사용 방법
- 설치 명령을 복사하고 자신의 에이전트 환경에 설치하기 전에 소스 패키지를 확인하세요.
- 필요한 도구, 인증 정보, 지원 환경은 원본 문서에서 확인하세요.
- 입력과 원하는 산출물을 설명하고 출처와 결과를 대조하세요.
npx skills add https://github.com/bagelhole/devops-security-agent-skills --skill openshift시작 전 확인
- 설치에는 모델 구독, API 한도, 파일 접근 권한이 포함되지 않습니다.
- 별점 수와 설치 수는 활동 지표이며 독립적인 품질·보안 검증이 아닙니다.
원본 Skill 문서
원본 저장소의 제목, 예시, 코드, 표, 링크, 이미지를 유지해 표시합니다.
OpenShift
Deploy and manage applications on Red Hat OpenShift Container Platform.
When to Use This Skill
Use this skill when:
- Deploying applications to OpenShift clusters
- Using OpenShift-specific features (Routes, BuildConfigs)
- Managing projects and RBAC in OpenShift
- Implementing S2I (Source-to-Image) builds
- Working with OpenShift Operators
Prerequisites
- OpenShift cluster access
- oc CLI installed
- Basic Kubernetes knowledge
CLI Basics
Authentication
bash
# Login to cluster
oc login https://api.cluster.example.com:6443 -u admin -p password
# Login with token
oc login --token=sha256~xxxx --server=https://api.cluster.example.com:6443
# Check current context
oc whoami
oc whoami --show-server
oc whoami --show-context
# Logout
oc logoutProject Management
bash
# Create project (namespace)
oc new-project myapp --display-name="My App" --description="My Application"
# Switch project
oc project myapp
# List projects
oc projects
# Delete project
oc delete project myappDeploying Applications
From Image
bash
# Deploy from container image
oc new-app --image=nginx:latest --name=webserver
# Deploy from Docker Hub
oc new-app docker.io/library/nginx:latest
# Deploy with environment variables
oc new-app myimage:latest \
-e DATABASE_URL=postgres://localhost/db \
-e APP_ENV=productionFrom Source (S2I)
bash
# Deploy from Git repository
oc new-app https://github.com/org/myapp.git
# Specify builder image
oc new-app nodejs:18~https://github.com/org/nodejs-app.git
# With context directory
oc new-app https://github.com/org/monorepo.git \
--context-dir=backend \
--name=backend-apiFrom Template
bash
# List available templates
oc get templates -n openshift
# Deploy from template
oc new-app postgresql-persistent \
-p POSTGRESQL_USER=user \
-p POSTGRESQL_PASSWORD=secret \
-p POSTGRESQL_DATABASE=mydbRoutes
Creating Routes
yaml
apiVersion: route.openshift.io/v1
kind: Route
metadata:
name: myapp
spec:
host: myapp.apps.cluster.example.com
to:
kind: Service
name: myapp
weight: 100
port:
targetPort: 8080
tls:
termination: edge
insecureEdgeTerminationPolicy: Redirectbash
# Create route via CLI
oc expose svc/myapp
# Create with custom hostname
oc create route edge myapp \
--service=myapp \
--hostname=myapp.apps.cluster.example.com
# Create passthrough route (TLS termination at pod)
oc create route passthrough myapp-secure --service=myappA/B Testing
yaml
apiVersion: route.openshift.io/v1
kind: Route
metadata:
name: myapp
spec:
to:
kind: Service
name: myapp-v1
weight: 90
alternateBackends:
- kind: Service
name: myapp-v2
weight: 10Build Configurations
BuildConfig
yaml
apiVersion: build.openshift.io/v1
kind: BuildConfig
metadata:
name: myapp
spec:
source:
type: Git
git:
uri: https://github.com/org/myapp.git
ref: main
strategy:
type: Docker
dockerStrategy:
dockerfilePath: Dockerfile
output:
to:
kind: ImageStreamTag
name: myapp:latest
triggers:
- type: ConfigChange
- type: GitHub
github:
secret: webhook-secretS2I Build
yaml
apiVersion: build.openshift.io/v1
kind: BuildConfig
metadata:
name: myapp
spec:
source:
type: Git
git:
uri: https://github.com/org/myapp.git
strategy:
type: Source
sourceStrategy:
from:
kind: ImageStreamTag
namespace: openshift
name: nodejs:18-ubi8
env:
- name: NPM_RUN
value: start
output:
to:
kind: ImageStreamTag
name: myapp:latestBuild Commands
bash
# Start build
oc start-build myapp
# Start build from local source
oc start-build myapp --from-dir=.
# Follow build logs
oc start-build myapp --follow
# View build logs
oc logs -f bc/myapp
# Cancel build
oc cancel-build myapp-1Image Streams
yaml
apiVersion: image.openshift.io/v1
kind: ImageStream
metadata:
name: myapp
spec:
lookupPolicy:
local: true
tags:
- name: latest
from:
kind: DockerImage
name: registry.example.com/myapp:latest
importPolicy:
scheduled: truebash
# Create image stream
oc create imagestream myapp
# Import image
oc import-image myapp:latest \
--from=docker.io/library/nginx:latest \
--confirm
# Tag image
oc tag myapp:latest myapp:productionDeployment Configs
yaml
apiVersion: apps.openshift.io/v1
kind: DeploymentConfig
metadata:
name: myapp
spec:
replicas: 3
selector:
app: myapp
template:
metadata:
labels:
app: myapp
spec:
containers:
- name: myapp
image: myapp:latest
ports:
- containerPort: 8080
resources:
requests:
memory: "128Mi"
cpu: "100m"
limits:
memory: "256Mi"
cpu: "500m"
triggers:
- type: ConfigChange
- type: ImageChange
imageChangeParams:
automatic: true
containerNames:
- myapp
from:
kind: ImageStreamTag
name: myapp:latest
strategy:
type: Rolling
rollingParams:
maxSurge: 25%
maxUnavailable: 25%ConfigMaps and Secrets
bash
# Create ConfigMap
oc create configmap myapp-config \
--from-literal=APP_ENV=production \
--from-file=config.yaml
# Create Secret
oc create secret generic myapp-secrets \
--from-literal=password=secret123
# Mount as volume
oc set volume dc/myapp \
--add --name=config \
--type=configmap \
--configmap-name=myapp-config \
--mount-path=/etc/config
# Set as environment
oc set env dc/myapp --from=secret/myapp-secretsSecurity Context Constraints
bash
# List SCCs
oc get scc
# View SCC details
oc describe scc restricted
# Grant SCC to service account
oc adm policy add-scc-to-user anyuid -z myapp-sa -n myproject
# Create service account
oc create serviceaccount myapp-saCustom SCC
yaml
apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
name: myapp-scc
allowPrivilegedContainer: false
runAsUser:
type: MustRunAsNonRoot
seLinuxContext:
type: MustRunAs
fsGroup:
type: RunAsAny
volumes:
- configMap
- secret
- persistentVolumeClaim
users:
- system:serviceaccount:myproject:myapp-saOperators
bash
# List available operators
oc get packagemanifests -n openshift-marketplace
# Subscribe to operator
cat <<EOF | oc apply -f -
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
name: prometheus
namespace: openshift-operators
spec:
channel: stable
name: prometheus
source: community-operators
sourceNamespace: openshift-marketplace
EOF
# View installed operators
oc get csv -n openshift-operatorsMonitoring
bash
# View pod logs
oc logs -f pod/myapp-1-xyz
# View events
oc get events --sort-by='.lastTimestamp'
# Resource usage
oc adm top pods
oc adm top nodes
# Debug pod
oc debug pod/myapp-1-xyzCommon Issues
Issue: Build Fails
Problem: S2I build cannot find dependencies Solution: Check builder image, verify source repository access
Issue: Pod Security Violation
Problem: Pod fails to start due to SCC Solution: Use appropriate SCC or modify container security context
Issue: Route Not Working
Problem: Cannot access application via route Solution: Verify service selector, check router pods, validate DNS
Issue: Image Pull Error
Problem: Cannot pull image from registry Solution: Create image pull secret, link to service account
bash
oc create secret docker-registry regcred \
--docker-server=registry.example.com \
--docker-username=user \
--docker-password=pass
oc secrets link default regcred --for=pullBest Practices
- Use Projects for isolation (not just namespaces)
- Leverage ImageStreams for image management
- Use BuildConfigs for CI/CD integration
- Implement proper SCCs (avoid privileged)
- Use Routes instead of Ingress
- Leverage OpenShift templates for repeatability
- Monitor with built-in Prometheus
- Use Operators for complex applications
Related Skills
- kubernetes-ops - K8s fundamentals
- helm-charts - Helm deployments
- container-registries - Image management
