1.8. 使用策略升级断开连接的集群

创建一个包含类似以下示例内容的脚本文件：

UPSTREAM_REGISTRY=quay.io
PRODUCT_REPO=openshift-release-dev
RELEASE_NAME=ocp-release
OCP_RELEASE=4.12.2-x86_64
LOCAL_REGISTRY=$(hostname):5000
LOCAL_SECRET_JSON=/path/to/pull/secret

oc adm -a ${LOCAL_SECRET_JSON} release mirror \
--from=${UPSTREAM_REGISTRY}/${PRODUCT_REPO}/${RELEASE_NAME}:${OCP_RELEASE} \
--to=${LOCAL_REGISTRY}/ocp4 \
--to-release-image=${LOCAL_REGISTRY}/ocp4/release:${OCP_RELEASE}

将 /path/to/pull/secret 替换为 OpenShift Container Platform pull secret 的路径。

等待 Operator 的安装完成。

提示： 您可以通过在 OpenShift Container Platform 命令行中输入 oc get pods 命令来检查安装的状态。验证 Operator 是否处于 running 状态。

输入以下命令克隆 graph data Git 存储库：

git clone https://github.com/openshift/cincinnati-graph-data

创建一个包含您的图形数据 init 信息的文件。您可以在 cincinnati-operator GitHub 仓库中找到此 Dockerfile 示例。该文件的内容在以下示例中显示：

FROM registry.access.redhat.com/ubi8/ubi:8.1

RUN curl -L -o cincinnati-graph-data.tar.gz https://github.com/openshift/cincinnati-graph-data/archive/master.tar.gz

RUN mkdir -p /var/lib/cincinnati/graph-data/

CMD exec /bin/bash -c "tar xvzf cincinnati-graph-data.tar.gz -C /var/lib/
cincinnati/graph-data/ --strip-components=1"

在本例中：

运行以下命令来构建 图形数据 init 容器:

podman build -f <path_to_Dockerfile> -t ${DISCONNECTED_REGISTRY}/cincinnati/cincinnati-graph-data-container:latest
podman push ${DISCONNECTED_REGISTRY}/cincinnati/cincinnati-graph-data-container:latest --authfile=/path/to/pull_secret.json

将 path_to_Dockerfile 替换为您在上一步中创建文件的路径。

将 ${DISCONNECTED_REGISTRY}/cincinnati/cincinnati-graph-data-container 替换为 graph data init 容器的路径。

将 /path/to/pull_secret 替换为 pull secret 文件的路径。

注： 如果没有安装 podman，您也可以将命令中的 podman 替换为 docker。

查找位于 image.config.openshift.io 的 OpenShift Container Platform 外部 registry API。这是存储外部 registry CA 证书的位置。

如需更多信息，请参阅 OpenShift Container Platform 文档中的为镜像 registry 访问配置额外的信任存储。

在密钥 updateservice-registry 中添加您的 CA 证书。OpenShift Update Service 使用此设置来定位您的证书：

apiVersion: v1
kind: ConfigMap
metadata:
  name: trusted-ca
data:
  updateservice-registry: |
    -----BEGIN CERTIFICATE-----
    ...
    -----END CERTIFICATE-----

编辑 image.config.openshift.io API 中的 cluster 资源，将 additionalTrustedCA 字段设置为您创建的 ConfigMap 的名称。

oc patch image.config.openshift.io cluster -p '{"spec":{"additionalTrustedCA":{"name":"trusted-ca"}}}' --type merge

将 trusted-ca 替换为新 ConfigMap 的路径。

如果您不想使用 Operator 的默认命名空间（openshift-cincinnati）， 为 OpenShift Update Service 实例创建一个命名空间：

粘贴 OpenShift Update Service 实例中的内容。您的 YAML 实例可能类似以下清单：

apiVersion: cincinnati.openshift.io/v1beta2
kind: Cincinnati
metadata:
  name: openshift-update-service-instance
  namespace: openshift-cincinnati
spec:
  registry: <registry_host_name>:<port> 1
  replicas: 1
  repository: ${LOCAL_REGISTRY}/ocp4/release
  graphDataImage: '<host_name>:<port>/cincinnati-graph-data-container' 2

将以下 YAML 内容粘贴到窗口以创建自定义策略：

apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  name: policy-mirror
  namespace: default
spec:
  disabled: false
  remediationAction: enforce
  policy-templates:
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: policy-image-content-source-policy
        spec:
          object-templates:
            - complianceType: musthave
              objectDefinition:
                apiVersion: operator.openshift.io/v1alpha1
                kind: ImageContentSourcePolicy
                metadata:
                  name: <your-local-mirror-name>
                spec:
                  repositoryDigestMirrors:
                    - mirrors:
                        - <your-registry> 1
                      source: registry.redhat.io
---
apiVersion: policy.open-cluster-management.io/v1
kind: PlacementBinding
metadata:
  name: binding-policy-mirror
  namespace: default
placementRef:
  name: placement-policy-mirror
  kind: PlacementRule
  apiGroup: apps.open-cluster-management.io
subjects:
- name: policy-mirror
  kind: Policy
  apiGroup: policy.open-cluster-management.io
---
apiVersion: apps.open-cluster-management.io/v1
kind: PlacementRule
metadata:
  name: placement-policy-mirror
  namespace: default
spec:
  clusterConditions:
  - status: "True"
    type: ManagedClusterConditionAvailable
  clusterSelector:
    matchExpressions:
      []  # selects all clusters if not specified

将以下 YAML 内容粘贴到窗口以创建自定义策略：

apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  name: policy-catalog
  namespace: default
spec:
  disabled: false
  remediationAction: enforce
  policy-templates:
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: policy-catalog
        spec:
          object-templates:
            - complianceType: musthave
              objectDefinition:
                apiVersion: config.openshift.io/v1
                kind: OperatorHub
                metadata:
                  name: cluster
                spec:
                  disableAllDefaultSources: true
            - complianceType: musthave
              objectDefinition:
                apiVersion: operators.coreos.com/v1alpha1
                kind: CatalogSource
                metadata:
                  name: my-operator-catalog
                  namespace: openshift-marketplace
                spec:
                  sourceType: grpc
                  image: '<registry_host_name>:<port>/olm/redhat-operators:v1' 1
                  displayName: My Operator Catalog
                  publisher: grpc
---
apiVersion: policy.open-cluster-management.io/v1
kind: PlacementBinding
metadata:
  name: binding-policy-catalog
  namespace: default
placementRef:
  name: placement-policy-catalog
  kind: PlacementRule
  apiGroup: apps.open-cluster-management.io
subjects:
- name: policy-catalog
  kind: Policy
  apiGroup: policy.open-cluster-management.io
---
apiVersion: apps.open-cluster-management.io/v1
kind: PlacementRule
metadata:
  name: placement-policy-catalog
  namespace: default
spec:
  clusterConditions:
  - status: "True"
    type: ManagedClusterConditionAvailable
  clusterSelector:
    matchExpressions:
      []  # selects all clusters if not specified

在受管集群中，输入以下命令确认 ClusterVersion upstream 参数目前是默认公共 OpenShift Update Service 操作对象：

oc get clusterversion -o yaml

返回的内容可能类似以下内容：

apiVersion: v1
items:
- apiVersion: config.openshift.io/v1
  kind: ClusterVersion
[..]
  spec:
    channel: stable-4.4
    upstream: https://api.openshift.com/api/upgrades_info/v1/graph

将以下 YAML 内容粘贴到窗口以创建自定义策略：

apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  name: policy-cluster-version
  namespace: default
  annotations:
    policy.open-cluster-management.io/standards: null
    policy.open-cluster-management.io/categories: null
    policy.open-cluster-management.io/controls: null
spec:
  disabled: false
  remediationAction: enforce
  policy-templates:
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: policy-cluster-version
        spec:
          object-templates:
            - complianceType: musthave
              objectDefinition:
                apiVersion: config.openshift.io/v1
                kind: ClusterVersion
                metadata:
                  name: version
                spec:
                  channel: stable-4.4
                  upstream: >-
                    https://example-cincinnati-policy-engine-uri/api/upgrades_info/v1/graph 1

---
apiVersion: policy.open-cluster-management.io/v1
kind: PlacementBinding
metadata:
  name: binding-policy-cluster-version
  namespace: default
placementRef:
  name: placement-policy-cluster-version
  kind: PlacementRule
  apiGroup: apps.open-cluster-management.io
subjects:
- name: policy-cluster-version
  kind: Policy
  apiGroup: policy.open-cluster-management.io
---
apiVersion: apps.open-cluster-management.io/v1
kind: PlacementRule
metadata:
  name: placement-policy-cluster-version
  namespace: default
spec:
  clusterConditions:
  - status: "True"
    type: ManagedClusterConditionAvailable
  clusterSelector:
    matchExpressions:
      []  # selects all clusters if not specified

您可以完成以下步骤来确定操作对象的路径：

在受管集群 CLI 中，使用以下命令确认 ClusterVersion 中的上游参数已使用本地 hub 集群 OpenShift Update Service URL 更新：

oc get clusterversion -o yaml

结果应该类似以下内容：

apiVersion: v1
items:
- apiVersion: config.openshift.io/v1
  kind: ClusterVersion
[..]
  spec:
    channel: stable-4.4
    upstream: https://<hub-cincinnati-uri>/api/upgrades_info/v1/graph

验证可选的升级路径是否可用。

注： 如果当前版本没有镜像到本地镜像存储库，则不会显示可用的升级版本。