13.4. 使用 PolicyGenerator CR 将 worker 节点策略应用到 worker 节点

流程

1. 创建以下 PolicyGenerator CR：

   apiVersion: policy.open-cluster-management.io/v1
   kind: PolicyGenerator
   metadata:
       name: example-sno-workers
   placementBindingDefaults:
       name: example-sno-workers-placement-binding
   policyDefaults:
       namespace: example-sno
       placement:
           labelSelector:
               matchExpressions:
                   - key: sites
                     operator: In
                     values:
                       - example-sno 1
       remediationAction: inform
       severity: low
       namespaceSelector:
           exclude:
               - kube-*
           include:
               - '*'
       evaluationInterval:
           compliant: 10m
           noncompliant: 10s
   policies:
       - name: example-sno-workers-config-policy
         policyAnnotations:
           ran.openshift.io/ztp-deploy-wave: "10"
         manifests:
           - path: source-crs/MachineConfigGeneric.yaml 2
             patches:
               - metadata:
                   labels:
                       machineconfiguration.openshift.io/role: worker 3
                   name: enable-workload-partitioning
                 spec:
                   config:
                       storage:
                           files:
                               - contents:
                                   source: data:text/plain;charset=utf-8;base64,W2NyaW8ucnVudGltZS53b3JrbG9hZHMubWFuYWdlbWVudF0KYWN0aXZhdGlvbl9hbm5vdGF0aW9uID0gInRhcmdldC53b3JrbG9hZC5vcGVuc2hpZnQuaW8vbWFuYWdlbWVudCIKYW5ub3RhdGlvbl9wcmVmaXggPSAicmVzb3VyY2VzLndvcmtsb2FkLm9wZW5zaGlmdC5pbyIKcmVzb3VyY2VzID0geyAiY3B1c2hhcmVzIiA9IDAsICJjcHVzZXQiID0gIjAtMyIgfQo=
                                 mode: 420
                                 overwrite: true
                                 path: /etc/crio/crio.conf.d/01-workload-partitioning
                                 user:
                                   name: root
                               - contents:
                                   source: data:text/plain;charset=utf-8;base64,ewogICJtYW5hZ2VtZW50IjogewogICAgImNwdXNldCI6ICIwLTMiCiAgfQp9Cg==
                                 mode: 420
                                 overwrite: true
                                 path: /etc/kubernetes/openshift-workload-pinning
                                 user:
                                   name: root
           - path: source-crs/PerformanceProfile-MCP-worker.yaml
             patches:
               - metadata:
                   name: openshift-worker-node-performance-profile
                 spec:
                   cpu: 4
                       isolated: 4-47
                       reserved: 0-3
                   hugepages:
                       defaultHugepagesSize: 1G
                       pages:
                           - count: 32
                             size: 1G
                   realTimeKernel:
                       enabled: true
           - path: source-crs/TunedPerformancePatch-MCP-worker.yaml
             patches:
               - metadata:
                   name: performance-patch-worker
                 spec:
                   profile:
                       - data: |
                         [main]
                         summary=Configuration changes profile inherited from performance created tuned
                         include=openshift-node-performance-openshift-worker-node-performance-profile
                         [bootloader]
                         cmdline_crash=nohz_full=4-47 5
                         [sysctl]
                         kernel.timer_migration=1
                         [scheduler]
                         group.ice-ptp=0:f:10:*:ice-ptp.*
                         [service]
                         service.stalld=start,enable
                         service.chronyd=stop,disable
                         name: performance-patch-worker
                   recommend:
                       - profile: performance-patch-worker

   1

   该策略应用于带有此标签的所有集群。

   2

   此通用 MachineConfig CR 用于在 worker 节点上配置工作负载分区。

   3

   MCP 字段必须设置为 worker。

   4

   必须为每个特定的硬件平台配置 cpu.isolated 和 cpu.reserved 字段。

   5

   cmdline_crash CPU 集必须与 PerformanceProfile 部分中设置的 cpu.isolated 匹配。

   通用 MachineConfig CR 用于在 worker 节点上配置工作负载分区。您可以生成 crio 和 kubelet 配置文件的内容。

2. 将创建的策略模板添加到由 ArgoCD policies 应用程序监控的 Git 存储库中。
3. 在 kustomization.yaml 文件中添加策略。
4. 提交 Git 中的更改，然后推送到由 GitOps ZTP ArgoCD 应用程序监控的 Git 存储库。

5. 要将新策略修复到 spoke 集群，请创建一个 TALM 自定义资源：

   $ cat <<EOF | oc apply -f -
   apiVersion: ran.openshift.io/v1alpha1
   kind: ClusterGroupUpgrade
   metadata:
     name: example-sno-worker-policies
     namespace: default
   spec:
     backup: false
     clusters:
     - example-sno
     enable: true
     managedPolicies:
     - group-du-sno-config-policy
     - example-sno-workers-config-policy
     - example-sno-config-policy
     preCaching: false
     remediationStrategy:
       maxConcurrency: 1
   EOF