Deploying the Operator into Openshift
To ensure the qpoint operator functions correctly in OpenShift, specific configurations are essential due to the additional security context constraints (SCCs) enforced by OpenShift. The Qpoint Operator, particularly its Qtap init container, requires privileged access to perform its intended operations. This level of access is necessary to intercept and manipulate network traffic, a fundamental capability for the Qpoint solution to function as designed.
To achieve this, the Qtap init container is configured to run in privileged mode. This is accomplished by setting the qpoint.io/qtap-init-run-as-privileged: "true" annotation within the Helm chart's values file. Running in privileged mode grants the container elevated permissions that are otherwise restricted by OpenShift's default SCCs.
The configuration snippet provided below outlines the necessary annotations and values required for deploying the Qpoint operator using Helm. Among these, the qpoint.io/qtap-init-run-as-privileged: "true" annotation is critical for ensuring the init container can operate with the elevated privileges needed for its network operations. Other configurations, such as port mappings (qpoint.io/qtap-init-egress-port-mapping) and logging levels (qpoint.io/qtap-log-level), are also specified to fine-tune the behavior of the qpoint operator within your OpenShift environment.
Last updated