where you installed the Operator. If your operator was installed to all namespaces, replace<project_name>withopenshift-operators.Delete the CSV for the Operator in the target namespace by using the currentCSV value that you obtained from the previous steps:
oc delete clusterserviceversion <currentCSV> -n <project_name>
$ oc delete clusterserviceversion <currentCSV> -n <project_name>Copy to Clipboard Copied! Toggle word wrap Toggle overflow NoteIn the preceding command, replace
<project_name>with the namespace of the project where you installed the Operator, and replace<currentCSV>with thecurrentCSV valuethat you obained in the preceding steps (for example, jws-operator.v<version>).The preceding command produces the following type of output:
clusterserviceversion.operators.coreos.com "jws-operator.v<version>" deleted
clusterserviceversion.operators.coreos.com "jws-operator.v<version>" deletedCopy to Clipboard Copied! Toggle word wrap Toggle overflow NoteIn the preceding command,
<project_name>refers to the namespace of the project where you installed the operator, andv<version>refers to the operator version (for example,v1.1.0). If your operator was installed to all namespaces, useopenshift-operatorsin place of<project_name>.