--- title: Deploying on OpenShift slug: ps/help/en_us/ics/25x/vadep/deploying-on-openshift docTags: createdAt: 2026-09-25T06:11:07.135Z --- ## Overview This guide describes how to deploy **Ivanti Connect Secure (ICS)** as a virtual machine on **Red Hat OpenShift** using **KubeVirt** and Ivanti-provided deployment artifacts, including OVMF, the wrapper binary, and YAML files. Secure Boot and vTPM are enabled by default. The guide also covers optional initialization of network and administrator settings using an ISO image during first boot. Use this guide to prepare the OpenShift environment, upload the ICS image, create the virtual machine, and optionally configure initial system settings for first-time deployment. ## Deployment Workflow Follow these steps to deploy Ivanti Connect Secure (ICS) on Red Hat OpenShift using KubeVirt: 1. Review the OpenShift, KubeVirt, compute, storage, and networking prerequisites defined in the provided YAML files. 2. Obtain the ICS KVM deployment artifact: (The version shown in the screenshots is an example based on ICS 25.1.3.0 GA build 22109.) ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/13G4eT3ifCJoFMrNoR1nP_upload.png" size="70" width="711" height="68" isUploading="false" darkWidth="711" darkHeight="68" position="flex-start" showCaption="false" indent="1"} 3. Extract the ZIP archive to obtain the deployment files, including the KVM image, OVMF files, and YAML manifests. ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/_YpLy3Jz949HASdG8ue9w_upload.png" size="70" width="714" height="123" isUploading="false" darkWidth="714" darkHeight="123" position="flex-start" showCaption="false" indent="1"} 4. Extract ISA-V-KVM-ICS-25.1.3.0-22109.1-VT-kvm.img.gz to obtain the ICS VM image file (.img in QCOW2 format). ::Image[]{src="https://api.archbee.com/api/optimize/wxZG1KsS4xNkVZYoiu_o9/af6zYlUCA_UsnfSLxhgbh_image.png" size="50" isUploading="false" width="647" height="52" darkWidth="647" darkHeight="52" position="flex-start" showCaption="false" indent="1"} 5. Upload the extracted ICS (qcow2 format) image to the OpenShift cluster. 6. Obtain and run the Ivanti wrapper binary (provided separately from the deployment artifact). Supply the OVMF\_VARS file and YAML manifests as input. The wrapper validates Secure Boot and vTPM settings, then creates and deploys the ICS virtual machine. Login to in [download portal](https://portal.ivanti.com/customer/product-downloads) and navigate to **Download > Network Security> Ivanti Connect Secure> Ivanti Connect Secure **to fetch `KVM_OpenShift_wrapper_binaries.zip` 7. (Optional) Initialize the VM configuration during deployment by attaching a configuration ISO image. ## Pre-Requisites - OpenShiftServer - Kubeconfigfile - KubevirtOperatorinstalled - StorageClassprovisioned - Networkprovisioned ## Key Concepts Review the terms below before starting the deployment steps. These explain the OpenShift virtualization components and security features referenced throughout this guide. - **Kubevirt**: KubeVirt is an open-source Kubernetes extension that allows you to run and manage Virtual Machines (VMs) alongside standard containers on a single platform. - **Secure Boot**: Secure Boot is a UEFI firmware feature that prevents malicious software, like rootkits or deep-level cheats, from loading when you turn on your PC. It acts like a bouncer by checking the cryptographic signature of every boot file against a trusted database before allowing Linux to start. - **Virtual TPM**: A Virtual Trusted Platform Module (vTPM) is a software-based emulation of a physical TPM 2.0 chip. It provides virtual machines (VMs) with hardware-level security, allowing guest operating systems to securely store cryptographic keys, perform remote system attestation, and meet OS requirements. - **OVMF**: OVMF (Open Virtual Machine Firmware) is an open-source project that provides UEFI (Unified Extensible Firmware Interface) support for virtual machines. It serves as the virtual equivalent of a motherboard's BIOS/UEFI, allowing hypervisors like QEMU and KVM to boot guest operating systems using modern firmware standards. - **Ivanti wrapper binary**: This wrapper binary is used to deploy ICS VM automatically with Secure Boot and vTPM enabled on OpenShift environment. Supports x86\_64 and ARM architectures. - **ivanti-oc-wrapper-linux-amd64 (x86\_64):** Wrapper binary for deploying and managing ICS virtual machines on OpenShift from 64-bit x86 Linux workstations, jump hosts, or CI/CD runners. - **ivanti-oc-wrapper-linux-arm64 (ARM64):** Wrapper binary for deploying and managing ICS virtual machines on OpenShift from 64-bit ARM Linux workstations, jump hosts, or management servers. - **ivanti-oc-wrapper-darwin-arm64 (macOS Apple Silicon):** Wrapper binary for deploying and managing ICS virtual machines on OpenShift from Apple Silicon (M-series) macOS workstations. ## Upload ICS Image UploadICSKVMimage to Red Hat OpenShift Cluster. The uploaded image is stored as a source PVC and is used by the virtual machine definition during deployment. Use the following command to upload the ICS image to the OpenShift cluster. ```python virtctlimage-uploadpvcics-25.1.3.0-22109.1 \ --namespace=openshift-cnv \ --pvc-size=80Gi \ --image-path=/path/to/ISA-V-KVM-ICS-25.1.3.0-22109.1-VT-kvm.img \ --storage-class=hostpath-csi \ --insecure ``` :::hint{type="info"} Above example command references the hostpath-csi storage class for demonstration purposes. Modify the storage class parameter to match the storage provisioner and storage class available in your Red Hat OpenShift deployment. ::: ## Create ICS VM 1. Create the VM YAML file for the ICS deployment. 2. Use the following sample YAML file as a starting point. Update the storage class, network attachment definitions, CPU and memory allocations, and image to match your target OpenShift environment and deployment requirements. Sample yaml ::File{src="https://api.archbee.com/api/presign/wxZG1KsS4xNkVZYoiu_o9/Yu-dDZ4Zztn6Upqyp2IdC_ics.yaml" label="ics.yaml" isUploading="false"} ### Review VM Configuration Areas The following subsections explain the main parts of the VM YAML that typically require review or customization before deployment. **Select the source image** The following section specifies the uploaded ICS image PVC that is used as the VM source image. :::BlockQuote source: pvc: name: ics-25.1.3.0-22109.1 namespace: openshift-cnv ::: **Configure computere sources** The following settings define the CPU and Memory allocation for the VM. :::BlockQuote cpu: cores: 4 model: host-passthrough resources: requests: memory: 8Gi ::: CPUs and Memory need to be based on ICS model like ISA4500-V, ISA6500-V and ISA8500-V. - ISA4500-V:4vCPUs and 8GB RAM - ISA6500-V:8vCPUs and 16GB RAM - ISA8500-V:12vCPUs and 32GB RAM **Enable Secure Boot and vTPM** The following settings enable UEFI Secure Boot and persistent vTPM support for the VM. :::BlockQuote firmware: bootloader: efi: persistent: true secureBoot: true devices: tpm: persistent: true ::: **Configure Network** The following settings create the VM network interface and bind it to the specified Multus network attachment. :::BlockQuote interfaces: \- name: extnet bridge: \{} rng: \{} networkInterfaceMultiqueue: true networks: \- name: extnet multus: networkName: openshift-cnv/br-ens8f0-net ::: In above example, only one interface is created. Depending on requirement, ICS can be created with three interfaces with appropriate bridges. - Internal (int0). - External (ext0). - Management (mgt0). ## Deploy ICS VM Execute the command using the syntax shown below and with required arguments. **Syntax** :::BlockQuote ./ivanti-oc-wrapper \\ -namespace \ \\ -vars \ \\ -yaml \ ::: - \ - Ivanti binary to deploy ICS VM. - \ – The namespace where we deploy the VM. - \ – The path of OVMF\_VARS.secboot.ivanti.fd file. - \ – The path of created ics.yaml file. Example: :::BlockQuote ./ivanti-oc-wrapper \\ -namespace openshift-cnv \\ -vars OVMF\_VARS.secboot.ivanti.fd \\ -yaml ics.yaml ::: ## Configuration Initialization ICS running on OpenShift supports configuration initialization through ISO image. During bootup, the system checks for an attached configuration ISO. If a valid ISO is detected, then configurations like IP address, subnet, username, and password is initialized from that ISO image. Example configuration initialization: :::BlockQuote \< Environment xmlns = "http\://schemas.dmtf.org/ovf/environment/1" xmlns: xsi = "http\://www\.w3.org/2001/XMLSchema-instance" xmlns: oe = "http\://schemas.dmtf.org/ovf/environment/1" xmlns: ve = "http\://www\.kvmv.com/schema/ovfenv" oe: id = "" > \ \ ICS KVM Image \< /Kind> \ 1.0 .0 \< /Version> \ Ivanti \< /Vendor> \ en \< /Locale> \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ ::: Save above XML as kvm\_template.xml (template is already part of compressed KVM file). :::hint{type="info"} The configuration file must be named** kvm\_template.xml**, else configuration initialization fails. ::: 1. Create** ISO image **from template file using below command. :::BlockQuote mkisofs -l -o openshift.iso kvm\_template.xml ::: 2. Upload** openshift.iso **file to OpenShift data volume. Following YAML file creates datastore volume. :::BlockQuote apiVersion: cdi.kubevirt.io/v1 kind: DataVolume metadata: name: iso-dv namespace: openshift-cnv spec: source\:upload: \{} # we will upload ISO storage: accessModes: \- ReadWriteOnce resources: requests: storage: 100Mi storageClassName: hostpath-csi# or your SC ::: 3. Upload ISO image to iso-dv data volume. :::BlockQuote virtctl image-upload dv iso-dv \\ \--namespace=openshift-cnv \\ \--size=100Mi \\ \--image-path=/path/of/openshift\_kvm.iso \\ \--uploadproxy-url=https\://\:443 \\ \--insecure ::: 4. Verify that upload is successful. :::BlockQuote $0cget dv -nopenshift-cnv NAME PHASE PROGRESS RESTARTS AGE iso-dv Succeeded N/A 11m ::: 5. Attach iso-dev to VM during creation. Following is snippet of YAML file where ISO is attached. :::BlockQuote spec: domain: devices: disks: \# Your standard boot/root operating system disk \- name: rootdisk5 disk: bus: virtio \# --- THE ISO DRIVE SECTION --- \- name: cdromiso # Give the drive a reference name cdrom: # Instructs to expose this volume as a CD-ROM drive bus: sata # SATA is the standard bus type used for CD-ROM drives ::: 6. If KVM initialization drive is successfully attached, then following message will be seen during boot up. “This is KVM environment and configuration drive is present”