How To Use OCP: A Complete Guide To OpenShift Container Platform Deployment

Orchestrating enterprise-grade container workloads requires a robust framework that extends basic Kubernetes capabilities. By mastering the Red Hat OpenShift Container Platform (OCP) workflow—specifically authenticating via the command-line interface, provisioning isolated projects, deploying applications via Source-to-Image pipelines, and exposing routes—you can reduce deployment times from hours to seconds while maintaining strict security policies. This operational guide provides the exact technical configurations, command syntaxes, and troubleshooting methodologies required to successfully deploy and manage scalable workloads on OCP.

Prerequisites and Configuration Requirements for OpenShift

Before initializing your first application deployment on OCP, you must configure a secure local workstation and establish authorized connectivity to your target cluster. Whether you are running a local instance like OpenShift Local (formerly CodeReady Containers) or connecting to a managed cloud environment like Red Hat OpenShift on AWS (ROSA) or Azure Red Hat OpenShift (ARO), adhering to these foundational requirements ensures smooth system integration.

Essential Tools and Hardware Resources

• Operating System Workstation: Linux (RHEL, Fedora, or Ubuntu), macOS, or Windows 10/11 with WSL2 configured.
• Command-Line Utilities: The OpenShift Client binary, commonly referred to as the oc CLI, aligned with your cluster's major and minor version numbers. You also require git for version control and source code deployments.
• Hardware Allocations (for Local Deployment): A minimum of 4 physical CPU cores, 9 GB of free RAM, and 35 GB of storage space dedicated exclusively to the virtualization layer.

Mandatory Prerequisite Knowledge and Security Policies

• Kubernetes Core Concepts: Deep familiarity with Pods, Services, ReplicaSets, and Persistent Volumes.
• Access Control Policies: An active Red Hat login and a cluster-allocated Role-Based Access Control (RBAC) profile with at least developer or edit permissions within target namespaces.
• Container Specifications: Understanding container image registries, tag management, and Dockerfile construction principles.

Estimated Operational Benchmarks

• Setup Budget: $0 for OpenShift Local or developer sandbox environments; standard cloud provider compute costs apply for enterprise managed clusters.
• Implementation Time: 15 minutes for command-line tool installation and authentication; 20 minutes for initial application provisioning.

Step-by-Step Application Deployment and Management on OCP

Step 1: Installing and Authenticating the OpenShift CLI

The OpenShift Client command-line interface acts as the primary administrative wrapper around standard Kubernetes command structures, providing advanced security and project management features. You must install the binary and authenticate your session against the cluster's active API server.

First, navigate to your Red Hat Hybrid Cloud Console and download the oc binary package appropriate for your operating system architecture. Extract the compressed file on your local machine and move the execution binary into a directory listed in your system's PATH variable, such as the standard usr/local/bin directory on Unix-based systems. Verify the installation by running the command oc version in your terminal, which should print the client version details.

To authenticate, obtain your login token from the OpenShift Web Console. Click on your username in the top-right corner, select Copy Login Command, and paste the generated string into your terminal. This command follows the structure of oc login followed by the double-dash server flag specifying your API server URL, such as https://api.cluster-name.domain.com:6443, and your secure token flag. If utilizing standard LDAP or local credentials, you may run oc login and provide your username and password when prompted by the secure interactive terminal.

Warning: Never hardcode your API tokens into automation scripts or share them across version control systems. These tokens grant complete RBAC permissions associated with your corporate identity.

Step 2: Provisioning a Secure Project Namespace

Unlike vanilla Kubernetes where namespaces must be managed with highly descriptive YAML manifests, OCP wraps namespaces in a custom resource called Projects. Projects simplify access control, resource quotas, and network isolation policies for development teams.

To create a new workspace, execute the command oc new-project followed by your desired project name, using lowercase alphanumeric characters and hyphens, such as backend-services-dev. This action creates the namespace and automatically switches your active CLI context to this project. You can verify your active context by running oc project, which outputs the current project name, the API server details, and your username.

Under the hood, OCP applies Default Security Context Constraints (SCC) to this project, ensuring that pods cannot run as root unless explicitly granted by a cluster administrator.

Step 3: Deploying Applications via Source-to-Image (S2I)

One of OCP's most powerful native features is Source-to-Image (S2I), an execution framework that compiles your application source code from a remote Git repository directly into a runnable container image, bypassing the need to write and maintain complex Dockerfiles.

To initiate an S2I build, execute the command oc new-app followed by the specific language runtime builder image and the remote Git repository URL. For instance, to deploy a Node.js application, specify nodejs:18~ followed by the HTTPS address of your repository.

During execution, OCP analyzes the source repository, creates an ImageStream to track container tags, provisions a Build Config resource to manage compilation triggers, and schedules a build pod on the cluster infrastructure.

You can monitor this compilation pipeline by executing the command oc logs -f bc/ followed by your application name, which streams the compilation logs, dependency installations, and final container packaging output.

Pro-Tip: If your repository requires authentication, you must inject an SSH or Basic Authentication Secret into the build configuration using the command oc secrets link before launching the build pod.

Step 4: Exposing the Application to External Traffic

By default, an application deployed inside OCP is assigned a cluster-internal service IP address, making it unreachable from the public internet. To allow external traffic, you must expose the internal Service using an OpenShift Route.

While standard Kubernetes requires configuring complex Ingress Controllers and writing custom ingress rule manifests, OCP provides a native Route resource that integrates directly with the cluster’s HAProxy router layer. To generate a Route, run the command oc expose service followed by the name of your service resource. OCP automatically queries the internal port configurations, assigns a publicly resolvable DNS subdomain based on your cluster's wildcard routing domain, and configures the HAProxy load balancer.

To view your new external URL, execute oc get route, which displays the exposed Host/Port endpoint. Copy this domain string into your browser to verify that your application is serving traffic.

Step 5: Scaling and Monitoring Pod Workloads

To ensure high availability and performance stability under heavy traffic loads, OCP allows you to scale your application's pod replicas horizontally on demand.

To scale your deployment configuration up or down, utilize the command oc scale deployment followed by the name of your deployment, appending the double-dash replicas flag with your target number of pods, such as three. OpenShift's scheduler instantly provisions new pod instances, distributes them across healthy nodes, and registers them with the active Service endpoint.

To monitor this scaling activity, execute the command oc get pods -w to watch the status transition of the pods from pending to running. To view real-time resource consumption metrics, including CPU core allocation and memory usage in megabytes, execute the command oc adm top pods inside your active project.

Technical Comparison of Kubernetes and OpenShift (OCP)

The following table highlights the critical structural, administrative, and operational differences between deploying workloads on standard upstream Kubernetes versus using the integrated developer-focused tools within the OpenShift Container Platform.

Resolving Common OpenShift Deployment and Pod Failures

Scenario 1: ImagePullBackOff or ErrImagePull Errors

• Root Cause: The cluster's compute nodes are unable to pull the designated container image from an external registry. This typically occurs because the registry requires authentication credentials, the image path is misspelled, or the service account does not have authorization to pull from the target project's internal image stream.
• Actionable Fix: Execute the command oc describe pod followed by the pod identifier to locate the specific failure logs. If using a private registry, create a new docker-registry secret using your external authentication credentials. Next, link this secret to your project's default service account by executing the command oc secrets link default followed by your secret name, adding the double-dash pull flag to authorize image pull processes.

Scenario 2: CrashLoopBackOff due to Security Context Constraints (SCC)

• Root Cause: The application container image is designed to run its main execution process as the root user (UID 0), or it attempts to write directly to host-level paths. OpenShift’s default restricted Security Context Constraint blocks root execution to protect the host operating system from privilege escalation vulnerabilities.
• Actionable Fix: The most secure resolution is to rebuild your application container image to utilize a non-root user ID, such as 1001, and configure write access exclusively to directories designated for non-privileged users. Alternatively, if your application absolutely requires administrative rights, a cluster administrator must execute the command oc adm policy add-scc-to-user anyuid -z default -n followed by your project name to grant the anyuid privilege level to the service account.

Scenario 3: Route Returning a 503 Service Unavailable Error

• Root Cause: The external HAProxy router is operational, but it cannot establish a connection with any backend pods. This occurs when the service selector labels do not match the labels assigned to your pods, the application failed its readiness probe checks, or the pod process crashed during initialization.
• Actionable Fix: Run the command oc get endpoints followed by your service name to verify if any valid IP addresses are listed under the endpoint array. If the list is empty, inspect your service configuration file and ensure the selector labels precisely match your pod labels. Additionally, check your application's internal logs by running oc logs with your pod name to verify if the server initialized successfully on the exact port defined in your Service port specification.

Frequently Asked Questions

What is the difference between standard Kubernetes kubectl and OpenShift oc commands?

The oc command-line client is a fully compatible superset of the standard Kubernetes kubectl client. Every command that works with kubectl also works with the oc binary by design. However, the oc utility includes specialized commands that are not native to Kubernetes, such as oc new-project to provision namespaces with integrated security parameters, oc new-app to compile code, and oc rsync to synchronize local developer directories directly into running container environments.

How do you configure persistent storage in OpenShift Container Platform?

To configure persistent storage, you must write a Persistent Volume Claim (PVC) manifest. This manifest defines your storage needs by specifying the access modes (such as ReadWriteOnce or ReadWriteMany) and the storage capacity requirements (such as 10Gi). Once you run oc create -f with your PVC file, OpenShift interfaces with the underlying infrastructure storage class to dynamically provision the storage disk and bind it to your application pods.

How can I deploy applications using a Dockerfile instead of Source-to-Image (S2I)?

You can deploy a Dockerfile directly inside OpenShift by using the command oc new-app and appending the double-dash docker-source flag followed by your Git repository URL. If the repository contains a valid file named Dockerfile, the OpenShift build engine automatically switches its build strategy to a Docker build, compiles each layer specified inside the file, and pushes the final product to your cluster's local container registry.

What are Security Context Constraints (SCC) and why do they block my pods?

Security Context Constraints are highly granular security policies that control the permissions assigned to pods within an OpenShift cluster. Unlike standard Kubernetes which allows unrestricted container operations by default, OCP utilizes SCCs to enforce strict system isolation, such as preventing pods from accessing host volumes, running with root permissions, or using host network ports. If your pod is blocked by these rules, you must either modify the pod to use unprivileged accounts or request a policy modification from your administrator.

Maximize Your Enterprise Kubernetes Potential

Accelerate your development pipelines by migrating your critical container workloads to the Red Hat OpenShift Container Platform today. Contact our certified cloud architecture team to schedule a custom deployment audit and experience the enterprise security, automated scaling, and simplified developer workflows of OCP.