Skip to content

Commit fd8b9fd

Browse files
manjunathdhegde-2910manjunathdhegde-2910
authored
ohs_24.4.1_release (#226)
1 parent e4857a1 commit fd8b9fd

File tree

3 files changed

+413
-0
lines changed

3 files changed

+413
-0
lines changed

‎OracleHTTPServer/kubernetes/README.md‎

Lines changed: 242 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,242 @@
1+
# Deploying Oracle HTTP Server in Kubernetes
2+
3+
For full documentation see: [https://oracle.github.io/fmw-kubernetes/ohs](https://oracle.github.io/fmw-kubernetes/ohs)
4+
5+
6+
## Obtaining the Scripts
7+
8+
The sample scripts are available for download from GitHub.
9+
10+
To obtain the scripts, use the following command:
11+
12+
```
13+
git clone https://github.com/oracle/fmw-kubernetes.git
14+
```
15+
16+
The scripts appear in the following directory:
17+
18+
```
19+
fmw-kubernetes/OracleHTTPServer/kubernetes
20+
```
21+
22+
23+
## Scope
24+
This section lists the actions that the scripts perform as part of the deployment process. It also lists the tasks the scripts do not perform.
25+
26+
### What the Scripts Will do
27+
28+
The scripts will deploy Oracle HTTP Server in Kubernetes.
29+
30+
The scripts perform the following actions:
31+
32+
* Create an Oracle HTTP Server Instance in Kubernetes, with your own configuration.
33+
* Deploy Oracle WebGate and its associated configuration.
34+
* Create a NodePort Service for accessing the Oracle HTTP Server
35+
36+
## Create a Namespace
37+
38+
Create a namespace for your Oracle HTTP Server:
39+
40+
`kubectl create namespace ohsns`
41+
42+
## Create Secrets
43+
44+
### Create Registry Secret
45+
46+
If you are pulling your container image from a protected registry then you must create a secret with the connection credentials, for example,
47+
48+
`kubectl create secret -n hosts docker-registry regcred --docker-server=<REGISTRY> --docker-username=<REG_USER> --docker-password=<REG_PWD>`
49+
50+
Where:
51+
52+
* \<REGISTRY\> is the name of the registry you are using.
53+
* \<REG_USER\> is the name of the user you use to connect to the registry.
54+
* \<REG_PWD\> is the password you use to connect to the registry.
55+
56+
57+
### Create OHS Secret
58+
59+
The Oracle HTTP Server requires a username and password for the standalone OHS domain. To create this secret use the following command:
60+
61+
`kubectl create secret generic ohs-secret -n\<namespace> --from-literal=username=weblogic --from-literal=password='<password>'`
62+
63+
Replace \<password\> with a password of your choice.
64+
65+
## Prepare your OHS configuration files
66+
67+
Before you deploy OHS, you must prepare your OHS configuration files. Oracle HTTP Server in containers stores the OHS configuration inside Kubernetes configmaps, rather than on the filesystem. This allows the configuration to be independent of both the instance and filesystem.
68+
69+
The steps below assume familiarity with on premises Oracle HTTP Server in terms of general configuration and use of Oracle WebGate.
70+
71+
**Note:** Administrators should be aware of the following:
72+
73+
* If you do not specify configuration files beforehand, then the OHS container is deployed with a default configuration of Oracle HTTP Server.
74+
* The directories listed below are optional. For example, if you do not want to deploy WebGate then you do not need to create the webgateConf and webgateWallet directories. Similarly, if you do not want to copy files to htdocs then you do not need to create the htdocs directory.
75+
76+
Create the following directories for your OHS configuration:
77+
78+
```
79+
mkdir -p $WORKDIR/ohsConfig/httpconf
80+
mkdir -p $WORKDIR/ohsConfig/moduleconf
81+
mkdir -p $WORKDIR/ohsConfig/htdocs
82+
mkdir -p $WORKDIR/ohsConfig/htdocs/myapp
83+
mkdir -p $WORKDIR/ohsConfig/webgate/config/wallet
84+
mkdir -p $WORKDIR/ohsConfig/wallet/mywallet
85+
```
86+
87+
**Where:**
88+
89+
* **httpconf** - contains any configuration files you want to configure that are usually found in the $OHS\_DOMAIN\_HOME/config/fmwconfig/components/OHS/ohs1 directory. For example httpd.conf, ssl.conf and mod\_wl\_ohs.conf. The webgate.conf does not need to be copied as this will get generated automatically if deploying with WebGate.
90+
* **moduleconf** - contains any additional config files, for example virtual host configuration files that you want to copy to the $OHS\_DOMAIN\_HOME/config/fmwconfig/components/OHS/ohs1/moduleconf folder in the container.
91+
* **htdocs** - contains any html files, or similar, that you want to copy to the $OHS\_DOMAIN\_HOME/config/fmwconfig/components/OHS/ohs1/htdocs folder in the container.
92+
* **htdocs/myapp** - myapp is an example directory name that exists under htdocs. If you need to copy any directories under htdocs above, then create the directories you require.
93+
* **webgate/config** - contains the extracted WebGate configuration. For example, when you download the \<agent\>.zip file from Oracle Access Management Console, you extract the zip file into this directory. If you are accessing OAM URL’s via SSL, this directory must also contain the Certificate Authority cacert.pem file that signed the certificate of the OAM entry point. For example, if you will access OAM via a HTTPS Load Balancer URL, then cacert.pem is the CA certificate that signed the load balancer certificate.
94+
* **webgate/config/wallet** - contains the contents of the wallet directory extracted from the \<agent.zip\> file.
95+
* **wallet/mywallet** - If OHS is to be configured to use SSL, this directory contains the preconfigured OHS Wallet file cwallet.sso.
96+
97+
**Note:** Administrators should be aware of the following if configuring OHS for SSL:
98+
99+
* The wallet must contain a valid certificate.
100+
* Only auto-login-only wallets (cwallet.sso only) are supported. For example, wallets created with orapki using the -auto-login-only option. Password protected wallets (ewallet.p12) are not supported.
101+
* You must configure ssl.conf in $WORKDIR/ohsConfig/httpconf and set the directory for SSLWallet to: SSLWallet "${ORACLE\_INSTANCE}/config/fmwconfig/components/${COMPONENT\_TYPE}/instances/${COMPONENT\_NAME}/keystores/wallet/mywallet".
102+
103+
An example file system may contain the following:
104+
105+
```
106+
ls -R $WORKDIR/ohsConfig
107+
108+
/home/opc/OHSK8S/ohsConfig:
109+
110+
htdocs httpconf moduleconf wallet webgate
111+
112+
/home/opc/OHSK8S/ohsConfig/htdocs:
113+
114+
myapp mypage.html
115+
116+
/home/opc/OHSK8S/ohsConfig/htdocs/myapp:
117+
118+
index.html
119+
120+
/home/opc/OHSK8S/ohsConfig/httpconf:
121+
122+
httpd.conf mod_wl_ohs.conf ssl.conf
123+
124+
/home/opc/OHSK8S/ohsConfig/moduleconf:
125+
126+
vh.conf
127+
128+
/home/opc/OHSK8S/ohsConfig/wallet:
129+
130+
mywallet
131+
132+
/home/opc/OHSK8S/ohsConfig/wallet/mywallet:
133+
134+
cwallet.sso
135+
136+
/home/opc/OHSK8S/ohsConfig/webgate:
137+
138+
config
139+
140+
/home/opc/OHSK8S/ohsConfig/webgate/config:
141+
142+
cacert.pem cwallet.sso cwallet.sso.lck ObAccessClient.xml wallet
143+
144+
/home/opc/OHSK8S/ohsConfig/webgate/config/wallet:
145+
146+
cwallet.sso cwallet.sso.lck
147+
```
148+
149+
## Create configmaps for the OHS configuration files
150+
151+
**Note:** Before following this section, make sure you have created the directories and files as per Prepare your OHS configuration files.
152+
153+
Run the following commands to create the required configmaps for the OHS directories and files created in Prepare your OHS configuration files.
154+
155+
```
156+
cd $WORKDIR
157+
158+
kubectl create cm -n ohsns ohs-config --from-file=ohsConfig/moduleconf
159+
kubectl create cm -n ohsns ohs-httpd --from-file=ohsConfig/httpconf
160+
kubectl create cm -n ohsns ohs-htdocs --from-file=ohsConfig/htdocs
161+
kubectl create cm -n ohsns ohs-myapp --from-file=ohsConfig/htdocs/myapp
162+
kubectl create cm -n ohsns webgate-config --from-file=ohsConfig/webgate/config
163+
kubectl create cm -n ohsns webgate-wallet --from-file=ohsConfig/webgate/config/wallet
164+
kubectl create cm -n ohsns ohs-wallet --from-file=ohsConfig/wallet/mywallet
165+
```
166+
**Note:** Only create the configmaps for directories that you want to copy to OHS.
167+
168+
169+
170+
## Filling in the Sample Files
171+
172+
### Prepare the ohs.yaml file
173+
174+
In this section you prepare the `ohs.yaml` file ready for OHS deployment.
175+
176+
Make a copy of the ohs.yaml file:
177+
178+
`$ cp ohs.yaml ohs.yaml.orig`
179+
180+
Edit the ohs.yaml and change the following parameters to match your installation:
181+
182+
**Notes:**
183+
184+
* During the earlier creation of the namespace, configmaps, and secret, if you changed the names from the given examples, then you will need to update the values accordingly.
185+
* All configMaps are shown for completeness. Remove any configMaps that you are not using, for example if you don’t require htdocs then remove the ohs-htdocs configMap. If you are not deploying webgate then remove the webgate-config and webgate-wallet configMaps, and so forth.
186+
* If you have created any additional directories under htdocs, then add the additional entries in that match the configmap and directory names.
187+
* All configMaps used must mount to the directories stated.
188+
* Change the image to the correct image tag on Oracle Container Registry. If you are using your own container registry for the image, you will need to change the image location appropriately. If your own container registry is open, you do not need the imagePullSecrets.
189+
* Ports can be changed if required.
190+
* Set DEPLOY_WG to true or false depending on whether webgate is to be deployed.
191+
192+
### Prepare the ohs_service.yaml file
193+
194+
Make a copy of the ohs_service.yaml file:
195+
196+
```
197+
cd $WORKDIR
198+
cp ohs_service.yaml ohs_service.yaml.orig
199+
```
200+
Edit the ohs_service.yaml and modify the file accordingly. For example, if you are using your own httpd.conf file and have changed the port to anything other than 7777, you must change the targetPort and port to match. Similarly, if you don’t require SSL, then you would remove the section relating to -port: 4443.
201+
202+
## Deploying Oracle HTTP Server
203+
204+
### Creating the OHS Container
205+
206+
In this section you create the OHS container using the ohs.yaml file created in Prepare the ohs.yaml file.
207+
208+
Run the following command to create the OHS container:
209+
210+
`kubectl create -f $WORKDIR/ohs.yaml`
211+
212+
The output will look similar to the following:
213+
214+
configmap/ohs-script-configmap created
215+
216+
deployment.apps/ohs-domain created
217+
218+
Run the following command to view the status of the pods:
219+
220+
`kubectl get pods -n <namespace> -w`
221+
222+
### Creating OHS NodePort Service
223+
224+
Run the following command to create a Kubernetes service nodeport for OHS.
225+
226+
**Note:** Administrators should be aware of the following:
227+
228+
As this is a Kubernetes service it will deploy to whichever node it is run from. If that node goes down then it will start on another node.
229+
230+
If you create another OHS container on a different port, you will need to create another nodeport service for that OHS.
231+
232+
`kubectl create -f $WORKDIR/ohs_service.yaml`
233+
234+
The output will look similar to the following:
235+
236+
service/ohs-domain-nodeport created
237+
238+
Validate the service has been created using the command:
239+
240+
`kubectl get service -n <namespace>`
241+
242+

‎OracleHTTPServer/kubernetes/ohs.yaml‎

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
# Copyright (c) 2024, Oracle and/or its affiliates.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl.
3+
#
4+
# This is a sample file to create an Oracle HTTP Server Container.
5+
#
6+
apiVersion: v1
7+
kind: ConfigMap
8+
metadata:
9+
name: ohs-script-configmap
10+
namespace: <NAMESPACE>
11+
data:
12+
ohs-script.sh: |
13+
#!/bin/bash
14+
mkdir -p /u01/oracle/bootdir /u01/oracle/config /u01/oracle/config/moduleconf /u01/oracle/config/webgate/config
15+
{ echo -en "username=" && cat /ohs-config/username && echo -en "\npassword=" && cat /ohs-config/password; } > /u01/oracle/bootdir/domain.properties
16+
/u01/oracle/provisionOHS.sh
17+
18+
---
19+
20+
apiVersion: apps/v1
21+
kind: Deployment
22+
metadata:
23+
name: ohs-domain
24+
namespace: <NAMESPACE>
25+
spec:
26+
progressDeadlineSeconds: 600
27+
replicas: 1
28+
selector:
29+
matchLabels:
30+
oracle: ohs
31+
template:
32+
metadata:
33+
labels:
34+
oracle: ohs
35+
spec:
36+
containers:
37+
- name: ohs
38+
image: <IMAGE_NAME>
39+
env:
40+
- name: DEPLOY_WG
41+
value: "false"
42+
ports:
43+
- name: http
44+
containerPort: 7777
45+
- name: https
46+
containerPort: 4443
47+
resources:
48+
requests:
49+
cpu: 1000m
50+
memory: 1Gi
51+
securityContext:
52+
allowPrivilegeEscalation: false
53+
capabilities:
54+
drop:
55+
- ALL
56+
privileged: false
57+
runAsNonRoot: true
58+
runAsUser: 1000
59+
livenessProbe:
60+
exec:
61+
command:
62+
- /bin/bash
63+
- -c
64+
- pgrep httpd
65+
initialDelaySeconds: 5
66+
periodSeconds: 5
67+
readinessProbe:
68+
httpGet:
69+
port: 7777
70+
path: /helloWorld.html
71+
volumeMounts:
72+
- name: ohs-secret
73+
mountPath: /ohs-config
74+
- name: ohs-config
75+
mountPath: /u01/oracle/config/moduleconf
76+
- name: ohs-htdocs
77+
mountPath: /u01/oracle/config/htdocs
78+
- name: ohs-httpd
79+
mountPath: /u01/oracle/config/httpd
80+
- name: webgate-config
81+
mountPath: /u01/oracle/config/webgate/config
82+
- name: webgate-wallet
83+
mountPath: /u01/oracle/config/webgate/config/wallet
84+
- name: ohs-wallet
85+
mountPath: /u01/oracle/config/wallet/<WALLET_NAME>
86+
- name: script-volume
87+
mountPath: /ohs-bin
88+
readOnly: true
89+
command: ["/ohs-bin/ohs-script.sh"]
90+
imagePullSecrets:
91+
- name: regcred
92+
affinity:
93+
podAntiAffinity:
94+
preferredDuringSchedulingIgnoredDuringExecution:
95+
- weight: 100
96+
podAffinityTerm:
97+
labelSelector:
98+
matchExpressions:
99+
- key: oracle
100+
operator: In
101+
values:
102+
- ohs
103+
topologyKey: "kubernetes.io/hostname"
104+
restartPolicy: Always
105+
securityContext:
106+
seccompProfile:
107+
type: RuntimeDefault
108+
terminationGracePeriodSeconds: 30
109+
volumes:
110+
- name: ohs-secret
111+
secret:
112+
defaultMode: 0444
113+
secretName: ohs-secret
114+
- name: script-volume
115+
configMap:
116+
defaultMode: 0555
117+
name: ohs-script-configmap
118+
- name: ohs-config
119+
configMap:
120+
defaultMode: 0555
121+
name: ohs-config
122+
- name: ohs-httpd
123+
configMap:
124+
defaultMode: 0555
125+
name: ohs-httpd
126+
- name: ohs-htdocs
127+
configMap:
128+
defaultMode: 0555
129+
name: ohs-htdocs
130+
- name: webgate-config
131+
configMap:
132+
defaultMode: 0555
133+
name: webgate-config
134+
- name: webgate-wallet
135+
configMap:
136+
defaultMode: 0555
137+
name: webgate-wallet
138+
- name: ohs-wallet
139+
configMap:
140+
defaultMode: 0555
141+
name: ohs-wallet
142+
strategy:
143+
type: RollingUpdate
144+
rollingUpdate:
145+
maxUnavailable: 1
146+

0 commit comments

Comments
 (0)