Red Hat OpenShift Security Roadshow
This course offers hands-on experience with Kubernetes-native security on Red Hat® OpenShift Container Platform—covering platform foundations, Advanced Cluster Security (RHACS), and Trusted Software Supply Chain (TSSC). Each module ends with a practical task so you apply what you learned before moving on.
How this Roadshow works
-
This page is home — Credentials and console links live here. Use the home button anytime you get lost.
-
Navigate with the table of contents — Modules are in the left table of contents, or use Next at the bottom of each page.
-
Use consoles in Showroom, or open them in a new tab — Keep this guide open. Prefer the console tabs on the right of the lab UI. To open a link in a new browser tab: on a Mac, <cmd> click; on Windows/Linux, <ctrl> click or right-click → "Open in new tab."
-
Use the bastion — Run
oc,roxctl, andpodmanon the RHEL bastion. -
Cluster services come from GitOps — RHACS, Quay, GitOps, Compliance Operator, and the vulnerable demo apps are already synced by Argo CD.
-
Run the bastion setup script — That step configures your CLI token, workshop images in Quay, and TSSC CLIs (
cosign,oc-mirror,ec). -
Work the catalog in order, or jump in — 101 → 201 → 301, then the product deep-dives (RHACS, Virtualization, Lightwell TSSC).
Environment setup
Cluster-wide install (RHACS, Quay, GitOps, Compliance Operator, demo apps) is already applied by OpenShift GitOps. From the Terminal tab, run the remaining bastion steps: RHACS CLI access, workshop images, and TSSC CLIs (cosign, oc-mirror, ec).
git clone https://github.com/rhpds/ocp5-rhacs-showroom.git
cd ocp5-rhacs-showroom
bash setup/lab-environment.sh \
--quay-user admin \
--quay-password '{common_password}'
source ~/.bashrc
| Feel free to sign into the consoles while the lab environment script runs in the background. |
All lab components
Before you start a path, confirm you can open each Showroom tab (right side of the lab UI) and sign in. Use these credentials anytime you return to this homepage.
| Using the Showroom allows you to move through the console tabs while you work through the labs. |
Red Hat® OpenShift Container Platform (OCP)
-
Open the OpenShift Console tab (or go to
{openshift_cluster_console_url}). -
Sign in with the credentials below.
Console URL |
{openshift_cluster_console_url} |
API URL |
{openshift_api_server_url} |
Username |
{openshift_cluster_admin_username} |
Password |
{openshift_cluster_admin_password} |
Red Hat® Advanced Cluster Security (RHACS)
-
Open the Red Hat Advanced Cluster Security tab (or go to
https://central-reencrypt-stackrox.{openshift_cluster_ingress_domain}). -
Sign in with the credentials below.
Console URL |
https://central-reencrypt-stackrox.{openshift_cluster_ingress_domain} |
Username |
admin |
Password |
{common_password} |
OpenShift GitOps (Argo CD)
-
Open the OpenShift GitOps tab (or go to
https://openshift-gitops-server-openshift-gitops.{openshift_cluster_ingress_domain}). -
Sign in with the credentials below.
Console URL |
https://openshift-gitops-server-openshift-gitops.{openshift_cluster_ingress_domain} |
Username |
{openshift_gitops_user} |
Password |
{openshift_gitops_password} |
SSO (Keycloak)
TSSC identity for RHTPA. Open the SSO (Keycloak) tab (or go to https://sso-tpa.{openshift_cluster_ingress_domain}/admin/). Use tpa-user on the RHTPA tab — not this admin console — when the lab asks you to sign in to Trusted Profile Analyzer.
Admin console |
|
Admin username |
admin |
Admin password |
{common_password} |
TPA username |
tpa-user |
TPA password |
{common_password} |
Red Hat Trusted Profile Analyzer (RHTPA)
-
Open the RHTPA tab (or go to
https://server-trusted-profile-analyzer.{openshift_cluster_ingress_domain}). -
Sign in with the TPA user (Keycloak realm
tpa).
Console URL |
https://server-trusted-profile-analyzer.{openshift_cluster_ingress_domain} |
Username |
tpa-user |
Password |
{common_password} |
Gitea
-
Open the Gitea tab (or go to
https://gitea.{openshift_cluster_ingress_domain}). -
Sign in with the credentials below.
Console URL |
|
Username |
student |
Password |
{common_password} |
Red Hat Developer Hub
-
Open the Developer Hub tab (or go to
https://backstage-developer-hub-rhdh.{openshift_cluster_ingress_domain}). -
Choose Guest — Developer Hub has no workshop password.
Console URL |
https://backstage-developer-hub-rhdh.{openshift_cluster_ingress_domain} |
Sign-in |
Guest (no password) |
What’s in this roadshow
-
101 Foundations — OpenShift secure-by-default posture.
-
201 Intermediate — Hardening and shift-left.
-
301 Advanced — Enterprise and zero trust.
-
Advanced Cluster Security (RHACS) — Setup, vulnerabilities, policy and risk, CI/CD gates, compliance, notifications and API, network and runtime, installation, and ACS 5 capabilities (VM scanning, file activity monitoring, MCP, and init containers).
-
OpenShift Virtualization Security — HyperConverged feature gates, virt RBAC, VM and storage isolation, VM networking, and host firmware/kernel controls from the OpenShift Virtualization hardening guide.
-
Lightwell and Red Hat Trusted Software Supply Chain (TSSC) — Hummingbird, Lightwell remediations, hermetic build, keyless signing, GitOps admission, and TPA/ACS compliance.