centos7.x 64位 openshift搭建

一、关闭防火墙、关闭selinux

 

 

关闭防火墙
systemctl stop firewalld
systemctl disable firewalld
关闭selinux
vi /etc/selinux/config
SELINUX=disabled
SELINUXTYPE=targeted

vi /etc/sysconfig/docker

OPTIONS='--selinux-enabled --log-driver=journald --signature-verification=false'
改成
OPTIONS='--selinux-enabled=false --log-driver=journald --signature-verification=false'

 

 

二、安装docker

 

yum install docker

systemctl enable docker

systemctl start docker

 三、安装openshift

 

 

wget https://github.com/openshift/origin/releases/download/v3.7.0/openshift-origin-server-v3.7.0-7ed6862-linux-64bit.tar.gz
tar zxvf openshift-origin-server-v3.7.0-7ed6862-linux-64bit.tar.gz
进入解压目录:
启动：
openshift start&

 四、客户机host

172.16.3.230 openshift.temspus.cn

 浏览器访问：https://openshift.temspus.cn:8443

开发帐号密码:dev dev

 创建管理员:

 

设置openshift 管理员admin密码
htpasswd -c /root/users.htpasswd admin
给admin添加集群管理员权限
oadm policy add-cluster-role-to-user cluster-admin admin

 可以用  admin admin 登录

 五、openshift添加scc安装权限，以便容器有权限执行

oc login -u system:admin -n default

 

Grant a Service Account Access to the Privileged SCC
First, create a service account. For example, to create service account mysvcacct in project myproject:

oc create serviceaccount gssuser -n gss

Then, add the service account to the privileged SCC.

oad3m polic3y add-scc-to-user privi3leged sys3tem:serviceaccount:myproject:mysvcacct

Enable Images to Run with USER in the Dockerfile

 To relax the security in your cluster so that images are not forced to run as a pre-allocated UID, without granting everyone access to the privileged SCC:

1. Grant all authenticated users access to the anyuid SCC:

1. $ oadm policy add-scc-to-group anyuid system:authenticated

 六、添加router

 通过web控制台添加routes后，需要添加router,否则会报

The route is not accepting traffic yet because it has not been admitted by a router。

docker的应用通过route将export不出去

router创建方法
为Router使用Service Account赋权

oadm policy add-scc-to-user privileged system:serviceaccount:default:router

oadm policy add-cluster-role-to-user cluster-reader system:serviceaccount:default:router

创建Router

oadm router router --replicas=1 --service-account=router --selector='region=infra'

其中 
–replicas 是一个实例，可以指定多个，分散负载 
–selector 是部署到指定的node上，可以没有，或者换成你自己的，用下面这个命令查看node的label：

oc get node --show-labels

如果node没有label，使用这个命令添加一个

oc label node node1.example.com region=infra

还有一点很重要，DNS做解析时把域名解析到router所在的node上，而不是master节点