Deploying Cisco ISE on OpenShift Virtualization/Kubevirt

README.md

Cisco ISE on OpenShift Virtualization

Ref.

• https://access.redhat.com/solutions/3598391
• https://kubevirt.io/user-guide/user_workloads/hook-sidecar/#enabling-sidecar-feature-gate

Installation

Enable the Sidecar Feature gate:

apiVersion: hco.kubevirt.io/v1beta1
kind: HyperConverged
metadata:
  name: kubevirt-hyperconverged
  namespace: openshift-cnv
  annotations:
    kubevirt.kubevirt.io/jsonpatch: >-
      [{"op": "add", "path": "/spec/configuration/developerConfiguration/featureGates/-", "value": "Sidecar"}] # <- Add this 
spec:
  # ...

Add the configmap with the script to replace the product in the SMBIOS xml:

cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: ConfigMap
metadata:
  name: my-config-map
  namespace: ise
data:
  my_script.sh: |
    #!/bin/sh
    tempFile=`mktemp --dry-run`
    echo $4 > $tempFile
    sed -i "s|OpenShift Virtualization|KVM|" $tempFile
    cat $tempFile
EOF

Add the hook annotation in your VM under spec.template.metadata.annotations:

apiVersion: kubevirt.io/v1
kind: VirtualMachine
metadata:
  name: ise
  namespace: ise
spec:
  running: true
  template:
    metadata:
      labels:
        kubevirt.io/domain: ise
      annotations:
        # Add the following annotation:
        hooks.kubevirt.io/hookSidecars: >
            [
              {
                "args": ["--version", "v1alpha2"],
                "configMap": {"name": "my-config-map", "key": "my_script.sh", "hookPath": "/usr/bin/onDefineDomain"}
              }
            ]
    spec:
      # ...