OpenShift 4.20+: Architecture Design Workshop Interactive

If the cluster goes through a forward proxy, the following destinations must be allowed (HTTPS/443 unless noted). Block any of these and the install or day-2 operations will fail silently or hang.

Copy# 1. Enable UWM in cluster-monitoring-config
oc -n openshift-monitoring edit configmap cluster-monitoring-config
# Add under data.config.yaml:
#   enableUserWorkload: true

# 2. Configure UWM retention and storage
oc -n openshift-user-workload-monitoring create configmap user-workload-monitoring-config
oc -n openshift-user-workload-monitoring edit configmap user-workload-monitoring-config
# Add under data.config.yaml:
#   prometheus:
#     retention: 15d
#     volumeClaimTemplate:
#       spec:
#         storageClassName: gp3-csi
#         resources:
#           requests:
#             storage: 50Gi

# 3. Verify UWM pods are running
oc get pods -n openshift-user-workload-monitoring

# 4. Create a ServiceMonitor for your app
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: my-app-monitor
  namespace: my-app
spec:
  selector:
    matchLabels:
      app: my-app
  endpoints:
    - port: metrics
      interval: 30s

Copy# Create the htpasswd file
htpasswd -c -B -b users.htpasswd admin 'CHANGE_ME'
htpasswd -B -b users.htpasswd emergency-admin 'CHANGE_ME'

# Create the secret in openshift-config
oc create secret generic htpasswd-secret \
  --from-file=htpasswd=users.htpasswd \
  -n openshift-config

# Patch the OAuth resource
oc edit oauth cluster
# Add under spec.identityProviders:
#   - name: htpasswd-local
#     type: HTPasswd
#     htpasswd:
#       fileData:
#         name: htpasswd-secret

# Grant cluster-admin to the admin user
oc adm policy add-cluster-role-to-user cluster-admin admin

Copy# Create a sync config file (ldap-sync.yaml):
kind: LDAPSyncConfig
apiVersion: v1
url: ldaps://ldap.example.com:636
bindDN: cn=ocp-svc,ou=ServiceAccounts,dc=example,dc=com
bindPassword:
  file: /etc/secrets/bindPassword
ca: /etc/ldap-ca/ca.crt
insecure: false
activeDirectory:
  usersQuery:
    baseDN: "dc=example,dc=com"
    scope: sub
    derefAliases: never
    filter: (objectClass=person)
    pageSize: 0
  userNameAttributes: [ sAMAccountName ]
  groupMembershipAttributes: [ memberOf ]

# Run the sync
oc adm groups sync --sync-config=ldap-sync.yaml --confirm

# Bind a synced group to a cluster role
oc adm policy add-cluster-role-to-group cluster-admin ocp-admins

Copy# Create the client secret in openshift-config
oc create secret generic oidc-client-secret \
  --from-literal=clientSecret='CHANGE_ME' \
  -n openshift-config

# Patch the OAuth resource
oc edit oauth cluster
# Add under spec.identityProviders:
#   - name: entra-id
#     mappingMethod: claim
#     type: OpenID
#     openID:
#       clientID: ocp-cluster-prod
#       clientSecret:
#         name: oidc-client-secret
#       issuer: https://login.microsoftonline.com/<tenant-id>/v2.0
#       claims:
#         preferredUsername: [ preferred_username ]
#         name: [ name ]
#         email: [ email ]
#         groups: [ groups ]
#       extraScopes: [ email, profile ]

Copy# 1. Create the TLS secret in openshift-ingress namespace
oc create secret tls apps-tls-cert \
  --cert=wildcard-apps.crt \
  --key=wildcard-apps.key \
  -n openshift-ingress

# Note: wildcard-apps.crt must contain the full chain:
#   - Server certificate (*.apps.ocp.example.com)
#   - Intermediate CA(s)
#   - (Optional) Root CA

# 2. Patch the IngressController to use the new certificate
oc patch ingresscontroller default \
  -n openshift-ingress-operator \
  --type=merge \
  -p '{"spec":{"defaultCertificate":{"name":"apps-tls-cert"}}}'

# 3. Verify — the router pods will restart automatically
oc get pods -n openshift-ingress -w

# 4. Test with curl
curl -v https://console-openshift-console.apps.ocp.example.com 2>&1 | grep issuer

Copy# 1. Create the TLS secret in openshift-config namespace
oc create secret tls api-tls-cert \
  --cert=api-server.crt \
  --key=api-server.key \
  -n openshift-config

# Note: The certificate SAN must include:
#   - api.<cluster>.<base>  (e.g., api.ocp.example.com)
# The cert file should include the full chain (server + intermediates)

# 2. Patch the APIServer resource
oc patch apiserver cluster \
  --type=merge \
  -p '{"spec":{"servingCerts":{"namedCertificates":[{"names":["api.ocp.example.com"],"servingCertificate":{"name":"api-tls-cert"}}]}}}'

# 3. Monitor the kube-apiserver rollout (takes several minutes)
oc get co kube-apiserver -w

# 4. Verify
oc login https://api.ocp.example.com:6443 -u kubeadmin
# Should connect without TLS warnings if CA is trusted

Copy# 1. Create a ConfigMap with the CA bundle in openshift-config
oc create configmap user-ca-bundle \
  --from-file=ca-bundle.crt=corp-root-ca.pem \
  -n openshift-config

# Note: ca-bundle.crt can contain multiple PEM certificates concatenated

# 2. Patch the proxy/cluster resource to use the custom CA
oc patch proxy/cluster \
  --type=merge \
  -p '{"spec":{"trustedCA":{"name":"user-ca-bundle"}}}'

# This injects the CA into:
#   - All pods via the trusted-ca-bundle ConfigMap (if they opt in via label)
#   - Machine Config for node-level trust (RHCOS trust store)
#   - Proxy-aware components (image pulls, egress)

# 3. Verify the CA is distributed
oc get configmap trusted-ca-bundle -n openshift-config-managed -o yaml | head -20