Red Hat OpenShift
SDP operators are certified for the OpenShift platform and can be installed from the OperatorHub.
| OpenShift installations with FIPS mode enabled are not supported. This is because neither the SDP operators, nor the supported Apache products are FIPS-compliant. |
| The operators deployed with OLM might have higher memory requests (and limits) compared to our Helm charts, as we have seen typical production OpenShift clusters being larger than typical non-Openshift clusters. The reason is that memory usage of some of our operators scales with the number of objects in your Kubernetes cluster. However, you can fine-tune the operator memory requirements using a custom Subscription object as described below, so this note is only about the default resources! |
Customizing operator installations
As described in the Openshift Subscription documentation you can configure the deployed operators.
E.g. depending on the cluster size, you may need to customize the resources requested by the SDP operator containers. This is possible when installing the operators via a Subscription CustomResource.
For example, to assign 256Mi of memory to the Apache Kafka operator, you need to create a custom Subscription as follows:
---
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
name: stackable-kafka-operator
namespace: stackable-operators
spec:
channel: stable
installPlanApproval: Automatic
name: stackable-kafka-operator
source: certified-operators
sourceNamespace: openshift-marketplace
startingCSV: kafka-operator.v24.7.0
config:
resources:
requests:
cpu: 100m
memory: 256Mi
limits:
cpu: 100m
memory: 256MiIn addition, You can restrict the operator to watch a specific namespace. By default, the operator watches all namespaces.
For example, to restrict the Kafka operator to watching only a namespace called kafka-namespace you add the following properties to the Subscription manifest:
spec:
config:
env:
- name: WATCH_NAMESPACE
value: kafka-namespacesecret and listener-operator
The secret and listener operator are not deployed by OLM directly but rather by a helper tool called olm-deployer. This tool is needed to work around some OLM limitations that prevent it from directly installing these operators.
In this case, olm-deployer takes it’s own resource requests and applies them to all containers on the DaemonSets of these operators..
This allows you to customize the resources of the DaemonSet in the same way as for the other operators - but doesn’t allow individual resources for each container.
Security context constraints
Starting with the release version 24.7.0, all products run with the nonroot-v2 security context constraints (SCC) on OpenShift. This security context is used by the product’s cluster role.
Operators (with two exceptions) don’t request a specific SCC to run with. Usually OpenShift will select the restricted or restricted-v2 SCC unless the cluster admins have specifically assigned a different one to the namespace where the operators are running.
The two exceptions are the secret and the listener operators. These need additional permissions not available in the restricted SCCs to propagate volume mounts to the requesting pods.