Lab Setup and Introduction

Table of Contents

1. Module Goals
2. Accessing the Workshop Components
- 2.1. Access the Red Hat^® Advanced Cluster Security (RHACS) User Interface
- 2.2. Access the Red Hat^® Quay UI
3. Lab environment setup
- 3.1. Run the setup script
4. Red Hat Quay
5. Security Exercise: Trusted Image Pulls from Quay
6. Summary
7. Cleanup

1. Module Goals

Access the OpenShift, RHACS, and Quay consoles used throughout the roadshow
Run the bastion setup script to configure RHACS CLI access and deploy vulnerable demo apps
Build and push workshop images to Quay, then deploy the patient-portal application
Complete the Trusted Image Pulls from Quay security exercise

2. Accessing the Workshop Components

2.1. Access the Red Hat^® Advanced Cluster Security (RHACS) User Interface

Ensure that you have access to the RHACS user interface using the tab in the right side of the UI or go to {acs_route}.

Procedure

Log into the RHACS console using the RHACS tab to the right or go to {acs_route}[{acs_route}^].

Enter the RHACS credentials:

RHACS Console Username:

{acs_portal_username}

RHACS Console Password:

{acs_portal_password}

2.2. Access the Red Hat^® Quay UI

Red Hat Quay is an enterprise-grade container registry that provides a secure, scalable, and highly available solution for storing and managing container images. It offers integrated security scanning, access controls, and image signing to help ensure the integrity and security of containerized applications across hybrid and multi-cloud environments, including Red Hat OpenShift, AWS, Azure, and Google Cloud.

Let’s ensure that you have access to the Quay User Interface.

Procedure

Log into the Quay console at {quay_console_url}[{quay_console_url}^]

Enter the Quay credentials:

Quay Console Username:

{quay_admin_username}

Quay Console Password:

{quay_admin_password}

3. Lab environment setup

The setup script below performs the CLI work for this module in one pass: it verifies OpenShift and RHACS access, saves workshop variables to ~/.bashrc, deploys the vulnerable demo applications, builds and pushes container images to Quay, and prints a summary when finished.

Variables persisted to ~/.bashrc:

TUTORIAL_HOME — cloned demo-apps repository
QUAY_USER / QUAY_URL — your Quay registry credentials and hostname
ROX_CENTRAL_ADDRESS / ROX_PASSWORD / ROX_API_TOKEN — RHACS Central host, admin password, and generated API token
APP_HOME — set when you deploy the patient-portal application (second script step)

3.1. Run the setup script

Procedure

Clone the roadshow repository and run the lab setup script:

git clone https://github.com/mfosterrox/openshift-security-roadshow.git
cd openshift-security-roadshow
bash setup/lab-environment.sh \
  --quay-user {quay_admin_username} \
  --quay-password '{quay_admin_password}'

Lab environment setup
Details: /home/lab-user/.acs-roadshow/lab-environment-YYYYMMDD-HHMMSS.log

[############################] 9/9  Lab environment setup complete

================================================================
  SUCCESS: Lab environment setup completed successfully
================================================================

  ✓ RHACS CLI ready (ROX_CENTRAL_ADDRESS / ROX_API_TOKEN saved)
  ✓ Workshop demo applications deployed
  ✓ Quay images ready (golden base + frontend, when image steps ran)
  ✓ Env file: /home/lab-user/.acs-roadshow/env
  ✓ Detailed log: /home/lab-user/.acs-roadshow/lab-environment-....log

PodSecurity warnings during oc apply are expected—you are deploying intentionally vulnerable applications for the workshop.

The script prints progress for each phase. When it completes, reload your shell environment:

source ~/.bashrc
echo "TUTORIAL_HOME=$TUTORIAL_HOME"
echo "QUAY_URL=$QUAY_URL"
echo "ROX_CENTRAL_ADDRESS=$ROX_CENTRAL_ADDRESS"
test -n "$ROX_API_TOKEN" && echo "ROX_API_TOKEN is set" || echo "ROX_API_TOKEN is missing"

4. Red Hat Quay

Red Hat Quay is an enterprise-quality registry for building, securing, and serving container images. The setup script already pushed your frontend and python-alpine-golden images. Explore the registry in the UI before deploying the patient-portal application.

4.1. Accessing Quay

Your Red Hat Quay console is available at: {quay_console_url}[window=blank]

Quay Console Username:

{quay_admin_username}

Quay Console Password:

{quay_admin_password}

4.2. Browse the Registry

The setup script built and pushed the frontend application image. Before deploying it to OpenShift, browse the repository and make it public.

Procedure

Click the frontend repository in Quay.

Under Settings → Repository Visibility, click Make Public and confirm.

The patient-portal deployment pulls from Quay. The repository must be public before running the deploy step below.

4.3. Vulnerability Scanning with Quay

Open the Tags tab for the frontend repository.

Hover over the Security Scan column for vulnerability details.

The image includes intentionally vulnerable packages for workshop policy exercises. Counts vary by scanner and feed.

Click a vulnerability entry for remediation guidance.

4.4. Verify RHACS and Quay integration

roxctl --insecure-skip-tls-verify -e "$ROX_CENTRAL_ADDRESS:443" \
  image scan --image=$QUAY_URL/$QUAY_USER/frontend:0.1 --force -o table | head -25

4.5. Deploy the patient-portal application

After making the frontend repository public, run the second setup phase:

cd ~/openshift-security-roadshow
bash setup/lab-environment.sh --deploy-skupper-only

[lab-user@bastion openshift-security-roadshow]$ cd ~/openshift-security-roadshow
[lab-user@bastion openshift-security-roadshow]$ bash setup/lab-environment.sh --deploy-skupper-only

==> Deploying patient-portal application (Skupper demo)
------------------------------------------------------------------------
Cloning into 'skupper-app'...
namespace/patient-portal created
deployment.apps/database created
service/database created
deployment.apps/frontend created
route.route.openshift.io/frontend-patient-route created
service/frontend-service created
deployment.apps/payment-processor created
service/payment-service created
NAME                                 READY   STATUS    RESTARTS   AGE
database-758f8f75f7-46ndf            1/1     Running   0          12s
frontend-5c487dcb47-7gsm7            1/1     Running   0          10s
frontend-5c487dcb47-f25hm            1/1     Running   0          10s
frontend-5c487dcb47-z9stn            1/1     Running   0          10s
payment-processor-6644dfc5b7-5vzqh   1/1     Running   0          8s
payment-processor-6644dfc5b7-96jb6   1/1     Running   0          8s
payment-processor-6644dfc5b7-9vl7b   1/1     Running   0          8s

Patient portal deployed. Frontend image: quay-h2xfr.apps.cluster-h2xfr.h2xfr.sandbox2437.opentlc.com/quayadmin/frontend:0.1

Verify the application is running:

oc get pods -n patient-portal

NAME                                 READY   STATUS    RESTARTS   AGE
database-758f8f75f7-46ndf            1/1     Running   0          56s
frontend-5c487dcb47-7gsm7            1/1     Running   0          54s
frontend-5c487dcb47-f25hm            1/1     Running   0          54s
frontend-5c487dcb47-z9stn            1/1     Running   0          54s
payment-processor-6644dfc5b7-5vzqh   1/1     Running   0          51s

5. Security Exercise: Trusted Image Pulls from Quay

You built, scanned, and deployed the frontend image through Quay. Before moving on, verify that OpenShift is running the same image you pushed—not an unexpected registry, tag, or stale pull.

5.1. Scenario

We scanned frontend:0.1 in Quay before go-live. Show me proof the patient-portal pods pulled that exact image from our registry and not something else.

— Morgan
Infosec

5.2. Your task

The steps are there for guidance. If you need help, expand the step and compare your approach to the lab commands.

Step 1 — Confirm the deployment image reference

Variables come from ~/.bashrc.

source ~/.bashrc
oc get deploy frontend -n patient-portal \
  -o jsonpath='{.spec.template.spec.containers[0].image}{"\n"}'
echo "Expected: ${QUAY_URL}/${QUAY_USER}/frontend:0.1"

Step 2 — Inspect pod pull events

Check where OpenShift pulled the image from.

oc describe pod -n patient-portal -l app=frontend | grep -E 'Image:|Pull|Pulling|Pulled|Failed|Back-off'

    Image:          quay-h2xfr.apps.cluster-h2xfr.h2xfr.sandbox2437.opentlc.com/quayadmin/frontend:0.1
  Normal  Pulling    2m   kubelet  Pulling image "quay-h2xfr.apps.cluster-h2xfr.h2xfr.sandbox2437.opentlc.com/quayadmin/frontend:0.1"
  Normal  Pulled     2m   kubelet  Successfully pulled image "quay-h2xfr.apps.cluster-h2xfr.h2xfr.sandbox2437.opentlc.com/quayadmin/frontend:0.1"

Step 3 — Compare Quay digest to running pods

The imageID on the pod should include the same digest prefix (sha256:…) as the Quay manifest.

source ~/.bashrc
podman inspect --format='Quay digest: {{.Digest}}' ${QUAY_URL}/${QUAY_USER}/frontend:0.1
oc get pod -n patient-portal -l app=frontend -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.status.containerStatuses[0].imageID}{"\n"}{end}'

Step 4 — Cross-check with RHACS

Confirm the scanned image matches what you deployed.

source ~/.bashrc
roxctl --insecure-skip-tls-verify -e "$ROX_CENTRAL_ADDRESS:443" \
  image scan --image=${QUAY_URL}/${QUAY_USER}/frontend:0.1 --force -o table | head -15

Earlier in this module you had to make the Quay repository public before the deploy succeeded. If the repository were private and no imagePullSecret were configured, frontend pods would stay in ImagePullBackOff—a common production misconfiguration.

5.3. What you learned

OpenShift records the full image reference and pull events on each pod—useful for supply-chain audits.
Tag names alone are not enough; digest comparison proves the cluster runs the same bits you scanned in Quay.
Registry visibility (public vs private) and pull secrets directly affect whether workloads can start securely.
RHACS ties vulnerability data to the exact image URI your deployments pull from Quay.

6. Summary

Great Job!

Now that the setup is all done, you are ready to move on with RHACS and dive into the security considerations.

On to Visibility and Navigation!

7. Cleanup

Before moving to the next module, run the lab cleanup script to reset transient resources from this module.

cd ~/openshift-security-roadshow
bash setup/lab-cleanup.sh --module 00

Lab Setup and Introduction

1. Module Goals

2. Accessing the Workshop Components

2.1. Access the Red Hat® Advanced Cluster Security (RHACS) User Interface

2.2. Access the Red Hat® Quay UI

3. Lab environment setup

3.1. Run the setup script

4. Red Hat Quay

4.1. Accessing Quay

4.2. Browse the Registry

4.3. Vulnerability Scanning with Quay

4.4. Verify RHACS and Quay integration

4.5. Deploy the patient-portal application

5. Security Exercise: Trusted Image Pulls from Quay

5.1. Scenario

5.2. Your task

5.3. What you learned

6. Summary

7. Cleanup

2.1. Access the Red Hat^® Advanced Cluster Security (RHACS) User Interface

2.2. Access the Red Hat^® Quay UI