15.4. 使用 GitOps ZTP 为单节点 OpenShift 集群执行基于镜像的升级

流程

1. 将 Prep、Upgrade 和 Idle 阶段的策略添加到名为 ibu-upgrade-ranGen.yaml 的现有组 PolicyGenTemplate 中：

   apiVersion: ran.openshift.io/v1
   kind: PolicyGenTemplate
   metadata:
     name: example-group-ibu
     namespace: "ztp-group"
   spec:
     bindingRules:
       group-du-sno: ""
     mcp: "master"
     evaluationInterval: 1
       compliant: 10s
       noncompliant: 10s
     sourceFiles:
       - fileName: ConfigMapGeneric.yaml
         complianceType: mustonlyhave
         policyName: "oadp-cm-policy"
         metadata:
           name: oadp-cm
           namespace: openshift-adp
       - fileName: ibu/ImageBasedUpgrade.yaml
         policyName: "prep-stage-policy"
         spec:
           stage: Prep
           seedImageRef: 2
             version: "4.15.0"
             image: "quay.io/user/lca-seed:4.15.0"
             pullSecretRef:
               name: "<seed_pull_secret>"
           oadpContent: 3
           - name: "oadp-cm"
             namespace: "openshift-adp"
         status:
           conditions:
             - reason: Completed
               status: "True"
               type: PrepCompleted
               message: "Prep stage completed successfully"
       - fileName: ibu/ImageBasedUpgrade.yaml
         policyName: "upgrade-stage-policy"
         spec:
           stage: Upgrade
         status:
           conditions:
             - reason: Completed
               status: "True"
               type: UpgradeCompleted
       - fileName: ibu/ImageBasedUpgrade.yaml
         policyName: "finalize-stage-policy"
         complianceType: mustonlyhave
         spec:
           stage: Idle
       - fileName: ibu/ImageBasedUpgrade.yaml
         policyName: "finalize-stage-policy"
         status:
           conditions:
             - reason: Idle
               status: "True"
               type: Idle

   1

   合规和不合规的策略的策略评估间隔。将它们设置为 10s，以确保策略状态准确反映当前的升级状态。

   2

   在 Prep 阶段为升级定义 seed 镜像、OpenShift Container Platform 版本和 pull secret。

   3

   定义备份和恢复所需的 OADP ConfigMap 资源。

2. 运行以下命令，验证是否创建了基于镜像的升级所需的策略：

   $ oc get policies -n spoke1 | grep -E "example-group-ibu"

   输出示例

   ztp-group.example-group-ibu-oadp-cm-policy             inform               NonCompliant          31h
   ztp-group.example-group-ibu-prep-stage-policy          inform               NonCompliant          31h
   ztp-group.example-group-ibu-upgrade-stage-policy       inform               NonCompliant          31h
   ztp-group.example-group-ibu-finalize-stage-policy      inform               NonCompliant          31h
   ztp-group.example-group-ibu-rollback-stage-policy      inform               NonCompliant          31h

3. 将 du-profile 集群标签更新至目标平台版本，或将 SiteConfig CR 中对应的 policy-binding 标签更新为目标平台。

   apiVersion: ran.openshift.io/v1
   kind: SiteConfig
   [...]
   spec:
     [...]
       clusterLabels:
         du-profile: "4.15.0"

   重要

   将标签更新至目标平台版本，取消绑定现有策略集。

4. 提交更新的 SiteConfig CR 并将其推送到 Git 存储库。

5. 当您准备好进入 Prep 阶段时，使用 Prep 和 OADP ConfigMap 策略在目标 hub 集群上创建 ClusterGroupUpgrade CR：

   apiVersion: ran.openshift.io/v1alpha1
   kind: ClusterGroupUpgrade
   metadata:
     name: cgu-ibu-prep
     namespace: default
   spec:
     clusters:
     - spoke1
     enable: true
     managedPolicies:
     - example-group-ibu-oadp-cm-policy
     - example-group-ibu-prep-stage-policy
     remediationStrategy:
       canaries:
         - spoke1
       maxConcurrency: 1
       timeout: 240

6. 运行以下命令来应用 Prep 策略：

   $ oc apply -f cgu-ibu-prep.yml

   如果您为 OADP 资源和额外清单提供 ConfigMap 对象，则 Lifecycle Agent 会在 Prep 阶段验证指定的 ConfigMap 对象。您可能会遇到以下问题：

   • 如果 Lifecycle Agent 检测到 extraManifests 的问题，验证警告或错误
   • 如果 Lifecycle Agent 检测到任何带有 oadpContent 的问题，验证错误

   验证警告不会阻止 Upgrade 阶段，但您必须确定是否可以安全地进行升级。这些警告（如缺少 CRD、命名空间或空运行失败）更新 Prep 阶段中的 status.conditions，和 ImageBasedUpgrade CR 中的 annotation 字段，其中包含有关警告的详情。

   验证警告示例

   [...]
   metadata:
   annotations:
     extra-manifest.lca.openshift.io/validation-warning: '...'
   [...]

   但是，验证错误，如将 MachineConfig 或 Operator 清单添加到额外清单中，从而导致 Prep 阶段失败并阻止 Upgrade 阶段。

   当验证通过时，集群会创建一个新的 ostree stateroot，它涉及拉取和解包 seed 镜像，并运行主机级别命令。最后，目标集群中会包括所有必需的镜像。

7. 运行以下命令监控状态并等待 cgu-ibu-prep ClusterGroupUpgrade 报告 Completed ：

   $ oc get cgu -n default

   输出示例

   NAME                    AGE   STATE       DETAILS
   cgu-ibu-prep            31h   Completed   All clusters are compliant with all the managed policies

流程

1. 当您准备好进入 Upgrade 阶段时，请在引用 Upgrade 策略的目标 hub 集群中创建 ClusterGroupUpgrade CR：

   apiVersion: ran.openshift.io/v1alpha1
   kind: ClusterGroupUpgrade
   metadata:
     name: cgu-ibu-upgrade
     namespace: default
   spec:
     actions:
       beforeEnable:
         addClusterAnnotations:
           import.open-cluster-management.io/disable-auto-import: "true" 1
       afterCompletion:
         removeClusterAnnotations:
         - import.open-cluster-management.io/disable-auto-import 2
     clusters:
     - spoke1
     enable: true
     managedPolicies:
     - example-group-ibu-upgrade-stage-policy
     remediationStrategy:
       canaries:
         - spoke1
       maxConcurrency: 1
       timeout: 240

   1

   在开始升级前，将 disable-auto-import 注解应用到受管集群。此注解可确保在升级阶段禁用自动导入受管集群，直到集群就绪为止。

   2

   升级完成后删除 disable-auto-import 注解。

2. 运行以下命令来应用 Upgrade 策略：

   $ oc apply -f cgu-ibu-upgrade.yml

3. 运行以下命令监控状态，并等待 cgu-ibu-upgrade ClusterGroupUpgrade 报告 Completed ：

   $ oc get cgu -n default

   输出示例

   NAME                              AGE   STATE       DETAILS
   cgu-ibu-prep                      31h   Completed   All clusters are compliant with all the managed policies
   cgu-ibu-upgrade                   31h   Completed   All clusters are compliant with all the managed policies

4. 当您对更改满意并准备好完成升级时，请在目标 hub 集群上创建一个 ClusterGroupUpgrade CR，该集群引用完成升级的策略：

   apiVersion: ran.openshift.io/v1alpha1
   kind: ClusterGroupUpgrade
   metadata:
     name: cgu-ibu-finalize
     namespace: default
   spec:
     actions:
       beforeEnable:
         removeClusterAnnotations:
         - import.open-cluster-management.io/disable-auto-import
     clusters:
     - spoke1
     enable: true
     managedPolicies:
     - example-group-ibu-finalize-stage-policy
     remediationStrategy:
       canaries:
         - spoke1
       maxConcurrency: 1
       timeout: 240

   重要

   确保没有其他 ClusterGroupUpgrade CR 正在进行，因为这会导致 TALM 持续协调它们。在应用 cgu-ibu-finalize.yaml 前，删除所有 "In-Progress" ClusterGroupUpgrade CR。

5. 运行以下命令来应用策略：

   $ oc apply -f cgu-ibu-finalize.yaml

6. 运行以下命令监控状态并等待 cgu-ibu-finalize ClusterGroupUpgrade 报告 Completed ：

   $ oc get cgu -n default

   输出示例

   NAME                    AGE   STATE       DETAILS
   cgu-ibu-finalize        30h   Completed   All clusters are compliant with all the managed policies
   cgu-ibu-prep            31h   Completed   All clusters are compliant with all the managed policies
   cgu-ibu-upgrade         31h   Completed   All clusters are compliant with all the managed policies

7. 您可以在成功升级后删除 OADP Operator 及其配置文件。

   1. 在 common-ranGen.yaml 文件中，将 OADP Operator 命名空间、Operator 组和订阅的 complianceType 更改为 mustnothave。

      [...]
      - fileName: OadpSubscriptionNS.yaml
        policyName: "subscriptions-policy"
        complianceType: mustnothave
      - fileName: OadpSubscriptionOperGroup.yaml
        policyName: "subscriptions-policy"
        complianceType: mustnothave
      - fileName: OadpSubscription.yaml
        policyName: "subscriptions-policy"
        complianceType: mustnothave
      - fileName: OadpOperatorStatus.yaml
        policyName: "subscriptions-policy"
        complianceType: mustnothave
      [...]

   2. 在站点 PolicyGenTemplate 文件中，将 OADP Operator 命名空间、Operator 组和订阅的 complianceType 更改为 mustnothave。

      - fileName: OadpSecret.yaml
        policyName: "config-policy"
        complianceType: mustnothave
      - fileName: OadpBackupStorageLocationStatus.yaml
        policyName: "config-policy"
        complianceType: mustnothave
      - fileName: DataProtectionApplication.yaml
        policyName: "config-policy"
        complianceType: mustnothave

   3. 将更改与自定义站点存储库合并，并等待 ArgoCD 应用程序对 hub 集群同步更改。common-subscriptions-policy 和 example-cnf-config-policy 策略的状态更改为 Non-Compliant。
   4. 使用 Topology Aware Lifecycle Manager 将更改应用到您的目标集群。有关滚动配置更改的更多信息，请参阅"更新受管集群上的策略"。

   5. 监控进程。当目标集群的 common-subscriptions-policy 和 example-cnf-config-policy 策略的状态为 Compliant 时，OADP Operator 已从集群中移除。运行以下命令，获取策略的状态：

      $ oc get policy -n ztp-common common-subscriptions-policy

      $ oc get policy -n ztp-site example-cnf-config-policy

   6. 从 common-ranGen.yaml 和站点 PolicyGenTemplate 文件中的 spec.sourceFiles 中删除 OADP Operator 命名空间、Operator 组和订阅 CR。
   7. 将更改与自定义站点存储库合并，并等待 ArgoCD 应用程序对 hub 集群同步更改。策略保持合规。

流程

1. 将 du-profile 或对应的 policy-binding 标签恢复到 SiteConfig CR 中的原始平台版本：

   apiVersion: ran.openshift.io/v1
   kind: SiteConfig
   [...]
   spec:
     [...]
       clusterLabels:
         du-profile: "4.14.x"

2. 当您准备好启动回滚时，将 Rollback 策略添加到现有组 PolicyGenTemplate CR 中：

   [...]
   - fileName: ibu/ImageBasedUpgrade.yaml
     policyName: "rollback-stage-policy"
     spec:
       stage: Rollback
     status:
       conditions:
         - message: Rollback completed
           reason: Completed
           status: "True"
           type: RollbackCompleted

3. 在目标 hub 集群上创建一个 ClusterGroupUpgrade CR，以引用 Rollback 策略：

   apiVersion: ran.openshift.io/v1alpha1
   kind: ClusterGroupUpgrade
   metadata:
     name: cgu-ibu-rollback
     namespace: default
   spec:
     actions:
       beforeEnable:
         removeClusterAnnotations:
         - import.open-cluster-management.io/disable-auto-import
     clusters:
     - spoke1
     enable: true
     managedPolicies:
     - example-group-ibu-rollback-stage-policy
     remediationStrategy:
       canaries:
         - spoke1
       maxConcurrency: 1
       timeout: 240

4. 运行以下命令来应用 Rollback 策略：

   $ oc apply -f cgu-ibu-rollback.yml

5. 当您对更改满意且准备好完成回滚时，请在目标 hub 集群上创建一个 ClusterGroupUpgrade CR，该集群引用完成回滚的策略：

   apiVersion: ran.openshift.io/v1alpha1
   kind: ClusterGroupUpgrade
   metadata:
     name: cgu-ibu-finalize
     namespace: default
   spec:
     actions:
       beforeEnable:
         removeClusterAnnotations:
         - import.open-cluster-management.io/disable-auto-import
     clusters:
     - spoke1
     enable: true
     managedPolicies:
     - example-group-ibu-finalize-stage-policy
     remediationStrategy:
       canaries:
         - spoke1
       maxConcurrency: 1
       timeout: 240

6. 运行以下命令来应用策略：

   $ oc apply -f cgu-ibu-finalize.yml