Install the Nginx Ingress operator

FTM requires you to install the Nginx Ingress operator on the Red Hat® OpenShift® cluster.

This operator is used to create Ingress objects that allow access to the FTM APIs. You do not need to install the Nginx Ingress operator for FTM Base.

The following instructions are a snapshot for convenience. For more information, see Installation in an OpenShift cluster using the OLM.
Note: The Nginx Ingress operator is not supported on Power clusters. Hence, you can skip the install the operator section when you use the Power cluster.
The following sections describe how to install, configure, and deploy NGINX Ingress on Red Hat OpenShift.
  1. Install the operator.
  2. Create the Ingress Certificate secret.
  3. Create the Certificate Revocation List (CRL) secret.

Install the operator

  1. Use the Operator Lifecycle Manager (OLM) to install the NGINX Ingress operator.
    1. In the Red Hat OpenShift dashboard, go to Ecosystem > Software Catalog in OCP 4.20+, Operators > OperatorHub in OCP 4.18, and search for nginx ingress.
    2. Select NGINX Ingress Operator and install the latest 3.6.x version from the alpha channel. Install it cluster-wide so it supports any FTM namespace on your cluster.
    3. Click Subscribe to complete the installation.
  2. Create a new SCC on your cluster. This SCC provides the capabilities that you need to assign to the NGINX Ingress service accounts.
    # Create SCC for IC resources
kind: SecurityContextConstraints
apiVersion: security.openshift.io/v1
metadata:
  name: nginx-ingress-admin
allowPrivilegedContainer: false
runAsUser:
  type: MustRunAs
  uid: 101
seLinuxContext:
  type: MustRunAs
fsGroup:
  type: MustRunAs
supplementalGroups:
  type: MustRunAs
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
allowHostDirVolumePlugin: false
allowHostIPC: false
readOnlyRootFilesystem: false
seccompProfiles:
  - runtime/default
volumes:
  - secret
requiredDropCapabilities:
  - ALL
users:
  - 'system:serviceaccount:*:nginx-ingress'
allowedCapabilities:
  - NET_BIND_SERVICE
  3. Create the scc.yaml file and run the following command.
    oc apply -f scc.yaml

Create the Ingress Certificate secret

If needed, create the ingress certificate secret. If not set, the FTM certificate is used instead. For more information, see Create certificates .

Create the Certificate Revocation List (CRL) secret

You need to create a new secret that contains the CRL file (crl.pem) in base64-encoded format. Ensure that the CRL file is in PEM format and contains the list of revoked certificates, typically obtained from your Certificate Authority (CA).

Run the following command that points to your crl.pem file. Replace secretName with the secret name and namespaceName with the name of the FTM namespace.
oc create secret generic [secretName] --from-file=crl.pem=/path/to/crl.pem -n [namespaceName]