GitOps

在受管集群集绑定中使用的命名空间中，创建一个 放置自定义资源 来选择要注册到 OpenShift GitOps operator 实例的一组受管集群。使用 multicloud-integration 放置示例作为模板。如需放置信息，请参阅使用 ManagedClusterSet with Placement。

备注：

创建 GitOpsCluster 自定义资源，将一组受管集群从放置决定注册到指定的 OpenShift GitOps 实例。这可让 OpenShift GitOps 实例将应用程序部署到任何 Red Hat Advanced Cluster Management 受管集群。使用 multicloud-integrations OpenShift GitOps 集群示例。

注：引用的放置资源必须与 GitOpsCluster 资源位于同一个命名空间中。请参见以下示例：

apiVersion: apps.open-cluster-management.io/v1beta1
kind: GitOpsCluster
metadata:
  name: gitops-cluster-sample
  namespace: dev
spec:
  argoServer:
    cluster: local-cluster
    argoNamespace: openshift-gitops
  placementRef:
    kind: Placement
    apiVersion: cluster.open-cluster-management.io/v1beta1
    name: all-openshift-clusters 1

进入非 OpenShift Container Platform ManagedCluster 资源 spec 中的 API 服务器 URL，并运行以下命令来验证它：

oc get managedclusters eks-1

验证您的输出是否类似以下信息：

NAME    HUB ACCEPTED   MANAGED CLUSTER URLS                                                      JOINED   AVAILABLE   AGE
eks-1   true           https://5E336C922AB16684A332C10535B8D407.gr7.us-east-2.eks.amazonaws.com  True     True        37m

如果非 OpenShift Container Platform MangedCluster 资源 spec 中的 API 服务器 URL 为空，请完成以下步骤来手动更新它：

NAME     HUB ACCEPTED  MANAGED CLUSTER URLS                                                      JOINED   AVAILABLE   AGE
eks-1    true          https://5E336C922AB16684A332C10535B8D407.gr7.us-east-2.eks.amazonaws.com  True     True        37m

要验证是否生成了集群 secret，请转至 openshift-gitops 命名空间，并确认 GitOpsCluster 资源状态报告成功。

备注：

添加覆盖默认 Push 模型所需的注解，如下例所示 ApplicationSet YAML，该 YAML 使用带有模板注解的 Pull 模型：

apiVersion: argoproj.io/v1alpha1
kind: `ApplicationSet`
metadata:
  name: guestbook-allclusters-app-set
  namespace: openshift-gitops
spec:
  generators:
  - clusterDecisionResource:
      configMapRef: ocm-placement-generator
      labelSelector:
        matchLabels:
          cluster.open-cluster-management.io/placement: aws-app-placement
      requeueAfterSeconds: 30
  template:
    metadata:
      annotations:
        apps.open-cluster-management.io/ocm-managed-cluster: '{{name}}'1
        apps.open-cluster-management.io/ocm-managed-cluster-app-namespace: openshift-gitops
        argocd.argoproj.io/skip-reconcile: "true" 2
      labels:
        apps.open-cluster-management.io/pull-to-ocm-managed-cluster: "true" 3
      name: '{{name}}-guestbook-app'
    spec:
      destination:
        namespace: guestbook
        server: https://kubernetes.default.svc
      project: default
      sources: [
      {
        repoURL: https://github.com/argoproj/argocd-example-apps.git
        targetRevision: main
        path: guestbook
         }
      ]
      syncPolicy:
        automated: {}
        syncOptions:
        - CreateNamespace=true

从控制台创建 ClusterRole。您的 ClusterRole 可能类似以下示例：

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: openshift-gitops-policy-admin
rules:
  - verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete
    apiGroups:
      - policy.open-cluster-management.io
    resources:
      - policies
      - configurationpolicies
      - certificatepolicies
      - operatorpolicies
      - policysets
      - placementbindings
  - verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete
    apiGroups:
      - apps.open-cluster-management.io
    resources:
      - placementrules
  - verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete
    apiGroups:
      - cluster.open-cluster-management.io
    resources:
      - placements
      - placements/status
      - placementdecisions
      - placementdecisions/status

另外，创建一个 ClusterRoleBinding 对象来授予 OpenShift GitOps 服务帐户对 openshift-gitops-policy-admin ClusterRole 对象的访问权限。ClusterRoleBinding 可能类似以下示例：

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: openshift-gitops-policy-admin
subjects:
  - kind: ServiceAccount
    name: openshift-gitops-argocd-application-controller
    namespace: openshift-gitops
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: openshift-gitops-policy-admin

注： - 当使用 OpenShift GitOps 部署 Red Hat Advanced Cluster Management 策略定义时，会在每个受管集群命名空间中创建一个策略副本，以解决 hub 模板的不同。这些副本称为复制策略。- 为了防止 OpenShift GitOps 重复删除此复制策略，或者显示 Argo CD 应用程序 没有同步，argocd.argoproj.io/compare-options：IgnoreExtraneous 注解由 Red Hat Advanced Cluster Management 策略框架自动在每个复制策略上设置。

要为您的 CertificatePolicy 资源配置健康检查，请使用以下命令编辑 ArgoCD 资源：

oc -n openshift-gitops edit argocd openshift-gitops

您的 ArgoCD 资源可能类似以下 YAML 文件：

apiVersion: argoproj.io/v1beta1
kind: ArgoCD
metadata:
  name: openshift-gitops
  namespace: openshift-gitops
spec:
  resourceHealthChecks:
    - group: policy.open-cluster-management.io
      kind: CertificatePolicy
      check: |
	hs = {}
	if obj.status == nil or obj.status.compliant == nil then
	  hs.status = "Progressing"
	  hs.message = "Waiting for the status to be reported"
	  return hs
	end
	if obj.status.compliant == "Compliant" then
	  hs.status = "Healthy" hs.message = "All certificates found comply with the policy"
	  return hs
	else hs.status = "Degraded"
          hs.message = "At least one certificate does not comply with the policy"
	  return hs
        end

要在 CertificatePolicy,ConfigurationPolicy,OperatorPolicy, 和 Policy 资源中添加健康检查，请运行以下命令下载 argocd-policy-healthchecks.yaml ：

wget https://raw.githubusercontent.com/open-cluster-management-io/policy-collection/main/stable/CM-Configuration-Management/argocd-policy-healthchecks.yaml

要应用 argocd-policy-healthchecks.yaml 策略，请运行以下命令：

oc apply -f ./argocd-policy-healthchecks.yaml

要将 &lt ;managed-sa-sample > 服务帐户权限授予部署到 < managed cluster > 上 mortgage 命名空间的示例 mortgage 应用程序，请使用以下内容创建一个 YAML：

apiVersion: rbac.open-cluster-management.io/v1alpha1
kind: ClusterPermission
metadata:
  name: <clusterpermission-msa-subject-sample>
  namespace: <managed cluster>
spec:
  roles:
  - namespace: default
    rules:
    - apiGroups: ["apps"]
      resources: ["deployments"]
      verbs: ["get", "list", "create", "update", "delete", "patch"]
    - apiGroups: [""]
      resources: ["configmaps", "secrets", "pods", "podtemplates", "persistentvolumeclaims", "persistentvolumes"]
      verbs: ["get", "update", "list", "create", "delete", "patch"]
    - apiGroups: ["storage.k8s.io"]
      resources: ["*"]
      verbs: ["list"]
  - namespace: mortgage
    rules:
    - apiGroups: ["apps"]
      resources: ["deployments"]
      verbs: ["get", "list", "create", "update", "delete", "patch"]
    - apiGroups: [""]
      resources: ["configmaps", "secrets", "pods", "services", "namespace"]
      verbs: ["get", "update", "list", "create", "delete", "patch"]
  clusterRole:
    rules:
    - apiGroups: ["*"]
      resources: ["*"]
      verbs: ["get", "list"]
  roleBindings:
  - namespace: default
    roleRef:
      kind: Role
    subject:
      apiGroup: authentication.open-cluster-management.io
      kind: ManagedServiceAccount
      name: <managed-sa-sample>
  - namespace: mortgage
    roleRef:
      kind: Role
    subject:
      apiGroup: authentication.open-cluster-management.io
      kind: ManagedServiceAccount
      name: <managed-sa-sample>
  clusterRoleBinding:
    subject:
      apiGroup: authentication.open-cluster-management.io
      kind: ManagedServiceAccount
      name: <managed-sa-sample>

将以下示例保存为 gitops.yaml 文件，以创建 GitOpsCluster 自定义资源：

apiVersion: apps.open-cluster-management.io/v1beta1
kind: GitOpsCluster
metadata:
  name: argo-acm-importer
  namespace: openshift-gitops
spec:
  managedServiceAccountRef: <managed-sa-sample>
  argoServer:
    cluster: notused
    argoNamespace: openshift-gitops
  placementRef:
    kind: Placement
    apiVersion: cluster.open-cluster-management.io/v1beta1
    name: all-openshift-clusters
    namespace: openshift-gitops

进入 openshift-gitops 命名空间，并验证是否有新的 Argo CD 集群 secret，名称为 < managed cluster-managed-sa-sample-cluster-secret>。运行以下命令:

oc get secrets -n openshift-gitops <managed cluster-managed-sa-sample-cluster-secret>

请查看以下输出来验证：

NAME                                        TYPE     DATA   AGE
<managed cluster-managed-sa-sample-cluster-secret>   Opaque   3      4m2s