Deploying on OpenShift
Overview
This guide describes how to deploy Ivanti Connect Secure (ICS) as a virtual machine on Red Hat OpenShift using KubeVirt and Ivanti-provided deployment artifacts, including OVMF, the wrapper binary, and YAML files. Secure Boot and vTPM are enabled by default. The guide also covers optional initialization of network and administrator settings using an ISO image during first boot.
Use this guide to prepare the OpenShift environment, upload the ICS image, create the virtual machine, and optionally configure initial system settings for first-time deployment.
Deployment Workflow
Follow these steps to deploy Ivanti Connect Secure (ICS) on Red Hat OpenShift using KubeVirt:
- Review the OpenShift, KubeVirt, compute, storage, and networking prerequisites defined in the provided YAML files.
- Obtain the ICS KVM deployment artifact: (The version shown in the screenshots is an example based on ICS 25.1.3.0 GA build 22109.)
- Extract the ZIP archive to obtain the deployment files, including the KVM image, OVMF files, and YAML manifests.
- Extract ISA-V-KVM-ICS-25.1.3.0-22109.1-VT-kvm.img.gz to obtain the ICS VM image file (.img in QCOW2 format).
- Upload the extracted ICS (qcow2 format) image to the OpenShift cluster.
- Obtain and run the Ivanti wrapper binary (provided separately from the deployment artifact). Supply the OVMF_VARS file and YAML manifests as input. The wrapper validates Secure Boot and vTPM settings, then creates and deploys the ICS virtual machine. Login to in download portal and navigate to Download > Network Security> Ivanti Connect Secure> Ivanti Connect Secure to fetch KVM_OpenShift_wrapper_binaries.zip
- (Optional) Initialize the VM configuration during deployment by attaching a configuration ISO image.
Pre-Requisites
- OpenShiftServer
- Kubeconfigfile
- KubevirtOperatorinstalled
- StorageClassprovisioned
- Networkprovisioned
Key Concepts
Review the terms below before starting the deployment steps. These explain the OpenShift virtualization components and security features referenced throughout this guide.
- Kubevirt: KubeVirt is an open-source Kubernetes extension that allows you to run and manage Virtual Machines (VMs) alongside standard containers on a single platform.
- Secure Boot: Secure Boot is a UEFI firmware feature that prevents malicious software, like rootkits or deep-level cheats, from loading when you turn on your PC. It acts like a bouncer by checking the cryptographic signature of every boot file against a trusted database before allowing Linux to start.
- Virtual TPM: A Virtual Trusted Platform Module (vTPM) is a software-based emulation of a physical TPM 2.0 chip. It provides virtual machines (VMs) with hardware-level security, allowing guest operating systems to securely store cryptographic keys, perform remote system attestation, and meet OS requirements.
- OVMF: OVMF (Open Virtual Machine Firmware) is an open-source project that provides UEFI (Unified Extensible Firmware Interface) support for virtual machines. It serves as the virtual equivalent of a motherboard's BIOS/UEFI, allowing hypervisors like QEMU and KVM to boot guest operating systems using modern firmware standards.
- Ivanti wrapper binary: This wrapper binary is used to deploy ICS VM automatically with Secure Boot and vTPM enabled on OpenShift environment. Supports x86_64 and ARM architectures.
- ivanti-oc-wrapper-linux-amd64 (x86_64): Wrapper binary for deploying and managing ICS virtual machines on OpenShift from 64-bit x86 Linux workstations, jump hosts, or CI/CD runners.
- ivanti-oc-wrapper-linux-arm64 (ARM64): Wrapper binary for deploying and managing ICS virtual machines on OpenShift from 64-bit ARM Linux workstations, jump hosts, or management servers.
- ivanti-oc-wrapper-darwin-arm64 (macOS Apple Silicon): Wrapper binary for deploying and managing ICS virtual machines on OpenShift from Apple Silicon (M-series) macOS workstations.
Upload ICS Image
UploadICSKVMimage to Red Hat OpenShift Cluster. The uploaded image is stored as a source PVC and is used by the virtual machine definition during deployment.
Use the following command to upload the ICS image to the OpenShift cluster.
virtctlimage-uploadpvcics-25.1.3.0-22109.1 \
--namespace=openshift-cnv \
--pvc-size=80Gi \
--image-path=/path/to/ISA-V-KVM-ICS-25.1.3.0-22109.1-VT-kvm.img \
--storage-class=hostpath-csi \
--insecureAbove example command references the hostpath-csi storage class for demonstration purposes. Modify the storage class parameter to match the storage provisioner and storage class available in your Red Hat OpenShift deployment.
Create ICS VM
- Create the VM YAML file for the ICS deployment.
- Use the following sample YAML file as a starting point. Update the storage class, network attachment definitions, CPU and memory allocations, and image to match your target OpenShift environment and deployment requirements.
Sample yaml
Review VM Configuration Areas
The following subsections explain the main parts of the VM YAML that typically require review or customization before deployment.
Select the source image
The following section specifies the uploaded ICS image PVC that is used as the VM source image.
Configure computere sources
The following settings define the CPU and Memory allocation for the VM.
CPUs and Memory need to be based on ICS model like ISA4500-V, ISA6500-V and ISA8500-V.
- ISA4500-V:4vCPUs and 8GB RAM
- ISA6500-V:8vCPUs and 16GB RAM
- ISA8500-V:12vCPUs and 32GB RAM
Enable Secure Boot and vTPM
The following settings enable UEFI Secure Boot and persistent vTPM support for the VM.
Configure Network
The following settings create the VM network interface and bind it to the specified Multus network attachment.
In above example, only one interface is created. Depending on requirement, ICS can be created with three interfaces with appropriate bridges.
- Internal (int0).
- External (ext0).
- Management (mgt0).
Deploy ICS VM
Execute the command using the syntax shown below and with required arguments.
Syntax
- <Ivanti-oc-wrapper> - Ivanti binary to deploy ICS VM.
- <namespace> – The namespace where we deploy the VM.
- <ovmf-path> – The path of OVMF_VARS.secboot.ivanti.fd file.
- <yaml> – The path of created ics.yaml file.
Example:
Configuration Initialization
ICS running on OpenShift supports configuration initialization through ISO image.
During bootup, the system checks for an attached configuration ISO. If a valid ISO is detected, then configurations like IP address, subnet, username, and password is initialized from that ISO image.
Example configuration initialization:
Save above XML as kvm_template.xml (template is already part of compressed KVM file).
The configuration file must be named kvm_template.xml, else configuration initialization fails.
- Create ISO image from template file using below command.
- Upload openshift.iso file to OpenShift data volume.
Following YAML file creates datastore volume.
- Upload ISO image to iso-dv data volume.
- Verify that upload is successful.
- Attach iso-dev to VM during creation. Following is snippet of YAML file where ISO is attached.
- If KVM initialization drive is successfully attached, then following message will be seen during boot up. “This is KVM environment and configuration drive is present”