--- schema_version: "1" id: ed5af47891981caf58e8d2b8498508249aec85b044e1d0bd1568ac31b0c6a974 title: Installing Anypoint Platform PCE on OpenShift collection: mulesoft version: current locale: en-us portal_url: https://docs.salesforce.com/mulesoft/current/en-us/private-cloud/4.0/install-openshift.md canonical_url: https://docs.mulesoft.com/private-cloud/4.0/install-openshift source_site: docs.mulesoft.com content_type: documentation content_hash: d6cb17e261ad941cbb962fe97862b97d0488447e0785832a747ec4d26ff40cfa description: MuleSoft Documentation Site release: "4.0" latest: false --- --- product: Anypoint Platform Private Cloud Edition version: 4.0 --- # Installing Anypoint Platform PCE on OpenShift > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Before installing Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) on OpenShift configure Security Context Constraints (SCC) to grant the required permissions for pods and create roles for Prometheus, allowing it to collect metrics from the services. After these configurations are complete, proceed with installing Anypoint Platform PCE. > [!NOTE] You must have an operational OpenShift cluster prior to installing Anypoint Platform PCE. > If you do not have one set up, refer to the OpenShift documentation for setup instructions. Contact MuleSoft Professional Services to perform the installation of Anypoint Platform PCE. ## Configure the Openshift Environment To configure the OpenShift Environment, configure Security Context Constraints (SCC) and roles for Prometheus. ### Configure Security Context Constraints (SCC) The following snippet contains the SCC configuration: ```yaml apiVersion: security.openshift.io/v1 kind: SecurityContextConstraints metadata: name: anypoint-anyuid allowHostDirVolumePlugin: false allowHostIPC: false allowHostNetwork: false allowHostPID: false allowHostPorts: false allowPrivilegeEscalation: true allowPrivilegedContainer: false allowedCapabilities: null defaultAddCapabilities: null fsGroup: type: RunAsAny users: [] groups: [] readOnlyRootFilesystem: false requiredDropCapabilities: - MKNOD runAsUser: type: RunAsAny seLinuxContext: type: MustRunAs seccompProfiles: - runtime/default supplementalGroups: type: RunAsAny volumes: - configMap - csi - downwardAPI - emptyDir - ephemeral - persistentVolumeClaim - projected - secret --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: anypoint-scc namespace: default rules: - apiGroups: ["security.openshift.io"] resourceNames: - anypoint-anyuid resources: ["securitycontextconstraints"] verbs: ["use"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: anypoint-scc roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: anypoint-scc subjects: - kind: ServiceAccount name: anypoint-install namespace: default - kind: ServiceAccount name: anypoint-install namespace: dias - kind: ServiceAccount name: default namespace: pce - kind: ServiceAccount name: default namespace: access-management - kind: ServiceAccount name: authentication-server-service-account namespace: access-management - kind: ServiceAccount name: default namespace: design-center - kind: ServiceAccount name: default namespace: api-console-proxy - kind: ServiceAccount name: default namespace: amf - kind: ServiceAccount name: default namespace: arm - kind: ServiceAccount name: default namespace: api-manager - kind: ServiceAccount name: default namespace: mozart - kind: ServiceAccount name: default namespace: mocking - kind: ServiceAccount name: default namespace: api-manager - kind: ServiceAccount name: default namespace: audit-log - kind: ServiceAccount name: default namespace: trusted-domains - kind: ServiceAccount name: default namespace: api-designer - kind: ServiceAccount name: monitoring namespace: pce - kind: ServiceAccount name: default namespace: exchange - kind: ServiceAccount name: xapi-service-deployment-manager namespace: exchange - kind: ServiceAccount name: default namespace: core-paas - kind: ServiceAccount name: default namespace: monitoring-center - kind: ServiceAccount name: default namespace: visualizer - kind: ServiceAccount name: secrets-robot namespace: dias - kind: ServiceAccount name: default namespace: dias - kind: ServiceAccount name: default namespace: amc - kind: Group name: system:serviceaccounts:monitoring - kind: ServiceAccount name: default namespace: anypoint-flash ``` Save this file as `openshift-scc.yaml` and apply it to the OpenShift cluster: ```none oc apply -f openshift-scc.yaml ``` ### Configure Roles for Prometheus Prometheus requires specific roles to collect metrics from Anypoint Platform PCE services. The following snippet provides the necessary roles configuration: ```yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: pce-prometheus rules: - apiGroups: - "" resources: - endpoints - pods - services - nodes - secrets verbs: - get - list - watch --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: pce-prometheus roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: pce-prometheus subjects: - kind: ServiceAccount name: prometheus-k8s namespace: openshift-monitoring ``` Save this file as `openshift-monitoring.yaml` and apply it to the OpenShift cluster: ```none oc apply -f openshift-monitoring.yaml ``` ## Install Anypoint Platform PCE on OpenShift The following snippet provides an example installation manifest for deploying Anypoint Platform PCE on an OpenShift cluster: ```yaml containerRegistry: endpoint: registry.pce.example.com username: username password: password certificate: "" subproject: example tlsSkipVerify: true postInstallConfiguration: platformDNS: anypoint.pce.example.com fileSystemDNS: fs.pce.example.com firstUserAccount: organizationName: Example Org username: username email: username@mulesoft.com password: password platformCertificate: cert.pem platformCertificateKey: key.pem amvInstallConfiguration: enabled: false storageConfiguration: pceobjectstore: type: persistentVolumeClaim storageClass: example-csi stolon: type: persistentVolumeClaim storageClass: example-csi monitoringAppConfiguration: monitoringStackEnabled: false grafana: enabled: true values: | datasources: datasources.yaml: apiVersion: 1 datasources: - name: Prometheus type: prometheus url: https://prometheus-k8s.openshift-monitoring.svc:9091 access: proxy isDefault: true jsonData: tlsSkipVerify: true httpHeaderName1: 'Authorization' secureJsonData: httpHeaderValue1: 'Bearer ' ``` Note the `monitoringAppConfiguration` section in the snippet. This section disables the monitoring stack for Anypoint Platform PCE and enables only the Grafana application. It is recommended to disable the monitoring stack because OpenShift includes Prometheus by default. Enable Grafana and configure its datasource to connect to Prometheus. To obtain the token for connecting to Prometheus, run this command: ```none oc create token prometheus-k8s -n openshift-monitoring --duration=87600h ``` After completing the installation, run the following commands to allow Prometheus in OpenShift to collect metrics from platform services: ```none oc label namespace default openshift.io/cluster-monitoring="true" --overwrite oc label namespace pce openshift.io/cluster-monitoring="true" --overwrite ``` ## See Also - [Installing Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)](https://docs.mulesoft.com/private-cloud/4.0/install-workflow) - [Anypoint Platform PCE Prerequisites](https://docs.mulesoft.com/private-cloud/4.0/install-checklist)