Skip to main content

Connecting to Red Hat OpenShift

Learn how to use the OneIQ Pulse connector to profile Red Hat OpenShift clusters.

Written by Omega Team

Overview

OneIQ Pulse supports telemetry for RedHat OpenShift services, pods, clusters, nodes, and persistent volumes.

Prerequisites

  • Red Hat OpenShift Platform version 4.8 or higher.

  • Connectivity from the cluster to the following container registries over HTTPS (port 443):

    • registry.access.redhat.com

    • oneiqpub.azurecr.io

  • Outbound Internet connectivity via port 443 (SSL) to OneIQ: my.oneiq.com, in.oneiq.com and nexus.oneiq.com.

Discovering an OpenShift cluster

  1. Login to the OneIQ Portal

  2. Click IT Environments in the left navigation menu

  3. Select an IT environment, go to the Connectors tab, and select OpenShift
    ​

  4. Specify the name for the OneIQ Pulse connector.

  5. In the Download Manifest section, define a namespace and optionally add tolerations separated by spaces.
    ​

  6. Click Download to generate a .1iq manifest for Red Hat OpenShift customized for the selected IT environment. The manifest must be deployed within 24 hours before it expires.
    ​

    The .1iq file is a standard OpenShift YAML manifest; only the file extension is specific to OneIQ. You can open and review it in any text editor before applying it. It contains an authentication key specific to your IT environment, so handle it as you would a secret.

  7. Run the following command in the target cluster using the Red Hat OpenShift command-line interface:

    oc apply -f <the name of the manifest>.1iq

  8. To check the status of the OneIQ Pulse connector in the cluster, run the following command (replace oneiq with the namespace you defined in step 5):

    oc get pods -n oneiq

    Repeat the steps above for each Red Hat OpenShift cluster.

Example

If you export the MyOpenShiftCluster (My IT environment).1iq manifest and run the following command:

oc apply -f "MyOpenShiftCluster (My IT environment).1iq"


The output should be:

namespace/oneiq created
serviceaccount/oneiq-pulse-connector created
clusterrole.rbac.authorization.k8s.io/oneiq-pulse-connector-w6dj4 created
clusterrolebinding.rbac.authorization.k8s.io/oneiq-pulse-connector-w6dj4 created
role.rbac.authorization.k8s.io/oneiq-pulse-connector created
rolebinding.rbac.authorization.k8s.io/oneiq-pulse-connector created
configmap/oneiq-pulse-state created
deployment.apps/oneiq-pulse-connector created

Security and Resource Details

  • Deployment: The connector runs as a single pod (one replica) in the namespace you chose, under its own service account, oneiq-pulse-connector.

  • Cluster access: The connector has read-only (get, list, watch) access to the cluster resources it inventories, such as nodes, pods, services, workloads and storage. The exact permissions are listed in the ClusterRole in the downloaded manifest.

  • Namespace access: Within its own namespace only, the connector can manage ConfigMaps and its own Deployment. It uses these to store its state and to apply connector updates.

  • Container security: The connector's containers run as non-root, with all Linux capabilities dropped, privilege escalation disabled, and the seccomp profile set to RuntimeDefault.

  • Storage: No persistent volume is required. The connector stores its state in a ConfigMap (oneiq-pulse-state) and uses temporary (emptyDir) volumes for working data.

  • Resources: No CPU or memory requests or limits are set. Ephemeral storage is requested at 512 MiB and limited to 1 GiB. You can apply your own resource policy if required. The connector's /tmp volume is memory-backed, so it counts toward the pod's memory use.

  • Network: The connector needs only outbound HTTPS (port 443) to OneIQ and to the container registries listed above. It does not expose any ports or create a Service, so no inbound connections are required.

Did this answer your question?