Flask application designed to be run on OpenShift with various DevOps features including health checks, persistent storage, and disaster recovery.
The application is a simple Flask app that returns a "Hello, World!" message. The repository includes unit tests, a Dockerfile for building a Docker image of the application, and configuration files for deploying the application to OpenShift. The configuration files also include settings for health checks, persistent storage, disaster recovery, and a Jenkinsfile to set up a CI/CD pipeline.
- Install dependencies:
pip install -r app/requirements.txt
- Run the application:
python app/app.py
- Run the tests:
python tests/test_app.py
You can build a Docker image of the application with the Dockerfile provided in the docker
directory. Use the following command, replacing <image-name>
with your preferred name for the image:
docker build -f docker/Dockerfile -t <image-name> .
These steps assume that you have access to an OpenShift cluster and have the OpenShift CLI (oc
) installed.
- Create a new project:
oc new-project flask-app
- Build the Docker image:
oc new-build --name flask-app --binary --strategy docker
- Start the build:
oc start-build flask-app --from-dir=. --follow
- Deploy the application:
oc new-app flask-app
- Expose the application:
oc expose svc/flask-app
Readiness and liveness probes are configured in the deployment.yaml
file to ensure the application is running smoothly. They monitor the /healthz
endpoint on port 8080.
In OpenShift, Security Context Constraints (SCCs) are used to define the level of security for pods. These constraints control how pods interact with underlying resources in the cluster and what actions they can perform. By default, OpenShift applies the restricted SCC to all projects, which offers a high level of security and restrictions.
Under the restricted
SCC:
- Pods cannot run as privileged.
- Pods cannot run as root.
- Pods cannot access host features like the host network or host ports.
If your application needs additional permissions, a cluster administrator can assign a different SCC to a service account. This should be done carefully, since granting permissions can have serious implications on the security of your cluster:
oc adm policy add-scc-to-user <scc-name> -z <service-account-name> -n <namespace>
Disaster recovery is handled by a backup and restore process configured in the backup.yaml
file. Backups can be triggered manually or set up to run on a schedule.
The application connects to a PostgreSQL database. Connection details are stored in the secret.yaml
file.
The application uses a Persistent Volume Claim (PVC) for storage. The PVC is defined in the pvc.yaml
file.
The application is secured with HTTPS, and containers do not run as root. These settings are defined in the route.yaml
file.
The Jenkinsfile in the root of the repository defines a Jenkins pipeline that builds, tests, and deploys the application.
You can use OpenShift's built-in monitoring and logging tools to monitor the application.
To check the logs of a specific pod, you can use the following command:
oc logs <pod-name>
You can also stream the logs in real-time with:
oc logs -f <pod-name>
Access these tools through the OpenShift web console for a GUI. Additionally, OpenShift includes a monitoring tool, Prometheus, and a visualization tool, Grafana, for comprehensive metrics about your application and the underlying infrastructure.
To view these metrics:
- Go to the OpenShift web console.
- Navigate to "Monitoring" > "Metrics".
The application is configured to automatically scale based on CPU usage. This is defined in the deployment.yaml
file.