It lists all the supported APIs and their corresponding resource

types.
To get an overview of your project status, -> OC status
The output provides a concise summary of the current state of
your project.
OC help
You will get a comprehensive list of available commands
grouped by category.
To get an overview of another project status, followed by the
name of the project you are interested in.->OC status -n
For example, if you want detailed info about usage and options
openShift-console
for the create command, you can type
Oc create—help
If you are a cluster administrator and you want to display the
status for all namespaces, you can ad>OC status -A
This command is used for advanced cluster management
tasks to see the available subcommands for tasks
like upgrading the cluster.
Oc new-app->When it comes to deploying applications, the Managing nodes, configuring security policies, and performing
OC new app command is your go to. maintenance operations.::oc arm -h
This command allows you to create a new application by
specifying the source code location, such as
a git repository, local code on your machine, or even using
templates or Docker images

The OC git command is incredibly useful for viewing various

aspects of your cluster. Managing Kubernetes Resources in OpenShift
For example.
OC get pods -o wide:Retrieves information about the pods ! Overview
running in your project with the minus O wide flag providing As an OpenShift administrator, you must manage the lifecycle of resources — importing,
additional exporting, and configuring Kubernetes objects such as Deployments, Services, ConfigMaps,
details. and Secrets.

The OC logs command allows you to view the logs of a

specific pod or deployment, for instance. " Importing Resources
Oc log deployment/first-app:retrieves the first app's
Purpose:
deployment logs. Bring existing Kubernetes manifests (YAML or JSON) into your OpenShift cluster.
Oc new-
Command:
oc apply -f <directory_or_file_path>
Oc ap-resources :If you need to explore the available API
resources in your cluster, the OC API resources command oc apply -f ./test

comes Details:
in handy.
• Creates or updates resources defined in the manifests.
• Works on a single file or an entire directory.
Example: Note:
oc apply -f ./manifests/ If the resource was originally created using oc new-app, you may see a warning when
applying changes.

Check Results:
For im[portingindividual resorce files by specifying the file path instead of a
oc get pods — verify replicas and pod states.
directory.
If we do the OC get pods command, we can see that we have two pod replicas
Oc apply -f ./test/service_account.yaml instead of one.

# Exporting Resources ⚖ Declarative vs Imperative Commands

Purpose:
Approach Commands Style Description
Backup, duplicate, or share resource configurations.
Declarative oc apply -f
Desired Define what you want; OpenShift
Command: (Preferred) state figures out how to achieve it.
oc get <resource_type> <resource_name> -o yaml > [Link] oc create, oc delete, oc Step-by- You explicitly tell OpenShift
Imperative
patch, oc replace, oc edit step what to do.
Examples:
Declarative (oc apply)
This command retrieves the definition of the first app deployment and saves it to a
file named my [Link].
• Checks if the resource exists:
o If not → creates it.
• oc get deployment first-app -o yaml > [Link]
o If yes → updates only what changed.
• you can export other types of resources such as services, config maps, or
• Ideal for Infrastructure as Code (IaC) workflows.
secrets by replacing
• Great for GitOps and version control.
• oc get svc,cm,secret -o yaml

Extracting Secrets/ConfigMaps: Imperative Commands

• First list secrets: oc get secrets • Execute direct actions manually.

• oc extract secret/<secret_name> • Useful for quick, one-off operations or troubleshooting.
• Then extract: oc extract secret/<secret_name> --to=./
o You can also specify a target directory (e.g. /tmp/). Immutable Fields
• You can extract the file and send it to another location by appending the path after
tmp. If certain properties cannot be changed, OpenShift shows a warning.
• To force the update (⚠ use cautiously):
o oc apply --force -f [Link]

⚙ Modifying Resource Configurations & Commonly Used oc Subcommands

Steps: Command Description

oc get List or view resources in cluster
nano [Link] oc describe Detailed info about a resource
oc create Create from a file or stdin new resources from yaml json maifest
1. Export the YAML file.
2. Open it in a text editor. oc apply Create or update declaratively
3. Change fields (replica count:2, environment variables, hanging service port oc delete Remove a resource from clustedr
mappings. oc edit Edit resources interactively in terminal
4. save oc logs View container logs
5. Apply updated configuration: oc exec Run a command inside a container
oc apply -f [Link]
Help Command:
oc -h
! 5. Default Image Streams

• When OpenShift is installed, it automatically creates Red Hat–provided image

' Summary streams.
• These are available in the openshift project (default global project).
✅ Import: oc apply -f <file_or_dir> • All users have view access to this project.
✅ Export: oc get <type> -o yaml > [Link]
✅ Extract secrets/config maps: oc extract <resource>
✅ Modify configs: Edit YAML → oc apply -f
! 6. Key Commands
✅ Prefer declarative (oc apply) for consistency and automation.
✅ Use imperative commands for direct or quick actions.
Purpose Command Description
List all image oc get imagestreams -n Lists available image streams in the
streams openshift openshift project.
Describe a specific oc describe is imagestream Shows details like labels, annotations,
image stream <name> -n openshift repository, tags, and image IDs.
( Locating and Examining Container Images in Get details of a oc describe image Displays metadata — image ID, size,
OpenShift specific image <image_id> creation time, ports, env vars, etc.
Downloads and extracts image
Extract image oc image extract <image> -
! 1. Importance contents -path /:/local/dir contents to your local system for
inspection.
• As an OpenShift administrator, it’s crucial to know how to find and inspect
container images running in the cluster.
• Helps in managing and troubleshooting applications. ! 7. Inspecting Images

• oc describe provides:
o Docker image ID
! 2. What is a Container Image? o Image size
o Creation date
• Defines the application code, dependencies, and runtime environment. o Exposed ports
• Every pod is created from one or more container images. o Environment variables
o Repository source
• oc image extract:
o Extracts file system of the image.
! 3. Kubernetes and Image Management o You can explore configuration files, binaries, and app code locally.
• Another way to examine a container image is to use the OC image Extract
• Kubernetes itself doesn’t manage container images directly. command to download the image
• It relies on Docker registries or other external registries to store and distribute • contents to your local file system.
images. • Running the OC image extract command will extract the file system contents
of the specified image and
• send them to the target on your local machine once the extraction is
complete.
! 4. OpenShift Image Streams • Navigate to that directory and explore the images file system.
• Look for configuration files, application code, and other relevant artifacts to
understand how the
• OpenShift uses Image Streams instead of raw images.
• image is structured and what it contains.
• An Image Stream is:
• By combining these techniques, such as listing image streams, describing
o A sequence of pointers to one or more container images.
image and image stream details,
o Acts as an abstraction layer for easier image management.
• and extracting image contents for further inspection.
o Can be linked to deployments for automatic updates.
• Images can come from: • You can comprehensively understand the container images deployed in your
o Internal registry (built into OpenShift)
OpenShift cluster.
o External registries (e.g., [Link], Docker Hub)
• That concludes our lecture on locating and examining container images in
OpenShift.
 • Please explore the container images in your cluster and apply the techniques ! 3. Creating a Project (CLI Method)
covered in this demo.
Step 1: Login to Cluster
o ✅oc login -u developer -p <password> [Link]
Step 2: Create a New Project
✅
oc new-project my-demo-project
! 8. Summary
• Creates a new project named my-demo-project.
• Use image streams for efficient image management in OpenShift. • Automatically switches the CLI context to the new project.
• Commands like oc get, oc describe, and oc image extract help in:
o Listing, ✅ Step 3: Verify the Project
o Inspecting, and oc projects
o Exploring container images.
• Combining these techniques gives a comprehensive view of how images are used • Lists all projects available to the logged-in user.
and structured in your OpenShift cluster. • The new project should appear in the list.

! 9. Next Steps ! 4. Deploying an Application

✅ Step 1: Create a Simple App
• Practice the commands in your own OpenShift environment. oc new-app -–name=my-app –-image-openshift/hello-openshift
• Explore different image streams in the openshift project.
• Next topic: Creating and Deleting Projects in OpenShift. • Deploys a simple "Hello OpenShift" application using the provided image.
✅
Step 2: Check Deployment Status
oc get pods

Notes: Projects in OpenShift

• Shows pod status (e.g., Running, Pending, etc.).
• Wait until the application pod is in the Running state.
! 1. What is a Project in OpenShift?

• A project in OpenShift is a logical unit that organizes and isolates resources within a
!
✅ 5. Viewing Project Resources
cluster.
• Each project contains: Get an Overview of All Resources
o Deployments oc get all
o Pods
o Services • Displays all resources in the current project (deployments, pods, services, etc.).
o Routes ✅
o ConfigMaps, etc. Describe Project Details
• Projects also enable access control, defining who can access and manage specific oc describe project my-demo-project
resources.
• Provides detailed information including:
o Metadata (labels, annotations)
o Resource quotas and limits
! 2. Purpose of Projects o Events and usage stats

• Isolation: Keeps different applications and teams separated.

• Organization: Groups related resources under one logical unit.
• Access Control: Determines user permissions within the project. ! 6. Deleting a Project (CLI Method)
• Resource Management: Supports quotas and limits per project. oc delete project my-demo-project

• Deletes the project and all associated resources.

• To confirm deletion:

oc projects
 • The deleted project will no longer appear. Action Command
Deploy app oc new-app openshift/hello-openshift --name=myapp
# Note:
View resources oc get all
After deletion, the message
Describe project oc describe project my-demo-project
“You are not a member of any projects.” Delete project oc delete project my-demo-project
appears — this is normal for a developer user (not a cluster admin).

! 7. Creating a Project (Web Console Method)

✅ Steps:
1. Log in to the OpenShift Web Console as developer.
2. Click Add (top-left corner).
! Notes: Examining Resources and Cluster Status in OpenShift
3. Select Projects.
4. Click Create Project.
5. Enter: ! 1. Importance
o Project Name → my-demo-project
o Optional: Display Name & Description • As an OpenShift administrator or developer, understanding your cluster resources
6. Click Create. and overall health is essential.
• Helps in monitoring performance, troubleshooting issues, and managing
✅ The new project appears in the Developer View. workloads efficiently.

! 8. Deleting a Project (Web Console Method) ! 2. Basic Resource Examination

Crc console --credentials
1. Go to the Project View.
✅
Login
2. Click the Actions (⋮) dropdown → choose Delete Project. oc login -u kubeadmin -p <password> [Link]
3. Confirm deletion by typing the project name. ✅
4. Click Delete. Common Commands
Purpose Command Description
⚠ Caution: Lists deployments in the current
Deleting a project removes all its resources permanently. List deployments oc get deployments
project.
oc get pods -n
List pods in <namespace>(openshift-
Views pods in a specified
another namespace apiserver) namespace.
! 9. Key Takeaways List pods from all oc get pods --all-namespaces Displays pods across the entire
namespaces cluster.
• Projects are fundamental for: Shows detailed info about a
o Organizing workloads Describe a oc describe <resource> <name> resource. Inspect abt the state
o Managing access control resource
and detail
o Isolating environments
• You can create, inspect, and delete projects via both the CLI and Web Console.
• Deleting a project cleans up all resources within it. $ Use oc get and oc describe for any resource type (e.g., pods, services, routes,
• Monitoring may be limited in local clusters (like CRC/OpenShift Local). deployments, etc.).

✅
! 10. Summary of Common Commands ! 3. Checking Cluster Status
Action Command Cluster Overview
oc status
Login to cluster oc login -u developer
Create project oc new-project my-demo-project • Gives a summary of:
List projects oc projects o Current project
 o Services and deployments
o Recent events or warnings
! 6. Monitoring via Web Console
Access the Dashboard
✅
! 4. Node and Control Plane Health
1. Log in as kubeadmin.
✅ List All Nodes 2. Go to Home → Overview.
oc get nodes 3. Dashboard sections include:

• Displays: Section Description

o Node names
Cluster Details Shows cluster ID, provider, OpenShift version.
o Status (Ready, NotReady)
o Roles (master/worker)
Cluster Inventory Counts of nodes, pods, storage classes, and PVCs.
o Age and version Cluster Status Shows health of control plane and operators.
Cluster Utilization Graphs for CPU, memory, and storage trends (requires Prometheus).
✅ Check Control Plane Components Activity Feed Lists recent events, alerts, and cluster changes.
oc get componentstatuses
# In OpenShift Local, advanced monitoring (Prometheus dashboards) may be unavailable.
• Shows health of:
o Scheduler
o etcd
o Controller Manager ! 7. Good Practices
• Status indicates whether each component is healthy or facing issues.
• Check cluster health regularly using oc status and dashboard overview.
• Monitor resource utilization with oc adm top commands.
! 5. The oc adm Command (Administrator Toolkit) • Investigate alerts and degraded operators immediately.
% • Use labels and namespaces to filter specific workloads for easier management.
Purpose

• Used for cluster-wide administration and performance monitoring.

• Acts as the "Swiss Army knife" for OpenShift administrators. ! 8. Key Commands Summary
• With OC ADM you can manage nodes, control, access and gather important
Command Purpose
insights about your clusters
• resource utilization.
oc get <resource> Lists resources
• The OC ADM top nodes command is handy when you want to monitor the oc describe <resource> <name> Detailed view of a resource
resource consumption of your cluster oc status Overview of current project
• nodes. oc get nodes View node list and status
•
✅ oc get componentstatuses Check control plane health
Examples
oc adm top nodes View node resource usage
oc adm top pods View pod resource usage
Task Command Description
Show node oc adm top nodes
Displays CPU & memory
resource usage usage of each node. ! 9. Summary
Sort nodes by oc adm top nodes --sort-by=cpu
Helps identify high CPU-
CPU usage consuming nodes. • oc get and oc describe → Examine resources.
Show pod Displays CPU & memory • oc status → Check project overview.
oc adm top pods
resource usage usage per pod. • oc get nodes / oc get componentstatuses → Check cluster health.
Pod usage by oc adm top pods - Limits view to a specific • oc adm top → Monitor resource utilization.
namespace namespace=<namespace>(my-namespace) namespace. • Web Console → Visual monitoring and insights.
• Regular monitoring ensures cluster stability and proactive issue resolution.
You can also use labels to filter the pods you want to see.:oca dm top pods –l
app=app-name

# Note: On OpenShift Local (CRC), monitoring operators are not installed, so metrics may
not appear.
 oc logs -f <pod_name>

# Show only the last 10 lines

! Lesson Notes: Viewing and Analyzing Logs in oc logs -f pod/<pod_name> --tail=10 (oc logs -f pod my-pod--tail=10)

OpenShift $ Viewing Node-Level Logs

! Administrator Command
" Introduction oc adm node-logs <node_name>
This command requires administrator level cluster permissions and will return logs
• Logs are essential for troubleshooting, monitoring, and understanding what’s from the system services
happening inside your OpenShift cluster. running on your nodes.
• They help diagnose issues like crash loops, failed deployments, or permission
errors.
• You’ll use both the CLI (oc logs) and the Web Console to access and analyze logs. • Requires cluster-admin privileges.
• Used to fetch logs from node-level system services (e.g., kubelet, cri-o).

Examples:
# Viewing Logs from the CLI
# Logs from master nodes
! The oc logs Command oc adm node-logs –role master

# Only kubelet logs

• The main command for retrieving logs of pods, builds, or deployments. oc adm node-logs –role master -u kubelet
• Syntax help:
• oc logs -h
% Using oc describe for Event & Log Context
Displays available options and usage examples. oc describe pod/<pod_name>

• Shows detailed information about the pod:

o Events (start, restart, errors)
" Streaming Logs in Real Time o State transitions
oc logs -f <resource_name> o Container names and statuses

• The -f (follow) flag streams logs live as they’re generated. Useful Tip:
• Commonly used for watching builds and deployments in progress. Find container names here if a pod has multiple containers — you can then target container-
specific logs:
Examples:
oc logs -f <pod_name> -c <container_name>
# Follow logs for the most recent build
oc logs -f bc/<buildconfig_name>

# Follow logs for the latest deployment & ! Practical Example: Troubleshooting NGINX Deployment
oc logs -f deployment/<deployment-name>
Scenario:

" Viewing Specific Versions • Deploying an NGINX app requiring root privileges.
• OpenShift runs containers as non-root users by default (security best practice).
If you want logs from a specific version, specify the version number:
Steps:
# For a specific deployment version
oc logs -deployment/<deployment-name> -version=<version-number>
1. Login as developer user.
# For a specific build version
oc logs bc/<build-configname> --version=< version-number> 2. Create project:
3. oc new-project log-demo
For example, if you want to see the logs of the first deployment, you would use version equals one. 4. Deploy app:
5. oc new-app –-name=log-demo -–docker-image=nginx
6. Check pod status:
" Viewing Pod Logs 7. oc get pods

# Stream a specific pod’s logs

 Pod shows status: CrashLoopBackOff → container is failing to start. Command Purpose Notes
oc adm node-logs Node/system logs Admin-only
8. Inspect logs:
9. oc logs -f <pod_name> Events & detailed
oc describe <resource> Great for finding container names
10. oc logs -f <pod_name> -c log-demo info
11. Filter, switch containers, or
12. Output shows permission denied errors — container can’t write to Web Console → Pods → Logs GUI log viewing
system directories. download logs
13. Confirm with describe:
14. oc describe pod/<pod_name>
* Closing Notes
Identify container name (e.g., log-demo) and review details.
• Logs are your best friend for debugging and learning what’s really happening inside
15. Root Cause: OpenShift.
o NGINX is attempting to perform privileged operations. • Think of them as a treasure map pointing you to the root cause of issues.
o Container is non-root → permission issues. • By mastering oc logs, oc describe, and oc adm node-logs, you’ll be fully
16. Solution: equipped for both real-world troubleshootingand the exam.
o Modify deployment configuration to allow appropriate privileges, or
o Use a base image that doesn’t require root access.

' Viewing Logs in the Web Console ) Lecture Notes: Assessing the Health of an OpenShift Cluster
! Steps: # Objective

1. Log into OpenShift Web Console as developer. Learn how to assess and monitor the health of an OpenShift cluster using CLI tools and built-
2. Navigate to your project (e.g., log-demo). in components like nodes, etcd, and operators.
3. Go to Project → Pods.
4. Click on the desired pod → open Logs tab.

Features: $ 1. Cluster Health Overview

• View logs per container (switch using dropdown). As an OpenShift Administrator, maintaining cluster health ensures:
• Filter or search logs.
• Download logs for offline analysis. • Application reliability
• Smooth resource utilization
• Early detection of issues

( Key Takeaways Key Components:

✅ Use oc logs for real-time or historical logs of builds, pods, or deployments. • Nodes
✅ Use oc adm node-logs for node-level diagnostics (admins only). • etcd (data store)
• Operators
✅ Use oc describe to view events, resource details, and container names.
• Version Compatibility
✅ The Web Console provides an easy graphical way to view and download logs.
✅ Always check logs when a pod enters CrashLoopBackOff or Error states.
✅ Logs are your first stop for troubleshooting and exam scenarios.
⚙ 2. Node Health

Nodes are the backbone of your OpenShift cluster.

) Summary Table & run the containers and provide CPU, memory, and network resources.
They
Command Purpose Notes
Commands:
oc logs -f <pod> Stream pod logs live Use --tail to limit lines
oc logs -f bc/<buildconfig> Stream build logs Follows latest build 1. List all nodes:
oc logs -f Stream deployment 2. oc get nodes
dc/<deploymentconfig> Tracks rollout progress o Displays all nodes and their status.
logs
 o ✅ Ready = healthy, ❌ NotReady = issue to investigate. o Available=True ✅ means healthy.
3. Check resource usage (CPU/Memory): o Progressing=True ⏳ = update in progress.
4. oc adm top nodes
o Degraded=True ⚠ = issue detected.
o Shows real-time node metrics.
3. Inspect degraded operatorLwe can use oc log)
o Requires metrics-server to be running. 4. oc describe clusteroperator <operator-name>
5. Inspect specific node details: 5. oc logs -n <operator-namespace> <operator-pod>
6. oc describe node <node-name> o Check for related error messages.
o Shows:
§ Allocated resources
§ Conditions
§ Recent events ( 5. Version Checks
§ Non-terminated pods
Ensure client and server versions are compatible.
( Tip: Use this command often to diagnose node-level issues.
1. Check cluster version:
2. oc describe clusterversion
3. Check OpenShift and Kubernetes versions:
& 3. etcd Health 4. oc version
o Confirms if client and server versions match.
• etcd = Central database of OpenShift.
• Stores configuration, secrets, and cluster state.
• Any etcd issue → affects the entire cluster.
) 6. Demo Steps
& Step 1: List Node Status
Commands:oc woami
Kubeadmin oc get nodes
Step 2: Monitor Node Resources
oc get pods -n openshift-etcd. :first we get the podname oc adm top nodes
oc -n openshift-etcd rsh etcd-crc : then we rsh to the pod: This command
Step 3: Inspect a Node
allows you to connect to an etcd pod and check the health of the etcd cluster. oc describe node <node-name>

1. Check etcd health: Step 4: Check etcd Health

2. oc rsh -n openshift-etcd <etcd-pod-name> etcdctl endpoint health -- oc get pods -n openshift-etcd
cluster oc rsh -n openshift-etcd <etcd-pod> etcdctl endpoint health --cluster
o Shows health of each etcd member. Quick overview Step 5: Examine etcd Logs
3. View etcd logs: oc logs -n openshift-etcd <etcd-pod>
4. oc logs -n openshift-etcd etcd-crc
Step 6: Check Operators
o Look for warnings or errors indicating latency or connectivity issues.
oc get clusteroperators

( Tip: Step 7: Verify Versions

oc version
Set up alerts for etcd latency, disk I/O, or network delay. oc describe clusterversion

It's important to establish a baseline for etcd performance, and set up alerts to notify
you of any $ 7. Summary
deviations or anomalies.
Component Command Purpose
Nodes oc get nodes Check node status
Nodes oc adm top nodes Monitor CPU/memory usage
etcd oc rsh … etcdctl endpoint health Check etcd health

' 4. Operators Health Operators oc get clusteroperators Monitor operator status

Version oc version Verify client-server compatibility
Operators manage the lifecycle of OpenShift components and ensure everything stays in the
& state.
desired
✅ Key Takeaways
Commands:
• Regularly check node, etcd, and operator health.
1. Check operator status: • Use logs and metrics to identify early issues.
2. oc get clusteroperators • Always ensure version compatibility.
 • Healthy cluster = reliable application performance. o Failed to pull image
o CrashLoopBackOff

Back-off restarting container Pay attention to the exit codes and error messages to
identify the root cause of the issue.
For example, an event like failed to pull image indicates that the container image specified in
the
pod configuration could not be retrieved from the registry.

) Lecture Notes: Troubleshooting Common Container, Pod, and o

5. If image pull fails:
Cluster Events & Alerts in OpenShift o Verify image name, tag, and registry access.

# Objective

Learn to identify, analyze, and troubleshoot common container, pod, and cluster-level issues + Issue 2: Exceeding Resource Limits
in OpenShift using logs, events, and commands.
• If CPU/memory limits are exceeded, container may throttle or terminate.

Check resource usage:

⚙ 1. Understanding Events and Alerts
oc adm top pod
• OpenShift automatically generates events and alerts to indicate:
o Problems (failures, crashes) Solution:
o State changes (Pending, Terminating)
o Resource constraints • Increase limits in Deployment or Pod spec:
• These help administrators detect and fix issues before they affect workloads. • resources:
• requests:
• memory: "256Mi"
• cpu: "250m"
! 2. Troubleshooting Common Container Issues • limits:
• memory: "512Mi"
+ Issue 1: Container Crash / Failure to Start • cpu: "500m"

Possible causes:
, 3. Troubleshooting Pod Issues
• Application misconfiguration + Issue 1: Pod Stuck in Pending State
• Missing dependencies
• Resource limits
Possible causes:
• When a container crashes, your first instinct should be to examine the
container logs.
• Insufficient node resources
• You can do this by using the OC logs command followed by the pod and
• Taints/tolerations mismatch
container names.
• NodeSelector or affinity mismatch
•

Commands:
Troubleshooting steps:
oc describe pod <pod-name>
1. Check logs:
2. oc logs <pod-name> -c <container-name>
Check Events for:
→ Reveals application errors or missing files. • "0/1 nodes are available: insufficient CPU."
• "node(s) didn’t match node selector"
3. Describe pod for events:
4. oc describe pod <pod-name>
Solutions:
→ Check Events section for messages like:
• Adjust resource requests.
 • Add more nodes. Commands:
• Fix nodeSelector or taint mismatch.
For example, you can use etcd CTL endpoint health to check the health of etcd
members and identify
any problematic nodes.
+ Issue 2: Pod Evicted or Terminated Repeatedly

Causes:
can use the etcd CTL command line tool.
• Node resource pressure
• Node failure 1. List etcd pods:
2. oc get pods -n openshift-etcd
Check events: 3. Check health:
4. oc rsh -n openshift-etcd <etcd-pod> etcdctl endpoint health --cluster
oc get events --field-selector 5. View logs:
[Link]=Pod,[Link]=<pod-name> 6. oc logs -n openshift-etcd <etcd-pod>

Look for: ( Tip: Monitor etcd metrics and set alerts for latency spikes.

• Evicted
• NodeLost
, b) Network Connectivity Issues
Fix:
Symptoms:
• Add cluster resources.
• Investigate node health. • Pods can't communicate with each other or external services.

Possible causes:
+ Issue 3: Pod Stuck in Terminating State • Misconfigured network policies
• Firewall restrictions
Causes: • Network plugin failure

• Network disconnection Steps:

• Container runtime issues
1. Inspect Pod Network Details:
Solution: 2. oc describe pod <pod-name> } Look for any error messages or indications of network
Force delete (use cautiously): related problems.
3. Check connectivity between pods:
oc delete pod <pod-name> --grace-period=0 --force 4. oc exec -it <pod-1> -- ping <pod-2-IP>
5. Additionally, you can use network diagnostic tools like ping, traceroute or
( Note: Always investigate root cause before force deletion. telnet to test connectivity
6. between pods or external endpoints. : oc exec my-pod –ping another-pod
7.
8. Use tools like:
) 4. Troubleshooting Cluster-Level Issues o
o
traceroute
telnet
o curl
$ a) etcd Issues 9. Verify network policies:
10. oc get networkpolicy -A
• etcd stores all cluster configuration and state data.
• Problems can cause cluster instability.
- 5. Demo: Troubleshooting Pod Scheduling (NodeSelector Example)
Common issues:
- Scenario
• High latency
• Disk I/O bottlenecks A new app is created with a nodeSelector condition, but no node matches it → Pod remains
• Network problems in Pending state.
 Issue Type Useful Commands Fix
' Demo Steps Network issues oc exec ping, oc describe Fix network policies

Oc get pods
we'll create a new application using the OC new app command and specify a node ✅ Summary
selector
condition that requires the label node name equals CRC. • Use logs + describe + events for root-cause diagnosis.
• Monitor nodes, etcd, and network continuously.
• Understand pod lifecycle to troubleshoot effectively.
1. Create an application with node selector: • Practice real scenarios like Pending, CrashLoopBackOff, Evicted, and
2. oc run nginx –-image=bitnami/nginx -–overrides=’{“spec”: {“nodeSelector”: Terminating pods.
{“nodename”: crc”}}}’
3. oc new-app nginx --dry-run=client -o yaml > [Link]
The commands "oc get nodes", "oc adm top nodes", and "oc describe node" are all
useful for assessing the health of nodes in an OpenShift cluster. "oc get nodes"
Add in [Link]:
provides a general overview of node status, "oc adm top nodes" shows resource
spec:
usage, and "oc describe node" gives detailed information about a specific node.
template: The oc whoami --show-console command provides the URL directly, while "oc get
spec: routes -n openshift-console" lists the routes in the openshift-console namespace,
nodeSelector: which includes the route for accessing the web console.
nodeName: CRC

Then apply:

oc apply -f [Link]
) Lecture Notes: Using Product Documentation in
4. Check pod status:
5. oc get pods OpenShift
→ Pod shows Pending. " Objective

6. Describe pod for details: Learn how to effectively access, navigate, and utilize OpenShift product documentation to
7. oc describe pod <pod-name>
understand features, troubleshoot issues, and stay updated with new releases.
Event Output:

0/1 nodes are available: node(s) didn’t match node selector.

( 1. Importance of Documentation
8. Label the node: Let's add the node name equals CRC label to our node to
resolve this. As an OpenShift administrator, the official product documentation is your go-to guide for:
9. oc label node crc nodeName=crc
10. Check pod again:
11. oc get pods • Understanding platform features
• Learning installation, configuration, and management
→ Pod now shows Running ✅ • Troubleshooting issues
• Exploring best practices and new capabilities
Oc describe pod nginx
% The documentation is continuously updated with every new release.

$ Lesson Takeaways
Issue Type Useful Commands Fix * 2. Accessing the Official Documentation
Container crash oc logs, oc describe pod Check logs, fix image/config
Primary Source:
Resource limit oc adm top pods Adjust limits
* [Link]
Pod pending oc describe pod Fix selector / resources
Pod evicted oc get events Add resources, check node • Central hub for Red Hat OpenShift Container Platform docs
etcd issues etcdctl endpoint health Monitor health, logs • Contains:
 o Installation guides o Import existing codebase
o Configuration steps o Deploy from container image
o Administration procedures
o Developer workflows Example Topics Covered:
o Release notes
• YAML examples for configurations
Steps to Access: • Customizing sample manifests
• Environment variable setup
1. Visit [Link] • Common troubleshooting tips
2. Select your OpenShift version from the dropdown (OCP section)
3. Browse through the structured sidebar for relevant topics , Tip: Note down best practices and recommendations for smoother deployments.

+ 3. Navigating the Documentation Structure , 5. Command Line Documentation Access

# Main Sections OpenShift CLI (oc) provides inline help and documentation for quick reference.

Section Description Command Purpose Example

Getting Started Introductory guide for new users oc help
Displays general or subcommand oc help get
Architecture Explains core OpenShift components help
Installation Step-by-step platform setup oc <command> -h
Shows usage and flags for a oc new-app -h
command
Post-installation Configuration Cluster customization, access control
oc explain Explains fields and specs of a oc explain
Application Management Creating and deploying applications <resource> resource [Link]
Operators Managing lifecycle of services
oc version
Displays OC client and cluster oc version
Networking & Storage Connectivity and persistent data handling version
Monitoring & Logging Observing cluster performance and logs
Security RBAC, authentication, and compliance % These are extremely useful when scripting or working without browser access.
Backup & Restore Disaster recovery and data protection

⚙ 4. Example: Creating and Deploying an Application - 6. Best Practices When Using Documentation

$ Step 1: Create a New Project • Bookmark frequently used sections (installation, networking, security)
• Cross-check version-specific changes before applying commands
• Use examples and YAML snippets as templates
• Go to the Developer Activities section • Read release notes for feature updates and deprecations
• Locate Work with Projects → Open it in a new tab • Leverage search to quickly find command references
• Follow the guide to:
• Combine CLI help + official docs for complete understanding
o Create a new project (Web Console or CLI)
o Set access permissions
o View or delete projects

+ Each step includes screenshots and detailed explanations. ( 7. Summary

Key Area Description
Access Docs [Link]
% Step 2: Deploy a New Application
Navigation Choose version → explore categories
CLI Support Use oc help, oc explain, and oc version
• From Developer Activities, open Creating Applications using Developer
Perspective Hands-on Follow step-by-step examples and YAML snippets
• Explore multiple deployment options: Continuous Learning Check documentation regularly for updates
o Quickstarts
✅ Takeaway
. Step 1: Create an HTPassword File
The OpenShift Product Documentation is your essential guide for:

• Learning new concepts Command Syntax:

• Troubleshooting efficiently
htpasswd -c -B -b <filename> <username> <password>
• Ensuring cluster consistency across updates
• Following best practices for stability and security
Flags:
- Always refer to official documentation and in-terminal help before applying • -c → Create a new file
configurations or troubleshooting commands. • -B → Use bcrypt encryption
• -b → Provide password directly on CLI

Example:

htpasswd -c -B -b [Link] alice password123

Add more users (without -c):

htpasswd -B -b [Link] bob pass123

htpasswd -B -b [Link] charlie pass123
htpasswd -B -b [Link] ted pass123

View file:

cat [Link]

/ Step 2: Configure OAuth using Web Console

To use this file for authentication, login to the OpenShift Web Console as a cluster
admin and navigate
to the administration section in the sidebar.
Section 3:
1. Log in as cluster-admin.
2. Go to Administration → Cluster Settings → Configuration tab.
3. Open OAuth configuration.
4. Add a new Identity Provider → HTPassword.
5. Upload the [Link] file.
. Configuring the HTPassword Identity Provider in OpenShift o Creates a Secret in the openshift-config namespace.
6. Verify the secret under:
# Objective o Workloads → Secrets → openshift-config (Show Default Project).
7. Log out → Login page should now show HTPassword as an option.
To configure user authentication in OpenShift using the HTPassword Identity Provider — 8. Test login with a user (e.g., ted / pass123).
both via Web Console and CLI.
( Note: New users will have no roles assigned until configured.

$ What is HTPassword Identity Provider?

Now let's explore how to set up HTTP password identity authentication using the
command line interface.
• A simple local authentication method in OpenShift.
• Uses a file containing usernames and hashed passwords. 0 Step 3: Configure OAuth using the CLI
• Ideal for:
o Testing environments Ls -l htpasswd
o Small setups 1. Create a secret from the HTPassword file:
o Local authentication without external ID providers. oc create secret generic my-htpass-secret
--from-file=htpasswd=[Link] -n openshift-config
2. Export current OAuth configuration: Command Description
oc get oauth cluster -o yaml > [Link] oc get secrets -n openshift-config View created secrets

get more detailed information about the OAuth resource using

the command line ⚙ Advantages of CLI Method
oc [Link]
To get further details about the Identity Providers field, you can use this syntax. • Easier to automate and script.
This command provides a wealth of information about the OAuth specification, • Ideal for reproducible cluster configurations.
including available fields
and their descriptions.
Oc explain [Link]
4. Edit ⚠ Important Notes
5. nano [Link]
• Only cluster-admin can configure Identity Providers.
• Deleting OAuth config may disrupt login access.
Add or update under spec
• Always backup the htpasswd file and YAML configuration.
identityProviders:

identityProviders:
- name: local_auth
mappingMethod: claim $ Exam Tip (EX280)
type: HTPasswd
htpasswd: • HTPassword authentication is a frequent exam topic.
fileData:
name: my-htpass-secret
• Practice:
o Creating htpasswd file
4. Apply the configuration: o Configuring via CLI
oc replace -f [Link]
o Logging in and verifying users
5. Monitor authentication pods:
oc get pods -n openshift-authentication -w
oc get pods -n openshift-authentication

Wait for pods to restart and stabilize.

Once the pods are running, you can test logging in with one of the new users.
htpasswd -u [Link] bob pass123

6. Verify users:
oc get users
To verify the users, you can use the OC Get Users command.
Once you log in with an administrator account.

Users appear only after first login.

& Useful Commands

Command Description
oc explain oauth View OAuth configuration schema
oc explain [Link] Get details about provider fields
oc get users List logged-in users
. Managing & Deleting Users in OpenShift (HTPassword % This uses:

Identity Provider) • oc create → to generate YAML of new secret

• --dry-run=client -o yaml → output only, don’t apply yet
" Objective • oc replace -f - → replace the existing secret in one step
• We have deleted the user from the HT password file and the corresponding
Learn how to delete a user configured via the HTPassword identity provider in OpenShift, secrets.
and ensure complete removal from the cluster. • But that's not enough to completely remove the user from the cluster.
• It is essential to remove users from the identity and user lists in OpenShift.
• Doing otherwise can lead to inconsistencies and potential security risks.
• For example, later on, a new user with the same username may be added to
' Types of Users in OpenShift the ht password file.
•

Type Description Examples

Standard interactive accounts
Regular for developers/admins. 0 Remove User from Cluster Objects
developer, admin
Users Created automatically at first
login or via API. Even after updating the file, the user & identity objects remain in the cluster.
Automatically created by the
System
system for internal system:admin, system:node, system:registry List current users:
Users
components.
Used by pods to interact with oc get users
Service
the OpenShift API. Defined system:serviceaccount:<namespace>:<name>
Accounts List identities:
within projects; carry specific
(SA)
credentials & permissions.
oc get identity

Delete the user and their identity:

( Steps to Delete a User (e.g., “Ted”) in HTPassword Setup
oc delete user ted
. Remove User from HTPassword File oc delete identity HTPasswd:ted

Open the file and delete Ted’s entry:

1 Verify Removal
nano [Link]
Check again:
# Delete the line with 'ted'
oc get users
oc get identity
Confirm:

cat [Link] ✅ Ted should no longer appear in either list.

/ Update the Secret in openshift-config we should be kubeadmin(oc login -u

kubeadmin) 2 Restart Authentication Pods (if not automatic)

List existing secrets: Wait a few minutes or check:

oc get secrets -n openshift-config oc get pods -n openshift-authentication

Identify the secret (e.g., htpass-secret). Pods should restart automatically when OAuth config changes.

Update the secret with the new file:

oc create secret generic htpasswd-hmnx

--from-file=htpasswd –dry-run=client -o yaml -n openshift-config | oc
⚠ Why Delete User & Identity Objects?
replace -f -
 • Prevents old access tokens or stale references. . Modifying User Passwords in OpenShift (HTPassword Identity
• Avoids permission inheritance if a new user with the same name is later added.
• Ensures clean, consistent authentication state. Provider)
# Objective

* Summary Learn how to update or reset a user’s password in OpenShift when using the HTPassword
identity provider.
Step Action Command / Tool
1 Remove user from htpasswd file Edit file manually
2 Update OpenShift secret `oc create secret --dry-run $ Why Modify Passwords?
3 Delete user from cluster oc delete user <name>
As an OpenShift administrator, you may need to:
4 Delete user identity oc delete identity HTPasswd:<name>
5 Verify removal oc get users, oc get identity • Reset passwords for users who forgot them.
• Enforce password rotation for security.
• Update passwords due to compromised credentials.
+ Key Takeaways

• Regular, system, and service accounts have distinct roles.

• HTPassword users are managed externally via a file and internally via OpenShift
⚙ Key Concept
objects.
• Always remove from both the file and cluster objects. Modifying a password in the HTPassword provider is nearly identical to creating a user.
• Restart OAuth pods after changes to propagate updates. The difference: you update an existing entry instead of adding a new one.

2 Scenario

User: Alice needs to change her password.

.
. Step-by-Step Procedure
Update Password in HTPassword File

Navigate to the directory containing your .htpasswd file and run:

htpasswd -b -B [Link] alice NewPassword123

Explanation:

• -b → Provide password on the command line

• -B → Use bcrypt hashing (recommended)
• This command updates Alice’s password in the existing file.

Verify the change:

/ [Link]
cat

Update the Secret in openshift-config

After updating the file, replace the secret in the cluster so OpenShift uses the new password
file.

oc create secret generic htpasswd-hmnx

 --from-file=htpasswd –dry-run=client -o yaml -n openshift-config | oc
replace -f -

Lesson: Creating and Managing Groups in OpenShift

% This recreates the secret with updated credentials and replaces the existing one.
Welcome back, everyone!
In this lesson, we’ll dive into creating and managing groups in OpenShift.
0 Wait for OAuth Pods to Restart
Groups play a crucial role in organizing users and simplifying access control. By using
Once the secret is updated, the authentication pods in OpenShift automatically restart to groups, you can assign roles and permissions to multiple users simultaneously, making
apply the new configuration. administration much more efficient.

Check status:

oc get pods -n openshift-authentication ! Understanding Groups

Wait until the pods return to Running. In OpenShift, groups are collections of users who share common roles, permissions, or
attributes.
By leveraging groups, you can streamline how access is granted to resources across projects
1 Verify the Password Update and make user management easier.

1. Log out from your admin session in the OpenShift Web Console.
2. Select HTPassword on the login page.
3. Enter username alice and the new password. ! Creating a New Group
4. Successful login confirms the password update worked.
To create a new group, use the following command:

oc adm groups new <group-name>

& Notes & Key Points
For example:
• No need to modify user or identity objects.
• Password changes are managed only through: oc adm groups new developers
o The .htpasswd file
o The corresponding secret in the openshift-config namespace This creates a group called developers.
• The oc get users and oc get identity lists remain unchanged.
You can also add users during group creation:

oc adm groups new developers alice bob charlie

⚡ Quick Recap
This command creates the developers group and adds three users — Alice, Bob, and Charlie.
Step Action Command
htpasswd -bB [Link] <user>
1 Update password in .htpasswd <newpass>

2 Replace secret in openshift- `oc create secret … ! Managing Group Membership

config
3 Wait for OAuth pods to restart oc get pods -n openshift-authentication
To add users to an existing group:
4 Test login Web Console → HTPassword provider
oc adm groups add-users developers david emily

✅ Summary To remove a user from a group:

• Password modification in HTPassword is simple and secure. oc adm groups remove-users developers charlie
• No need to recreate users or identities.
• Always remember to update the secret and wait for OAuth to restart.
• Verify by logging in with the updated credentials. ! Assigning Roles to Groups

Assigning roles to groups allows you to grant permissions to all users in that group at once.
For instance, to assign the view role to the developers group in a project:
oc adm policy add-role-to-group view developers -n my-project

This grants the view role to all members of the developers group in the my-project That was an excellent and complete walkthrough of Role-Based Access Control (RBAC)
namespace. in OpenShift — it covers every important aspect that’s relevant for both EX280 exam prep
We’ll explore roles and permissions in more depth in the next lesson. and real-world OpenShift administration.

Here’s a structured summary + key takeaways from your transcript so you can use it as
notes or a study reference 3
! Default Virtual Groups in OpenShift

OpenShift provides three built-in virtual groups:

• system:authenticated — includes all authenticated users.

+ Lesson Summary: RBAC in OpenShift
• system:authenticated:oauth — includes users authenticated via OAuth tokens.
• system:unauthenticated — includes all unauthenticated users. ! What is RBAC?

These virtual groups can be used to apply cluster-wide access [Link] poremission RBAC (Role-Based Access Control) manages who can do what within an OpenShift
cluster.
It links users or groups to roles, which define permissions through verbs (like get, list,
create, delete).
, Demo

Let’s reinforce this with a quick demo:

( Core Concepts
1. Create a new project
2. oc new-project demo
3. Create a group named testers and add three users: 1. Roles
4. oc adm groups new testers alice bob charlie
5. Assign the view role to the group: • Define permissions (rules) for resources.
6. oc adm policy add-role-to-group view testers -n demo • Use verbs like:
7. Remove a user (Alice) from the group: o get, list, watch, create, update, patch, delete
8. oc adm groups remove-users testers alice • Two levels:
o ClusterRole → applies cluster-wide.
You can verify group membership and permissions in the OpenShift Web Console. o Role → applies within a specific namespace (project).
Log in as each user and observe their access to the demo namespace.
2. RoleBinding / ClusterRoleBinding

• Connects a role to a user or group.

- Summary • Makes the role effective.
• Scope:
In this lesson, we covered: o RoleBinding → Namespace-specific.
o ClusterRoleBinding → Cluster-wide.
• What groups are in OpenShift
• How to create and manage them
• How to assign roles to groups
• The default virtual groups in OpenShift
/ Default Roles in OpenShift
We also walked through a hands-on demo where we created a project, added users to a
group, assigned roles, and removed a user. Role Scope Description
admin Project Full project control except quotas
Mastering group management is essential for efficiently controlling user access and basic-user Cluster Read-only access to basic info
permissions in OpenShift.
By organizing users into groups and assigning roles appropriately, you simplify
cluster-admin Cluster Superuser (full control)
administration and ensure users have the right level of access to resources. cluster-status Cluster Read-only cluster status
cluster-reader Cluster Read-only access to most objects
edit Project Modify objects in a project (no RBAC(role) changes)
 Role Scope Description 13. oc describe [Link] self-provisioner
view Project View-only access 14. Grant specific user (Alice) the self-provisioner role:
15. oc adm policy add-role-to-user self-provisioner alice
self-provisioner Cluster Allows users to create their own projects 16. Verify Alice can now create projects again.
Two level rbac approach :cluster roles :platform access control 17. Oc new project permissions
Local roles: project specific flexibility 18. Oc get rolebindings -o wide. :to verify who is alice

To see who can create project: oca dm policy who-can-create

19. Grant Bob admin role in Alice’s project:

important OC/ADM Commands 20. oc adm policy add-role-to-user admin bob -n <project-name>
21. now lets Create groups:login as kubeadmin
22. oc adm groups new developers bob
. Viewing Role Bindings 23. oc adm groups new testers charlie
24. oc get groups
oc describe [Link] :To view the role bindings at the cluster level 25. Assign roles to groups:
oc describe [Link] :To view the role bindings at the project level 26. oc adm policy add-role-to-group edit developers -n <project>
oc describe [Link] -n <project> : To view the role bindings at the specific 27. oc adm policy add-role-to-group view testers -n <project>
project 28. Verify group access:
o o Bob (developer) can modify resources. Oc login -u -p redhat123
o Charlie (tester) has view-only access.
. Add/Remove Roles 29. If we log in as user Bob, we'll see he can access the project.
30. We can view the current role bindings in the project using OC get role bindings
# Add a role to a user in a( namespace )with in a specific project Eigtht.
oc adm policy add-role-to-user <role> <user> -n <namespace>
31. Bob can view the role bindings as he is also a project ad
# Remove a role from a user within a project o
oc adm policy remove-role-from-user <role> <user> -n <namespace> 32. Restore default:
33. oc adm policy add-cluster-role-to-group self-provisioner
# Add a role to a group within a project system:authenticated:oauth
oc adm policy add-role-to-group <role> <group> -n <namespace>
34. login as charlie and try to create new project
# Remove a role from a group within project
oc adm policy remove-role-from-group <role> <group> -n <namespace>
) Key Concepts to Remember
• Roles = rules, RoleBindings = assignments.
list users/groups with specific permissions:
oc adm policy who-can <verb><resources>
• ClusterRole vs Role = cluster-wide vs project-specific.
• OC ADM POLICY is the main command family for managing RBAC.
• who-can is your auditing friend.
. Check who can perform an action
oc adm policy who-can create pods • Avoid giving cluster-admin unless absolutely necessary.
oc adm policy who-can create project • Always verify access changes with a different user login.

0 Demo Steps Recap

✅ Practice Tip (EX280 / Real Labs)
1. View existing self-provisioning role:
2. oc get clusterrolebinding -o wide | grep self-provisioner Try this lab scenario:
3. oc describe [Link] self-provisioner
4. 1. Create users alice, bob, and charlie.
5. 2. Give alice the self-provisioner role.
6. Login with alice create new project to. Verify : oc login -u alice - 3. Create two groups — developers (bob) and testers (charlie).
p newpassword 4. Assign edit to developers and view to testers.
7. Oc new-project alice10 5. Verify access using oc whoami and resource listing commands.
8. log in as cluster admin and remove the Self-provisioning role from the system. 6. Finally, remove and restore the self-provisioning role for system:authenticated:oauth.
9. Remove self-provisioning from all OAuth users:
10. oc adm policy remove-cluster-role-from-group self-provisioner
system:authenticated:oauth
11. Verify that users like Alice can’t create new projects.
12. We can verify the removal by running OC.