As a regular user, log in to OpenShift:

$ oc login -u <user> -p <password>

Create a project with your desired parameters. The project name (<your_project> in this example) is mandatory, but <description> and <display_name> are optional:

$ oc new-project <your_project> \
--description="<description>" \
--display-name="<display_name>"

As the admin user, configure security context constraints (SCCs) for your OpenShift service accounts:

Verify the SCCs are added correctly to the service accounts and project:

$ oc describe scc anyuid | grep Users
Users:					system:serviceaccount:<your-project>:cfme-anyuid,system:serviceaccount:<your-project>:cfme-httpd,system:serviceaccount:<your-project>:cfme-orchestrator
$ oc describe scc privileged | grep Users
Users:					system:admin,system:serviceaccount:openshift-infra:build-controller,system:serviceaccount:management-infra:management-admin,system:serviceaccount:management-infra:inspector-admin,system:serviceaccount:logging:aggregated-logging-fluentd,system:serviceaccount:<your-project>:cfme-privileged

As the admin user, add the httpd-configmap-generator service account to the httpd-scc-sysadmin SCC before the Httpd Configmap Generator can run.

Users:        system:serviceaccount:<your-namespace>:httpd-configmap-generator

Add the view and edit roles to the cfme-orchestrator service account:

$ oc policy add-role-to-user view system:serviceaccount:<your-project>:cfme-orchestrator -n <your-project>
$ oc policy add-role-to-user edit system:serviceaccount:<your-project>:cfme-orchestrator -n <your-project>

As the admin user, prepare persistent storage for the deployment. (Skip this step if you have already configured persistent storage.)

A basic CloudForms deployment needs at least two persistent volumes (PVs) to store CloudForms data. As the admin user, create two persistent volumes: one to host the CloudForms PostgreSQL database, and one to host the application data.

Example NFS-backed volume templates are provided by cfme-pv-db-example.yaml and cfme-pv-server-example.yaml, available from the image stream or repository configured in Section 1.1.3, “Templates and Images”.

Increase the maximum number of imported images on ImageStream.

By default, OpenShift Container Platform can import five tags per image stream, but the CloudForms repositories contain more than five images for deployments.

You can modify this setting on the master node at /etc/origin/master/master-config.yaml so OpenShift can import additional images.

On each OpenShift node, persistently enable the container_manage_cgroup SELinux boolean to allow container processes to make changes to the cgroup configuration:

# setsebool -P container_manage_cgroup on

As a regular user, create the CloudForms template:

$ oc create -f cfme-template.yaml
template "cloudforms" created

Verify the template is available with your project:

$ oc get templates
NAME         DESCRIPTION                                    PARAMETERS        OBJECTS
cloudforms   CloudForms appliance with persistent storage   18 (1 blank)      12

(Optional) Customize the template’s deployment parameters. Use the following command to see the available parameters and descriptions:

$ oc process --parameters -n <your-project> cloudforms

To customize the deployment configuration parameters, run:

$ oc edit dc/<deployconfig_name>

To deploy CloudForms from template using default settings, run:

$ oc new-app --template=cloudforms

Alternatively, to deploy CloudForms from a template using customized settings, add the -p option and the desired parameters to the command. For example:

$ oc new-app --template=cloudforms -p DATABASE_VOLUME_CAPACITY=2Gi,POSTGRESQL_MEM_LIMIT=4Gi,APPLICATION_DOMAIN=hostname

Confirm the CloudForms pod is bound to the correct security context constraints:

Verify the persistent volumes are attached to the postgresql and cfme-app pods:

$ oc volume pods --all
pods/postgresql-1-437jg
  pvc/cfme-pgdb-claim (allocated 2GiB) as cfme-pgdb-volume
    mounted at /var/lib/pgsql/data
  secret/default-token-2se06 as default-token-2se06
    mounted at /var/run/secrets/kubernetes.io/serviceaccount
pods/cfme-1-s3bnp
  pvc/cfme (allocated 2GiB) as cfme-app-volume
    mounted at /persistent
  secret/default-token-9q4ge as default-token-9q4ge
    mounted at /var/run/secrets/kubernetes.io/serviceaccount

Check the readiness of the CloudForms pod:

$ oc describe pods <cfme_pod_name>
...
Conditions:
  Type      Status
  Ready     True
Volumes:
...

After you have successfully validated your CloudForms deployment, disable automatic image change triggers to prevent unintended upgrades.

By default, on initial deployments the automatic image change trigger is enabled. This could potentially start an unintended upgrade on a deployment if a newer image is found in the ImageStream.

Disable the automatic image change triggers for CloudForms deployment configurations (DCs) on each project with the following commands:

$ oc set triggers dc --manual -l app=cloudforms
deploymentconfig "memcached" updated
deploymentconfig "postgresql" updated

$ oc set triggers dc --from-config --auto -l app=cloudforms
deploymentconfig "memcached" updated
deploymentconfig "postgresql" updated

To open a shell on the pod, run:

$ oc rsh <pod_name> bash -l

Get the route information:

$ oc get routes
NAME         HOST/PORT                   PATH                SERVICE      TERMINATION   LABELS
cloudforms   cfme.apps.e2e.example.com  cloudforms:443-tcp   passthrough                app=cloudforms

Create the persistent volume for the backup:

$ oc create -f cfme-pv-backup-example.yaml

Create the backup persistent volume claim (PVC):

$ oc create -f cfme-backup-pvc.yaml

Verify the persistent volume claim was created:

$ oc get pvc

Back up secrets, such as database encryption keys and credentials.

$ oc get secret -o yaml --export=true > secrets.yaml
$ oc get pvc -o yaml --export=true > pvc.yaml

Initiate the database backup:

$ oc create -f cfme-backup-job.yaml

Shut down all pods:

$ oc scale dc --all --replicas=0
$ oc scale statefulset --all --replicas=0

To initiate the database restore, create the restore template:

$ oc create -f cfme-restore-job.yaml

Inside the project, run the following as a regular user:

$ oc delete all --all

Wait approximately 30 seconds for the command to process, then run:

$ oc delete pvc --all