Horizon 8 on OpenShift

Overview

Horizon 8 supports Red Hat OpenShift Virtualization as a capacity provider, so you can deploy and manage Horizon desktop pools and RDSH farms on virtual machines running in an OpenShift cluster.

The following capabilities are confirmed and validated for this release:

• Integrating Connection Server with OpenShift, UAG (native OpenShift), and Edge (native OpenShift).
• Authenticating to the OpenShift cluster, including OAuth ID/Secret and refresh-token-based authentication, with auth and API endpoints discovered automatically from the server address you provide.
• Onboarding an OpenShift cluster as a capacity provider, including the certificate handling covered below.
• Automated, non-GPU and GPU desktop pools, supporting both persistent and non-persistent workloads.
  • For GPU-based desktop pools, the GPU profile and licensing must be set up correctly in the parent (golden image) VM to be made available to the pool's VMs. Nvidia GRID profiles are supported only if the GPU is added to the golden image; the profile is then inherited by all of the pool's clones. Changing the GPU profile during pool creation is not supported, so there are no GPU-related options in the pool creation UI.
• Non-hardware-based vTPM support.
• Dedicated (1:1) and pooled (1:N) automated desktop pools.
• Automated provisioning of RDSH farms for desktops and published apps on Windows Server OS.

Scale targets for this release are up to 500 single-session floating/non-persistent VDI desktops and 500 multi-session RDSH sessions.

For more details on the functionality available in this limited availability release, see [KB ARTICLE LINK - TBD].

Certificate prerequisites

Before you register the OpenShift provider in Horizon, make sure the following certificate prerequisites are met:

• The OpenShift OAuth URL is reachable from the Horizon server (for example, https://oauth-openshift.apps.<cluster-domain>).
• The OpenShift API server URL is reachable from the Horizon server (for example, https://api.<cluster-domain>:6443).
• The OAuth endpoint is configured with a CA-signed certificate.
• The issuing CA or root CA certificate for the OAuth endpoint is available.
• You have administrator access to the Windows Horizon server.
• OAuth server: a CA-signed certificate is required. If the issuing CA or root CA certificate is not already trusted, it must be imported on each Horizon Connection Server.
• API server: the current flow accepts both CA-signed and self-signed certificates. If the API server uses a self-signed certificate, you can accept it through the UI.

Obtaining the OpenShift OAuth CA certificate

You can obtain the OpenShift OAuth CA certificate using either of the following methods.

Option 1: Export from the browser

1. Open the OpenShift OAuth URL in a browser.
2. View the certificate chain.
3. Export the issuing CA certificate or root CA certificate as a .cer file.

Option 2: Get the OAuth CA certificate from the OpenShift web console

1. Log in to the OpenShift web console.
2. Go to Workloads > Secrets.
3. Select the openshift-ingress-operator namespace.
4. Open the router-ca secret.
5. Under Details, locate tls.crt.
6. Use the Reveal option to display the certificate contents. Copy the certificate contents, including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines.
7. Save the copied certificate contents as a certificate file on the Horizon server for import.

Import the CA certificate into the Windows trusted store

If the OpenShift OAuth server certificate is not already trusted by the Horizon server, perform the following procedure:

1. Copy the certificate file to the Horizon server.
2. On the Horizon server, open the Manage Computer Certificates application by running certlm.msc.
3. In the navigation tree, under Certificates - Local Computer, expand Trusted Root Certification Authorities.
4. Right-click Certificates, and select All Tasks > Import.
5. In the Certificate Import Wizard, browse to the certificate file.
6. Select Place all certificates in the following store: Trusted Root Certification Authorities.
7. Complete the wizard and confirm that the certificate import is successful.
8. Restart the Omnissa Horizon Connection Server service.

Note: The certificate must be placed in the local computer trusted root store (Cert:\LocalMachine\Root), not the current user store. The Windows certificate import is mainly required for OAuth server certificate trust. For the API server, if it uses a self-signed certificate, you can accept it directly through the UI during registration.

Import the trusted certificate through Horizon Console (recommended)

Instead of manually importing the certificate into the Windows certificate store, you can import the OpenShift OAuth certificate directly through Horizon Console, using the Trusted Root Certificates section of Certificate Management. This method is simpler and does not require a Connection Server restart. The existing manual method described above still works and is not being removed.

Prerequisites

• You have the OpenShift OAuth CA certificate file ready (see Obtaining the OpenShift OAuth CA certificate above).
• Your administrator role includes the Manage Certificates privilege. This privilege is required to import or delete a trusted root certificate. If your role does not already include this privilege, see Add a Custom Role in Horizon Console or Modify the Privileges in a Custom Role in Horizon Console to add it.

Steps

1. Log in to Horizon Console.
2. Go to Settings > Certificate Management.
3. Select the Trusted Root Certificates tab.
4. Click Import.
5. Browse to and select the certificate file you obtained, and optionally enter a Friendly Name to help identify it later. Supported file types are .pem, .crt, .cer, and .der, up to 250 KB in size.
6. Click Import to complete the upload.

Note: The certificate is trusted immediately after import. There is no need to restart the Omnissa Horizon Connection Server service.

If you have multiple Connection Servers in the same pod, you only need to perform this import once. The certificate is automatically applied to all other Connection Servers in the pod, including any replica added later.

Once imported, you can proceed to register OpenShift as a capacity provider. If you have a CA-signed certificate for the API server, you can pre-import it here using the same Trusted Root Certificates tab. If the API server uses a self-signed certificate instead, you can accept it directly during the Add Capacity Provider step, without importing it here first.

OpenShift requirements

• OpenShift Virtualization 4.19+ installed and enabled.
• Supported storage, based on the OpenShift support matrix.
• Adequate compute nodes with KVM-enabled hardware.
• OpenShift cluster with API server access for Horizon.
• Network: Horizon pod network with sufficient bandwidth and latency for Blast or PCoIP traffic.
• Service account roles: the Admin role handles all integration requirements; custom roles are detailed in Horizon 8 on OpenShift - Service Account Permissions.

Golden image and guest OS requirements

• Windows 10/11 Enterprise (supported versions per the Horizon 8 compatibility matrix).
• Horizon Agent installed after VM creation from the OpenShift template.
• Storage: VirtIO drivers required.
• Networking: appropriate drivers required.
• OpenShift: driver ISO (prompted during setup).
• QEMU guest agent for host-to-guest OS communication (optional).
• vTPM: set to non-persistent (OpenShift blocks persistent vTPM from being cloned).
• Boot type: UEFI set to non-persistent (OpenShift blocks persistent boot type from being cloned).
• Cloning mechanism: based on the storage class in the golden image. ClonePrep and Sysprep are both supported.
• Disable Windows Updates in the golden image.

Creating a virtual machine on OpenShift

Horizon does not document the steps for uploading a boot image, creating a virtual machine, or installing a guest OS in OpenShift Virtualization, since these procedures are owned and maintained by Red Hat and may change independently of Horizon releases. For these steps, see Red Hat's own OpenShift Virtualization documentation:

• Creating virtual machines by using the web console - create a VM from a template in the OpenShift web console.
• Creating VMs from uploaded images, including Windows VMs - upload a boot image (ISO, IMG, or QCOW2) and create a VM from it, including the Windows-specific upload and clone procedure.

After the VM is created and the guest OS is installed, continue with the Horizon-specific steps below.

What to read next