---
schema_version: "1"
id: 0efd72db5c003dd6facfc092e1a8ea2f14ac2d1739a76d6274c62f82e2b716a4
title: Installing Runtime Fabric as a Kubernetes (K8s) Operator
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/runtime-fabric/2.7/install-openshift.md
canonical_url: https://docs.mulesoft.com/runtime-fabric/2.7/install-openshift
source_site: docs.mulesoft.com
content_type: documentation
content_hash: bfcfd722ff771ee3746aea0e324216c4a5194ed5caca3b042c34d5cb50a060cf
description: MuleSoft Documentation Site
release: "2.7"
latest: false
---
---
product: Runtime Fabric
version: 2.7
---

# Installing Runtime Fabric as a Kubernetes (K8s) Operator

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

You can install Anypoint Runtime Fabric as a Kubernetes (K8s) operator in the following platforms:

- Red Hat OpenShift Service on AWS

- Microsoft Azure Red Hat OpenShift

- Red Hat OpenShift Dedicated

- Red Hat OpenShift on IBM Cloud

- Self-managed Red Hat OpenShift editions (Platform Plus, OCP, Kubernetes engine)

## Install Runtime Fabric on Red Hat OpenShift

When you install Runtime Fabric on Red Hat OpenShift, you’ll:

1.  Create a Runtime Fabric using Runtime Manager

2.  Create a namespace for Runtime Fabric

3.  Create a Docker pull secret for pulling the Runtime Fabric component images

4.  Optionally, configure shared tenancy

5.  Install and configure the Runtime Fabric operator

6.  Complete the remaining installation steps to validate your Runtime Fabric and configure ingress

Runtime Fabric also supports OpenShift routes, refer to
[Configure OpenShift Routes](https://docs.mulesoft.com/runtime-fabric/2.7/configure-openshift-routes) documentation.

## Before You Begin

Before installing Runtime Fabric on Red Hat OpenShift, ensure that:

- You have reviewed the architecture and requirements outlined in Runtime Fabric on Self-Managed
  Kubernetes

- You have reviewed the network requirements

- You have installed and configured a supported Red Hat OpenShift Kubernetes environment with:

  - A supported Kubernetes version

  - An ingress controller to send external requests to applications

- You have privileged user permissions to complete the installation process

- You have access to the following URLs needed for Red Hat OpenShift registry:

  - `registry.connect.redhat.com` (See the
    [Red Hat Container Registry Authentication](https://access.redhat.com/articles/RegistryAuthentication))

  - `[https://rhc4tp-prod-z8cxf-image-registry-us-east-1-evenkyleffocxqvofrk.s3.dualstack.us-east-1.amazonaws.com](https://rhc4tp-prod-z8cxf-image-registry-us-east-1-evenkyleffocxqvofrk.s3.dualstack.us-east-1.amazonaws.com)`

## Create a Runtime Fabric using Runtime Manager

To install Runtime Fabric on Red Hat OpenShift, first create a Runtime Fabric using Runtime Manager.
This is required to obtain the activation data which is needed during installation.

1.  From Anypoint Platform, select Runtime Manager.

2.  Click **Runtime Fabrics**.

3.  Click **Create Runtime Fabric**.

4.  Enter the name of the new Runtime Fabric, then select the Red Hat OpenShift option.

5.  Review the Support responsibility disclaimer, then if you agree click **Accept**.

6.  Click **Operator**.

7.  Copy the activation data.

## Create A Namespace for Runtime Fabric

In your Kubernetes cluster, create a namespace for installing Runtime Fabric. This namespace is
where you install Runtime Fabric components.

To create the namespace, run:

```copy
oc create ns <rtf-namespace>
```

## Create A Docker Pull Secret

After you create the namespace, create a pull secret so you can retrieve the Docker images needed to
install and run Runtime Fabric.

The default registry URL is `rtf-runtime-registry.kprod.msap.io`. If you’re using a local registry,
specify those values here.

To create the pull secret, run:

```copy
oc create secret docker-registry <pull_secret> --namespace rtf --docker-server=<docker_registry_url> --docker-username=<docker_registry_username> --docker-password=<docker_ registry_password>
```

## (Optional) Configure Authorized Namespaces

You can optionally configure [authorized namespaces](https://docs.mulesoft.com/runtime-fabric/2.7/authorized-namespaces), which enable you to
deploy Runtime Fabric alongside other services in a Kubernetes cluster.

### Before You Begin

Before configuring authorized namespaces, note the following:

- You must create the `authorized-namespaces` ConfigMap file _before_ installing Runtime Fabric.
  Additionally, you must name the ConfigMap, `authorized-namespaces`.

- The `rtf:resource-metrics-collector` ClusterRole has cluster-wide permissions to `get` and `list`
  nodes, pods, and namespaces and has `watch` permissions for nodes. The role ClusterRole is defined
  as follows:

  apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name:
  rtf:resource-metrics-collector labels: {{- include "labels.standard" . | nindent 4 }} rules:
  - apiGroups: \[""\] resources: \["nodes", "pods", "namespaces"\] verbs: \["list", "get"\]
  - apiGroups: \[""\] resources: \["nodes"\] verbs: \["watch"\]
  1.  In your cluster, create an additional namespace for application deployments, and add the
      necessary labels to the namespace. To do so, create a YAML file with the following contents:

      ```copy
      apiVersion: v1
      kind: Namespace
      metadata:
        name: <app_namespace>
        labels:
          rtf.mulesoft.com/agentNamespace: <rtf_namespace>
          rtf.mulesoft.com/envId: <environment_id>
          rtf.mulesoft.com/org: <org_id>
          rtf.mulesoft.com/role: workers
      ```

  2.  Apply the file you just created:

      ```copy
      oc apply -f <filename>.yaml
      ```

  3.  Repeat steps 1 and 2 to add as many namespaces as you need.

  4.  Create the RoleBinding for the Runtime Fabric agent ClusterRole that includes the Runtime
      Fabric agent ServiceAccount. To do so, apply the following configuration in your additional
      namespace:

      ```copy
      kind: RoleBinding
      apiVersion: rbac.authorization.k8s.io/v1
      metadata:
        name: <name>
        namespace: <app_namespace>
      subjects:
        - kind: ServiceAccount
          name: rtf-agent
          namespace: <rtf_namespace>
      # If using persistence gateway uncomment and provide the following. Ref: https://docs.mulesoft.com/runtime-fabric/latest/persistence-gateway#persistence-gateway-with-authorized-namespaces
      # subjects:
      #  - kind: ServiceAccount
      #    name: rtf-persistence-gateway
      #    namespace: <rtf_namespace>
      roleRef:
        kind: ClusterRole
        name: rtf:agent-<rtf_namespace>
        apiGroup: rbac.authorization.k8s.io
      ```

  5.  Apply the following RoleBinding template to rtf namespace and any additional namespaces:

      ```copy
      apiVersion: rbac.authorization.k8s.io/v1
      kind: RoleBinding
      metadata:
        name: rtf
        namespace: <rtf_namespace>
      roleRef:
        apiGroup: rbac.authorization.k8s.io
        kind: ClusterRole
        name: system:openshift:scc:anyuid
      subjects:
        - kind: ServiceAccount
          name: rtf-agent
          namespace: <rtf_namespace>
        - kind: ServiceAccount
          name: mule-clusterip-service
          namespace: <rtf_namespace>
        - kind: ServiceAccount
          name: resource-cache
          namespace: <rtf_namespace>
        - kind: ServiceAccount
          name: rtf-persistence-gateway
          namespace: <rtf_namespace>
        - kind: ServiceAccount
          name: cluster-status
          namespace: <rtf_namespace>
        - kind: ServiceAccount
          name: am-log-forwarder
          namespace: <rtf_namespace>
        - kind: ServiceAccount
          name: rtf-certificate-renewal
          namespace: <rtf_namespace>
      ```

To use clustered apps in authorized namespaces mode, the following RoleBinding must be created:

```yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: rtf-mule-clusterip-service
  namespace: <app_namespace>
subjects:
  - kind: ServiceAccount
    name: mule-clusterip-service
    namespace: <rtf_namespace>
roleRef:
  kind: ClusterRole
  name: rtf:mule-clusterip-service-<rtf-namespace>
  apiGroup: rbac.authorization.k8s.io
```

For `<additional-namespace>`, use the same template as well:

```copy
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: rtf
  namespace: <app_namespace>
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:openshift:scc:anyuid
subjects:
  - kind: ServiceAccount
    name: rtf-agent
    namespace: <rtf_namespace>
  - kind: ServiceAccount
    name: mule-clusterip-service
    namespace: <rtf_namespace>
  - kind: ServiceAccount
    name: resource-cache
    namespace: <rtf_namespace>
  - kind: ServiceAccount
    name: rtf-persistence-gateway
    namespace: <rtf_namespace>
  - kind: ServiceAccount
    name: cluster-status
    namespace: <rtf_namespace>
  - kind: ServiceAccount
    name: am-log-forwarder
    namespace: <rtf_namespace>
  - kind: ServiceAccount
    name: rtf-certificate-renewal
    namespace: <rtf_namespace>
```

6.  In your cluster, create a ConfigMap file named `authorized-namespaces` and list any additional
    namespaces. Note that the additional namespace mapping keys must be unique since they use the
    standard K8s resource (ConfigMap). There is no specific requirements on the format of the key
    name provided they are unique.

    ```copy
    apiVersion: v1
    kind: ConfigMap
    metadata:
      name: authorized-namespaces
      namespace: <rtf_namespace>
    data:
      APPLICATION_NAMESPACE_1: "<app_namespace_1>"
      APPLICATION_NAMESPACE_2: "<app_namespace_2>
    ```

7.  If, after fully installing Runtime Fabric, you later add or delete any namespaces from the
    ConfigMap, you must restart the Runtime Fabric agent pod. To do so, run the following command:

    ```copy
    oc -nrtf delete po -l app=agent
    ```

    After you delete the pod, Kubernetes starts a new one.

### Install the Red Hat OpenShift Runtime Fabric Operator

You install the Runtime Fabric operator (`rtf-agent-operator`) from the OperatorHub.

1.  In the Red Hat OpenShift console, navigate to **Operators** > **OperatorHub**.

2.  In the OperatorHub search field, search for the Runtime Fabric operator.

3.  In the rtf-agent-operator dialog, click **Install**.

> [!NOTE] Installing the Runtime Fabric operator requires manual approval and may take several
> minutes to complete.

## Configure the Runtime Fabric Operator

To configure the Runtime Fabric operator, you supply the necessary values when prompted.

1.  In the Red Hat OpenShift console, navigate to **Operators** > **Installed Operators**.

2.  In the console, switch the value of **Project** to the namespace you created for installing
    Runtime Fabric.

3.  In the console, click **Create Instance**, and select **Configure via form view**.

    > [!WARNING] Do not change the name of the instance. Doing so can create installation errors.

4.  Add any required parameters. Refer to the Installation Parameters Reference for guidance.

    If you’re using authorized namespaces, set `authorizedNamespaces` to `true`.

5.  Click **Create**.

## Installation Parameters Reference

The following is an example YAML view of the installation parameters.

```yaml
activationData: <activation_data>
proxy:
  http_proxy:
  http_no_proxy:
  monitoring_proxy:
custom_log4j_enabled: true
muleLicense: <mule_license_key>
global:
  authorizedNamespaces: false
  image:
    rtfRegistry: <rtf-runtime-registry.kprod.msap.io or local registry value>
    pullSecretName: rtf-pull-secret
  containerLogPaths:
    - /var/lib/docker/containers
    - /var/log/containers
    - /var/log/pods
```

### Required Parameters

The values for these required parameters are set when you create the Runtime Fabric in Runtime
Manager. If you’re not using a local registry, use the default values for the registry URL and pull
secret.

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Key</th><th>Value</th><th>Example</th></tr></thead><tbody><tr><td><p><code>activationData</code></p></td><td><p>Activation data</p></td><td><p>YW55cG9pbnQubXVsZXNvZnQuY29tOjBmODdmYzYzLTM3MWUtNDU2Yy1iODg5LTU5NTkyNjYyZjUxZQ==</p></td></tr><tr><td><p><code>rtfRegistry</code></p></td><td><p>Registry URL</p></td><td><p><code>rtf-runtime-registry.kprod.msap.io</code></p></td></tr><tr><td><p><code>pullSecretName</code></p></td><td><p>Registry secret</p></td><td><p><code>&lt;pull_secret&gt;</code></p></td></tr><tr><td><p><code>muleLicense</code></p></td><td><p>Mule license for applications</p></td><td><p><code>&lt;mule_license_key&gt;</code>. Must be Base64 encoded.</p></td></tr></tbody></table>

### Optional Parameters

Set these optional parameters as needed.

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Key</th><th>Value</th><th>Example</th></tr></thead><tbody><tr><td><p><code>customLog4jEnabled</code></p></td><td><p>Enables or disables custom Log4j configurations</p></td><td><p><code>customLog4jEnabled: true</code>, default is <code>false</code></p></td></tr><tr><td><p><code>authorizedNamespaces</code></p></td><td><p>Enables or disables additional namespaces</p></td><td><p><code>authorizedNamespaces: true</code>, default is false =======</p></td></tr><tr><td><p><code>authorizedNamespaces</code></p></td><td><p>Enable authorized namespaces</p></td><td><p><code>authorizedNamespaces:true</code></p></td></tr><tr><td><div><div><ul><li><p><code>proxy.http_proxy</code></p></li><li><p><code>proxy.http_no_proxy</code></p></li></ul></div></div></td><td><p>Proxy and no_proxy values</p></td><td><div><div><ul><li><p><code><a href="http://&lt;user&gt;:&lt;pass&gt;@&lt;10.0.0.1&gt;:&lt;8080&gt;">http://&lt;user&gt;:&lt;pass&gt;@&lt;10.0.0.1&gt;:&lt;8080&gt;</a>;</code></p></li><li><p><code>&lt;1.1.1.1:8888,2.2.2.2:9999&gt;</code></p></li></ul></div></div></td></tr><tr><td><p><code>proxy.monitoring_proxy</code></p></td><td><p>Anypoint Monitoring proxy values</p></td><td><p><code>socks5://&lt;user&gt;:&lt;pass&gt;@&lt;10.0.0.2&gt;:&lt;8080&gt;</code></p></td></tr><tr><td><p><code>global.containerLogPaths</code></p></td><td><p>The Filebeat read path</p></td><td><div><div><ul><li><p><code>/var/lib/docker/</code></p></li><li><p><code>/var/log/containers</code></p></li><li><p><code>/var/log/pods</code></p></li></ul></div></div></td></tr></tbody></table>

## Insert the Mule License Key

If you didn’t add the Mule license key during install, you can add it using the `rtfctl` command
line utility or Helm.

Before you install the license key, encode it to Base64 format.

### Encode the License Key

- On MacOS, run the following command:

  ```copy
  base64 -b 0 -i <license-file>
  ```

- On Unix, run the following command:

  ```copy
  base64 -w0 <license-file>
  ```

- On Windows, choose one of the following:

  - Use a WSL or Cygwin shell that includes the base64 tool and use the above Unix command.

  - Use the base64.exe program included with Windows git (C:\\Program Files\\Git\\usr\\bin).

  - Use the following Powershell command:

    ```copy
    $BASE64_ENCODED_LICENSE=[convert]::ToBase64String((Get-Content -path "license.lic" -Encoding byte))
    ```

### Apply the License Key from the OpenShift Console

To apply the license key from the OpenShift console, follow these steps:

1.  Navigate to the Runtime Fabric operator.

2.  Select the namespace in which the Runtime Fabric instance is installed.

3.  Click on the **Runtime Fabric** tab.

4.  Click on the **runtime-fabric** instance link.

    ![Runtime Fabric operator with runtime-fabric instance selected](/mulesoft/current/en-us/runtime-fabric/2.7/_images/rtf-license-operator-1.png)

5.  Update the Runtime Fabric instance CR .yaml file by adding the `muleLicense`.

    ![Runtime Fabric instance with mulelicense](/mulesoft/current/en-us/runtime-fabric/2.7/_images/rtf-license-operator-2.png)

### Apply the License Key Using Helm

To apply the license using Helm, run the following command:

```copy
helm upgrade runtime-fabric rtf/rtf-agent --set muleLicense=$BASE64_ENCODED_LICENSE -n rtf --reuse-values
```

## Configure the Ingress Resource Template

If your ingress controller requires custom annotations and ingress class definition, follow the
instructions in [Defining a Custom Ingress Configuration](https://docs.mulesoft.com/runtime-fabric/2.7/custom-ingress-configuration).

> [!NOTE] For GKE customers, the ingress controller included with GKE will provision a separate HTTP
> load balancer per application by default.

## Validate Your Runtime Fabric

After completing the installation, your Runtime Fabric should be activated within your Anypoint
organization. To validate your installation, go to Anypoint Runtime Manager and confirm that the
status of the Runtime Fabric is `Active`.

Before deploying an application to your Runtime Fabric:

1.  Associate the Runtime Fabric with at least one Anypoint environment.

2.  Review and update the Inbound Traffic settings based upon your Kubernetes environment.

3.  Deploy an application to verify that Runtime Fabric is installed and configured correctly.

## Prepare for Deploying Mule Apps to Red Hat OpenShift

Before you deploy any Mule applications to your Red Hat OpenShift cluster, ensure that you’ve
installed your Mule license key and then, perform the following steps.

Also, before attempting to deploy an Mule applications, ensure that you’ve installed your Mule
license key.

1.  Create a namespace for your Mule app deployments. See
    [Creating Application Namespaces for Application Deployments.](https://docs.mulesoft.com/runtime-fabric/2.7/create-custom-namespace)

2.  From Runtime Manager, deploy a Mule app using your namespace. See
    [Deploy Mule Applications to Runtime Fabric](https://docs.mulesoft.com/runtime-fabric/2.7/deploy-to-runtime-fabric) for instructions.