/openshift

name: openshift
description: OpenShift SCC diagnosis and hardening, Route TLS patterns, OpenShift GitOps app delivery, and cluster upgrade validation.
argument-hint: "[scc|route|gitops|upgrade|debug] [namespace or manifest path]"
title: "OpenShift Command"
sidebar_label: "openshift"
custom_edit_url: null

OpenShift Command

Structured guidance for OpenShift SecurityContextConstraints, Routes, GitOps app delivery, and cluster upgrades.

Activation

/platform-skills:openshift scc      # diagnose SCC rejections, grant minimum SCC, document exceptions
/platform-skills:openshift route    # Route TLS modes, troubleshoot 503/504, Route vs Ingress decision
/platform-skills:openshift gitops   # OpenShift GitOps (Argo CD) app delivery, sync waves, app-of-apps
/platform-skills:openshift upgrade  # pre-upgrade validation, operator impact, post-upgrade checks
/platform-skills:openshift debug    # structured debug — symptom → SCC | Route | Operator | Runtime

---

Interactive Wizard (fires when no mode is provided)

When invoked with no arguments, ask before proceeding:

**Q1 — Mode?**

What do you need?
  1. scc      — SCC rejection diagnosis, minimum SCC generation, Pod Security Admission interaction
  2. route    — Route TLS modes, 503/504 diagnosis, Route vs Ingress vs Gateway API decision
  3. gitops   — OpenShift GitOps (Argo CD), app-of-apps, sync waves, SCC + Argo interaction
  4. upgrade  — pre-upgrade checks, operator approval, post-upgrade validation, rollback
  5. debug    — general structured debug for any OpenShift symptom

Enter 1–5 or mode name:

**Q2 — Context** (after mode selected):

• **scc**: `Paste the rejection message or describe what the workload needs (privileged port, host path, fixed UID).`
• **route**: `Paste the Route YAML and describe the symptom (503, cert error, timeout, no traffic).`
• **gitops**: `New app delivery setup or debugging an existing Application? Which namespace?`
• **upgrade**: `Current OCP version and target version. Are you upgrading control plane, nodes, or operators?`
• **debug**: `Describe the symptom and paste any relevant events, logs, or error messages.`

---

Mode: scc

**Triggers:** SCC, SecurityContextConstraints, forbidden, unable to validate, runAsUser, privileged, capability, hostPath

Read `references/openshift.md` → SecurityContextConstraints section before responding.

Step 1 — Diagnose which SCC is blocking

# What SCC is currently assigned to a running pod
oc get pod <pod-name> -n <namespace> \
  -o jsonpath='{.metadata.annotations.openshift\.io/scc}'

# Simulate which SCC a service account would get for a given manifest
oc adm policy scc-subject-review -z <service-account> -n <namespace> \
  -f <manifest.yaml>

# List subjects allowed to use a specific SCC (users, groups, service accounts)
oc adm policy who-can use scc restricted-v2 -n <namespace>

Step 2 — Map rejection message to root cause

| Rejection message | Root cause | Fix | |---|---|---| | `unable to validate against any security context constraint` | No SCC grants the requested privilege | Grant a custom SCC with only what is needed | | `runAsUser` rejected | Fixed UID outside the namespace UID range | Remove `runAsUser`, let OpenShift assign; or use `anyuid` (document exception) | | `privileged` capability denied | Container requests `CAP_NET_ADMIN`, `CAP_SYS_PTRACE`, etc. | Remove the capability or create a custom SCC granting only that capability | | `hostPath` volume denied | Pod mounts a host directory | Replace with `emptyDir` or PVC; if required, grant `hostmount-anyuid` to the SA | | `allowPrivilegeEscalation` rejected | `securityContext.allowPrivilegeEscalation: true` | Set to `false` — this is enforced by `restricted-v2` |

Step 3 — Grant minimum SCC

# custom-scc.yaml — grant only what is needed
apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
  name: custom-net-admin
allowPrivilegedContainer: false
allowPrivilegeEscalation: false
runAsUser:
  type: MustRunAsRange
seLinuxContext:
  type: MustRunAs
fsGroup:
  type: MustRunAs
supplementalGroups:
  type: RunAsAny
allowedCapabilities:
  - NET_ADMIN
volumes:
  - configMap
  - emptyDir
  - projected
  - secret
  - persistentVolumeClaim

oc apply -f custom-scc.yaml

oc adm policy add-scc-to-user custom-net-admin \
  -z <service-account> -n <namespace>

# Verify
oc adm policy who-can use scc custom-net-admin -n <namespace>

SCC and Pod Security Admission (OCP 4.11+)

OpenShift 4.11+ runs both SCC and Kubernetes Pod Security Admission. PSA labels on the namespace add a second check — a pod blocked by PSA will not reach SCC evaluation.

# Check PSA labels on the namespace
oc get namespace <namespace> \
  -o jsonpath='{.metadata.labels}' | jq 'with_entries(select(.key | startswith("pod-security")))'

If PSA blocks what SCC permits, set the PSA label to match the granted SCC level or use `audit` mode while rolling out.

**Rollback:** Delete the `ClusterRoleBinding` or `RoleBinding` that grants the SCC. This revokes the SCC from the SA without affecting the SCC object itself.

---

Mode: route

**Triggers:** Route, 503, 504, TLS, edge, passthrough, reencrypt, timeout, route not admitted, no traffic

Read `references/openshift.md` → Routes and ingress section before responding.

TLS termination decision

| Scenario | Termination | |---|---| | Standard HTTPS, cert managed by router | `edge` | | Pod handles its own TLS (mTLS, specific cert) | `passthrough` | | End-to-end encryption with separate frontend and backend certs | `reencrypt` | | WebSocket / gRPC | `passthrough` or `edge` + timeout annotation |

Route templates

# Edge — most common
apiVersion: route.openshift.io/v1
kind: Route
metadata:
  name: my-app
  namespace: app-team
spec:
  host: my-app.apps.cluster.example.com
  to:
    kind: Service
    name: my-app
  port:
    targetPort: 8080
  tls:
    termination: edge
    insec