Skip to content

README.md

Latest commit

 

History

History
172 lines (129 loc) · 6.88 KB

README.md

File metadata and controls

172 lines (129 loc) · 6.88 KB

ForgeOps on OpenShift CRC Deployment

Production-ready scripts for deploying ForgeRock Identity Platform (ForgeOps) on Red Hat OpenShift CRC (Code Ready Containers). Solves the 3 most common deployment failures: SCC violations, internal registry issues, and disk exhaustion.

Full guide: Deploying ForgeRock ForgeOps on Red Hat OpenShift CRC: A Step-by-Step Guide

The Problem This Solves

Most ForgeOps-on-OpenShift deployments fail at the same 3 points:

Error Root Cause Fix
pods "ig-0" is forbidden: unable to validate against any security context constraint ForgeRock runs as UID 11111; OpenShift restricts UIDs to 1000680000+ Custom SCC (scc/forgerock-scc.yaml)
Failed to pull image: ImagePullBackOff Internal registry not exposed; TLS cert not trusted scripts/01-setup-registry.sh
Evicted pod: node was low on ephemeral-storage ForgeRock images are 600MB–1.2GB each; CRC default disk is 31GB Resize to 80GB in setup

Hardware Requirements

Resource Minimum Recommended
CPUs 8 vCPUs 16 vCPUs
Memory 16 GB 32 GB
Disk 80 GB 100 GB
OS macOS 10.14+ / RHEL / Ubuntu Same

Quick Start

# Clone this repo
git clone https://github.com/IAMDevBox/forgeops-openshift-deployment.git
cd forgeops-openshift-deployment

# Make scripts executable
chmod +x scripts/*.sh

# Step 1: Setup CRC (5-10 min)
./scripts/00-setup-crc.sh

# Step 2: Expose internal registry and trust TLS cert
eval $(crc oc-env)
oc login -u kubeadmin https://api.crc.testing:6443
./scripts/01-setup-registry.sh

# Step 3: Create namespace and apply ForgeRock SCC
./scripts/02-apply-scc.sh

# Step 4: Clone ForgeOps and build images (requires ForgeRock license)
git clone https://github.com/ForgeRock/forgeops.git ~/forgeops
./scripts/03-build-push-images.sh

# Step 5: Deploy ForgeRock components
./scripts/04-deploy-forgeops.sh

Directory Structure

forgeops-openshift-deployment/
├── scc/
│   └── forgerock-scc.yaml          # Custom SecurityContextConstraints for ForgeRock
├── scripts/
│   ├── 00-setup-crc.sh             # Install and configure OpenShift CRC
│   ├── 01-setup-registry.sh        # Expose internal image registry
│   ├── 02-apply-scc.sh             # Create namespace and bind SCC
│   ├── 03-build-push-images.sh     # Build and push ForgeRock images
│   ├── 04-deploy-forgeops.sh       # Deploy ForgeRock platform
│   └── 05-troubleshoot.sh          # Diagnose common failures
└── README.md

The SCC Configuration Explained

The key configuration is the custom SecurityContextConstraints:

# scc/forgerock-scc.yaml
runAsUser:
  type: RunAsAny  # Allows ForgeRock's UID 11111 (vs default 1000680000+)
fsGroup:
  type: RunAsAny  # Allows ForgeRock's GID
supplementalGroups:
  type: RunAsAny
allowedCapabilities:
  - NET_BIND_SERVICE  # Required for IG port 443/80 binding

Without this SCC, every ForgeRock pod fails immediately with:

Error: pods "am-0" is forbidden: unable to validate against any security context constraint

See the full SCC guide for binding to specific service accounts.

Component Deployment Order

ForgeRock components have a strict startup dependency:

DS (Directory Server) → AM + IDM (can be parallel) → IG

The 04-deploy-forgeops.sh script handles this order automatically. For individual component deployment:

# Individual components (recommended for CRC with limited RAM)
DEPLOY_MODE=individual ./scripts/04-deploy-forgeops.sh

# Full stack (requires 32GB RAM)
DEPLOY_MODE=full ./scripts/04-deploy-forgeops.sh

Troubleshooting

Run the diagnostic script first:

./scripts/05-troubleshoot.sh

Common Errors and Fixes

SCC violation:

# Re-apply SCC (idempotent)
oc apply -f scc/forgerock-scc.yaml
oc adm policy add-scc-to-user forgerock-scc -z default -n forgerock

Image pull failure:

# Re-login to registry
REGISTRY=$(oc get route default-route -n openshift-image-registry -o jsonpath='{.spec.host}')
podman login -u $(oc whoami) -p $(oc whoami -t) $REGISTRY --tls-verify=false

Disk exhaustion:

# Clean failed pods
oc delete pod --field-selector=status.phase==Failed -n forgerock
oc delete pod --field-selector=status.phase==Evicted -n forgerock
oc adm prune images --confirm

Related Resources on IAMDevBox

Environment Variables

Variable Default Description
NAMESPACE forgerock OpenShift project name
FQDN forgerock.apps-crc.testing Base FQDN for routes
FORGEOPS_DIR ~/forgeops Path to cloned ForgeOps repo
FORGEOPS_VERSION 7.3.0 ForgeOps release tag
CRC_CPUS 8 vCPU count for CRC
CRC_MEMORY 16384 Memory in MB for CRC
CRC_DISK_SIZE 80 Disk size in GB for CRC
PULL_SECRET ~/Downloads/pull-secret.txt Red Hat pull secret path
DEPLOY_MODE individual individual or full

License

Scripts are MIT licensed. ForgeRock/PingOne Advanced Identity Cloud software requires a valid ForgeRock/Ping license.

Maintained by IAMDevBox.com — Identity and Access Management tutorials and tools.