Chapter 7. Working with containers

Procedure

1. Create the pod for the Init Container:

   1. Create a YAML file similar to the following:

      apiVersion: v1
      kind: Pod
      metadata:
        name: myapp-pod
        labels:
          app: myapp
      spec:
        containers:
        - name: myapp-container
          image: registry.access.redhat.com/ubi8/ubi:latest
          command: ['sh', '-c', 'echo The app is running! && sleep 3600']
        initContainers:
        - name: init-myservice
          image: registry.access.redhat.com/ubi8/ubi:latest
          command: ['sh', '-c', 'until getent hosts myservice; do echo waiting for myservice; sleep 2; done;']
        - name: init-mydb
          image: registry.access.redhat.com/ubi8/ubi:latest
          command: ['sh', '-c', 'until getent hosts mydb; do echo waiting for mydb; sleep 2; done;']
      # ...

   2. Create the pod:

      $ oc create -f myapp.yaml

   3. View the status of the pod:

      $ oc get pods

      Example output

      NAME                          READY     STATUS              RESTARTS   AGE
      myapp-pod                     0/1       Init:0/2            0          5s

      The pod status, Init:0/2, indicates it is waiting for the two services.

2. Create the myservice service.

   1. Create a YAML file similar to the following:

      kind: Service
      apiVersion: v1
      metadata:
        name: myservice
      spec:
        ports:
        - protocol: TCP
          port: 80
          targetPort: 9376

   2. Create the pod:

      $ oc create -f myservice.yaml

   3. View the status of the pod:

      $ oc get pods

      Example output

      NAME                          READY     STATUS              RESTARTS   AGE
      myapp-pod                     0/1       Init:1/2            0          5s

      The pod status, Init:1/2, indicates it is waiting for one service, in this case the mydb service.

3. Create the mydb service:

   1. Create a YAML file similar to the following:

      kind: Service
      apiVersion: v1
      metadata:
        name: mydb
      spec:
        ports:
        - protocol: TCP
          port: 80
          targetPort: 9377

   2. Create the pod:

      $ oc create -f mydb.yaml

   3. View the status of the pod:

      $ oc get pods

      Example output

      NAME                          READY     STATUS              RESTARTS   AGE
      myapp-pod                     1/1       Running             0          2m

      The pod status indicated that it is no longer waiting for the services and is running.

Procedure

1. To view the list of files in the volume, run the oc rsh command:

   $ oc rsh <pod>

   Example output

   sh-4.2$ ls /path/to/volume/subpath/mount
   example_file1 example_file2 example_file3

2. Specify the subPath:

   Example Pod spec with subPath parameter

   apiVersion: v1
   kind: Pod
   metadata:
     name: my-site
   spec:
       containers:
       - name: mysql
         image: mysql
         volumeMounts:
         - mountPath: /var/lib/mysql
           name: site-data
           subPath: mysql 1
       - name: php
         image: php
         volumeMounts:
         - mountPath: /var/www/html
           name: site-data
           subPath: html 2
       volumes:
       - name: site-data
         persistentVolumeClaim:
           claimName: my-site-data

   1

   Databases are stored in the mysql folder.

   2

   HTML content is stored in the html folder.

1. Create the secret:

   1. Create a YAML file similar to the following, replacing the password and user information as appropriate:

      apiVersion: v1
      kind: Secret
      metadata:
        name: mysecret
      type: Opaque
      data:
        pass: MWYyZDFlMmU2N2Rm
        user: YWRtaW4=

   2. Use the following command to create the secret:

      $ oc create -f <secrets-filename>

      For example:

      $ oc create -f secret.yaml

      Example output

      secret "mysecret" created

   3. You can check that the secret was created using the following commands:

      $ oc get secret <secret-name>

      For example:

      $ oc get secret mysecret

      Example output

      NAME       TYPE      DATA      AGE
      mysecret   Opaque    2         17h

      $ oc get secret <secret-name> -o yaml

      For example:

      $ oc get secret mysecret -o yaml

      apiVersion: v1
      data:
        pass: MWYyZDFlMmU2N2Rm
        user: YWRtaW4=
      kind: Secret
      metadata:
        creationTimestamp: 2017-05-30T20:21:38Z
        name: mysecret
        namespace: default
        resourceVersion: "2107"
        selfLink: /api/v1/namespaces/default/secrets/mysecret
        uid: 959e0424-4575-11e7-9f97-fa163e4bd54c
      type: Opaque

2. Create a pod with a projected volume.

   1. Create a YAML file similar to the following, including a volumes section:

      kind: Pod
      metadata:
        name: test-projected-volume
      spec:
        containers:
        - name: test-projected-volume
          image: busybox
          args:
          - sleep
          - "86400"
          volumeMounts:
          - name: all-in-one
            mountPath: "/projected-volume"
            readOnly: true
            securityContext:
              allowPrivilegeEscalation: false
              capabilities:
                drop:
                  - ALL
        volumes:
        - name: all-in-one
          projected:
            sources:
            - secret:
                name: mysecret 1

      1

      The name of the secret you created.

   2. Create the pod from the configuration file:

      $ oc create -f <your_yaml_file>.yaml

      For example:

      $ oc create -f secret-pod.yaml

      Example output

      pod "test-projected-volume" created

3. Verify that the pod container is running, and then watch for changes to the pod:

   $ oc get pod <name>

   For example:

   $ oc get pod test-projected-volume

   The output should appear similar to the following:

   Example output

   NAME                    READY     STATUS    RESTARTS   AGE
   test-projected-volume   1/1       Running   0          14s

4. In another terminal, use the oc exec command to open a shell to the running container:

   $ oc exec -it <pod> <command>

   For example:

   $ oc exec -it test-projected-volume -- /bin/sh

5. In your shell, verify that the projected-volumes directory contains your projected sources:

   / # ls

   Example output

   bin               home              root              tmp
   dev               proc              run               usr
   etc               projected-volume  sys               var

Procedure

1. Create a secret to inject:

   1. Create a secret.yaml file similar to the following:

      apiVersion: v1
      kind: Secret
      metadata:
        name: mysecret
      data:
        password: <password>
        username: <username>
      type: kubernetes.io/basic-auth

   2. Create the secret object from the secret.yaml file:

      $ oc create -f secret.yaml

2. Create a pod that references the username field from the above Secret object:

   1. Create a pod.yaml file similar to the following:

      apiVersion: v1
      kind: Pod
      metadata:
        name: dapi-env-test-pod
      spec:
        containers:
          - name: env-test-container
            image: gcr.io/google_containers/busybox
            command: [ "/bin/sh", "-c", "env" ]
            env:
              - name: MY_SECRET_USERNAME
                valueFrom:
                  secretKeyRef:
                    name: mysecret
                    key: username
        restartPolicy: Never
      # ...

   2. Create the pod from the pod.yaml file:

      $ oc create -f pod.yaml

Procedure

1. Create a config map with the values to inject:

   1. Create a configmap.yaml file similar to the following:

      apiVersion: v1
      kind: ConfigMap
      metadata:
        name: myconfigmap
      data:
        mykey: myvalue

   2. Create the config map from the configmap.yaml file:

      $ oc create -f configmap.yaml

2. Create a pod that references the above config map:

   1. Create a pod.yaml file similar to the following:

      apiVersion: v1
      kind: Pod
      metadata:
        name: dapi-env-test-pod
      spec:
        containers:
          - name: env-test-container
            image: gcr.io/google_containers/busybox
            command: [ "/bin/sh", "-c", "env" ]
            env:
              - name: MY_CONFIGMAP_VALUE
                valueFrom:
                  configMapKeyRef:
                    name: myconfigmap
                    key: mykey
        restartPolicy: Always
      # ...

   2. Create the pod from the pod.yaml file:

      $ oc create -f pod.yaml

Procedure

1. Create a pod that references an existing environment variable:

   1. Create a pod.yaml file similar to the following:

      apiVersion: v1
      kind: Pod
      metadata:
        name: dapi-env-test-pod
      spec:
        containers:
          - name: env-test-container
            image: gcr.io/google_containers/busybox
            command: [ "/bin/sh", "-c", "env" ]
            env:
              - name: MY_EXISTING_ENV
                value: my_value
              - name: MY_ENV_VAR_REF_ENV
                value: $(MY_EXISTING_ENV)
        restartPolicy: Never
      # ...

   2. Create the pod from the pod.yaml file:

      $ oc create -f pod.yaml

Procedure

1. Create a pod that references an existing environment variable:

   1. Create a pod.yaml file similar to the following:

      apiVersion: v1
      kind: Pod
      metadata:
        name: dapi-env-test-pod
      spec:
        containers:
          - name: env-test-container
            image: gcr.io/google_containers/busybox
            command: [ "/bin/sh", "-c", "env" ]
            env:
              - name: MY_NEW_ENV
                value: $$(SOME_OTHER_ENV)
        restartPolicy: Never
      # ...

   2. Create the pod from the pod.yaml file:

      $ oc create -f pod.yaml

1. Modify the YAML file that defines the pod and add the securityContext spec, as shown in the following example:

   apiVersion: v1
   kind: Pod
   metadata:
     name: sysctl-example
   spec:
     securityContext:
       sysctls:
       - name: kernel.shm_rmid_forced
         value: "0"
       - name: net.core.somaxconn
         value: "1024"
       - name: kernel.msgmax
         value: "65536"
     ...

2. Create the pod:

   $ oc apply -f <file-name>.yaml

   If the unsafe sysctls are not allowed for the node, the pod is scheduled, but does not deploy:

   $ oc get pod

   Example output

   NAME        READY   STATUS            RESTARTS   AGE
   hello-pod   0/1     SysctlForbidden   0          14s

Procedure

1. Add a label to the machine config pool where the containers where containers with the unsafe sysctls will run:

   $ oc edit machineconfigpool worker

   apiVersion: machineconfiguration.openshift.io/v1
   kind: MachineConfigPool
   metadata:
     creationTimestamp: 2019-02-08T14:52:39Z
     generation: 1
     labels:
       custom-kubelet: sysctl 1

   1

   Add a key: pair label.

2. Create a KubeletConfig custom resource (CR):

   apiVersion: machineconfiguration.openshift.io/v1
   kind: KubeletConfig
   metadata:
     name: custom-kubelet
   spec:
     machineConfigPoolSelector:
       matchLabels:
         custom-kubelet: sysctl 1
     kubeletConfig:
       allowedUnsafeSysctls: 2
         - "kernel.msg*"
         - "net.core.somaxconn"

   1

   Specify the label from the machine config pool.

   2

   List the unsafe sysctls you want to allow.

3. Create the object:

   $ oc apply -f set-sysctl-worker.yaml

   A new MachineConfig object named in the 99-worker-XXXXXX-XXXXX-XXXX-XXXXX-kubelet format is created.

4. Wait for the cluster to reboot using the machineconfigpool object status fields:

   For example:

   status:
     conditions:
       - lastTransitionTime: '2019-08-11T15:32:00Z'
         message: >-
           All nodes are updating to
           rendered-worker-ccbfb5d2838d65013ab36300b7b3dc13
         reason: ''
         status: 'True'
         type: Updating

   A message similar to the following appears when the cluster is ready:

      - lastTransitionTime: '2019-08-11T16:00:00Z'
         message: >-
           All nodes are updated with
           rendered-worker-ccbfb5d2838d65013ab36300b7b3dc13
         reason: ''
         status: 'True'
         type: Updated

5. When the cluster is ready, check for the merged KubeletConfig object in the new MachineConfig object:

   $ oc get machineconfig 99-worker-XXXXXX-XXXXX-XXXX-XXXXX-kubelet -o json | grep ownerReference -A7

           "ownerReferences": [
               {
                   "apiVersion": "machineconfiguration.openshift.io/v1",
                   "blockOwnerDeletion": true,
                   "controller": true,
                   "kind": "KubeletConfig",
                   "name": "custom-kubelet",
                   "uid": "3f64a766-bae8-11e9-abe8-0a1a2a4813f2"
               }
           ]

   You can now add unsafe sysctls to pods as needed.