<commit_before>[[installing-openshift]]

:cmdcli: oc

== Installing {ProductName} on OpenShift

include::common/prerequisites-openshift.adoc[leveloffset=+1]

include::common/install-procedure.adoc[leveloffset+=1]

To simplify deployment, have a look at the `deploy-openshift.sh` script which should work on Linux
and Mac. You can invoke the deployment script with `-h` to view a list of options.

This guide will walk through the manual deployment procedure and should work on any platform
supporting the OpenShift client.

==== Creating project for {ProductName}

. Create enmasse project:
+
[options="nowrap"]
----
oc new-project enmasse
----

==== Deploying authentication services

{ProductName} require at least 1 authentication service to be deployed. The authentication service
can either be none (allow all), standard (keycloak) or external (not managed by enmasse).

===== Deploying the none authentication service

.Procedure

. Create a certificate to use for the none authentication service. For testing purposes, you can create a self-signed certificate:
+
[options="nowrap"]
----
mkdir -p none-authservice-cert
openssl req -new -x509 -batch -nodes -days 11000 -subj "/O=io.enmasse/CN=none-authservice.enmasse.svc.cluster.local" -out none-authservice-cert/tls.crt -keyout none-authservice-cert/tls.key
----

. Create secret with the none authentication service certificate:
+
[options="nowrap"]
----
oc create secret tls none-authservice-cert --cert=none-authservice-cert/tls.crt --key=none-authservice-cert/tls.key
----

. Create the none authentication service:
+
[options="nowrap"]
----
oc process -f ./openshift/addons/none-authservice.yaml | oc create -f -
----

===== Deploying the standard authentication service

.Procedure

. Create a certificate to use for the standard authentication service. For testing purposes, you can create a self-signed certificate:
+
[options="nowrap"]
----
mkdir -p standard-authservice-cert
openssl req -new -x509 -batch -nodes -days 11000 -subj "/O=io.enmasse/CN=standard-authservice.enmasse.svc.cluster.local" -out standard-authservice-cert/tls.crt -keyout standard-authservice-cert/tls.key
----

. Create secret with the standard authentication service certificate:
+
[options="nowrap"]
----
oc create secret tls standard-authservice-cert --cert=standard-authservice-cert/tls.crt --key=standard-authservice-cert/tls.key
----

. Create secret with keycloak admin credentials. Choose password wisely as this user will have complete access over authentication and authorization policies:
+
[options="nowrap"]
----
oc create secret generic keycloak-credentials --from-literal=admin.username=admin --from-literal=admin.password=<PASSWORD>
----

. Give view permissions for the keycloak controller:
+
[options="nowrap"]
----
oc adm add-role-to-user view system:serviceaccount:$(oc project -q):default
----

. Create the standard authentication service:
+
[options="nowrap"]
----
oc process -f ./openshift/addons/standard-authservice.yaml | oc create -f -
----

==== Deploying {ProductName}

To deploy {ProductName}, it is recommended that you have cluster-admin access in order to set up the
required roles for creating namespaces and managing resources in those namespaces. See
<<openshift-install-single-address-space>> for how to deploy {ProductName} without cluster-admin
access, which will restrict it to a single address space.

.Procedure

. Create a service account for the {ProductName} address controller:
+
[options="nowrap"]
----
oc create sa enmasse-admin
----

. Create cluster-wide roles used by the `enmasse-admin` service account:
+
[options="nowrap"]
----
oc login -u system:admin
oc create -f ./openshift/cluster-roles.yaml
----

. Grant cluster-admin privileges to service account:
+
[options="nowrap"]
----
oc login -u system:admin
oc adm policy add-cluster-role-to-user enmasse-namespace-admin system:serviceaccount:enmasse:enmasse-admin
----
+
*Note*: You can log back in as the regular user after this step.

. Create a certificate to use for the address controller. For testing purposes, you can create a self-signed certificate:
+
[options="nowrap"]
----
mkdir -p address-controller-cert/
openssl req -new -x509 -batch -nodes -days 11000 -subj "/O=io.enmasse/CN=address-controller.enmasse.svc.cluster.local" -out address-controller-cert/tls.crt -keyout address-controller-cert/tls.key
----

. Create a secret containing the address-controller certificate:
+
[options="nowrap"]
----
oc create secret tls address-controller-cert --cert=address-controller-cert/tls.crt --key=address-controller-cert/tls.key
----

. Deploy the address-controller:
+
[options="nowrap"]
----
oc process -f ./openshift/enmasse.yaml ENABLE_RBAC=true ADDRESS_CONTROLLER_CERT_SECRET=address-controller-cert | oc create -f -
----
+
The deployments required for running {ProductName} are now created.

. {ProductName} will be up and running once all pods in the 'enmasse' namespace are in the `Running` state:
+
[options="nowrap"]
----
oc get pods -n enmasse
----

==== Deploying {ProductName} limited to a single address space
[[openshift-install-single-address-space]]

.Procedure

. Create service accounts for the {ProductName} address controller and address space:
+
[options="nowrap"]
----<commit_msg>Update link text<commit_after>[[installing-openshift]]

:cmdcli: oc

== Installing {ProductName} on OpenShift

include::common/prerequisites-openshift.adoc[leveloffset=+1]

include::common/install-procedure.adoc[leveloffset+=1]

To simplify deployment, have a look at the `deploy-openshift.sh` script which should work on Linux
and Mac. You can invoke the deployment script with `-h` to view a list of options.

This guide will walk through the manual deployment procedure and should work on any platform
supporting the OpenShift client.

==== Creating project for {ProductName}

. Create enmasse project:
+
[options="nowrap"]
----
oc new-project enmasse
----

==== Deploying authentication services

{ProductName} require at least 1 authentication service to be deployed. The authentication service
can either be none (allow all), standard (keycloak) or external (not managed by enmasse).

===== Deploying the none authentication service

.Procedure

. Create a certificate to use for the none authentication service. For testing purposes, you can create a self-signed certificate:
+
[options="nowrap"]
----
mkdir -p none-authservice-cert
openssl req -new -x509 -batch -nodes -days 11000 -subj "/O=io.enmasse/CN=none-authservice.enmasse.svc.cluster.local" -out none-authservice-cert/tls.crt -keyout none-authservice-cert/tls.key
----

. Create secret with the none authentication service certificate:
+
[options="nowrap"]
----
oc create secret tls none-authservice-cert --cert=none-authservice-cert/tls.crt --key=none-authservice-cert/tls.key
----

. Create the none authentication service:
+
[options="nowrap"]
----
oc process -f ./openshift/addons/none-authservice.yaml | oc create -f -
----

===== Deploying the standard authentication service

.Procedure

. Create a certificate to use for the standard authentication service. For testing purposes, you can create a self-signed certificate:
+
[options="nowrap"]
----
mkdir -p standard-authservice-cert
openssl req -new -x509 -batch -nodes -days 11000 -subj "/O=io.enmasse/CN=standard-authservice.enmasse.svc.cluster.local" -out standard-authservice-cert/tls.crt -keyout standard-authservice-cert/tls.key
----

. Create secret with the standard authentication service certificate:
+
[options="nowrap"]
----
oc create secret tls standard-authservice-cert --cert=standard-authservice-cert/tls.crt --key=standard-authservice-cert/tls.key
----

. Create secret with keycloak admin credentials. Choose password wisely as this user will have complete access over authentication and authorization policies:
+
[options="nowrap"]
----
oc create secret generic keycloak-credentials --from-literal=admin.username=admin --from-literal=admin.password=<PASSWORD>
----

. Give view permissions for the keycloak controller:
+
[options="nowrap"]
----
oc adm add-role-to-user view system:serviceaccount:$(oc project -q):default
----

. Create the standard authentication service:
+
[options="nowrap"]
----
oc process -f ./openshift/addons/standard-authservice.yaml | oc create -f -
----

==== Deploying {ProductName}

To deploy {ProductName}, it is recommended that you have cluster-admin access in order to set up the
required roles for creating namespaces and managing resources in those namespaces. See
<<openshift-install-single-address-space>> for how to deploy {ProductName} without cluster-admin
access, which will restrict it to a single address space.

.Procedure

. Create a service account for the {ProductName} address controller:
+
[options="nowrap"]
----
oc create sa enmasse-admin
----

. Create cluster-wide roles used by the `enmasse-admin` service account:
+
[options="nowrap"]
----
oc login -u system:admin
oc create -f ./openshift/cluster-roles.yaml
----

. Grant cluster-admin privileges to service account:
+
[options="nowrap"]
----
oc login -u system:admin
oc adm policy add-cluster-role-to-user enmasse-namespace-admin system:serviceaccount:enmasse:enmasse-admin
----
+
*Note*: You can log back in as the regular user after this step.

. Create a certificate to use for the address controller. For testing purposes, you can create a self-signed certificate:
+
[options="nowrap"]
----
mkdir -p address-controller-cert/
openssl req -new -x509 -batch -nodes -days 11000 -subj "/O=io.enmasse/CN=address-controller.enmasse.svc.cluster.local" -out address-controller-cert/tls.crt -keyout address-controller-cert/tls.key
----

. Create a secret containing the address-controller certificate:
+
[options="nowrap"]
----
oc create secret tls address-controller-cert --cert=address-controller-cert/tls.crt --key=address-controller-cert/tls.key
----

. Deploy the address-controller:
+
[options="nowrap"]
----
oc process -f ./openshift/enmasse.yaml ENABLE_RBAC=true ADDRESS_CONTROLLER_CERT_SECRET=address-controller-cert | oc create -f -
----
+
The deployments required for running {ProductName} are now created.

. {ProductName} will be up and running once all pods in the 'enmasse' namespace are in the `Running` state:
+
[options="nowrap"]
----
oc get pods -n enmasse
----

[[openshift-install-single-address-space]]
==== Deploying {ProductName} limited to a single address space

.Procedure

. Create service accounts for the {ProductName} address controller and address space:
+
[options="nowrap"]
----
{'fraction_non_alphanumeric': 0.12220424478918816, 'fraction_numerical': 0.005139430855620063, 'mean_word_length': 4.189135802469136, 'pattern_counts': {'":': 0, '<': 9, '<?xml version=': 0, '>': 9, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '822283', 'n_tokens_mistral': 3129, 'n_tokens_neox': 3028, 'n_words': 1040}