<commit_before>OpenShift 3 Application Lifecycle Sample
========================================

This is a set of configuration files and scripts which work with OpenShift 3 to create a new application and perform application builds.

This example assumes you have successfully built the `openshift`
binary executable (normally located under origin/\_output/local/go/bin),
you have that and its symlink/copy `osc` in your `PATH` and root's,
and Docker is installed and working.  See
https://github.com/openshift/origin/blob/master/CONTRIBUTING.adoc.

Alternatively, if you are using the openshift/origin Docker container, please
make sure you follow these instructions first:
https://github.com/openshift/origin/blob/master/examples/sample-app/container-setup.md

Security Warning
----------------
OpenShift no longer requires SElinux to be disabled, however OpenShift is a system which runs Docker containers on your system.  In some cases (build operations and the registry service) it does so using privileged containers.  Furthermore those containers access your host's Docker daemon and perform `docker build` and `docker push` operations.  As such, you should be aware of the inherent security risks associated with performing `docker run` operations on arbitrary images as they effectively have root access.  This is particularly relevant when running the OpenShift nodes directly on your host system.

For more information, see these articles:

* http://opensource.com/business/14/7/docker-security-selinux
* https://docs.docker.com/articles/security/

The OpenShift security model will continue to evolve and tighten as we head towards production ready code.

Setup
-----
At this stage of OpenShift 3 development, there are a few things that you will need to configure on the host where OpenShift is running in order for things to work.

- - -

**NOTE:** You do not need to do this if you are using [Vagrant](https://vagrantup.com/) to work with OpenShift (see the [Vagrantfile](https://github.com/openshift/origin/blob/master/Vagrantfile) for more info). These changes are only necessary when you have set up the host system yourself. If you are using Vagrant, [jump to the next section](#application-build-deploy-and-update-flow).

- - -

### Docker Changes ###

First, you'll need to configure the Docker daemon on your host to trust the Docker registry service you'll be starting.

To do this, you need to add "--insecure-registry 172.30.17.0/24" to the Docker daemon invocation, eg:

    $ docker -d --insecure-registry 172.30.17.0/24

Note that you need to have installed Docker 1.3.2 or higher in order to use the `--insecure-registry` flag.

If you are running Docker as a service via `systemd`, you can add this argument to the options value in `/etc/sysconfig/docker`

This will instruct the Docker daemon to trust any Docker registry on the 172.30.17.0/24 subnet,
rather than requiring the registry to have a verifiable certificate.

These instructions assume you have not changed the kubernetes/openshift service subnet configuration from the default value of 172.30.17.0/24.

### FirewallD Changes ###

Similar to our work on SELinux policies, the OpenShift firewalld rules are also a work in progress. For now it is easiest to disable firewalld altogether:

    $ sudo systemctl stop firewalld

Firewalld will start again on your next reboot, but you can manually restart it with this command when you are done with the sample app:

    $ sudo systemctl start firewalld

### Still Having Trouble? ###

If you hit any snags while taking the sample app for a spin, check out the [troubleshooting guide](https://github.com/openshift/origin/blob/master/docs/debugging-openshift.md).

Application Build, Deploy, and Update Flow
------------------------------------------

This section covers how to perform all the steps of building, deploying, and updating an application on the OpenShift platform.

NOTE: All commands assume the `osc` binary/symlink is in your path and
the present working directory is the same directory as this README.

1. *Optional*: Pre-pull the Docker images used in this sample.  This is
    not strictly necessary as OpenShift will pull the images as it needs them,
    but by doing it up front it will prevent lengthy operations during build
    and deployment which might otherwise lead you to believe the process
    has failed or hung.

        $ ./pullimages.sh

2. Launch an all-in-one `openshift` instance

        $ sudo openshift start &> logs/openshift.log &

    Note: sudo is required so the kubernetes proxy can manipulate iptables rules to expose service ports.

3. Set up your client to reach the OpenShift master now running.

    Since OpenShift services are secured by TLS, your client will
    need to accept the server certificates and present its own client
    certificate. These are generated as part of the `openshift start`
    command in whatever the current directory is at the time. You will
    need to point osc and curl at the appropriate .kubeconfig in order
    to connect to OpenShift. Assuming you are running as a user other
    than root, you will also need to make the .kubeconfig readable by
    that user. (Note: this is just for example purposes; in a real
    installation, users would generate their own keys and not have access
    to the system keys.)

        $ export KUBECONFIG=`pwd`/openshift.local.certificates/admin/.kubeconfig
        $ export CURL_CA_BUNDLE=`pwd`/openshift.local.certificates/admin/root.crt
        $ sudo chmod +r "$KUBECONFIG"

4. Bind a user to the `view` role in the default namespace so you can observe progress in the web console

        $ openshift ex policy add-user view anypassword:test-admin

5. *Optional:* View the OpenShift web console in your browser by browsing to `https://<host>:8444`.  Login using the user `test-admin` and any password.

    * You will need to have the browser accept the certificate at
      `https://<host>:8443` before the console can consult the OpenShift
      API. Of course this would not be necessary with a legitimate
      certificate.
    * If you click the `default` project and leave the tab open,
      you'll see the page update as you deploy objects into the project
      and run builds.

6. Deploy a private docker registry within OpenShift with the certs necessary for access to master:

        $ sudo chmod +r ./openshift.local.certificates/openshift-client/key.key
        $ openshift ex registry --create --credentials="${KUBECONFIG}"
          docker-registry # the service
          docker-registry # the deployment config

    Note that the private Docker registry is using ephemeral storage,
    so when it is stopped, the image will be lost. An external volume
    could be used for persistent storage, but that is beyond the scope
    of this tutorial.

7. Confirm the registry is started (this can take a few minutes):

        $ osc describe service docker-registry

    You should see:

        Name:       docker-registry
        Labels:     docker-registry=default
        Selector:   docker-registry=default
        Port:       5000
        Endpoints:  172.17.0.60:5000
        No events.

    If "Endpoints" is listed as <none>, your registry hasn't started yet.  You can run `osc get pods` to
    see the registry pod and if there are any issues. Once the pod has started, the IP of the pod will
    be added to the docker-registry service list so that it's reachable from other places.

8. Confirm the registry is accessible (you may need to run this more than once):

        $ curl `osc get service docker-registry --template="{{ .portalIP}}:{{ .port }}"`

    You should see:

        "docker-registry server (dev) (v0.9.0)"


9. Create a new project in OpenShift. This creates a namespace `test` to contain the builds and app that we will generate below.

        $ openshift ex new-project test --display-name="OpenShift 3 Sample" --description="This is an example project to demonstrate OpenShift v3" --admin=anypassword:<PASSWORD>

10. *Optional:* View the OpenShift web console in your browser by browsing to `https://<host>:8444`.  Login using the user `test-admin` and any password.
<commit_msg>Fix escaping and value<commit_after>OpenShift 3 Application Lifecycle Sample
========================================

This is a set of configuration files and scripts which work with OpenShift 3 to create a new application and perform application builds.

This example assumes you have successfully built the `openshift`
binary executable (normally located under origin/\_output/local/go/bin),
you have that and its symlink/copy `osc` in your `PATH` and root's,
and Docker is installed and working.  See
https://github.com/openshift/origin/blob/master/CONTRIBUTING.adoc.

Alternatively, if you are using the openshift/origin Docker container, please
make sure you follow these instructions first:
https://github.com/openshift/origin/blob/master/examples/sample-app/container-setup.md

Security Warning
----------------
OpenShift no longer requires SElinux to be disabled, however OpenShift is a system which runs Docker containers on your system.  In some cases (build operations and the registry service) it does so using privileged containers.  Furthermore those containers access your host's Docker daemon and perform `docker build` and `docker push` operations.  As such, you should be aware of the inherent security risks associated with performing `docker run` operations on arbitrary images as they effectively have root access.  This is particularly relevant when running the OpenShift nodes directly on your host system.

For more information, see these articles:

* http://opensource.com/business/14/7/docker-security-selinux
* https://docs.docker.com/articles/security/

The OpenShift security model will continue to evolve and tighten as we head towards production ready code.

Setup
-----
At this stage of OpenShift 3 development, there are a few things that you will need to configure on the host where OpenShift is running in order for things to work.

- - -

**NOTE:** You do not need to do this if you are using [Vagrant](https://vagrantup.com/) to work with OpenShift (see the [Vagrantfile](https://github.com/openshift/origin/blob/master/Vagrantfile) for more info). These changes are only necessary when you have set up the host system yourself. If you are using Vagrant, [jump to the next section](#application-build-deploy-and-update-flow).

- - -

### Docker Changes ###

First, you'll need to configure the Docker daemon on your host to trust the Docker registry service you'll be starting.

To do this, you need to add "--insecure-registry 172.30.17.0/24" to the Docker daemon invocation, eg:

    $ docker -d --insecure-registry 172.30.17.0/24

Note that you need to have installed Docker 1.3.2 or higher in order to use the `--insecure-registry` flag.

If you are running Docker as a service via `systemd`, you can add this argument to the options value in `/etc/sysconfig/docker`

This will instruct the Docker daemon to trust any Docker registry on the 172.30.17.0/24 subnet,
rather than requiring the registry to have a verifiable certificate.

These instructions assume you have not changed the kubernetes/openshift service subnet configuration from the default value of 172.30.17.0/24.

### FirewallD Changes ###

Similar to our work on SELinux policies, the OpenShift firewalld rules are also a work in progress. For now it is easiest to disable firewalld altogether:

    $ sudo systemctl stop firewalld

Firewalld will start again on your next reboot, but you can manually restart it with this command when you are done with the sample app:

    $ sudo systemctl start firewalld

### Still Having Trouble? ###

If you hit any snags while taking the sample app for a spin, check out the [troubleshooting guide](https://github.com/openshift/origin/blob/master/docs/debugging-openshift.md).

Application Build, Deploy, and Update Flow
------------------------------------------

This section covers how to perform all the steps of building, deploying, and updating an application on the OpenShift platform.

NOTE: All commands assume the `osc` binary/symlink is in your path and
the present working directory is the same directory as this README.

1. *Optional*: Pre-pull the Docker images used in this sample.  This is
    not strictly necessary as OpenShift will pull the images as it needs them,
    but by doing it up front it will prevent lengthy operations during build
    and deployment which might otherwise lead you to believe the process
    has failed or hung.

        $ ./pullimages.sh

2. Launch an all-in-one `openshift` instance

        $ sudo openshift start &> logs/openshift.log &

    Note: sudo is required so the kubernetes proxy can manipulate iptables rules to expose service ports.

3. Set up your client to reach the OpenShift master now running.

    Since OpenShift services are secured by TLS, your client will
    need to accept the server certificates and present its own client
    certificate. These are generated as part of the `openshift start`
    command in whatever the current directory is at the time. You will
    need to point osc and curl at the appropriate .kubeconfig in order
    to connect to OpenShift. Assuming you are running as a user other
    than root, you will also need to make the .kubeconfig readable by
    that user. (Note: this is just for example purposes; in a real
    installation, users would generate their own keys and not have access
    to the system keys.)

        $ export KUBECONFIG=`pwd`/openshift.local.certificates/admin/.kubeconfig
        $ export CURL_CA_BUNDLE=`pwd`/openshift.local.certificates/admin/root.crt
        $ sudo chmod +r "$KUBECONFIG"

4. Bind a user to the `view` role in the default namespace so you can observe progress in the web console

        $ openshift ex policy add-user view anypassword:<PASSWORD>

5. *Optional:* View the OpenShift web console in your browser by browsing to `https://<host>:8444`.  Login using the user `test-admin` and any password.

    * You will need to have the browser accept the certificate at
      `https://<host>:8443` before the console can consult the OpenShift
      API. Of course this would not be necessary with a legitimate
      certificate.
    * If you click the `default` project and leave the tab open,
      you'll see the page update as you deploy objects into the project
      and run builds.

6. Deploy a private docker registry within OpenShift with the certs necessary for access to master:

        $ sudo chmod +r ./openshift.local.certificates/openshift-client/key.key
        $ openshift ex registry --create --credentials="${KUBECONFIG}"
          docker-registry # the service
          docker-registry # the deployment config

    Note that the private Docker registry is using ephemeral storage,
    so when it is stopped, the image will be lost. An external volume
    could be used for persistent storage, but that is beyond the scope
    of this tutorial.

7. Confirm the registry is started (this can take a few minutes):

        $ osc describe service docker-registry

    You should see:

        Name:       docker-registry
        Labels:     docker-registry=default
        Selector:   docker-registry=default
        Port:       5000
        Endpoints:  172.17.0.60:5000
        No events.

    If "Endpoints" is listed as `<empty>`, your registry hasn't started yet.  You can run `osc get pods` to
    see the registry pod and if there are any issues. Once the pod has started, the IP of the pod will
    be added to the docker-registry service list so that it's reachable from other places.

8. Confirm the registry is accessible (you may need to run this more than once):

        $ curl `osc get service docker-registry --template="{{ .portalIP}}:{{ .port }}"`

    You should see:

        "docker-registry server (dev) (v0.9.0)"


9. Create a new project in OpenShift. This creates a namespace `test` to contain the builds and app that we will generate below.

        $ openshift ex new-project test --display-name="OpenShift 3 Sample" --description="This is an example project to demonstrate OpenShift v3" --admin=anypassword:test-admin

10. *Optional:* View the OpenShift web console in your browser by browsing to `https://<host>:8444`.  Login using the user `test-admin` and any password.

{'fraction_non_alphanumeric': 0.0736405754693977, 'fraction_numerical': 0.011338697878566204, 'mean_word_length': 3.4920591456736036, 'pattern_counts': {'":': 0, '<': 13, '<?xml version=': 0, '>': 15, 'https://': 18, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 10, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6485465', 'n_tokens_mistral': 4415, 'n_tokens_neox': 4091, 'n_words': 2183}