Red Hat OpenShift Security Roadshow

This course offers hands-on experience with Kubernetes-native security on Red Hat® OpenShift Container Platform—covering platform foundations, Advanced Cluster Security (RHACS), and Trusted Software Supply Chain (TSSC). Each module ends with a practical task so you apply what you learned before moving on.

How this Roadshow works

  • This page is home — Credentials and console links live here. Use the home button anytime you get lost.

  • Navigate with the table of contents — Modules are in the left table of contents, or use Next at the bottom of each page.

  • Use consoles in Showroom, or open them in a new tab — Keep this guide open. Prefer the console tabs on the right of the lab UI. To open a link in a new browser tab: on a Mac, <cmd> click; on Windows/Linux, <ctrl> click or right-click → "Open in new tab."

  • Use the bastion — Run oc, roxctl, and podman on the RHEL bastion.

  • Cluster services come from GitOps — RHACS, Quay, GitOps, Compliance Operator, and the vulnerable demo apps are already synced by Argo CD.

  • Run the bastion setup script — That step configures your CLI token, workshop images in Quay, and TSSC CLIs (cosign, oc-mirror, ec).

  • Work the catalog in order, or jump in — 101 → 201 → 301, then the product deep-dives (RHACS, Virtualization, Lightwell TSSC).

Environment setup

Cluster-wide install (RHACS, Quay, GitOps, Compliance Operator, demo apps) is already applied by OpenShift GitOps. From the Terminal tab, run the remaining bastion steps: RHACS CLI access, workshop images, and TSSC CLIs (cosign, oc-mirror, ec).

git clone https://github.com/rhpds/ocp5-rhacs-showroom.git
cd ocp5-rhacs-showroom
bash setup/lab-environment.sh \
  --quay-user admin \
  --quay-password '{common_password}'
source ~/.bashrc
Feel free to sign into the consoles while the lab environment script runs in the background.

All lab components

Before you start a path, confirm you can open each Showroom tab (right side of the lab UI) and sign in. Use these credentials anytime you return to this homepage.

Using the Showroom allows you to move through the console tabs while you work through the labs.

Red Hat® OpenShift Container Platform (OCP)

  1. Open the OpenShift Console tab (or go to {openshift_cluster_console_url}).

  2. Sign in with the credentials below.

Console URL

{openshift_cluster_console_url}

API URL

{openshift_api_server_url}

Username

{openshift_cluster_admin_username}

Password

{openshift_cluster_admin_password}

Red Hat® Advanced Cluster Security (RHACS)

  1. Open the Red Hat Advanced Cluster Security tab (or go to https://central-reencrypt-stackrox.{openshift_cluster_ingress_domain}).

  2. Sign in with the credentials below.

Console URL

https://central-reencrypt-stackrox.{openshift_cluster_ingress_domain}

Username

admin

Password

{common_password}

OpenShift GitOps (Argo CD)

  1. Open the OpenShift GitOps tab (or go to https://openshift-gitops-server-openshift-gitops.{openshift_cluster_ingress_domain}).

  2. Sign in with the credentials below.

Console URL

https://openshift-gitops-server-openshift-gitops.{openshift_cluster_ingress_domain}

Username

{openshift_gitops_user}

Password

{openshift_gitops_password}

SSO (Keycloak)

TSSC identity for RHTPA. Open the SSO (Keycloak) tab (or go to https://sso-tpa.{openshift_cluster_ingress_domain}/admin/). Use tpa-user on the RHTPA tab — not this admin console — when the lab asks you to sign in to Trusted Profile Analyzer.

Admin console

https://sso-tpa.{openshift_cluster_ingress_domain}/admin/

Admin username

admin

Admin password

{common_password}

TPA username

tpa-user

TPA password

{common_password}

Red Hat Trusted Profile Analyzer (RHTPA)

  1. Open the RHTPA tab (or go to https://server-trusted-profile-analyzer.{openshift_cluster_ingress_domain}).

  2. Sign in with the TPA user (Keycloak realm tpa).

Console URL

https://server-trusted-profile-analyzer.{openshift_cluster_ingress_domain}

Username

tpa-user

Password

{common_password}

Gitea

  1. Open the Gitea tab (or go to https://gitea.{openshift_cluster_ingress_domain}).

  2. Sign in with the credentials below.

Console URL

https://gitea.{openshift_cluster_ingress_domain}

Username

student

Password

{common_password}

Red Hat Developer Hub

  1. Open the Developer Hub tab (or go to https://backstage-developer-hub-rhdh.{openshift_cluster_ingress_domain}).

  2. Choose Guest — Developer Hub has no workshop password.

Console URL

https://backstage-developer-hub-rhdh.{openshift_cluster_ingress_domain}

Sign-in

Guest (no password)

Showroom Terminal

Use the Terminal tab (or SSH) for CLI work (oc, roxctl, podman, curl, etc.).

SSH command

{bastion_ssh_command}

Password

{bastion_ssh_password}

What’s in this roadshow