Controlling access to OpenShift resources

Question 1

Log in to your OpenShift cluster as the admin user and remove the ability to create projects cluster wide.

Answer 1

1. Log in to the cluster as the admin user.
   $ oc login -u admin -p redhat \
   > https://api.ocp4.example.com:6443
2. Remove the self-provisioner cluster role from the system:authenticated:oauth virtual group.
   $ oc adm policy remove-cluster-role-from-group \
   > self-provisioner system:authenticated:oauth

Question 2

Create a group named wp-mgrs for the WordPress managers and grant project creation privileges to it. Add the leader user to the group and create the authorization-review project as the leader user.

Answer 2

1. Create a group named wp-mgrs.
   $ oc adm groups new wp-mgrs
2. Grant cluster creation privileges to the wp-mgrs group.
   $ oc adm policy add-cluster-role-to-group \
   > self-provisioner wp-mgrs
3. Add the leader user to the wp-mgrs group.
   $ oc adm groups add-users wp-mgrs leader
4. As the leader user, create the authorization-review project.
   $ oc login -u leader -p redhat
   oc new-project authorization-review

Question 3

Create a group named wp-devs and grant edit privileges on the authorization-review project. Add the developer user to the group.

Answer 3

1. Log in to the cluster as the admin user.
   $ oc login -u admin -p redhat
2. Create a group named wp-devs.
   $ oc adm groups new wp-devs
3. Add the developer user to wp-devs.
   $ oc adm groups add-users wp-devs developer
4. Grant edit privileges to the wp-devs group on the authorization-review project.
   $ oc policy add-role-to-group edit wp-devs

Question 4

Create a group named wp-qa and grant view privileges on the authorization-review project. Add the qa user to the group.

Answer 4

1.  Create a group named wp-qa. 
$ oc adm groups new wp-qa
2.  Add the qa user to wp-qa. 
$ oc adm groups add-users wp-qa qa
3.  Grant view privileges to the wp-qa group on the authorization-review project. 
$ oc policy add-role-to-group view wp-qa

Question 5

Allow the wordpress application to run as root: create a service account named wordpress-sa and grant the anyuid SCC to it.

Answer 5

1. Create a service account named wordpress-sa.
   $ oc create sa wordpress-sa
2. Grant anyuid SCC to the wordpress-sa service account.
   $ oc adm policy add-scc-to-user anyuid -z wordpress-sa

Question 6

As the developer user, create a secret named review-secret, which you will use with the MySQL database and WordPress applications.

The secret should include three key-value pairs: user=wpuser, password=redhat123, and database=wordpress.

Answer 6

1. Log in as the developer user.
   $ oc login -u developer -p developer
2. Create a secret named review-secret.
   $ oc create secret generic review-secret \
   > –from-literal user=wpuser –from-literal password=redhat123 \
   > –from-literal database=wordpress

Question 7

Deploy a MySQL database application named mysql using the image located at registry.access.redhat.com/rhscl/mysql-57-rhel7:5.7-47. After it was deployed, modify the deployment to use the review-secret secret, as environment variables with the MYSQL_ prefix.

Answer 7

1. Create a new application to deploy a mysql database server.
   $ oc new-app –name mysql \
   > –docker-image registry.access.redhat.com/rhscl/mysql-57-rhel7:5.7-47
2. Use the review-secret secret to initialize the environment variables on the mysql deployment.
   $ oc set env deployment/mysql –prefix MYSQL_ \
   > –from secret/review-secret

Question 8

Deploy a WordPress application named wordpress using the container image located at docker.io/library/wordpress:5.3.0. Add the WORDPRESS_DB_HOST=mysql and WORDPRESS_DB_NAME=wordpress environmental variables when creating the application. Once deployed, modify the wordpress deployment to use the review-secret secret as environment variables with the WORDPRESS_DB_ prefix. The application needs these additional variables to connect to the database. Because the wordpress application needs extra privileges, assign the wordpress-sa service account to it.

Answer 8

1. Deploy a wordpress application.
   $ oc new-app –name wordpress \
   > –docker-image docker.io/library/wordpress:5.3.0 \
   > -e WORDPRESS_DB_HOST=mysql \
   > -e WORDPRESS_DB_NAME=wordpress
2. Set the wordpress-sa service account to the wordpress deployment.
   $ oc set serviceaccount deployment/wordpress \
   > wordpress-sa
3. Use the review-secret secret to initialize the environment variables on the wordpress deployment.
   $ oc set env deployment/wordpress \
   > –prefix WORDPRESS_DB_ –from secret/review-secret

Question 9

As the qa user, verify the mysql database and wordpress application status and try to make a change to the wordpress deployment.

Answer 9

1. Log in as the qa user.
   $ oc login -u qa -p redhat
2. Verify the wordpress application status.
   $ oc status
3. Try to delete the wordpress application to verify that the qa user does not have edit privileges in the project.
   $ oc delete all -l app=wordpress