Deploying Cisco ISE on OpenShift Virtualization/Kubevirt

README.md

Cisco ISE on OpenShift Virtualization

Ref.

• https://access.redhat.com/solutions/3598391
• https://kubevirt.io/user-guide/user_workloads/hook-sidecar/#enabling-sidecar-feature-gate

Installation

kubectl scale -n openshift-cnv --replicas=0 deployment/hco-operator
kubectl edit kubevirt/kubevirt-kubevirt-hyperconverged -n openshift-cnv

Enable the Sidecar Feature gate:

kind: KubeVirt
metadata:
  name: kubevirt-kubevirt-hyperconverged
  namespace: openshift-cnv
  # ...
spec:
  # ...
  configuration:
    developerConfiguration:
      featureGates:
      - Sidecar # <-- Add this
      - ...

Add the configmap with the script to replace the product in the SMBIOS xml:

cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: ConfigMap
metadata:
  name: my-config-map
  namespace: ise
data:
  my_script.sh: |
    #!/bin/sh
    tempFile=`mktemp --dry-run`
    echo $4 > $tempFile
    sed -i "s|OpenShift Virtualization|KVM|" $tempFile
    cat $tempFile
EOF

Add the hook annotation in your VM under spec.template.metadata.annotations:

apiVersion: kubevirt.io/v1
kind: VirtualMachine
metadata:
  name: ise
  namespace: ise
spec:
  running: true
  template:
    metadata:
      labels:
        kubevirt.io/domain: ise
      annotations:
        # Add the following annotation:
        hooks.kubevirt.io/hookSidecars: >
            [
              {
                "args": ["--version", "v1alpha2"],
                "configMap": {"name": "my-config-map", "key": "my_script.sh", "hookPath": "/usr/bin/onDefineDomain"}
              }
            ]
    spec:
      # ...