Red Hat OpenShift Security Roadshow

This course offers hands-on experience with Kubernetes-native security on Red Hat® OpenShift Container Platform—covering platform foundations, Advanced Cluster Security (RHACS), and Trusted Software Supply Chain (TSSC). Each module ends with a practical task so you apply what you learned before moving on.

How this Roadshow works

  • This page is home — Credentials and console links live here. Use the home button anytime you get lost.

  • Navigate with the table of contents — Modules are in the left table of contents, or use Next at the bottom of each page.

  • Open consoles in a new tab — Keep this guide open. On a Mac, use <cmd> click; on Windows/Linux, use <ctrl> click or right-click → "Open in new tab."

  • Use the bastion — Run oc, roxctl, and podman on the RHEL bastion.

  • Run the setup script — To ensure you have the applications installed and configured, make sure to run the setup script from the bastion terminal tab.

  • Pick a role — For a tailored experience, start with the track that matches your desired role.

Environment setup

From the bastion terminal tab, run the following commands to setup the lab environment.

git clone https://github.com/mfosterrox/openshift-security-roadshow.git
cd openshift-security-roadshow
bash setup/lab-environment.sh \
  --quay-user {quay_admin_username} \
  --quay-password '{quay_admin_password}'
source ~/.bashrc
Feel free to sign into the consoles while the lab environment script runs in the background.

All lab components

Before you start a path, confirm you can open each Showroom tab (right side of the lab UI) and sign in. Use these credentials anytime you return to this homepage.

Using the Showroom allows you to move through the console tabs while you work through the labs.

Red Hat® OpenShift Container Platform (OCP)

  1. Open the OpenShift tab (or go to {openshift_cluster_console_url}).

  2. Sign in with the credentials below.

Console URL

{openshift_cluster_console_url}

Username

{openshift_cluster_admin_username}

Password

{openshift_cluster_admin_password}

RHACM and OpenShift GitOps (ArgoCD) are available from the same OpenShift console (Applications, Pipelines, and GitOps in the left menu or cluster dropdown).

Red Hat® Advanced Cluster Security (RHACS)

  1. Open the RHACS tab to the right (or go to {acs_route}[{acs_route}^]).

  2. Sign in with the credentials below.

Console URL

{acs_route}[{acs_route}^]

Username

{acs_portal_username}

Password

{acs_portal_password}

Red Hat® Quay

  1. Open the Quay tab (or go to {quay_console_url}[{quay_console_url}^]).

  2. Sign in with the credentials below.

Console URL

{quay_console_url}[{quay_console_url}^]

Username

{quay_admin_username}

Password

{quay_admin_password}

Red Hat® Enterprise Linux (RHEL) bastion

Use the Terminal / bastion tab (or SSH) for CLI work (oc, roxctl, podman, curl, etc.).

SSH Command

{bastion_ssh_command}

Password

{bastion_ssh_password}

Choose your role

Start here. Open the track for your role, then follow the recommended sequence (Basic → Intermediate → Advanced).

  • Application Developer — Build and ship secure workloads: least privilege, secrets, trusted images, and baseline pipeline hygiene.

  • Platform Operator — Operate and harden clusters: SCCs, quotas, network baselines, audit, compliance, and day-2 guardrails.

  • DevSecOps Engineer — Embed security in delivery: CI/CD gates, signing, admission policy, runtime feedback, and supply chain controls.

  • Security Architect — Design governance and zero-trust strategy across teams, clusters, identity, and exceptions.

  • Network & Infrastructure Engineer — Secure the data plane: segmentation, encryption in transit, mTLS patterns, and traffic-focused observability.

Browse full catalogs by skill level: 101 Foundations, 201 Intermediate, 301 Advanced.

Product specific deep-dives

Use these after (or alongside) the role track that owns the capability—especially DevSecOps, Platform Operator, and Security Architect.