Skip to content

Commit 05b9aaf

Browse files
rjeberhardrjeberhard
authored
Update OpenShift documentation and certifications (#4138)
* Update OpenShift documentation and certifications
1 parent 7b03668 commit 05b9aaf

File tree

2 files changed

+45
-34
lines changed

2 files changed

+45
-34
lines changed

‎documentation/4.0/content/introduction/platforms/environments.md

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -166,10 +166,14 @@ See also the [Tanzu Kubernetes Grid sample]({{<relref "/samples/tanzu-kubernetes
166166

167167
OpenShift can be a cloud platform or can be deployed on premises.
168168

169-
- Operator 3.4.0+ is certified for use on OpenShift Container Platform 4.10.4+ with Kubernetes 1.23+.
170-
- Operator v3.4.4 is certified for use on:
169+
- Operator v3.4.6 is certified for use on:
171170
- OpenShift Container Platform 4.9.50 with Kubernetes 1.22, RedHat OpenShift Mesh 2.3, and Istio 1.14.
172-
- OpenShift Container Platform 4.11.0 with Kubernetes 1.24, RedHat OpenShift Mesh 2.3, and Istio 1.14.
171+
- OpenShift Container Platform 4.10.20 with Kubernetes 1.23, RedHat OpenShift Mesh 2.2.1, and Istio 1.14.
172+
- OpenShift Container Platform 4.11.6 with Kubernetes 1.24, RedHat OpenShift Mesh 2.2.3, and Istio 1.12.9.
173+
-
174+
- Operator v4.0.5 is certified for use on:
175+
- OpenShift Container Platform 4.11.30 with Kubernetes 1.24, RedHat OpenShift Mesh 2.3.2, and Istio 1.14.5.
176+
- OpenShift Container Platform 4.12.2 with Kubernetes 1.25, RedHat OpenShift Mesh 2.3.2, and Istio 1.14.5.
173177

174178
To accommodate OpenShift security requirements:
175179
- For security requirements to run WebLogic Server in OpenShift, see the [OpenShift]({{<relref "/security/openshift.md">}}) documentation.

‎documentation/4.0/content/security/openshift.md

Lines changed: 38 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,40 @@ weight: 7
55
description: "OpenShift information for the operator."
66
---
77

8+
#### Set the Helm chart property `kubernetesPlatform` to `OpenShift`
9+
10+
Beginning with operator version 3.3.2,
11+
set the operator `kubernetesPlatform` Helm chart property to `OpenShift`.
12+
This property accommodates OpenShift security requirements. Specifically, the operator's deployment and any pods created
13+
by the operator for WebLogic Server instances will not contain `runAsUser: 1000` in the configuration of the `securityContext`. This is to
14+
accommodate OpenShift's default `restricted` security context constraint.
15+
For more information, see [Operator Helm configuration values]({{<relref "/managing-operators/using-helm#operator-helm-configuration-values">}}).
16+
17+
#### Use a dedicated namespace
18+
19+
When the user that installs an individual instance of the operator
20+
does _not_ have the required privileges to create resources at the Kubernetes cluster level,
21+
they can use a `Dedicated` namespace selection strategy for the operator instance to limit
22+
it to managing domain resources in its local namespace only
23+
(see [Operator namespace management]({{< relref "/managing-operators/namespace-management#choose-a-domain-namespace-selection-strategy" >}})),
24+
and they may need to manually install the Domain Custom Resource (CRD)
25+
(see [Prepare for installation]({{< relref "/managing-operators/preparation/#how-to-manually-install-the-domain-resource-custom-resource-definition-crd" >}})).
26+
27+
#### With WIT, set the `target` parameter to `OpenShift`
28+
29+
When using the [WebLogic Image Tool](https://oracle.github.io/weblogic-image-tool/) (WIT),
30+
`create`, `rebase`, or `update` command, to create a
31+
[Domain in Image]({{< relref "/managing-domains/choosing-a-model/_index.md" >}}) domain home,
32+
[Model in Image]({{< relref "/managing-domains/choosing-a-model/_index.md" >}}) image,
33+
or [Model in Image]({{< relref "/managing-domains/choosing-a-model/_index.md" >}}) auxiliary image,
34+
you can specify the `--target` parameter for the target Kubernetes environment.
35+
Its value can be either `Default` or `OpenShift`.
36+
The `OpenShift` option changes the domain directory files such that the group permissions
37+
for those files will be the same as the user permissions (group writable, in most cases).
38+
If you do not supply the OS group and user setting with `--chown`,
39+
then the `Default` setting for this option is changed from `oracle:oracle` to `oracle:root`
40+
to be in line with the expectations of an OpenShift environment.
41+
842
#### Security requirements to run WebLogic in OpenShift
943

1044
WebLogic Kubernetes Operator images starting with version 3.1 and
@@ -50,6 +84,10 @@ than are needed, and is therefore less secure.
5084

5185
#### Create a custom Security Context Constraint
5286

87+
For most use cases, customers should use OpenShift's default `restricted` security context constraint. If you do need to
88+
create and use a custom security context constraint, this section describes the settings necessary to be compatible with
89+
the operator and pods for WebLogic Server instances.
90+
5391
To create a custom security context constraint, create a YAML file with the following
5492
content. This example assumes that your OpenShift project is called `weblogic` and
5593
that the service account you will use to run the operator and domains
@@ -113,34 +151,3 @@ For additional information about OpenShift requirements and the operator,
113151
see [OpenShift]({{<relref "/introduction/platforms/environments#openshift">}}).
114152
{{% /notice %}}
115153

116-
#### Use a dedicated namespace
117-
118-
When the user that installs an individual instance of the operator
119-
does _not_ have the required privileges to create resources at the Kubernetes cluster level,
120-
they can use a `Dedicated` namespace selection strategy for the operator instance to limit
121-
it to managing domain resources in its local namespace only
122-
(see [Operator namespace management]({{< relref "/managing-operators/namespace-management#choose-a-domain-namespace-selection-strategy" >}})),
123-
and they may need to manually install the Domain Custom Resource (CRD)
124-
(see [Prepare for installation]({{< relref "/managing-operators/preparation.md" >}})).
125-
126-
#### Set the Helm chart property `kubernetesPlatform` to `OpenShift`
127-
128-
Beginning with operator version 3.3.2,
129-
set the operator `kubernetesPlatform` Helm chart property to `OpenShift`.
130-
This property accommodates OpenShift security requirements.
131-
For more information, see [Operator Helm configuration values]({{<relref "/managing-operators/using-helm#operator-helm-configuration-values">}}).
132-
133-
#### With WIT, set the `target` parameter to `OpenShift`
134-
135-
When using the [WebLogic Image Tool](https://oracle.github.io/weblogic-image-tool/) (WIT),
136-
`create`, `rebase`, or `update` command, to create a
137-
[Domain in Image]({{< relref "/managing-domains/choosing-a-model/_index.md" >}}) domain home,
138-
[Model in Image]({{< relref "/managing-domains/choosing-a-model/_index.md" >}}) image,
139-
or [Model in Image]({{< relref "/managing-domains/choosing-a-model/_index.md" >}}) auxiliary image,
140-
you can specify the `--target` parameter for the target Kubernetes environment.
141-
Its value can be either `Default` or `OpenShift`.
142-
The `OpenShift` option changes the domain directory files such that the group permissions
143-
for those files will be the same as the user permissions (group writable, in most cases).
144-
If you do not supply the OS group and user setting with `--chown`,
145-
then the `Default` setting for this option is changed from `oracle:oracle` to `oracle:root`
146-
to be in line with the expectations of an OpenShift environment.

0 commit comments

Comments
 (0)