|
| 1 | + OpenShift Container Platform by Red Hat |
| 2 | + |
| 3 | +## Create a cluster |
| 4 | + |
| 5 | +1. Download and extract `openshift-install` and `oc` binaries from https://mirror.openshift.com/pub/openshift-v4/clients/ocp-dev-preview/4.21.0-ec.2/. |
| 6 | +2. Download installation pull secret from https://console.redhat.com/openshift/install/pull-secret. |
| 7 | +3. Run `openshift-install` and follow the instructions. When the cluster deployment completes, |
| 8 | + directions for accessing your cluster display in your terminal. |
| 9 | + |
| 10 | +``` |
| 11 | +openshift-install create cluster --dir <installation_directory> |
| 12 | +``` |
| 13 | + |
| 14 | +4. Set the environment variable KUBECONFIG pointing to your `.kubeconfig` from the previous step. |
| 15 | + |
| 16 | +``` |
| 17 | +export KUBECONFIG=PATH_TO_KUBECONFIG |
| 18 | +``` |
| 19 | + |
| 20 | +NOTE: Detailed instructions how to install OpenShift cluster can be found under https://docs.openshift.com/container-platform/. |
| 21 | + |
| 22 | +## Run conformance tests |
| 23 | + |
| 24 | +1. By default OpenShift security rules do not allow running with privileged access. |
| 25 | + Below commands allow unprivileged users to run root level containers. Once |
| 26 | + conformance testing is completed, you should restore the default security rules. |
| 27 | + |
| 28 | +``` |
| 29 | +oc adm policy add-scc-to-group privileged system:authenticated system:serviceaccounts |
| 30 | +oc adm policy add-scc-to-group anyuid system:authenticated system:serviceaccounts |
| 31 | +``` |
| 32 | + |
| 33 | +2. Follow the [test instructions](https://github.com/cncf/k8s-conformance/blob/master/instructions.md#hydrophone) |
| 34 | + to run the conformance tests. OpenShift cluster disables [scheduling on control plane nodes](https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/nodes/working-with-nodes#nodes-nodes-working-master-schedulable_nodes-nodes-managing) |
| 35 | + in the default installation, so you need to pass `--extra-args="--allowed-not-ready-nodes=3"` |
| 36 | + to inform testing framework it should take that into account. |
| 37 | + |
| 38 | +``` |
| 39 | +hydrophone --conformance --conformance-image registry.k8s.io/conformance:v1.34.1 --extra-args="--allowed-not-ready-nodes=3" |
| 40 | +``` |
| 41 | + |
| 42 | +3. Once conformance testing is completed, restore the default security rules: |
| 43 | + |
| 44 | +``` |
| 45 | +oc adm policy remove-scc-from-group anyuid system:authenticated system:serviceaccounts |
| 46 | +oc adm policy remove-scc-from-group privileged system:authenticated system:serviceaccounts |
| 47 | +``` |
0 commit comments