Rewrite OpenShift deployment guide for 4.7.0#11397
Merged
Merged
Conversation
Complete rewrite of the OpenShift deployment overview: step-by-step Quick Start flow, live-tested Dockerfile with correct permissions, route configuration using default_openshift_values.yaml, DNS setup for CRC and managed clusters, portal access table, and expanded troubleshooting section. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
📝 WalkthroughOpenShift Deployment Documentation RewriteThis pull request fully rewrites the OpenShift deployment overview for WSO2 API Manager, reorganizing content into a Helm-based Quick Start plus Advanced Configuration and Troubleshooting sections tailored for OpenShift. Key Changes
Scope
Impact
WalkthroughThis pull request substantially reorganizes the OpenShift deployment documentation for WSO2 API Manager. The content shifts from a generic prerequisites-and-steps layout to a structure emphasizing OpenShift's security model and Helm-based deployment. The new introduction explains UID/GID randomization, image preparation requirements (GID 0 group-write with root ownership), and Route-based routing. A comprehensive Quick Start section replaces prior deployment guidance, detailing tool installation, image building with architecture-specific platform handling, keystore secret creation, values file customization, and verification workflows. Advanced Configuration provides reusable OpenShift securityContext blocks. A new Distributed Deployments section outlines multi-component patterns with concrete examples. Troubleshooting narrows to OpenShift-specific operational issues with specific Suggested reviewers
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
en/docs/install-and-setup/setup/kubernetes-deployment/openshift/openshift-deployment-overview.md (1)
100-102: 💤 Low valueConsider using GID 0 for JDBC driver consistency.
The
ADDcommand uses--chown=wso2carbon:wso2, which sets the group towso2instead of the root group (GID 0). While JDBC drivers are typically read-only and this may work, using--chown=wso2carbon:0would align with the GID 0 pattern explained earlier and ensure the file is always accessible when OpenShift assigns an arbitrary UID.♻️ Suggested change for consistency
- ADD --chown=wso2carbon:wso2 \ + ADD --chown=wso2carbon:0 \ https://repo1.maven.org/maven2/mysql/mysql-connector-java/8.0.28/mysql-connector-java-8.0.28.jar \ ${WSO2_SERVER_HOME}/repository/components/lib/🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@en/docs/install-and-setup/setup/kubernetes-deployment/openshift/openshift-deployment-overview.md` around lines 100 - 102, Update the Dockerfile ADD instruction that currently reads ADD --chown=wso2carbon:wso2 ... to use GID 0 for consistency with OpenShift's arbitrary UIDs; change the group portion to 0 (i.e., --chown=wso2carbon:0) so the JDBC driver file added by the ADD command (mysql-connector-java-8.0.28.jar) is owned by user wso2carbon and group GID 0.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In
`@en/docs/install-and-setup/setup/kubernetes-deployment/openshift/openshift-deployment-overview.md`:
- Around line 100-102: Update the Dockerfile ADD instruction that currently
reads ADD --chown=wso2carbon:wso2 ... to use GID 0 for consistency with
OpenShift's arbitrary UIDs; change the group portion to 0 (i.e.,
--chown=wso2carbon:0) so the JDBC driver file added by the ADD command
(mysql-connector-java-8.0.28.jar) is owned by user wso2carbon and group GID 0.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: d6e3f84b-1512-48b5-9282-d020f71e580f
📒 Files selected for processing (1)
en/docs/install-and-setup/setup/kubernetes-deployment/openshift/openshift-deployment-overview.md
Krishanx92
previously approved these changes
May 21, 2026
kavindasr
requested changes
May 22, 2026
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
en/docs/install-and-setup/setup/kubernetes-deployment/openshift/openshift-deployment-overview.md (1)
108-110:⚠️ Potential issue | 🟠 Major | ⚡ Quick winFix Buildx push flow and digest retrieval to match registry output
- The current
docker buildx build(no--push/--load) + separatedocker pushcan fail because the build isn’t exported to the local Docker image store or the registry.- The current
docker inspect ... .RepoDigestsis not aligned with Buildx/registry-based outputs; fetch the digest directly from the registry viadocker buildx imagetools inspect.Proposed documentation update
- docker buildx build --platform linux/amd64 -t <REGISTRY>/wso2am-ocp:<TAG> . - docker push <REGISTRY>/wso2am-ocp:<TAG> + docker buildx build --platform linux/amd64 -t <REGISTRY>/wso2am-ocp:<TAG> \ + --push .- docker inspect <REGISTRY>/wso2am-ocp:<TAG> \ - --format='{% raw %}{{index .RepoDigests 0}}{% endraw %}' + docker buildx imagetools inspect <REGISTRY>/wso2am-ocp:<TAG> \ + --format '{% raw %}{{.Manifest.Digest}}{% endraw %}'🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@en/docs/install-and-setup/setup/kubernetes-deployment/openshift/openshift-deployment-overview.md` around lines 108 - 110, The build/push/digest steps are incorrect for buildx: change the two-step "docker buildx build" + "docker push" flow to a single buildx invocation that exports to the registry (use "docker buildx build --platform linux/amd64 --push -t <REGISTRY>/wso2am-ocp:<TAG> .") and remove the separate "docker push"; then replace the "docker inspect ... .RepoDigests" digest retrieval with a registry-aware lookup using "docker buildx imagetools inspect <REGISTRY>/wso2am-ocp:<TAG>" to read the digest from the registry output. Ensure these changes are applied where the build/push commands and digest inspection are described.
♻️ Duplicate comments (1)
en/docs/install-and-setup/setup/kubernetes-deployment/openshift/openshift-deployment-overview.md (1)
46-50:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winPrefer interactive password input for
oc login(Username / Password)
The exampleoc login <API_SERVER_URL> -u <USERNAME> -p <PASSWORD>passes a password via CLI flags; switch to an interactive prompt by omitting-psoocprompts for the password.Proposed documentation update
- oc login <API_SERVER_URL> -u <USERNAME> -p <PASSWORD> + oc login <API_SERVER_URL> -u <USERNAME>🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@en/docs/install-and-setup/setup/kubernetes-deployment/openshift/openshift-deployment-overview.md` around lines 46 - 50, The example uses `oc login <API_SERVER_URL> -u <USERNAME> -p <PASSWORD>` which passes the password on the command line; update the documentation to show `oc login <API_SERVER_URL> -u <USERNAME>` (omit the `-p` flag) so `oc login` prompts interactively for the password, and mention that this avoids exposing credentials in shell history or process lists.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In
`@en/docs/install-and-setup/setup/kubernetes-deployment/openshift/openshift-deployment-overview.md`:
- Around line 108-110: The build/push/digest steps are incorrect for buildx:
change the two-step "docker buildx build" + "docker push" flow to a single
buildx invocation that exports to the registry (use "docker buildx build
--platform linux/amd64 --push -t <REGISTRY>/wso2am-ocp:<TAG> .") and remove the
separate "docker push"; then replace the "docker inspect ... .RepoDigests"
digest retrieval with a registry-aware lookup using "docker buildx imagetools
inspect <REGISTRY>/wso2am-ocp:<TAG>" to read the digest from the registry
output. Ensure these changes are applied where the build/push commands and
digest inspection are described.
---
Duplicate comments:
In
`@en/docs/install-and-setup/setup/kubernetes-deployment/openshift/openshift-deployment-overview.md`:
- Around line 46-50: The example uses `oc login <API_SERVER_URL> -u <USERNAME>
-p <PASSWORD>` which passes the password on the command line; update the
documentation to show `oc login <API_SERVER_URL> -u <USERNAME>` (omit the `-p`
flag) so `oc login` prompts interactively for the password, and mention that
this avoids exposing credentials in shell history or process lists.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: cefb03cb-93ec-4c83-a018-1d5cb457be7f
📒 Files selected for processing (1)
en/docs/install-and-setup/setup/kubernetes-deployment/openshift/openshift-deployment-overview.md
kavindasr
approved these changes
May 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose