--- schema_version: "1" id: 8b92f1c36bda18491f4590c50171050cdd42cd37bbf98d397dbf63b2f855cb6d title: Installing Anypoint Platform PCE on OpenShift collection: mulesoft version: current locale: en-us portal_url: https://docs.salesforce.com/mulesoft/current/en-us/private-cloud/latest/install-openshift.md canonical_url: https://docs.mulesoft.com/private-cloud/latest/install-openshift source_site: docs.mulesoft.com content_type: documentation content_hash: 86b7bd6bb76d9f9e655409665461784c700e322b6e3c8573a1f2644dc2868715 description: MuleSoft Documentation Site release: "4.3" latest: true --- --- product: Anypoint Platform Private Cloud Edition version: 4.3 is-latest-version: true --- # Installing Anypoint Platform PCE on OpenShift > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Before installing Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) on OpenShift configure Security Context Constraints (SCC) to grant the required permissions for pods and create roles for Prometheus, allowing it to collect metrics from the services. After these configurations are complete, proceed with installing Anypoint Platform PCE. > [!NOTE] Contact MuleSoft Professional Services or your Anypoint PCE Certified Partner to perform > the installation or upgrade of Anypoint Platform PCE. > [!NOTE] You must have an operational OpenShift cluster prior to installing Anypoint Platform PCE. > If you do not have one set up, refer to the OpenShift documentation for setup instructions. > [!NOTE] Anypoint Platform PCE 4.2.1 is installed and validated on OpenShift 4.18 and 4.20. > [!NOTE] It isn’t supported to in-place upgrade from an existing Openshift PCE 4.1.x cluster that’s > been installed with full admin privilege to 4.2.1 or higher with no admin scope. If this is your > case, consult [Migrating Anypoint Platform PCE to v4.x](https://docs.mulesoft.com/private-cloud/latest/upgrade). ## Configure the Openshift Environment To configure the OpenShift Environment, configure Security Context Constraints (SCC) and roles for Prometheus. ### Configure Security Context Constraints (SCC) This snippet contains the SCC configuration: ```yaml apiVersion: security.openshift.io/v1 kind: SecurityContextConstraints metadata: name: anypoint-anyuid allowHostDirVolumePlugin: false allowHostIPC: false allowHostNetwork: false allowHostPID: false allowHostPorts: false allowPrivilegeEscalation: false allowPrivilegedContainer: false allowedCapabilities: null defaultAddCapabilities: null fsGroup: type: RunAsAny users: [] groups: [] readOnlyRootFilesystem: false requiredDropCapabilities: - MKNOD runAsUser: type: MustRunAs uid: 2020 seLinuxContext: type: MustRunAs seccompProfiles: - runtime/default supplementalGroups: type: RunAsAny volumes: - configMap - csi - downwardAPI - emptyDir - ephemeral - persistentVolume - persistentVolumeClaim - projected - secret --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: anypoint-scc namespace: pce-core rules: - apiGroups: ["security.openshift.io"] resourceNames: - anypoint-anyuid resources: ["securitycontextconstraints"] verbs: ["use"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: anypoint-scc roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: anypoint-scc subjects: - kind: ServiceAccount name: pce-cluster-ssl-app namespace: pce-core - kind: ServiceAccount name: default namespace: pce-core - kind: ServiceAccount name: anypoint namespace: pce-core - kind: ServiceAccount name: anypoint-install namespace: pce-core - kind: ServiceAccount name: anypoint-install-anypoint-services namespace: pce-core - kind: ServiceAccount name: anypoint-install-cluster-ssl namespace: pce-core - kind: ServiceAccount name: anypoint-install-namespaces-job namespace: pce-core - kind: ServiceAccount name: anypoint-install-seaweedfs namespace: pce-core - kind: ServiceAccount name: anypoint-prometheus-install namespace: pce-core - kind: ServiceAccount name: anypoint-grafana-install namespace: pce-core - kind: ServiceAccount name: anypoint-install namespace: dias - kind: ServiceAccount name: default namespace: pce - kind: ServiceAccount name: default namespace: access-management - kind: ServiceAccount name: authentication-server-service-account namespace: access-management - kind: ServiceAccount name: default namespace: api-console-proxy - kind: ServiceAccount name: default namespace: amf - kind: ServiceAccount name: default namespace: arm - kind: ServiceAccount name: default namespace: api-manager - kind: ServiceAccount name: default namespace: mozart - kind: ServiceAccount name: default namespace: mocking - kind: ServiceAccount name: default namespace: api-manager - kind: ServiceAccount name: default namespace: audit-log - kind: ServiceAccount name: default namespace: trusted-domains - kind: ServiceAccount name: default namespace: api-designer - kind: ServiceAccount name: monitoring namespace: pce - kind: ServiceAccount name: default namespace: exchange - kind: ServiceAccount name: xapi-service-deployment-manager namespace: exchange - kind: ServiceAccount name: default namespace: core-paas - kind: ServiceAccount name: default namespace: monitoring-center - kind: ServiceAccount name: default namespace: visualizer - kind: ServiceAccount name: secrets-robot namespace: dias - kind: ServiceAccount name: default namespace: dias - kind: ServiceAccount name: default namespace: amc - kind: Group name: system:serviceaccounts:monitoring - kind: ServiceAccount name: default namespace: anypoint-flash - kind: ServiceAccount name: default namespace: design-center --- apiVersion: security.openshift.io/v1 kind: SecurityContextConstraints metadata: name: anypoint-anyuid-privileged allowHostDirVolumePlugin: false allowHostIPC: false allowHostNetwork: false allowHostPID: false allowHostPorts: false allowPrivilegeEscalation: true allowPrivilegedContainer: false allowedCapabilities: null defaultAddCapabilities: null fsGroup: type: RunAsAny users: [] groups: [] readOnlyRootFilesystem: false requiredDropCapabilities: - MKNOD runAsUser: type: RunAsAny seLinuxContext: type: MustRunAs seccompProfiles: - runtime/default supplementalGroups: type: RunAsAny volumes: - configMap - csi - downwardAPI - emptyDir - ephemeral - persistentVolume - persistentVolumeClaim - projected - secret - nfs --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: anypoint-scc-privileged rules: - apiGroups: ["security.openshift.io"] resourceNames: - anypoint-anyuid-privileged resources: ["securitycontextconstraints"] verbs: ["use"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: anypoint-scc-privileged roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: anypoint-scc-privileged subjects: - kind: ServiceAccount name: stolon namespace: pce-core - kind: ServiceAccount name: default namespace: pce-core - kind: ServiceAccount name: anypoint-install namespace: pce-core - kind: ServiceAccount name: seaweedfs-rw-sa namespace: pce-core - kind: ServiceAccount name: default namespace: api-manager - kind: ServiceAccount name: default namespace: design-center - kind: ServiceAccount name: default namespace: exchange - kind: ServiceAccount name: default namespace: logging-internal - kind: ServiceAccount name: default namespace: pce - kind: ServiceAccount name: monitoring namespace: pce - kind: ServiceAccount name: default namespace: trusted-domains - kind: ServiceAccount name: default namespace: mocking --- apiVersion: security.openshift.io/v1 kind: SecurityContextConstraints metadata: name: anypoint-pce-monitoring allowHostDirVolumePlugin: false allowHostIPC: false allowHostNetwork: false allowHostPID: false allowHostPorts: false allowPrivilegeEscalation: false allowPrivilegedContainer: false allowedCapabilities: null defaultAddCapabilities: null fsGroup: type: RunAsAny users: [] groups: [] readOnlyRootFilesystem: false requiredDropCapabilities: - MKNOD runAsUser: type: MustRunAs uid: 472 seLinuxContext: type: MustRunAs seccompProfiles: - runtime/default supplementalGroups: type: RunAsAny volumes: - configMap - csi - downwardAPI - emptyDir - ephemeral - persistentVolumeClaim - projected - secret --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: anypoint-pce-monitoring rules: - apiGroups: ["security.openshift.io"] resourceNames: - anypoint-pce-monitoring resources: ["securitycontextconstraints"] verbs: ["use"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: anypoint-pce-monitoring roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: anypoint-pce-monitoring subjects: - kind: ServiceAccount name: grafana namespace: monitoring ``` Save this file as `openshift-scc.yaml` and apply it to the OpenShift cluster: ```none oc apply -f openshift-scc.yaml ``` ### Configure Roles for Prometheus Prometheus requires specific roles to collect metrics from Anypoint Platform PCE services. The following snippet provides the necessary roles configuration: ```yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: pce-prometheus rules: - apiGroups: - "" resources: - endpoints - pods - services - nodes - secrets verbs: - get - list - watch --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: pce-prometheus roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: pce-prometheus subjects: - kind: ServiceAccount name: prometheus-k8s namespace: openshift-monitoring ``` Save this file as `openshift-monitoring.yaml` and apply it to the OpenShift cluster: ```none oc apply -f openshift-monitoring.yaml ``` ## Install Anypoint Platform PCE on OpenShift The following snippet provides an example installation manifest for deploying Anypoint Platform PCE on an OpenShift cluster: ```yaml containerRegistry: endpoint: registry.pce.example.com username: username password: password certificate: "" subproject: example tlsSkipVerify: true postInstallConfiguration: platformDNS: anypoint.pce.example.com fileSystemDNS: fs.pce.example.com firstUserAccount: organizationName: Example Org username: username email: username@mulesoft.com password: password platformCertificate: cert.pem platformCertificateKey: key.pem amvInstallConfiguration: enabled: false storageConfiguration: pceobjectstore: type: persistentVolumeClaim storageClass: example-csi stolon: type: persistentVolumeClaim storageClass: example-csi monitoringAppConfiguration: monitoringStackEnabled: false grafana: enabled: true values: | datasources: datasources.yaml: apiVersion: 1 datasources: - name: Prometheus type: prometheus url: https://prometheus-k8s.openshift-monitoring.svc:9091 access: proxy isDefault: true jsonData: tlsSkipVerify: true httpHeaderName1: 'Authorization' secureJsonData: httpHeaderValue1: 'Bearer ' ``` Note the `monitoringAppConfiguration` section in the snippet. This section disables the monitoring stack for Anypoint Platform PCE and enables only the Grafana application. It is recommended to disable the monitoring stack because OpenShift includes Prometheus by default. Enable Grafana and configure its datasource to connect to Prometheus. To obtain the token for connecting to Prometheus, run this command: ```none oc create token prometheus-k8s -n openshift-monitoring --duration=87600h ``` After completing the installation, run the following commands to allow Prometheus in OpenShift to collect metrics from platform services: ```none oc label namespace default openshift.io/cluster-monitoring="true" --overwrite oc label namespace pce openshift.io/cluster-monitoring="true" --overwrite ``` ## See Also - [Installing or Upgrading Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)](https://docs.mulesoft.com/private-cloud/latest/install-workflow) - [Anypoint Platform PCE Prerequisites](https://docs.mulesoft.com/private-cloud/latest/install-checklist)