第 4 章教程

本章的教程假定您有一个与执行 OpenShift Container Platform 集群安装相同的 OpenShift 实例。

4.1. 为 OpenShift 镜像版本的新 Red Hat Single Sign-On 更新数据库
复制链接

请注意，以下与更新相关：

从早期版本的 Red Hat Single Sign-On for OpenShift 的滚动更新改为版本 7.5.3，因为数据库和缓存不向后兼容。
用于 OpenShift 7.5.3 的红帽单点登录需要 PostgreSQL 服务器版本 13.5。如果您有一个过时的 PostgreSQL 版本，请在更新数据库前更新 PostgreSQL 版本。
从 Red Hat Single Sign-On for OpenShift 版本中的实例在升级前无法运行。它们不能对同一数据库同时运行。
预生成的脚本不可用。它们会根据数据库动态生成。

您有三种更新数据库的选择：

如果您有一个过时的 PostgreSQL 服务器版本，升级 PostgreSQL 服务器，然后迁移数据库。
允许 Red Hat Single Sign-On 7.5.3 自动迁移数据库模式
手动更新数据库

注意

默认情况下，当您首次启动 Red Hat Single Sign-On 7.5.3 时，数据库会自动迁移。

4.1.1. PostgreSQL 版本升级和数据库迁移
复制链接

Red Hat Single Sign-On 7.5.3 模板中提供的 PostgreSQL 服务器可能与之前使用的版本不同。例如，请考虑这种情况：

您使用 PostgreSQL 服务器的版本 10，运行带有 PostgreSQL 容器集的 Red Hat Single Sign-On for OpenShift 容器镜像。
Red Hat Single Sign-On 7.5.3 容器镜像需要 PostgreSQL pod 使用 PostgreSQL 服务器的版本 13.5。

以下流程描述了如何将 PostgreSQL 版本升级到 13.5，然后迁移数据库。

流程

首先执行数据库级别备份。

oc rsh <POSTGRE-SQL-POD> pg_dump -C <DATABASE> rhsso_db.bak

$ oc rsh <POSTGRE-SQL-POD> pg_dump -C <DATABASE> rhsso_db.bak

Copy to Clipboard

Toggle word wrap

缩减 sso 容器集。
```
oc scale dc/sso --replicas=0
```
```
$ oc scale dc/sso --replicas=0
```
Copy to Clipboard Toggle word wrap

编辑 dc/sso-postgresql.

oc edit dc/sso-postgresql

$ oc edit dc/sso-postgresql

Copy to Clipboard

Toggle word wrap

将 ImageStreamTag 切换到 :postgresql:13-el8。

- imageChangeParams:
      automatic: true
      containerNames:
      - sso-postgresql
      from:
        kind: ImageStreamTag
        name: postgresql:13-el8
        namespace: openshift

- imageChangeParams:
      automatic: true
      containerNames:
      - sso-postgresql
      from:
        kind: ImageStreamTag
        name: postgresql:13-el8
        namespace: openshift

Copy to Clipboard

Toggle word wrap

再次等待 sso-postgresql pod 正在运行并稳定。

确保 pod sso-postgresql 具有正确的版本。

oc rsh dc/sso-postgresql /bin/bash -c "psql --version"
psql (PostgreSQL) 13.5

$ oc rsh dc/sso-postgresql /bin/bash -c "psql --version"
psql (PostgreSQL) 13.5

Copy to Clipboard

Toggle word wrap

取消设置变量 POSTGRESQL_UPGRADE，并再次部署 sso-postgresql pod。
```
oc set env dc/sso-postgresql POSTGRESQL_UPGRADE-
```
```
$ oc set env dc/sso-postgresql POSTGRESQL_UPGRADE-
```
Copy to Clipboard Toggle word wrap
确认 Pod sso-posgresql 正在运行的最后一个时间。

运行以下命令更新 openshift 项目中的 OpenShift 的 Red Hat Single Sign-On 7.5.3 资源集：

for resource in sso75-image-stream.json \
  sso75-https.json \
  sso75-postgresql.json \
  sso75-postgresql-persistent.json \
  sso75-x509-https.json \
  sso75-x509-postgresql-persistent.json
do
  oc replace -n openshift --force -f \
  https://raw.githubusercontent.com/jboss-container-images/redhat-sso-7-openshift-image/sso75-dev/templates/${resource}
done

$ for resource in sso75-image-stream.json \
  sso75-https.json \
  sso75-postgresql.json \
  sso75-postgresql-persistent.json \
  sso75-x509-https.json \
  sso75-x509-postgresql-persistent.json
do
  oc replace -n openshift --force -f \
  https://raw.githubusercontent.com/jboss-container-images/redhat-sso-7-openshift-image/sso75-dev/templates/${resource}
done

Copy to Clipboard

Toggle word wrap

运行以下命令，在 openshift 项目中安装 Red Hat Single Sign-On 7.5.3 OpenShift 镜像流：

oc -n openshift import-image rh-sso-7/sso75-openshift-rhel8:7.5 --from=registry.redhat.io/rh-sso-7/sso75-openshift-rhel8:7.5 --confirm

$ oc -n openshift import-image rh-sso-7/sso75-openshift-rhel8:7.5 --from=registry.redhat.io/rh-sso-7/sso75-openshift-rhel8:7.5 --confirm

Copy to Clipboard

Toggle word wrap

更新现有部署配置中的镜像更改触发器，以引用 Red Hat Single Sign-On 7.5.3 镜像。

oc patch dc/sso --type=json -p '[{"op": "replace", "path": "/spec/triggers/0/imageChangeParams/from/name", "value": "sso75-openshift-rhel8:7.5"}]'
"sso" patched

$ oc patch dc/sso --type=json -p '[{"op": "replace", "path": "/spec/triggers/0/imageChangeParams/from/name", "value": "sso75-openshift-rhel8:7.5"}]'
"sso" patched

Copy to Clipboard

Toggle word wrap

开始根据镜像更改触发器中定义的最新镜像推出新的 Red Hat Single Sign-On 7.5.3 镜像。
```
oc rollout latest dc/sso
```
```
$ oc rollout latest dc/sso
```
Copy to Clipboard Toggle word wrap
将 sso pod 扩展至一个副本。
注意
您可能希望从 dc/sso 中暂时增加存活和就绪度探测阈值和值（以秒为单位）。此步骤在第一次引导时执行数据库升级，这可能需要一些时间。
```
oc scale --replicas=1 dc/sso
```
```
$ oc scale --replicas=1 dc/sso
```
Copy to Clipboard Toggle word wrap
注意
如果您有多个副本，请考虑扩展至一个副本。在 Red Hat Single Sign-On 启动后，您可以将缩减回原始副本数。

4.1.3. 手动数据库迁移
复制链接

数据库迁移过程更新数据架构，并执行数据操作。在动态生成 SQL 迁移文件之前，这个过程还会停止运行之前版本的 Red Hat Single Sign-On for OpenShift 镜像的所有 pod。

注意

此流程假设您正在运行一个早期版本的 Red Hat Single Sign-On for OpenShift 镜像，该镜像由 PostgreSQL 数据库（以临时或持久模式部署）支持，并在单独的 pod 上运行。

流程

为脚本生成准备环境。

使用正确的数据源配置 Red Hat Single Sign-On 7.5.3，
在 standalone-openshift.xml 文件中设置以下配置选项：
1. initializeEmpty=false,
2. migrationStrategy=manual, 和
3. migrationExport to the pod 文件系统中的位置，应存储输出 SQL 迁移文件（例如，migrationExport="${jboss.home.dir}/keycloak-database-update.sql）。

流程

执行以下步骤为数据库生成 SQL 迁移文件：

准备 OpenShift 数据库迁移作业模板，以生成 SQL 文件。

$ cat job-to-migrate-db-to-sso75.yaml.orig
apiVersion: batch/v1
kind: Job
metadata:
  name: job-to-migrate-db-to-sso75
spec:
  autoSelector: true
  parallelism: 0
  completions: 1
  template:
    metadata:
      name: job-to-migrate-db-to-sso75
    spec:
      containers:
      - env:
        - name: DB_SERVICE_PREFIX_MAPPING
          value: <<DB_SERVICE_PREFIX_MAPPING_VALUE>>
        - name: <<PREFIX>>_JNDI
          value: <<PREFIX_JNDI_VALUE>>
        - name: <<PREFIX>>_USERNAME
          value: <<PREFIX_USERNAME_VALUE>>
        - name: <<PREFIX>>_PASSWORD
          value: <<PREFIX_PASSWORD_VALUE>>
        - name: <<PREFIX>>_DATABASE
          value: <<PREFIX_DATABASE_VALUE>>
        - name: TX_DATABASE_PREFIX_MAPPING
          value: <<TX_DATABASE_PREFIX_MAPPING_VALUE>>
        - name: <<SERVICE_HOST>>
          value: <<SERVICE_HOST_VALUE>>
        - name: <<SERVICE_PORT>>
          value: <<SERVICE_PORT_VALUE>>
        image: <<SSO_IMAGE_VALUE>>
        imagePullPolicy: Always
        name: job-to-migrate-db-to-sso75
        # Keep the pod running after the SQL migration
        # file was generated, so we can retrieve it
        command:
          - "/bin/bash"
          - "-c"
          - "/opt/eap/bin/openshift-launch.sh || sleep 600"
      restartPolicy: Never

$ cat job-to-migrate-db-to-sso75.yaml.orig
apiVersion: batch/v1
kind: Job
metadata:
  name: job-to-migrate-db-to-sso75
spec:
  autoSelector: true
  parallelism: 0
  completions: 1
  template:
    metadata:
      name: job-to-migrate-db-to-sso75
    spec:
      containers:
      - env:
        - name: DB_SERVICE_PREFIX_MAPPING
          value: <<DB_SERVICE_PREFIX_MAPPING_VALUE>>
        - name: <<PREFIX>>_JNDI
          value: <<PREFIX_JNDI_VALUE>>
        - name: <<PREFIX>>_USERNAME
          value: <<PREFIX_USERNAME_VALUE>>
        - name: <<PREFIX>>_PASSWORD
          value: <<PREFIX_PASSWORD_VALUE>>
        - name: <<PREFIX>>_DATABASE
          value: <<PREFIX_DATABASE_VALUE>>
        - name: TX_DATABASE_PREFIX_MAPPING
          value: <<TX_DATABASE_PREFIX_MAPPING_VALUE>>
        - name: <<SERVICE_HOST>>
          value: <<SERVICE_HOST_VALUE>>
        - name: <<SERVICE_PORT>>
          value: <<SERVICE_PORT_VALUE>>
        image: <<SSO_IMAGE_VALUE>>
        imagePullPolicy: Always
        name: job-to-migrate-db-to-sso75
        # Keep the pod running after the SQL migration
        # file was generated, so we can retrieve it
        command:
          - "/bin/bash"
          - "-c"
          - "/opt/eap/bin/openshift-launch.sh || sleep 600"
      restartPolicy: Never

Copy to Clipboard

Toggle word wrap

cp job-to-migrate-db-to-sso75.yaml.orig \
     job-to-migrate-db-to-sso75.yaml

$ cp job-to-migrate-db-to-sso75.yaml.orig \
     job-to-migrate-db-to-sso75.yaml

Copy to Clipboard

Toggle word wrap

从用于运行 OpenShift 镜像的 Red Hat Single Sign-On 版本的部署配置中，复制数据源定义和数据库访问凭据，使其适合数据库迁移作业模板的位置。

使用以下脚本复制 DB_SERVICE_PREFIX_MAPPING 和 TX_DATABASE_PREFIX_MAPPING 变量值，以及特定于特定数据源的环境变量的值( <PREFIX>_JNDI、<PREFIX>_ USERNAME、<PREFIX &gt;_PASSWORD 和 <PREFIX>_) DATABASE），从名为 sso 的部署配置到名为 job-to-migrate-db-to-sso75.yaml 的数据库作业模板。

注意

虽然 DB_SERVICE_PREFIX_MAPPING 环境变量允许以逗号分隔的 < name>-<database_type>=<PREFIX > triplets 列表作为其值，本例脚本只接受一个数据源行程序定义用于演示目的。您可以修改脚本来处理多个数据源定义。

cat mirror_sso_dc_db_vars.sh
#!/bin/bash

# IMPORTANT:
#
# If the name of the SSO deployment config differs from 'sso'
or if the file name of the YAML definition of the migration
job is different, update the following two variables
SSO_DC_NAME="sso"
JOB_MIGRATION_YAML="job-to-migrate-db-to-sso75.yaml"

# Get existing variables of the $SSO_DC_NAME deployment config
in an array
declare -a SSO_DC_VARS=( \
  $(oc set env dc/${SSO_DC_NAME} --list \
  | sed '/^#/d') \
)

# Get the PREFIX used in the names of environment variables
PREFIX=$( \
  grep -oP 'DB_SERVICE_PREFIX_MAPPING=[^ ]+' \
  <<< "${SSO_DC_VARS[@]}" \
)
PREFIX=${PREFIX##*=}

# Substitute:
# * <<PREFIX>> with actual $PREFIX value and
# * <<PREFIX with "<<$PREFIX" value
# The order in which these replacements are made is important!
sed -i "s#<<PREFIX>>#${PREFIX}#g" ${JOB_MIGRATION_YAML}
sed -i "s#<<PREFIX#<<${PREFIX}#g" ${JOB_MIGRATION_YAML}

# Construct the array of environment variables
specific to the datasource
declare -a DB_VARS=(JNDI USERNAME PASSWORD DATABASE)

# Prepend $PREFIX to each item of the datasource array
DB_VARS=( "${DB_VARS[@]/#/${PREFIX}_}" )

# Add DB_SERVICE_PREFIX_MAPPING and TX_DATABASE_PREFIX_MAPPING
variables to datasource array
DB_VARS=( \
  "${DB_VARS[@]}" \
  DB_SERVICE_PREFIX_MAPPING \
  TX_DATABASE_PREFIX_MAPPING \
)

# Construct the SERVICE from DB_SERVICE_PREFIX_MAPPING
SERVICE=$( \
  grep -oP 'DB_SERVICE_PREFIX_MAPPING=[^ ]' \
  <<< "${SSO_DC_VARS[@]}" \
)
SERVICE=${SERVICE#*=}
SERVICE=${SERVICE%=*}
SERVICE=${SERVICE^^}
SERVICE=${SERVICE//-/_}

# If the deployment config contains <<SERVICE>>_SERVICE_HOST
# and <<SERVICE>>_SERVICE_PORT variables, add them to the
datasource array. Their values also need to be propagated into
# yaml definition of the migration job.
HOST_PATTERN="${SERVICE}_SERVICE_HOST=[^ ]"
PORT_PATTERN="${SERVICE}_SERVICE_PORT=[^ ]"
if
  grep -Pq "${HOST_PATTERN}" <<< "${SSO_DC_VARS[@]}" &&
  grep -Pq "${PORT_PATTERN}" <<< "${SSO_DC_VARS[@]}"
then
  DB_VARS=( \
    "${DB_VARS[@]}" \
    "${SERVICE}_SERVICE_HOST" \
    "${SERVICE}_SERVICE_PORT" \
  )
# If they are not defined, delete their placeholder rows in
yaml definition file (since if not defined they are not
# expanded which make the yaml definition invalid).
else
  for KEY in "HOST" "PORT"
  do
    sed -i "/SERVICE_${KEY}/d" ${JOB_MIGRATION_YAML}
  done
fi

# Substitute:
# * <<SERVICE_HOST>> with ${SERVICE}_SERVICE_HOST and
# * <<SERVICE_HOST_VALUE>> with <<${SERVICE}_SERVICE_HOST_VALUE>>
# The order in which replacements are made is important!
# Do this for both "HOST" and "PORT"
for KEY in "HOST" "PORT"
do
  PATTERN_1="<<SERVICE_${KEY}>>"
  REPL_1="${SERVICE}_SERVICE_${KEY}"
  sed -i "s#${PATTERN_1}#${REPL_1}#g" ${JOB_MIGRATION_YAML}
  PATTERN_2="<<SERVICE_${KEY}_VALUE>>"
  REPL_2="<<${SERVICE}_SERVICE_${KEY}_VALUE>>"
  sed -i "s#${PATTERN_2}#${REPL_2}#g" ${JOB_MIGRATION_YAML}
done

# Propagate the values of the datasource array items into
yaml definition of the migration job
for VAR in "${SSO_DC_VARS[@]}"
do
  IFS=$'=' read KEY VALUE <<< $VAR
  if grep -q $KEY <<< ${DB_VARS[@]}
  then
    KEY+="_VALUE"
    # Enwrap integer port value with double quotes
    if [[ ${KEY} =~ ${SERVICE}_SERVICE_PORT_VALUE ]]
    then
      sed -i "s#<<${KEY}>>#\"${VALUE}\"#g" ${JOB_MIGRATION_YAML}
    # Character values do not need quotes
    else
      sed -i "s#<<${KEY}>>#${VALUE}#g" ${JOB_MIGRATION_YAML}
    fi
    # Verify that the value has been successfully propagated.
    if
      grep -q '(JNDI|USERNAME|PASSWORD|DATABASE)' <<< "${KEY}" &&
      grep -q "<<PREFIX${KEY#${PREFIX}}" ${JOB_MIGRATION_YAML} ||
      grep -q "<<${KEY}>>" ${JOB_MIGRATION_YAML}
    then
      echo "Failed to update value of ${KEY%_VALUE}! Aborting."
      exit 1
    else
      printf '%-60s%-40s\n' \
             "Successfully updated ${KEY%_VALUE} to:" \
             "$VALUE"
    fi
  fi
done

$ cat mirror_sso_dc_db_vars.sh
#!/bin/bash

# IMPORTANT:
#
# If the name of the SSO deployment config differs from 'sso'
# or if the file name of the YAML definition of the migration
# job is different, update the following two variables
SSO_DC_NAME="sso"
JOB_MIGRATION_YAML="job-to-migrate-db-to-sso75.yaml"

# Get existing variables of the $SSO_DC_NAME deployment config
# in an array
declare -a SSO_DC_VARS=( \
  $(oc set env dc/${SSO_DC_NAME} --list \
  | sed '/^#/d') \
)

# Get the PREFIX used in the names of environment variables
PREFIX=$( \
  grep -oP 'DB_SERVICE_PREFIX_MAPPING=[^ ]+' \
  <<< "${SSO_DC_VARS[@]}" \
)
PREFIX=${PREFIX##*=}

# Substitute:
# * <<PREFIX>> with actual $PREFIX value and
# * <<PREFIX with "<<$PREFIX" value
# The order in which these replacements are made is important!
sed -i "s#<<PREFIX>>#${PREFIX}#g" ${JOB_MIGRATION_YAML}
sed -i "s#<<PREFIX#<<${PREFIX}#g" ${JOB_MIGRATION_YAML}

# Construct the array of environment variables
# specific to the datasource
declare -a DB_VARS=(JNDI USERNAME PASSWORD DATABASE)

# Prepend $PREFIX to each item of the datasource array
DB_VARS=( "${DB_VARS[@]/#/${PREFIX}_}" )

# Add DB_SERVICE_PREFIX_MAPPING and TX_DATABASE_PREFIX_MAPPING
# variables to datasource array
DB_VARS=( \
  "${DB_VARS[@]}" \
  DB_SERVICE_PREFIX_MAPPING \
  TX_DATABASE_PREFIX_MAPPING \
)

# Construct the SERVICE from DB_SERVICE_PREFIX_MAPPING
SERVICE=$( \
  grep -oP 'DB_SERVICE_PREFIX_MAPPING=[^ ]' \
  <<< "${SSO_DC_VARS[@]}" \
)
SERVICE=${SERVICE#*=}
SERVICE=${SERVICE%=*}
SERVICE=${SERVICE^^}
SERVICE=${SERVICE//-/_}

# If the deployment config contains <<SERVICE>>_SERVICE_HOST
# and <<SERVICE>>_SERVICE_PORT variables, add them to the
# datasource array. Their values also need to be propagated into
# yaml definition of the migration job.
HOST_PATTERN="${SERVICE}_SERVICE_HOST=[^ ]"
PORT_PATTERN="${SERVICE}_SERVICE_PORT=[^ ]"
if
  grep -Pq "${HOST_PATTERN}" <<< "${SSO_DC_VARS[@]}" &&
  grep -Pq "${PORT_PATTERN}" <<< "${SSO_DC_VARS[@]}"
then
  DB_VARS=( \
    "${DB_VARS[@]}" \
    "${SERVICE}_SERVICE_HOST" \
    "${SERVICE}_SERVICE_PORT" \
  )
# If they are not defined, delete their placeholder rows in
# yaml definition file (since if not defined they are not
# expanded which make the yaml definition invalid).
else
  for KEY in "HOST" "PORT"
  do
    sed -i "/SERVICE_${KEY}/d" ${JOB_MIGRATION_YAML}
  done
fi

# Substitute:
# * <<SERVICE_HOST>> with ${SERVICE}_SERVICE_HOST and
# * <<SERVICE_HOST_VALUE>> with <<${SERVICE}_SERVICE_HOST_VALUE>>
# The order in which replacements are made is important!
# Do this for both "HOST" and "PORT"
for KEY in "HOST" "PORT"
do
  PATTERN_1="<<SERVICE_${KEY}>>"
  REPL_1="${SERVICE}_SERVICE_${KEY}"
  sed -i "s#${PATTERN_1}#${REPL_1}#g" ${JOB_MIGRATION_YAML}
  PATTERN_2="<<SERVICE_${KEY}_VALUE>>"
  REPL_2="<<${SERVICE}_SERVICE_${KEY}_VALUE>>"
  sed -i "s#${PATTERN_2}#${REPL_2}#g" ${JOB_MIGRATION_YAML}
done

# Propagate the values of the datasource array items into
# yaml definition of the migration job
for VAR in "${SSO_DC_VARS[@]}"
do
  IFS=$'=' read KEY VALUE <<< $VAR
  if grep -q $KEY <<< ${DB_VARS[@]}
  then
    KEY+="_VALUE"
    # Enwrap integer port value with double quotes
    if [[ ${KEY} =~ ${SERVICE}_SERVICE_PORT_VALUE ]]
    then
      sed -i "s#<<${KEY}>>#\"${VALUE}\"#g" ${JOB_MIGRATION_YAML}
    # Character values do not need quotes
    else
      sed -i "s#<<${KEY}>>#${VALUE}#g" ${JOB_MIGRATION_YAML}
    fi
    # Verify that the value has been successfully propagated.
    if
      grep -q '(JNDI|USERNAME|PASSWORD|DATABASE)' <<< "${KEY}" &&
      grep -q "<<PREFIX${KEY#${PREFIX}}" ${JOB_MIGRATION_YAML} ||
      grep -q "<<${KEY}>>" ${JOB_MIGRATION_YAML}
    then
      echo "Failed to update value of ${KEY%_VALUE}! Aborting."
      exit 1
    else
      printf '%-60s%-40s\n' \
             "Successfully updated ${KEY%_VALUE} to:" \
             "$VALUE"
    fi
  fi
done

Copy to Clipboard

Toggle word wrap

运行脚本。

chmod +x ./mirror_sso_dc_db_vars.sh
./mirror_sso_dc_db_vars.sh
Successfully updated DB_SERVICE_PREFIX_MAPPING to:          sso-postgresql=DB
Successfully updated DB_JNDI to:                            java:jboss/datasources/KeycloakDS
Successfully updated DB_USERNAME to:                        userxOp
Successfully updated DB_PASSWORD to:                        tsWNhQHK
Successfully updated DB_DATABASE to:                        root
Successfully updated TX_DATABASE_PREFIX_MAPPING to:         sso-postgresql=DB

$ chmod +x ./mirror_sso_dc_db_vars.sh
$ ./mirror_sso_dc_db_vars.sh
Successfully updated DB_SERVICE_PREFIX_MAPPING to:          sso-postgresql=DB
Successfully updated DB_JNDI to:                            java:jboss/datasources/KeycloakDS
Successfully updated DB_USERNAME to:                        userxOp
Successfully updated DB_PASSWORD to:                        tsWNhQHK
Successfully updated DB_DATABASE to:                        root
Successfully updated TX_DATABASE_PREFIX_MAPPING to:         sso-postgresql=DB

Copy to Clipboard

Toggle word wrap

使用预先配置的来源构建 Red Hat Single Sign- On 7.5.3 数据库迁移镜像，并等待构建完成。

oc get is -n openshift | grep sso75 | cut -d ' ' -f1
sso75-openshift-rhel8

$ oc get is -n openshift | grep sso75 | cut -d ' ' -f1
sso75-openshift-rhel8

Copy to Clipboard

Toggle word wrap

oc new-build sso75-openshift-rhel8:7.5~https://github.com/iankko/openshift-examples.git#KEYCLOAK-8500 \
  --context-dir=sso-manual-db-migration \
  --name=sso75-db-migration-image
--> Found image bf45ac2 (7 days old) in image stream "openshift/sso75-openshift-rhel8" under tag "7.5" for "sso75-openshift-rhel8:7.5"

    Red Hat SSO 7.5.3
    ---------------
    Platform for running Red Hat SSO

    Tags: sso, sso7, keycloak

    * A source build using source code from https://github.com/iankko/openshift-examples.git#KEYCLOAK-8500 will be created
      * The resulting image will be pushed to image stream "sso75-db-migration-image:latest"
      * Use 'start-build' to trigger a new build

--> Creating resources with label build=sso75-db-migration-image ...
    imagestream "sso75-db-migration-image" created
    buildconfig "sso75-db-migration-image" created
--> Success
    Build configuration "sso75-db-migration-image" created and build triggered.
    Run 'oc logs -f bc/sso75-db-migration-image' to stream the build progress.

$ oc new-build sso75-openshift-rhel8:7.5~https://github.com/iankko/openshift-examples.git#KEYCLOAK-8500 \
  --context-dir=sso-manual-db-migration \
  --name=sso75-db-migration-image
--> Found image bf45ac2 (7 days old) in image stream "openshift/sso75-openshift-rhel8" under tag "7.5" for "sso75-openshift-rhel8:7.5"

    Red Hat SSO 7.5.3
    ---------------
    Platform for running Red Hat SSO

    Tags: sso, sso7, keycloak

    * A source build using source code from https://github.com/iankko/openshift-examples.git#KEYCLOAK-8500 will be created
      * The resulting image will be pushed to image stream "sso75-db-migration-image:latest"
      * Use 'start-build' to trigger a new build

--> Creating resources with label build=sso75-db-migration-image ...
    imagestream "sso75-db-migration-image" created
    buildconfig "sso75-db-migration-image" created
--> Success
    Build configuration "sso75-db-migration-image" created and build triggered.
    Run 'oc logs -f bc/sso75-db-migration-image' to stream the build progress.

Copy to Clipboard

Toggle word wrap

oc logs -f bc/sso75-db-migration-image --follow
Cloning "https://github.com/iankko/openshift-examples.git#KEYCLOAK-8500" ...
...
Push successful

$ oc logs -f bc/sso75-db-migration-image --follow
Cloning "https://github.com/iankko/openshift-examples.git#KEYCLOAK-8500" ...
...
Push successful

Copy to Clipboard

Toggle word wrap

通过引用内置的 sso75-db-migration-image 镜像，更新数据库迁移作业(job-to-migrate-db-to-sso75.yaml)的模板。

获取镜像的 docker pull 引用。

PULL_REF=$(oc get istag -n $(oc project -q) --no-headers | grep sso75-db-migration-image | tr -s ' ' | cut -d ' ' -f 2)

$ PULL_REF=$(oc get istag -n $(oc project -q) --no-headers | grep sso75-db-migration-image | tr -s ' ' | cut -d ' ' -f 2)

Copy to Clipboard

Toggle word wrap

将作业模板的 <<SSO_IMAGE_VALUE>> 字段替换为 pull 规格。

sed -i "s#<<SSO_IMAGE_VALUE>>#$PULL_REF#g" job-to-migrate-db-to-sso75.yaml

$ sed -i "s#<<SSO_IMAGE_VALUE>>#$PULL_REF#g" job-to-migrate-db-to-sso75.yaml

Copy to Clipboard

Toggle word wrap

验证字段是否已更新。

从作业模板实例化数据库迁移作业。
```
oc create -f job-to-migrate-db-to-sso75.yaml
job "job-to-migrate-db-to-sso75" created
```
```
$ oc create -f job-to-migrate-db-to-sso75.yaml
job "job-to-migrate-db-to-sso75" created
```
Copy to Clipboard Toggle word wrap
重要
数据库迁移过程处理数据 schema 更新并执行相关的数据，因此在动态生成 SQL 迁移文件前，停止所有运行 Red Hat Single Sign-On for OpenShift 镜像的 pod。

识别用于部署容器的部署配置，该配置运行了 OpenShift 镜像的红帽单点登录版本。

oc get dc -o name --selector=application=sso
deploymentconfig/sso
deploymentconfig/sso-postgresql

$ oc get dc -o name --selector=application=sso
deploymentconfig/sso
deploymentconfig/sso-postgresql

Copy to Clipboard

Toggle word wrap

停止当前命名空间中为 OpenShift 镜像运行之前版本的 Red Hat Single Sign-On 的所有 pod。
```
oc scale --replicas=0 dc/sso
deploymentconfig "sso" scaled
```
```
$ oc scale --replicas=0 dc/sso
deploymentconfig "sso" scaled
```
Copy to Clipboard Toggle word wrap

运行数据库迁移作业，并等待 pod 正确运行。

oc get jobs
NAME                            DESIRED   SUCCESSFUL   AGE
job-to-migrate-db-to-sso75   1         0            3m

$ oc get jobs
NAME                            DESIRED   SUCCESSFUL   AGE
job-to-migrate-db-to-sso75   1         0            3m

Copy to Clipboard

Toggle word wrap

oc scale --replicas=1 job/job-to-migrate-db-to-sso75
job "job-to-migrate-db-to-sso75" scaled

$ oc scale --replicas=1 job/job-to-migrate-db-to-sso75
job "job-to-migrate-db-to-sso75" scaled

Copy to Clipboard

Toggle word wrap

oc get pods
NAME                                  READY     STATUS      RESTARTS   AGE
sso-postgresql-1-n5p16                1/1       Running     1          19h
job-to-migrate-db-to-sso75-b87bb   1/1       Running     0          1m
sso75-db-migration-image-1-build      0/1       Completed   0          27m

$ oc get pods
NAME                                  READY     STATUS      RESTARTS   AGE
sso-postgresql-1-n5p16                1/1       Running     1          19h
job-to-migrate-db-to-sso75-b87bb   1/1       Running     0          1m
sso75-db-migration-image-1-build      0/1       Completed   0          27m

Copy to Clipboard

Toggle word wrap

注意

默认情况下，数据库迁移作业在生成迁移文件后在 600 秒后自动 终止。您可以调整这个时间段。

从 pod 获取动态生成的 SQL 数据库迁移文件。

mkdir -p ./db-update
oc rsync job-to-migrate-db-to-sso75-b87bb:/opt/eap/keycloak-database-update.sql ./db-update
receiving incremental file list
keycloak-database-update.sql

sent 30 bytes  received 29,726 bytes  59,512.00 bytes/sec
total size is 29,621  speedup is 1.00

$ mkdir -p ./db-update
$ oc rsync job-to-migrate-db-to-sso75-b87bb:/opt/eap/keycloak-database-update.sql ./db-update
receiving incremental file list
keycloak-database-update.sql

sent 30 bytes  received 29,726 bytes  59,512.00 bytes/sec
total size is 29,621  speedup is 1.00

Copy to Clipboard

Toggle word wrap

检查 keycloak-database-update.sql 文件，以便在手动数据库更新过程中对 Red Hat Single Sign-On 7.5.3 版本进行的更改。

手动应用数据库更新。

如果运行一些之前版本的 Red Hat Single Sign-On for OpenShift 镜像，则由以临时或持久模式部署的 PostgreSQL 数据库支持，请在单独的 pod 上运行：

将生成的 SQL 迁移文件复制到 PostgreSQL pod。

oc rsync --no-perms=true ./db-update/ sso-postgresql-1-n5p16:/tmp
sending incremental file list

sent 77 bytes  received 11 bytes  176.00 bytes/sec
total size is 26,333  speedup is 299.24

$ oc rsync --no-perms=true ./db-update/ sso-postgresql-1-n5p16:/tmp
sending incremental file list

sent 77 bytes  received 11 bytes  176.00 bytes/sec
total size is 26,333  speedup is 299.24

Copy to Clipboard

Toggle word wrap

启动连接到 PostgreSQL pod 的 shell 会话。
```
oc rsh sso-postgresql-1-n5p16
sh-4.2$
```
```
$ oc rsh sso-postgresql-1-n5p16
sh-4.2$
```
Copy to Clipboard Toggle word wrap

使用 psql 工具手动应用数据库更新。

alias psql="/opt/rh/rh-postgresql95/root/bin/psql"
psql --version
psql (PostgreSQL) 9.5.4
psql -U <PREFIX>_USERNAME -d <PREFIX>_DATABASE -W -f /tmp/keycloak-database-update.sql
Password for user <PREFIX>_USERNAME:
INSERT 0 1
INSERT 0 1
...

sh-4.2$ alias psql="/opt/rh/rh-postgresql95/root/bin/psql"
sh-4.2$ psql --version
psql (PostgreSQL) 9.5.4
sh-4.2$ psql -U <PREFIX>_USERNAME -d <PREFIX>_DATABASE -W -f /tmp/keycloak-database-update.sql
Password for user <PREFIX>_USERNAME:
INSERT 0 1
INSERT 0 1
...

Copy to Clipboard

Toggle word wrap

重要

将 <PREFIX>_USERNAME 和 <PREFIX>_DATABASE 替换为上一节中检索到的实际数据库凭证。另外，在提示时使用 & lt;PREFIX>_PASSWORD 作为数据库的密码。

关闭与 PostgreSQL pod 的 shell 会话。继续更新镜像更改触发器步骤。

更新现有部署配置中的镜像更改触发器，以引用 Red Hat Single Sign-On 7.5.3 镜像。

oc patch dc/sso --type=json -p '[{"op": "replace", "path": "/spec/triggers/0/imageChangeParams/from/name", "value": "sso75-openshift-rhel8:7.5"}]'
"sso" patched

$ oc patch dc/sso --type=json -p '[{"op": "replace", "path": "/spec/triggers/0/imageChangeParams/from/name", "value": "sso75-openshift-rhel8:7.5"}]'
"sso" patched

Copy to Clipboard

Toggle word wrap

开始根据镜像更改触发器中定义的最新镜像推出新的 Red Hat Single Sign-On 7.5.3 镜像。
```
oc rollout latest dc/sso
deploymentconfig "sso" rolled out
```
```
$ oc rollout latest dc/sso
deploymentconfig "sso" rolled out
```
Copy to Clipboard Toggle word wrap
使用修改后的部署配置部署红帽 Single Sign-On 7.5.3 容器。
```
oc scale --replicas=1 dc/sso
deploymentconfig "sso" scaled
```
```
$ oc scale --replicas=1 dc/sso
deploymentconfig "sso" scaled
```
Copy to Clipboard Toggle word wrap

第 4 章教程

4.1. 为 OpenShift 镜像版本的新 Red Hat Single Sign-On 更新数据库
复制链接

4.1.1. PostgreSQL 版本升级和数据库迁移
复制链接

4.1.2. 自动数据库迁移
复制链接

4.1.3. 手动数据库迁移
复制链接

学习

尝试、购买和销售

社区

关于红帽文档

让开源更具包容性

關於紅帽

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links

第 4 章 教程

4.1. 为 OpenShift 镜像版本的新 Red Hat Single Sign-On 更新数据库复制链接链接已复制到粘贴板!

4.1.1. PostgreSQL 版本升级和数据库迁移复制链接链接已复制到粘贴板!

4.1.2. 自动数据库迁移复制链接链接已复制到粘贴板!

4.1.3. 手动数据库迁移复制链接链接已复制到粘贴板!

学习

尝试、购买和销售

社区

关于红帽文档

让开源更具包容性

關於紅帽

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links

第 4 章教程

4.1. 为 OpenShift 镜像版本的新 Red Hat Single Sign-On 更新数据库
复制链接

4.1.1. PostgreSQL 版本升级和数据库迁移
复制链接

4.1.2. 自动数据库迁移
复制链接

4.1.3. 手动数据库迁移
复制链接