Installing Sisense on OpenShift

Prerequisites

General prerequisites: Checking the Prerequisites and Planning Your Configuration.
Linux OS supported by Sisense. See Minimum Requirements for Sisense in Linux Environments for more information.
Pre-installed OpenShift. You must also be connected to your Kubernetes cluster (i.e., you can do oc commands, such as oc get pod, and others). For more information, see Preparing an OpenShift Environment.
A licensed Red Hat Pull Secret.
Access to your cloud CLI and credentials.

Create your Sisense project (namespace).

Copy

NAMESPACE_NAME=sisense #for example
oc new-project ${NAMESPACE_NAME} --display-name ${NAMESPACE_NAME}

Create the Role. It will be assigned to the serviceAccount used by the installation. Make sure to name the role sisense and assign it to the relevant namespace.

Create the file role.yaml with the following content:

Copy

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: sisense
  namespace: <NAMESPACE_NAME>
rules:
  - verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete
      - use
      - deletecollection
    apiGroups:
      - '*'
    resources:
      - '*'

Save it, and run the command oc apply -f role.yaml.
Create new SecurityContextConstraints (scc) named sisense to allow sisense pods to get the necessary permissions.

Create the file scc.yaml with the following content:

Copy

allowHostDirVolumePlugin: false
allowHostIPC: false
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
allowPrivilegeEscalation: false
allowPrivilegedContainer: false
allowedCapabilities: null
apiVersion: security.openshift.io/v1
defaultAddCapabilities: null
fsGroup:
  type: RunAsAny
groups: []
kind: SecurityContextConstraints
metadata:
  annotations:
  name: sisense
priority: null
readOnlyRootFilesystem: false
requiredDropCapabilities:
- KILL
- MKNOD
- SYS_CHROOT
runAsUser:
  type: RunAsAny
seLinuxContext:
  type: MustRunAs
supplementalGroups:
  type: RunAsAny
volumes:
- configMap
- downwardAPI
- emptyDir
- persistentVolumeClaim
- projected
- secret

Save it, and run the following commands:

Copy

# Create the scc
oc apply -f scc.yaml
securitycontextconstraints.security.openshift.io/sisense created

# Attach sisense scc to all service accounts on your namespace 
oc adm policy add-scc-to-group sisense system:serviceaccounts:${NAMESPACE_NAME}

Manually label your Kubernetes nodes. Each of your nodes must have at least one of the following labels and values:

node-${NAMESPACE}-Application=true
node-${NAMESPACE}-Query=true
node-${NAMESPACE}-Build=true

And remove node taint node-role.kubernetes.io/master:NoSchedule from all nodes.

For example:

Copy

oc label node ${your_node_1} node-${NAMESPACE}-Application=true --overwrite=true
oc label node ${your_node_1} node-${NAMESPACE}-Query=true --overwrite=true
oc label node ${your_node_2} node-${NAMESPACE}-Application=true --overwrite=true
oc label node ${your_node_2} node-${NAMESPACE}-Query=true --overwrite=true
oc label node ${your_node_3} node-${NAMESPACE}-Build=true --overwrite=true

oc taint nodes --all node-role.kubernetes.io/master:NoSchedule-

Note:

If you are using a cloud managed OpenShift, you may not be able to use the oc label node command, and you will have to modify the node labels via the Cloud/OpenShift provider’s UI or CLI command.
If you have more than three nodes not including master, you do not need to remove the last taint (i.e., there is no need to run the last command above).

Install your own Storage Classes (or you can use the same Storage Class for both RWX and RWO):

One for RWX (Read/Write many, for the Sisense apps themselves)

One for RWO (Read/Write once, for the stateful sets, such as MongoDB/ZooKeeper/RabbitMQ)

Storage Class installation example

For this example, assume there is an NFS server with an NFS path, so we will install an NFS Storage Class, and we will use it for both RWX and RWO.

Copy

# Create the serviceAccount that will be used by the nfs-client-provisioner
oc create sa -n ${NAMESPACE_NAME} nfs-client-provisioner

# Grant the permission which allows host mounts and any UID by a pod
oc adm policy add-scc-to-user hostmount-anyuid system:serviceaccount:${NAMESPACE_NAME}:nfs-client-provisioner
oc adm policy add-scc-to-user hostmount-anyuid system:serviceaccount:${NAMESPACE_NAME}:nfs-subdir-external-provisioner

# Attach sisense scc to all service accounts on your namespace 
oc adm policy add-scc-to-group sisense system:serviceaccounts:${NAMESPACE_NAME}

Create the file nfs-values.yaml with the following content:

(Example for NFS server: 10.192.168.32)

(Example for NFS path: /mnt/share)

Copy

nfs:
  server: <Your NFS server address>
  path: <Your NFS server path>
serviceAccount:
  name: nfs-client-provisioner
  create: false

Run the installation command:

Copy

helm repo add nfs-subdir-external-provisioner https://kubernetes-sigs.github.io/nfs-subdir-external-provisioner/
helm install nfs-subdir-external-provisioner nfs-subdir-external-provisioner/nfs-subdir-external-provisioner --values nfs-values.yaml

# After a minute or 2 (maybe less) you'll see the new Storage Class (nfs-client) installed:
oc get sc
NAME            PROVISIONER                                     RECLAIMPOLICY   VOLUMEBINDINGMODE      ALLOWVOLUMEEXPANSION   AGE
gp2             kubernetes.io/aws-ebs                           Delete          WaitForFirstConsumer   true                   27h
gp2-csi         ebs.csi.aws.com                                 Delete          WaitForFirstConsumer   true                   27h
gp3 (default)   ebs.csi.aws.com                                 Delete          WaitForFirstConsumer   true                   27h
gp3-csi         ebs.csi.aws.com                                 Delete          WaitForFirstConsumer   true                   27h
nfs-client      cluster.local/nfs-subdir-external-provisioner   Delete          Immediate              true                   21h