Files
hacktricks-cloud/pentesting-cloud/openshift-pentesting/openshift-basic-information.md
2024-12-12 19:35:48 +01:00

37 lines
2.0 KiB
Markdown
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
# OpenShift - Basic information
## Kubernetes prior b**asic knowledge** <a href="#a94e" id="a94e"></a>
Before working with OpenShift, ensure you are comfortable with the Kubernetes environment. The entire OpenShift chapter assumes you have prior knowledge of Kubernetes.
## OpenShift - Basic Information
### Introduction
OpenShift is Red Hats container application platform that offers a superset of Kubernetes features. OpenShift has stricter security policies. For instance, it is forbidden to run a container as root. It also offers a secure-by-default option to enhance security. OpenShift, features an web console which includes a one-touch login page.
#### CLI
OpenShift come with a it's own CLI, that can be found here:
{% embed url="https://docs.openshift.com/container-platform/4.11/cli_reference/openshift_cli/getting-started-cli.html" %}
To login using the CLI:
```bash
oc login -u=<username> -p=<password> -s=<server>
oc login -s=<server> --token=<bearer token>
```
### **OpenShift - Security Context Constraints** <a href="#a94e" id="a94e"></a>
In addition to the [RBAC resources](https://docs.openshift.com/container-platform/3.11/architecture/additional\_concepts/authorization.html#architecture-additional-concepts-authorization) that control what a user can do, OpenShift Container Platform provides _security context constraints_ (SCC) that control the actions that a pod can perform and what it has the ability to access.
SCC is a policy object that has special rules that correspond with the infrastructure itself, unlike RBAC that has rules that correspond with the Platform. It helps us define what Linux access-control features the container should be able to request/run. Example: Linux Capabilities, SECCOMP profiles, Mount localhost dirs, etc.
{% content-ref url="openshift-scc.md" %}
[openshift-scc.md](openshift-scc.md)
{% endcontent-ref %}
{% embed url="https://docs.openshift.com/container-platform/3.11/architecture/additional_concepts/authorization.html#security-context-constraints" %}