Recipe: Testing Restricted Policies with OpenShift and the IBM FHIR Server Schema Tool

Docker: ibmcom/ibm-fhir-schematool supports onboarding and offboarding of a schema in support of the IBM FHIR Server. I am working on a project that runs on OpenShift using CodeReadyContainers, and I needed to test the image with a restricted policy.

Note, these are roughly my notes from testing, and converted to a post.

Recipe

1. Start up Code Ready Containers or create your OpenShift environment.

2. Connect to the Docker registry in CRC

docker login -u kubeadmin -p $(oc whoami -t) default-route-openshift-image-registry.apps-crc.testing

3. Build your Docker image with a new tag

docker build . -t default/ibm-fhir-schematool:latest
docker push default/ibm-fhir-schematool:latest

4. Login to OpenShift

oc login -u $(oc whoami) -p $(oc whoami -t)

5. Create a new persistence.json using one of the examples as a template

oc create secret generic persistence-json --from-file=persistence-onboard-example.json -n=default

6. Add the restricted policy to the developer user.

oc adm policy add-scc-to-user restricted developer

7. Add the developer user to the default namespace.

oc adm policy add-role-to-user edit developer -n=default

8. Make the locak registry lookup use relative names

oc set image-lookup  --all

9. Create a new pod.yaml

apiVersion: v1
kind: Pod
metadata:
  name: ibm-fhir-server-schematool
spec:
  containers:
    - name: test-container
      image: default/ibm-fhir-schematool
      env:
        - name: ENV_TOOL_INPUT
          valueFrom:
            secretKeyRef:
              name: persistence-json
              key: persistence-onboard-example.json

10. Create the pod.

oc apply -f pod.yaml --as=developer  -n=default

11. Check the logs, and you should see a successful run.

oc logs pod/ibm-fhir-server-schematool

References

• OpenShift: Managing SCCs in OpenShift
• OpenShift: Manging Security Constraints
• OpenShift: How do I allow another user to work on my project?
• StackOverflow: What’s the best way to share/mount one file into a pod?
• Kubernetes: Create a Pod that has access to the secret data through a Volume