I need to perform some quite extensive deployment tasks in an air-gapped environment. My approach will be automation, automation, and automation achieved with magefile and sshkit. However since it's air-gapped, we will need to prepare our toolings first. Offline Golang Module Dependency Let’s prepare the module dependencies and prepackage them with “go vendor”. go…

I use Traefik as a reverse proxy to expose my application running on OpenShift. To expose the HTTPS service, which is configured as a route of TCP, I will need the following sample configuration in TOML format, [tcp.routers.dev-ocp410-https] entryPoints = ["https"] rule = "HostSNI(`oauth-openshift.apps.dev-ocp410.ibmcloud.io.cpak`,`console-openshift-console.apps.dev-ocp410.ibmcloud.io.cpak`,)" service = "service-dev-ocp410-https"…

While working on the OpenShift Mirror Registry for air-gapped environment setup, I have some hiccups encountered. This paper notes down those issues and how I troubleshoot and fix them. Request Line is too large There is no issue to mirror the standard OCP platform images into the mirror registry. However, when I started to populate…

OpenShift 4.10 has brought in some new features to streamline the installation of airgap/disconnected environment for the platform’s images, the operator’s images, and other normal images. Let's check it out. A Mirror Registry with Red Hat Quay A small-scale Quay can be set up on a Redhat Linux server with a single command-line tool, mirror-registry , such…

I need to perform some OIDC integration work. Let’s set up an OIDC provider with the opensource Keycloak running on the OpenShift cluster, and explore it. Part 1. Setup of Keycloak We will use the latest operator version of Keycloak to deploy on OpenShift. Create a dedicated namespace named keycloak for it. The operator needs…

Supply chain security is becoming more critical to any serious cloud adopters. This paper explores how the container image in a private registry can be verified to be what it claimed to be and enforced by the verification policy. Toolings and Environment I am going to use Sigstore’s Cosign tool to sign the…

HTTPS/TLS certificate for On-premises applications is traditionally centrally managed. To get a certificate for your app in an enterprise environment, you will need to create a certificate signing request, submit it to a certificate authority to sign, and get your certificate back. It’s usually tedious and time-consuming. Don’t forget the…

I was requested to import a company Certificate Authority (CA) signed certificate to replace the default self-signed cert of an appliance. The appliance is able to generate the Certificate Signing Request (CSR) file; We submit the CSR to CA, get the CA-signed cert, and import it into the appliance. Everything…

In this paper, I will explore how we use Instana to trace a Java Spring Boot application, down to its JMS messaging, and further down to the underlying Queue manager (IBM MQ). The environment is Kubernetes based. All the components including the application, MQ, Instana agent are running on the…