How Do You Create a Router in OpenShift When You Get an Error about a User Being Forbidden?

Problem scenario
You are trying to create a virtual router in OpenShift.  When you run the command "oc adm router goodname" you get this error:

"error: router could not be created; could not retrieve list of security constraints to verify service account "router": securitycontextconstraints.security.openshift.io is forbidden: User "jdoe" cannot list securitycontextconstraints.security.openshift.io at the cluster scope: User "jdoe" cannot list all securitycontextconstraints.security.openshift.io in the cluster"

What should you do?

Solution
Run this command:  oc login -u system:admin

Now run your command to create a router:  oc adm router goodname

Now log back into the project with the regular user:  oc login

What Are the Differences between Kubernetes and OpenShift?

Question
What are the differences between Kubernetes and OpenShift?

Answer

  • OpenShift was built by Red Hat.  OpenShift did not originally use Kubernetes (OpenShift blog).  Kubernetes was built at Google.
  • Kubernetes is open source whereas OpenShift usually costs money.  There are different types of OpenShift (e.g., OpenShift Online, OpenShift Enterprise etc.).
  • You use "oc" (OpenShift Client) commands with OpenShift that are often identical to "kubectl" commands in the options that they support.  OpenShift supports native "kubectl" and Red Hat specific "oc" commands.
  • OpenShift uses projects which enhance security by default.  Projects control the access to a namespace.  
  • OpenShift has user accounts that can run a limited number of commands.  For example OpenShift users cannot by default create virtualized routers.  There is a way to use a more privileged user.  This can readily allow you to delegate administrator rights to certain users and not others in OpenShift.
  • Having different namespaces and user accounts that lend themselves to segmentation can make OpenShift a more hardened container orchestration tool.  But these advantages come at the price of proprietary nuances, complexity and financial cost not associated with the purely open source alternative.
  • According to OpenShift's website as of 1/12/18, Kubernetes does not support the following features that OpenShift supports:
    1. Multi-tenancy
    2. Collaboration
    3. Networking
    4. Image registry
    5. Monitoring   
    6. Log aggregation  
    7. CI/CD and DevOps
    8. Enterprise 24/7 Support  
    9. Security response team
    10. Stable Lifecycle (7 years)

Naturally we believe that Kubernetes and open source Docker facilitate several of the above. 

Happy Martin Luther King Jr. Day!

Martin Luther King Jr. was a Nobel Peace Prize winner who died before the age of 40.  He was not quite 5'7" but made a massive impact on U.S. history.  It is unlikely Barack Obama would have been elected President in 2008 had Martin Luther King Jr. not advanced the cause of civil rights for African Americans.  King's influence and inspiration will be felt for decades to come.  On January 15, 2018 we observe Martin Luther King Jr. Day (the day of King's birth).  

You can buy books about King with one of these links: Martin's Big Words, an autobiography, and The Essential Writings and Speeches of Martin Luther King Jr.  Along with the Nobel Prize he won, we should remember the Montgomery Bus Boycott that King lead starting in 1955 lasting until early 1957.  If you get a chance to visit Montgomery, Alabama you should find the bus stop where Rosa Parks refused to give up her seat or the fountain where slaves were once sold.  You should also visit the Civil Rights Memorial and learn about an important era in American history.

Citations
The photo was taken from this website: http://www.photosforclass.com/search/martin%20luther%20king%20jr.

How Do Install and Configure OpenShift to Test It Out?

Problem scenario
You want to use OpenShift as opposed to Kubernetes.  How do you deploy OpenShift to try it out?

Solution
1.  Install Docker on Linux.  We recommend you use a RedHat OS.  The hardware requirements are not that high if you are just testing it for development and/or learning purposes.  For directions on how to install Docker on a RedHat distribution of Linux, see this posting if it is in AWS.  For directions on installing Docker on a RHEL VM in GCP, see this posting.

2.  Run these three commands:

sudo service docker start

docker run -d --name "origin2" --privileged --pid=host --net=host -v /:/rootfs:ro -v /var/run:/var/run:rw -v /sys:/sys -v /sys/fs/cgroup:/sys/fs/cgroup:rw -v /var/lib/docker:/var/lib/docker:rw -v /var/lib/origin/openshift.local.volumes:/var/lib/origin/openshift.local.volumes:rslave openshift/origin start

docker exec -it origin2 bash

3.  Now that you are inside the Docker container, run this command:

oc login # for the username and password use "test" and "test" respectively

4.  Now you can run oc commands to test openshift.  Try these:

oc version
oc whoami

(The above commands were mostly taken from OpenShift.org. The old link was https://docs.openshift.org/latest/getting_started/administrators.html, but this no longer works.)

FYI  The "oc" command (which stands for OpenShift Client) is very similar to the way that kubectl works. 

How Do You Troubleshoot the Error “ERROR: S3 error: 400 (InvalidRequest): The authorization mechanism you have provided is not supported. Please use AWS4-HMAC-SHA256.”

Problem scenario
Some s3cmd commands work fine.  But others give you this error:
"ERROR: S3 error: 400 (InvalidRequest): The authorization mechanism you have provided is not supported. Please use AWS4-HMAC-SHA256."

What can you do to get s3cmd commands to work consistently?

Solution
Upgrade your s3cmd to a newer version.

How Do You Troubleshoot the I.E. Error “Your current security settings do not allow this file to be downloaded”?

Problem scenario
On a Windows server in AWS, you are trying to download a file with Internet Explorer.  You get this error: "Your current security settings do not allow this file to be downloaded." How do you solve this problem?

Solution
Using Internet Explorer 11, go to Internet Options.  Go to the Security tab.  Click on "Internet."  Scroll down to "Downloads."  For "File download" (beneath "Downloads"), choose "Enable."  Click "Ok" twice. 

If you want to revert your server to this level of security, simply undo the setting change after you download the file.

How Do You Install Maven on Any Type of Linux?

Problem scenario
You want to install Maven with a script.  You want the script to work regardless of what distribution of Linux you are using (e.g., Ubuntu/Debian, RedHat (including CentOS/Fedora), or SUSE).  How do you write a script to install the latest version of Maven?

Solution
Update:  This script was updated on 9/23/19.

1.  Create this file in /tmp/ and call it maven.sh.  Below is the content:

#!/bin/bash
# Written by www.continualintegration.com

mvnversion=3.6.2  # Change this version as necessary

distro=$(cat /etc/*-release | grep NAME)

debflag=$(echo $distro | grep -i "ubuntu")
if [ -z "$debflag" ]
then   # If it is not Ubuntu, test if it is Debian.
  debflag=$(echo $distro | grep -i "debian")
  echo "determining Linux distribution..."
else
   echo "You have Ubuntu Linux!"
fi

rhflag=$(echo $distro | grep -i "red*hat")
if [ -z "$rhflag" ]
then   #If it is not RedHat, see if it is CentOS or Fedora.
  rhflag=$(echo $distro | grep -i "centos")
  if [ -z "$rhflag" ]
    then    #If it is neither RedHat nor CentOS, see if it is Fedora.
    echo "It does not appear to be CentOS or RHEL..."
    rhflag=$(echo $distro | grep -i "fedora")
    fi
fi

if [ -z "$rhflag" ]
  then
  echo "...still determining Linux distribution..."
else
  echo "You have a RedHat distribution (e.g., CentOS, RHEL, or Fedora)"
  yum -y install java-1.8.0-openjdk*
  JAVA_HOME=/usr/lib/jvm/jre-1.8.0-openjdk
  echo 'export JAVA_HOME=/usr/lib/jvm/jre-1.8.0-openjdk' >> ~/.bashrc
  source ~/.bashrc
  source /etc/environment
fi

if [ -z "$debflag" ]
then
  echo "...still determining Linux distribution..."
else
   echo "You are using either Ubuntu Linux or Debian Linux."
   apt-get -y update # This is necessary on new AWS Ubuntu servers.
   apt -y install openjdk-9-jre-headless default-jdk
   apt -y install openjdk-11-jre-headless
   echo "If you see an error about an installation candidate, do not be concerned"
   sleep 2
fi

suseflag=$(echo $distro | grep -i "suse")
if [ -z "$suseflag" ]
then
  if [ -z "$debflag" ]
  then
    if [ -z "$rhflag" ]
      then
      echo "*******************************************"
      echo "Could not determine the Linux distribution!"
      echo "Installation aborted. Nothing was done."
      echo "******************************************"
      exit
    fi
  fi
else
   zypper -n install java-1_8_0-openjdk java-1_8_0-openjdk-devel
fi

curl http://ftp.wayne.edu/apache/maven/maven-3/$mvnversion/binaries/apache-maven-$mvnversion-bin.tar.gz > /bin/apache-maven-$mvnversion-bin.tar.gz

cd /bin
tar -xvf apache-maven-$mvnversion-bin.tar.gz
mkdir -p /usr/local/apache-maven
mv /bin/apache-maven-$mvnversion/* /usr/local/apache-maven

if [ -z "$debflag" ]
then
  /usr/bin/ln -s /usr/local/apache-maven/bin/mvn /bin/mvn
else
  /bin/ln -s /usr/local/apache-maven/bin/mvn /bin/mvn
fi

echo 'PATH="$PATH":/usr/local/apache-maven/bin/' > /etc/profile.d/maven.sh

echo 'To finish the process, run this command:'
echo 'export PATH="$PATH":/usr/local/apache-maven/bin/'

echo "Then run 'mvn -version' to see if Maven is installed."

2.  Run it with this command: sudo -s source /tmp/maven.sh