8.3. 为 OpenShift 安装设置环境

1. 配置 install-config.yaml。更改适当的变量以匹配环境，包括 pullSecret 和 sshKey。

   apiVersion: v1
   baseDomain: <domain>
   metadata:
     name: <cluster-name>
   networking:
     machineCIDR: <public-cidr>
     networkType: OVNKubernetes
   compute:
   - name: worker
     replicas: 2 1
   controlPlane:
     name: master
     replicas: 3
     platform:
       baremetal: {}
   platform:
     baremetal:
       apiVIP: <api-ip>
       ingressVIP: <wildcard-ip>
       provisioningNetworkCIDR: <CIDR>
       hosts:
         - name: openshift-master-0
           role: master
           bmc:
             address: ipmi://<out-of-band-ip> 2
             username: <user>
             password: <password>
           bootMACAddress: <NIC1-mac-address>
           rootDeviceHints:
            deviceName: "/dev/disk/by-id/<disk_id>" 3
         - name: <openshift-master-1>
           role: master
           bmc:
             address: ipmi://<out-of-band-ip> 4
             username: <user>
             password: <password>
           bootMACAddress: <NIC1-mac-address>
           rootDeviceHints:
            deviceName: "/dev/disk/by-id/<disk_id>" 5
         - name: <openshift-master-2>
           role: master
           bmc:
             address: ipmi://<out-of-band-ip> 6
             username: <user>
             password: <password>
           bootMACAddress: <NIC1-mac-address>
           rootDeviceHints:
            deviceName: "/dev/disk/by-id/<disk_id>" 7
         - name: <openshift-worker-0>
           role: worker
           bmc:
             address: ipmi://<out-of-band-ip> 8
             username: <user>
             password: <password>
           bootMACAddress: <NIC1-mac-address>
         - name: <openshift-worker-1>
           role: worker
           bmc:
             address: ipmi://<out-of-band-ip>
             username: <user>
             password: <password>
           bootMACAddress: <NIC1-mac-address>
           rootDeviceHints:
            deviceName: "/dev/disk/by-id/<disk_id>" 9
   pullSecret: '<pull_secret>'
   sshKey: '<ssh_pub_key>'

   1

   根据作为 OpenShift Container Platform 集群一部分的 worker 节点数量来缩放 worker 机器。

   2 4 6 8

   如需了解更多选项，请参阅 BMC 寻址部分。

   3 5 7 9

   设置安装磁盘驱动器的路径，例如： /dev/disk/by-id/wwn-0x64cd98f04fde100024684cf3034da5c2。

2. 创建用于存储集群配置的目录。

   $ mkdir ~/clusterconfigs
   $ cp install-config.yaml ~/clusterconfigs

3. 在安装 OpenShift Container Platform 集群前，请确保关闭所有裸机节点。

   $ ipmitool -I lanplus -U <user> -P <password> -H <management-server-ip> power off

4. 如果以前的部署尝试中保留任何旧的 bootstrap 资源，则删除旧的 bootstrap 资源。

   for i in $(sudo virsh list | tail -n +3 | grep bootstrap | awk {'print $2'});
   do
     sudo virsh destroy $i;
     sudo virsh undefine $i;
     sudo virsh vol-delete $i --pool $i;
     sudo virsh vol-delete $i.ign --pool $i;
     sudo virsh pool-destroy $i;
     sudo virsh pool-undefine $i;
   done

1. 创建 OpenShift Container Platform 清单。

   $ ./openshift-baremetal-install --dir ~/clusterconfigs create manifests

   INFO Consuming Install Config from target directory
   WARNING Making control-plane schedulable by setting MastersSchedulable to true for Scheduler cluster settings
   WARNING Discarding the OpenShift Manifest that was provided in the target directory because its dependencies are dirty and it needs to be regenerated

流程

1. 创建 Butane 配置（99-master-chrony-conf-override.bu），包括 control plane 节点的 chrony.conf 文件的内容。

   注意

   有关 Butane 的信息，请参阅"使用 Butane 创建机器配置"。

   Butane 配置示例

   variant: openshift
   version: 4.8.0
   metadata:
     name: 99-master-chrony-conf-override
     labels:
       machineconfiguration.openshift.io/role: master
   storage:
     files:
       - path: /etc/chrony.conf
         mode: 0644
         overwrite: true
         contents:
           inline: |
             # Use public servers from the pool.ntp.org project.
             # Please consider joining the pool (https://www.pool.ntp.org/join.html).
   
             # The Machine Config Operator manages this file
             server openshift-master-0.<cluster-name>.<domain> iburst 1
             server openshift-master-1.<cluster-name>.<domain> iburst
             server openshift-master-2.<cluster-name>.<domain> iburst
   
             stratumweight 0
             driftfile /var/lib/chrony/drift
             rtcsync
             makestep 10 3
             bindcmdaddress 127.0.0.1
             bindcmdaddress ::1
             keyfile /etc/chrony.keys
             commandkey 1
             generatecommandkey
             noclientlog
             logchange 0.5
             logdir /var/log/chrony
   
             # Configure the control plane nodes to serve as local NTP servers
             # for all worker nodes, even if they are not in sync with an
             # upstream NTP server.
   
             # Allow NTP client access from the local network.
             allow all
             # Serve time even if not synchronized to a time source.
             local stratum 3 orphan

   1

   您必须将 <cluster-name> 替换为集群的名称，并将 <domain> 替换为完全限定域名。

2. 使用 Butane 生成 MachineConfig 对象文件 99-master-chrony-conf-override.yaml，包含要传送到 control plane 节点的配置：

   $ butane 99-master-chrony-conf-override.bu -o 99-master-chrony-conf-override.yaml

3. 为引用 control plane 节点上的 NTP 服务器的 worker 节点创建 Butane 配置 99-worker-chrony-conf-override.bu，包括 chrony.conf 文件的内容。

   Butane 配置示例

   variant: openshift
   version: 4.8.0
   metadata:
     name: 99-worker-chrony-conf-override
     labels:
       machineconfiguration.openshift.io/role: worker
   storage:
     files:
       - path: /etc/chrony.conf
         mode: 0644
         overwrite: true
         contents:
           inline: |
             # The Machine Config Operator manages this file.
             server openshift-master-0.<cluster-name>.<domain> iburst 1
             server openshift-master-1.<cluster-name>.<domain> iburst
             server openshift-master-2.<cluster-name>.<domain> iburst
   
             stratumweight 0
             driftfile /var/lib/chrony/drift
             rtcsync
             makestep 10 3
             bindcmdaddress 127.0.0.1
             bindcmdaddress ::1
             keyfile /etc/chrony.keys
             commandkey 1
             generatecommandkey
             noclientlog
             logchange 0.5
             logdir /var/log/chrony

   1

   您必须将 <cluster-name> 替换为集群的名称，并将 <domain> 替换为完全限定域名。

4. 使用 Butane 生成 MachineConfig 对象文件 99-worker-chrony-conf-override.yaml，包含要传送到 worker 节点的配置：

   $ butane 99-worker-chrony-conf-override.bu -o 99-worker-chrony-conf-override.yaml

流程

1. 进入存储 install-config.yaml 文件的目录：

   $ cd ~/clusterconfigs

2. 切换到 manifests 子目录：

   $ cd manifests

3. 创建名为 cluster-network-avoid-workers-99-config.yaml 的文件：

   $ touch cluster-network-avoid-workers-99-config.yaml

4. 在编辑器中打开 cluster-network-avoid-workers-99-config.yaml 文件，并输入描述 Operator 配置的自定义资源（CR）：

   apiVersion: machineconfiguration.openshift.io/v1
   kind: MachineConfig
   metadata:
     name: 50-worker-fix-ipi-rwn
     labels:
       machineconfiguration.openshift.io/role: worker
   spec:
     config:
       ignition:
         version: 3.2.0
       storage:
         files:
           - path: /etc/kubernetes/manifests/keepalived.yaml
             mode: 0644
             contents:
               source: data:,

   此清单将 ingressVIP 虚拟 IP 地址放在 control plane 节点上。另外，此清单仅在 control plane 节点上部署以下进程：

   • openshift-ingress-operator
   • keepalived
5. 保存 cluster-network-avoid-workers-99-config.yaml 文件。

6. 创建 manifests/cluster-ingress-default-ingresscontroller.yaml 文件：

   apiVersion: operator.openshift.io/v1
   kind: IngressController
   metadata:
     name: default
     namespace: openshift-ingress-operator
   spec:
     nodePlacement:
       nodeSelector:
         matchLabels:
           node-role.kubernetes.io/master: ""

7. 考虑备份 manifests 目录。安装程序会在创建集群时删除 manifests/ 目录。

8. 通过将 mastersSchedulable 字段设置为 true 来修改 cluster-scheduler-02-config.yml 清单，使 control plane 节点可以调度。control plane 节点默认不可调度。例如：

   $ sed -i "s;mastersSchedulable: false;mastersSchedulable: true;g" clusterconfigs/manifests/cluster-scheduler-02-config.yml

   注意

   如果在完成此步骤后 control plane 节点不可调度，则部署集群将失败。

流程

1. 打开 registry 节点上的防火墙端口。

   $ sudo firewall-cmd --add-port=5000/tcp --zone=libvirt  --permanent
   $ sudo firewall-cmd --add-port=5000/tcp --zone=public   --permanent
   $ sudo firewall-cmd --reload

2. 为 registry 节点安装所需的软件包。

   $ sudo yum -y install python3 podman httpd httpd-tools jq

3. 创建保存存储库信息的目录结构。

   $ sudo mkdir -p /opt/registry/{auth,certs,data}

流程

1. 根据情况调整证书信息。

   $ host_fqdn=$( hostname --long )
   $ cert_c="<Country Name>"   # Country Name (C, 2 letter code)
   $ cert_s="<State>"          # Certificate State (S)
   $ cert_l="<Locality>"       # Certificate Locality (L)
   $ cert_o="<Organization>"   # Certificate Organization (O)
   $ cert_ou="<Org Unit>"      # Certificate Organizational Unit (OU)
   $ cert_cn="${host_fqdn}"    # Certificate Common Name (CN)
   
   $ openssl req \
       -newkey rsa:4096 \
       -nodes \
       -sha256 \
       -keyout /opt/registry/certs/domain.key \
       -x509 \
       -days 365 \
       -out /opt/registry/certs/domain.crt \
       -addext "subjectAltName = DNS:${host_fqdn}" \
       -subj "/C=${cert_c}/ST=${cert_s}/L=${cert_l}/O=${cert_o}/OU=${cert_ou}/CN=${cert_cn}"

   注意

   当替换 <Country Name> 时，请确保它只包含两个字母。例如，US。

2. 使用新证书更新 registry 节点的 ca-trust。

   $ sudo cp /opt/registry/certs/domain.crt /etc/pki/ca-trust/source/anchors/
   $ sudo update-ca-trust extract

流程

1. 在 /opt/registry/auth 中创建一个 htpasswd 文件供容器使用。

   $ htpasswd -bBc /opt/registry/auth/htpasswd <user> <passwd>

   将 <user> 替换为用户名，将 <passwd> 替换为密码。

2. 创建并启动 registry 容器。

   $ podman create \
     --name ocpdiscon-registry \
     -p 5000:5000 \
     -e "REGISTRY_AUTH=htpasswd" \
     -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry" \
     -e "REGISTRY_HTTP_SECRET=ALongRandomSecretForRegistry" \
     -e "REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd" \
     -e "REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt" \
     -e "REGISTRY_HTTP_TLS_KEY=/certs/domain.key" \
     -e "REGISTRY_COMPATIBILITY_SCHEMA1_ENABLED=true" \
     -v /opt/registry/data:/var/lib/registry:z \
     -v /opt/registry/auth:/auth:z \
     -v /opt/registry/certs:/certs:z \
     docker.io/library/registry:2

   $ podman start ocpdiscon-registry

流程

1. 复制 pull-secret.txt 文件。

   $ scp kni@provisioner:/home/kni/pull-secret.txt pull-secret.txt

2. 使用 registry 节点的完全限定域名更新 host_fqdn 环境变量。

   $ host_fqdn=$( hostname --long )

3. 使用用于创建 htpasswd 文件的 http 凭证的 base64 编码来更新 b64auth 环境变量。

   $ b64auth=$( echo -n '<username>:<passwd>' | openssl base64 )

   将 <username> 替换为用户名，将 <passwd> 替换为密码。

4. 设置 AUTHSTRING 环境变量使用 base64 授权字符串。$USER 变量是包含当前用户名称的环境变量。

   $ AUTHSTRING="{\"$host_fqdn:5000\": {\"auth\": \"$b64auth\",\"email\": \"$USER@redhat.com\"}}"

5. 更新 pull-secret.txt 文件。

   $ jq ".auths += $AUTHSTRING" < pull-secret.txt > pull-secret-update.txt

流程

1. 将 provisioner 节点中的 oc 二进制文件复制到 registry 节点。

   $ sudo scp kni@provisioner:/usr/local/bin/oc /usr/local/bin

2. 设置所需的环境变量。

   1. 设置发行版本：

      $ VERSION=<release_version>

      对于 <release_version>，请指定与 OpenShift Container Platform 版本对应的标签，如 4.8。

   2. 设置本地 registry 名称和主机端口：

      $ LOCAL_REG='<local_registry_host_name>:<local_registry_host_port>'

      对于 <local_registry_host_name>，请指定镜像存储库的 registry 域名；对于 <local_registry_host_port>，请指定用于提供内容的端口。

   3. 设置本地存储库名称：

      $ LOCAL_REPO='<local_repository_name>'

      对于 <local_repository_name>，请指定要在 registry 中创建的仓库名称，如 ocp4/openshift4。

3. 将远程安装镜像镜像(mirror)到本地存储库。

   $ /usr/local/bin/oc adm release mirror \
     -a pull-secret-update.txt \
     --from=$UPSTREAM_REPO \
     --to-release-image=$LOCAL_REG/$LOCAL_REPO:${VERSION} \
     --to=$LOCAL_REG/$LOCAL_REPO

流程

1. 将断开连接的 registry 节点的证书添加到 install-config.yaml 文件中。证书应该跟着 "additionalTrustBundle: |" 行，并带有正确的缩进（通常是两个空格）。

   $ echo "additionalTrustBundle: |" >> install-config.yaml
   $ sed -e 's/^/  /' /opt/registry/certs/domain.crt >> install-config.yaml

2. 将 registry 的镜像信息添加到 install-config.yaml 文件中。

   $ echo "imageContentSources:" >> install-config.yaml
   $ echo "- mirrors:" >> install-config.yaml
   $ echo "  - registry.example.com:5000/ocp4/openshift4" >> install-config.yaml
   $ echo "  source: quay.io/openshift-release-dev/ocp-release" >> install-config.yaml
   $ echo "- mirrors:" >> install-config.yaml
   $ echo "  - registry.example.com:5000/ocp4/openshift4" >> install-config.yaml
   $ echo "  source: quay.io/openshift-release-dev/ocp-v4.0-art-dev" >> install-config.yaml

   注意

   将 registry.example.com 替换为 registry 的完全限定域名。