OpenShift is Red Hat's enterprise Kubernetes distribution. It adds developer tools, built-in CI/CD (Source-to-Image), stricter security defaults, and the Route resource for external access. The oc CLI extends kubectl.
| Item | Syntax / Value | Description |
|---|---|---|
| oc login | oc login https://api.cluster:6443 -u admin -p pass | Authenticate to OpenShift cluster |
| oc project | oc project myapp / oc new-project myapp | Switch to or create a namespace/project |
| oc new-app | oc new-app python~https://github.com/user/repo | Source-to-Image build from git repo |
| oc new-build | oc new-build --strategy=dockerfile --binary | Create a build config |
| oc start-build | oc start-build myapp --from-dir=. --follow | Trigger a build from local directory |
| oc get | oc get pods / deployments / services / routes | List resources |
| oc describe | oc describe pod mypod-abc123 | Detailed info about a resource |
| oc logs | oc logs mypod-abc123 -f | Stream pod logs |
| oc exec | oc exec -it mypod-abc123 -- /bin/bash | Shell into a running pod |
| oc rsh | oc rsh mypod-abc123 | Remote shell (OpenShift convenience) |
| oc apply | oc apply -f manifest.yaml | Apply YAML manifest |
| oc delete | oc delete pod mypod-abc123 | Delete a resource |
| oc scale | oc scale deployment myapp --replicas=5 | Scale deployment |
| oc rollout | oc rollout status deployment/myapp | Check rollout progress |
| oc rollout undo | oc rollout undo deployment/myapp | Roll back to previous version |
| oc expose | oc expose service myapp | Create a Route from a Service |
| Route | OpenShift-specific resource for external HTTP/S access | Like k8s Ingress but with TLS termination built-in |
| oc set image | oc set image deployment/myapp myapp=image:tag | Update container image |
| oc set env | oc set env deployment/myapp KEY=value | Set environment variable |
| oc adm | oc adm policy add-scc-to-user anyuid -z default | Admin commands (cluster admin required) |
| SCC | Security Context Constraint — stricter than k8s PodSecurityPolicy | OpenShift blocks containers running as root by default |
| DeploymentConfig | OpenShift-specific deployment resource (legacy) | dc/myapp — prefer Deployment in OCP 4.x |
| BuildConfig | OpenShift build pipeline resource | bc/myapp — S2I, Docker, or custom strategy |
| ImageStream | OpenShift image registry abstraction | is/myapp — triggers redeploy on new image |
| oc process | oc process -f template.yaml -p PARAM=val | oc apply -f - | Process OpenShift template |
| Helm on OCP | helm install myapp ./chart -n myproject | Helm works on OpenShift 4.x |
# OpenShift / Kubernetes — deployment workflow
# ── Connect to cluster ────────────────────────────────────────
# OpenShift
oc login https://api.myocp.example.com:6443 -u developer -p password
oc project mywebuniversity
# Kubernetes (kubectl)
kubectl config use-context my-k8s-cluster
kubectl config set-context --current --namespace=mywebuniversity
# ── Deploy application ────────────────────────────────────────
# Option 1: From Docker image
oc new-app --image=myregistry.io/mywebuniversity/api:latest \
--name=mywebuniversity-api
# Option 2: Source-to-Image from git
oc new-app python~https://github.com/myorg/mywebuniversity-api \
--name=mywebuniversity-api \
--env=FLASK_ENV=production
# Option 3: From YAML manifest
cat > deployment.yaml << 'EOF'
apiVersion: apps/v1
kind: Deployment
metadata:
name: mywebuniversity-api
namespace: mywebuniversity
spec:
replicas: 3
selector:
matchLabels:
app: mywebuniversity-api
template:
metadata:
labels:
app: mywebuniversity-api
spec:
containers:
- name: api
image: myregistry.io/mywebuniversity/api:2.0
ports:
- containerPort: 8080
env:
- name: DATABASE_URL
valueFrom:
secretKeyRef:
name: db-credentials
key: url
resources:
requests: {cpu: "100m", memory: "128Mi"}
limits: {cpu: "500m", memory: "512Mi"}
readinessProbe:
httpGet: {path: /health, port: 8080}
initialDelaySeconds: 10
---
apiVersion: v1
kind: Service
metadata:
name: mywebuniversity-api
spec:
selector:
app: mywebuniversity-api
ports:
- port: 80
targetPort: 8080
EOF
oc apply -f deployment.yaml # OpenShift
kubectl apply -f deployment.yaml # Kubernetes
# ── Expose externally ─────────────────────────────────────────
# OpenShift Route (auto TLS with cluster CA)
oc expose service mywebuniversity-api
oc get routes
# Custom hostname with TLS
oc create route edge mywebuniversity-api \
--service=mywebuniversity-api \
--hostname=api.mywebuniversity.com \
--cert=tls.crt --key=tls.key
# Kubernetes Ingress equivalent
kubectl apply -f - << 'EOF'
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: mywebuniversity-api
annotations:
cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
rules:
- host: api.mywebuniversity.com
http:
paths:
- path: /
pathType: Prefix
backend:
service: {name: mywebuniversity-api, port: {number: 80}}
tls:
- hosts: [api.mywebuniversity.com]
secretName: api-tls
EOF
# ── Monitor and manage ────────────────────────────────────────
oc get pods -w # watch pods
oc logs -f deployment/mywebuniversity-api # stream logs
oc describe pod mywebuniversity-api-xxx # debug pod issues
oc exec -it mywebuniversity-api-xxx -- bash # shell in
oc scale deployment mywebuniversity-api --replicas=5
oc set image deployment/mywebuniversity-api api=myregistry.io/mywebuniversity/api:2.1
oc rollout status deployment/mywebuniversity-api
oc rollout undo deployment/mywebuniversity-api # if needed
# ── Secrets and ConfigMaps ────────────────────────────────────
oc create secret generic db-credentials \
--from-literal=url="postgresql://admin:pass@db:5432/mywebuniversity"
oc create configmap app-config \
--from-literal=ENVIRONMENT=production \
--from-literal=LOG_LEVEL=info
# ── Build from source (OpenShift S2I) ────────────────────────
oc start-build mywebuniversity-api --from-dir=. --follow
oc get builds
oc logs build/mywebuniversity-api-2← Ansible Inventory & Roles | 🏠 Index | Ansible Ad-hoc & Modules →