Skip to content

Commit fae5709

Browse files
authored
Merge pull request #722 from sebrandon1/update_tutorial_bash
tutorials: update readability
2 parents 4867d08 + 30bac5d commit fae5709

File tree

8 files changed

+75
-33
lines changed

8 files changed

+75
-33
lines changed

doc/crds.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ automatically when the ComplianceOperator starts in order to provide useful defa
6565
You can inspect the existing `ProfileBundle` objects by calling:
6666

6767
```
68-
oc get profilebundle -nopenshift-compliance
68+
oc get profilebundle -n openshift-compliance
6969
```
7070

7171
Note that in case you need to roll back to a known-good content image

doc/remediation-templating.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -250,6 +250,6 @@ metadata:
250250

251251
The above situation can be caused by the situation where an administrator did not set a value for `sshd_idle_timeout_value` in the TailorProfile before the scan, to find which value is available to set for that variable in order to fix that remediation, an admin can use:
252252

253-
`$ oc describe variable rhcos4-sshd-idle-timeout-value -nopenshift-compliance`
253+
`$ oc describe variable rhcos4-sshd-idle-timeout-value -n openshift-compliance`
254254

255255
An admin can find a section of value for variable `sshd-idle-timeout-value` to choose from, and they can set that value in a tailored profile to satisfy the `compliance.openshift.io/value-required`. Noted, an admin can also set the variable to any other value besides the section values.

doc/troubleshooting.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ to a (CRD document)[crds.md] to learn more API objects.
1010

1111
* The Compliance Operator emits Kubernetes events when something
1212
important happens. You can either view all events in the cluster (`oc get events
13-
-nopenshift-compliance`) or events for an object, e.g. for a scan
13+
-n openshift-compliance`) or events for an object, e.g. for a scan
1414
(`oc describe compliancescan/$scan`)
1515

1616
* The Compliance Operator consists of several controllers, roughly

doc/tutorials/workshop/content/exercises/02-installation.md

Lines changed: 62 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -11,19 +11,29 @@ not deploying from the source, we're going to be creating several Kubernetes
1111
objects from manifests in the upstream repository.
1212

1313
Start by creating the `openshift-compliance` namespace:
14-
```
15-
$ oc create -f https://raw.githubusercontent.com/ComplianceAsCode/compliance-operator/master/config/ns/ns.yaml
16-
namespace/openshift-compliance created
14+
15+
```bash
16+
oc create -f https://raw.githubusercontent.com/ComplianceAsCode/compliance-operator/master/config/ns/ns.yaml
1717
```
1818

1919
We'll be using the OpenShift [Operator Lifecycle Manager](https://docs.openshift.com/container-platform/4.5/operators/understanding_olm/olm-understanding-olm.html)
2020
so we'll continue by creating several objects that describe the operator for
2121
the OLM. First, we'll create the `CatalogSource` and verify that it's been
2222
created successfully:
23+
24+
```bash
25+
oc create -f https://raw.githubusercontent.com/ComplianceAsCode/compliance-operator/master/config/catalog/catalog-source.yaml
2326
```
24-
$ oc create -f https://raw.githubusercontent.com/ComplianceAsCode/compliance-operator/master/config/catalog/catalog-source.yaml
27+
28+
```yaml
2529
catalogsource.operators.coreos.com/compliance-operator created
26-
$ oc get catalogsource -nopenshift-marketplace
30+
```
31+
32+
```bash
33+
oc get catalogsource -n openshift-marketplace
34+
```
35+
36+
```
2737
NAME DISPLAY TYPE PUBLISHER AGE
2838
certified-operators Certified Operators grpc Red Hat 24m
2939
community-operators Community Operators grpc Red Hat 24m
@@ -36,59 +46,91 @@ The `CatalogSource` represents metadata that OLM can use to discover and
3646
install Operators. Once the `CatalogSource` is created, we can continue by
3747
telling OLM that we want to install the Compliance Operator to the `openshift-compliance`
3848
namespace by creating the `OperatorGroup` and the `Subscription` objects:
49+
50+
```bash
51+
oc create -f https://raw.githubusercontent.com/ComplianceAsCode/compliance-operator/master/config/catalog/operator-group.yaml
3952
```
40-
$ oc create -f https://raw.githubusercontent.com/ComplianceAsCode/compliance-operator/master/config/catalog/operator-group.yaml
53+
54+
```yaml
4155
operatorgroup.operators.coreos.com/compliance-operator created
42-
$ oc create -f https://raw.githubusercontent.com/ComplianceAsCode/compliance-operator/master/config/catalog/subscription.yaml
56+
```
57+
58+
```bash
59+
oc create -f https://raw.githubusercontent.com/ComplianceAsCode/compliance-operator/master/config/catalog/subscription.yaml
60+
```
61+
62+
```yaml
4363
subscription.operators.coreos.com/compliance-operator-sub created
4464
```
4565

46-
The Subscription file can be edited to optionally deploy a custom version,
47-
see the `startingCSV` attribute in the `config/catalog/subscription.yaml`
48-
file.
66+
The Subscription file can be edited to optionally deploy a custom version, see the `startingCSV` attribute in the `config/catalog/subscription.yaml` file.
4967

5068
After a minute or two, the operator should be installed. Verify that the
5169
Compliance Operator deployment and pods are running:
70+
71+
```bash
72+
oc get deploy -n openshift-compliance
73+
oc get pods -n openshift-compliance
5274
```
53-
$ oc get deploy -nopenshift-compliance
54-
$ oc get pods -nopenshift-compliance
55-
```
75+
5676
You should see output similar to this one:
77+
78+
```bash
79+
oc get deploy -n openshift-compliance
80+
```
81+
5782
```
58-
$ oc get deploy -nopenshift-compliance
5983
NAME READY UP-TO-DATE AVAILABLE AGE
6084
compliance-operator 1/1 1 1 8m9s
6185
ocp4-openshift-compliance-pp 1/1 1 1 7m22s
6286
rhcos4-openshift-compliance-pp 1/1 1 1 7m22s
87+
```
88+
89+
```bash
90+
oc get pods -n openshift-compliance
91+
```
6392

64-
$ oc get pods -nopenshift-compliance
93+
```
6594
NAME READY STATUS RESTARTS AGE
6695
compliance-operator-6fb8c75499-wkmjg 1/1 Running 0 8m11s
6796
ocp4-openshift-compliance-pp-6d45b4664d-ztflt 1/1 Running 0 7m24s
6897
rhcos4-openshift-compliance-pp-5cd48cff6-98kl2 1/1 Running 0 7m24s
6998
```
99+
70100
Note: The `ocp4-openshift-compliance-pp` and the `rhcos4-openshift-compliance-pp` `Deployment` and `Pods` are created
71101
by the operator and can take up to a minute to appear. The most important
72102
object to see is the `compliance-operator` deployment and the associated pod.
73103

74104
If the deployment does not appear, check the `ClusterServiceVersion` and
75105
`InstallationPlan` objects, normally you should see output similar to the
76106
one below:
107+
108+
```bash
109+
oc get csv -nopenshift-compliance
110+
```
111+
77112
```
78-
$ oc get csv -nopenshift-compliance
79113
NAME DISPLAY VERSION REPLACES PHASE
80114
compliance-operator.v1.2.0 Compliance Operator 1.2.0 Succeeded
81-
$ oc get ip -nopenshift-compliance
115+
```
116+
117+
```bash
118+
oc get ip -nopenshift-compliance
119+
```
120+
121+
```
82122
NAME CSV APPROVAL APPROVED
83123
install-mlxkz compliance-operator.v1.2.0 Automatic true
84124
```
85125

86126
If the deployment is there, but pods don't appear, check the `Deployment`
87127
or its `ReplicaSet`:
128+
129+
```bash
130+
oc describe deploy/compliance-operator -nopenshift-compliance
131+
oc describe rs -lname=compliance-operator -nopenshift-compliance
88132
```
89-
$ oc describe deploy/compliance-operator -nopenshift-compliance
90-
$ oc describe rs -lname=compliance-operator -nopenshift-compliance
91-
```
133+
92134
Any errors would usually surface as `Events` attached to the respective
93135
Kubernetes objects.
94136

doc/tutorials/workshop/content/exercises/03-creating-your-first-scan.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ the result of the content parsing.
7575

7676
Several `Profile` objects are parsed out of each bundle, for the `rhcos4` bundle we'd have:
7777
```
78-
$ oc get profile.compliance -lcompliance.openshift.io/profile-bundle=rhcos4 -nopenshift-compliance
78+
$ oc get profile.compliance -lcompliance.openshift.io/profile-bundle=rhcos4 -n openshift-compliance
7979
NAME AGE
8080
rhcos4-anssi-bp28-enhanced 19m
8181
rhcos4-anssi-bp28-high 19m

doc/tutorials/workshop/content/exercises/06-troubleshooting.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ General tips
88

99
* The Compliance Operator emits Kubernetes events when something
1010
important happens. You can either view all events in the cluster (`oc get events
11-
-nopenshift-compliance`) or events for an object, e.g. for a scan
11+
-n openshift-compliance`) or events for an object, e.g. for a scan
1212
(`oc describe compliancescan/$scan`)
1313

1414
* The Compliance Operator consists of several controllers, roughly

doc/usage.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -583,7 +583,7 @@ spec:
583583

584584
and apply it:
585585
```shell
586-
$ oc patch sub compliance-operator -nopenshift-compliance --patch-file co-memlimit-patch.yaml --type=merge
586+
$ oc patch sub compliance-operator -n openshift-compliance --patch-file co-memlimit-patch.yaml --type=merge
587587
```
588588

589589
Please note that this only sets the limit for the compliance-operator

tests/data/ocp4-unexistent-resource.xml

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2601,55 +2601,55 @@ configured to false.
26012601
<ocil:boolean_question id="ocil:ssg-controller_service_account_ca_question:question:1">
26022602
<ocil:question_text>To verify that root-ca-file is configured correctly,
26032603
run the following command:
2604-
$ oc get configmaps config -n openshift-kube-controller-manager -ojson | jq -r '.data["config.yaml"]' | jq -r '.extendedArguments["root-ca-file"]'
2604+
$ oc get configmaps config -n openshift-kube-controller-manager -o json | jq -r '.data["config.yaml"]' | jq -r '.extendedArguments["root-ca-file"]'
26052605
The output should return a configured certificate authority file.
26062606
Is it the case that &lt;tt&gt;root-ca-file&lt;/tt&gt; is not configured&lt;/tt&gt;?
26072607
</ocil:question_text>
26082608
</ocil:boolean_question>
26092609
<ocil:boolean_question id="ocil:ssg-controller_use_service_account_question:question:1">
26102610
<ocil:question_text>To verify that service-account-credentials is configured correctly,
26112611
run the following command:
2612-
$ oc get configmaps config -n openshift-kube-controller-manager -ojson | jq -r '.data["config.yaml"]' | jq -r '.extendedArguments["use-service-account-credentials"]'
2612+
$ oc get configmaps config -n openshift-kube-controller-manager -o json | jq -r '.data["config.yaml"]' | jq -r '.extendedArguments["use-service-account-credentials"]'
26132613
The value of use-service-account-credentials should be true.
26142614
Is it the case that &lt;tt&gt;use-service-account-credentials&lt;/tt&gt; is set to &lt;tt&gt;false&lt;/tt&gt;?
26152615
</ocil:question_text>
26162616
</ocil:boolean_question>
26172617
<ocil:boolean_question id="ocil:ssg-controller_secure_port_question:question:1">
26182618
<ocil:question_text>To verify that secure-port is configured correctly,
26192619
run the following command:
2620-
$ oc get configmaps config -n openshift-kube-controller-manager -ojson | jq -r '.data["config.yaml"]' | jq '.extendedArguments["secure-port"][]'
2620+
$ oc get configmaps config -n openshift-kube-controller-manager -o json | jq -r '.data["config.yaml"]' | jq '.extendedArguments["secure-port"][]'
26212621
Verify that it's using an appropriate port (the value is not 0).
26222622
Is it the case that &lt;tt&gt;secure-port&lt;/tt&gt; is not configured to use a secure port?
26232623
</ocil:question_text>
26242624
</ocil:boolean_question>
26252625
<ocil:boolean_question id="ocil:ssg-controller_service_account_private_key_question:question:1">
26262626
<ocil:question_text>To verify that service-account-private-key-file is configured correctly,
26272627
run the following command:
2628-
$ oc get configmaps config -n openshift-kube-controller-manager -ojson | jq -r '.data["config.yaml"]' | jq -r '.extendedArguments["service-account-private-key-file"]'
2628+
$ oc get configmaps config -n openshift-kube-controller-manager -o json | jq -r '.data["config.yaml"]' | jq -r '.extendedArguments["service-account-private-key-file"]'
26292629
The output should return a configured private key file.
26302630
Is it the case that &lt;tt&gt;service-account-private-key-file&lt;/tt&gt; does not exist or is configured properly?
26312631
</ocil:question_text>
26322632
</ocil:boolean_question>
26332633
<ocil:boolean_question id="ocil:ssg-controller_insecure_port_disabled_question:question:1">
26342634
<ocil:question_text>To verify that port is configured correctly,
26352635
run the following command:
2636-
$ oc get configmaps config -n openshift-kube-controller-manager -ojson | jq -r '.data["config.yaml"]' | jq '.extendedArguments["port"][]'
2636+
$ oc get configmaps config -n openshift-kube-controller-manager -o json | jq -r '.data["config.yaml"]' | jq '.extendedArguments["port"][]'
26372637
Verify that it's disabled (the value is 0).
26382638
Is it the case that &lt;tt&gt;port&lt;/tt&gt; is not disabled?
26392639
</ocil:question_text>
26402640
</ocil:boolean_question>
26412641
<ocil:boolean_question id="ocil:ssg-controller_terminated_pod_gc_threshhold_question:question:1">
26422642
<ocil:question_text>To verify that terminated-pod-gc-threshold is configured correctly,
26432643
run the following command:
2644-
$ oc get configmaps config -n openshift-kube-controller-manager -ojson | jq -r '.data["config.yaml"]' | jq -r '.extendedArguments["terminated-pod-gc-threshold"]'
2644+
$ oc get configmaps config -n openshift-kube-controller-manager -o json | jq -r '.data["config.yaml"]' | jq -r '.extendedArguments["terminated-pod-gc-threshold"]'
26452645
The returned value of terminated-pod-gc-threshold should be greater than zero.
26462646
Is it the case that &lt;tt&gt;terminated-pod-gc-threshold&lt;/tt&gt; is not enabled?
26472647
</ocil:question_text>
26482648
</ocil:boolean_question>
26492649
<ocil:boolean_question id="ocil:ssg-controller_rotate_kubelet_server_certs_question:question:1">
26502650
<ocil:question_text>To verify that RotateKubeletServerCertificate is configured correctly,
26512651
run the following command:
2652-
$ oc get configmaps config -n openshift-kube-controller-manager -ojson | jq -r '.data["config.yaml"]' | jq -r '.extendedArguments["feature-gates"]'
2652+
$ oc get configmaps config -n openshift-kube-controller-manager -o json | jq -r '.data["config.yaml"]' | jq -r '.extendedArguments["feature-gates"]'
26532653
The output should return RotateKubeletServerCertificate=true.
26542654
Is it the case that &lt;tt&gt;RotateKubeletServerCertificate&lt;/tt&gt; argument is set to &lt;tt&gt;false&lt;/tt&gt; in the
26552655
&lt;tt&gt;controllerArguments&lt;/tt&gt; options?

0 commit comments

Comments
 (0)