OpenShift

To use Airlock Microgateway in your OpenShift cluster, follow this guide to deploy the Airlock Microgateway Operator and its resources.

• Choose the required installation mode according to the article Sidecar-based installation mode types.
• To use Airlock Microgateway, a valid license is required. Airlock Microgateway is available in a Premium and a free Community edition. To request and configure/change a license, see the article Configuration and monitoring of licenses.
• Install a cert-manager in your Kubernetes cluster.
• All pods that Airlock Microgateway should protect must explicitly reference the Airlock Microgateway CNI NetworkAttachmentDefinition via the annotation k8s.v1.cni.cncf.io/networks.
• Airlock Microgateway CNI Helm charts are available here:
• Airlock Microgateway Helm charts on GitHub
• Airlock Microgateway Helm charts on Artifact Hub
• Helm value files for Airlock Microgateway CNI installations on GKE and OpenShift are available as separate values.yaml files:
• gke-values.yaml (on GitHub)
• openshift-values.yaml (on GitHub)

You can install the cert-manager with the commands below in the 'VERSION' that you wish to install. You may use the latest cert-manager version (see cert-manager Helm installation instructions), which should work fine in most cases, or install the version we use for internal testing (see tested version of cert-manager for Microgateway 4.3).

copy

# Add the cert-manager repository and perform a Helm-based installation
helm repo add jetstack https://charts.jetstack.io 
helm install cert-manager jetstack/cert-manager --version 'VERSION' -n cert-manager --create-namespace --set crds.enabled=true --wait

Install the CNI DaemonSet and required RBAC (Role Based Access Control) manifests using our Helm charts.

We recommend installing the CNI plugin into the namespace openshift-operators instead of kube-system.

The default values have been tested in our installation environments. However, some values may need to be adapted to meet the requirements of your setup environment. Path information for the CNI config files and binaries can either be found in the documentation of your Kubernetes distribution or CNI provider or queried with the following commands.

The cniNetDir, the directory of the CNI config files on the host, can be queried with:

copy

crictl info -o go-template --template '{{.config.cni.confDir}}'

The cniBinDir, the directory of the CNI plugin binaries on the host, can be queried with:

copy

crictl info -o go-template --template '{{.config.cni.binDir}}'

Privileged access is required to install the CNI plugin on the node. In OpenShift, this may lead to a warning if the label pod-security.kubernetes.io/warn: privileged is not set for the OpenShift operator namespace during the CNI helm install process. For the related OpenShift documentation, see Managing pod security admission in OpenShift.

0. Helm-based installation procedure:
1. Adapt and run the following command with the current CNI helm chart version from GitHub or a local version of the openshift-values.yaml file.
copy



helm install airlock-microgateway-cni -n openshift-operators oci://quay.io/airlockcharts/microgateway-cni -f https://github.com/airlock/microgateway/tree/4.3.0/deploy/charts/airlock-microgateway-cni/openshift-values.yaml --version 4.3.0

2. Wait for the Airlock Microgateway Operator to be up and running.
copy



oc -n airlock-microgateway-system wait --for=condition=Available deployments --all --timeout=3m 

3. Verify the correctness of the installation with helm test.
copy



helm upgrade airlock-microgateway-cni -n openshift-operators oci://quay.io/airlockcharts/microgateway-cni --set tests.enabled=true --reuse-values --version 4.3.0

4. Check the log messages.
copy



helm test airlock-microgateway-cni -n openshift-operators --logs

5. On successful installation, the logs should show the message Success.
6. Disable the helm test deployment afterward.
copy



helm upgrade airlock-microgateway-cni -n openshift-operators  oci://quay.io/airlockcharts/microgateway-cni --set tests.enabled=false --reuse-values --version 4.3.0

In order to complete the Airlock Microgateway Operator installation and to run the below helm test successfully, you need to deploy a valid license. See article Configuration and monitoring of licenses for more information.

1. Create the airlock-microgateway-system namespace
copy



oc create namespace airlock-microgateway-system

2. Store the license in the Microgateway Operator namespace, in a Kubernetes secret with the name airlock-microgateway-license and the key microgateway-license.txt. Use the following command:
copy



oc -n airlock-microgateway-system create secret generic airlock-microgateway-license  
--from-file=microgateway-license.txt=<my-local-microgateway-license.txt>

3. Adapt and run the following command with the current Airlock Microgateway Operator Helm chart version. This will install airlock-microgateway in the airlock-microgateway-system namespace.
copy



helm install -n airlock-microgateway-system airlock-microgateway oci://quay.io/airlockcharts/microgateway --wait --version 4.3.0

4. Verify that the Airlock Microgateway Operator started successfully:
copy



oc -n airlock-microgateway-system wait --for=condition=Available deployments --all --timeout=3m

5. Verify the correctness of the installation with helm test.
copy



helm upgrade airlock-microgateway -n airlock-microgateway-system oci://quay.io/airlockcharts/microgateway --set tests.enabled=true --reuse-values --version 4.3.0

6. Check the log messages.
copy



helm test airlock-microgateway -n airlock-microgateway-system --logs

During installation, the installation status is echoed – i.e., the preliminary cleanup task and scaling the test installation to only 1 replica (to ensure no pods from previous runs are present).

7. On successful installation, the logs should show the following message: ### Installation of 'airlock-microgateway' succeeded
8. Disable the helm test deployment afterward.
copy



helm upgrade airlock-microgateway -n airlock-microgateway-system oci://quay.io/airlockcharts/microgateway --set tests.enabled=false --reuse-values --version 4.3.0

The default SCC privileged provides sufficient rights and could be used for the serviceAccount. For further information consult the OpenShift website (Default security context constraints).

0. After deploying the Airlock Microgateway Operator in your Cluster, the following steps are required:
1. Configure/change the Airlock Microgateway license. See article Configuration and monitoring of licenses.
2. Annotate the web application Pods to protect as explained in Labels and annotations for Airlock Microgateway.
3. Create the CustomResources to configure the Airlock Microgateway as outlined in Configuration.
4. Append default/airlock-microgateway-cni in the annotation k8s.v1.cni.cncf.io/networks of the web application Pod to allow the Microgateway CNI plugin work together with OpenShift Multus. For example: k8s.v1.cni.cncf.io/networks: [<network>,...],default/airlock-microgateway-cni. For further information consider Adding a pod to an additional network in OpenShift.

• Internal links:
• Configuration and monitoring of licenses
• Labels and annotations for Airlock Microgateway
• Microgateway CNI
• Configuration

• External links:
• Adding a pod to an additional network in OpenShift
• Managing pod security admission in OpenShift