OpenShift 4 - 通过模板定制新建project的配置

《OpenShift 4.x HOL教程汇总》
说明：本文已经在OpenShift 4.7环境中验证

OpenShift 的project对应的是Kubernetes的namespace对象。当通过命令创建project的时候，OpenShift使用内部的template创建项目对象。

1. 创建项目，查看项目当前配置。注意测试项目使用的资源没有明确的ResourceQuota和LimitRanges限制。

$ oc new-project test1
$ oc describe project test1
Name:                   test1
Created:                9 seconds ago
Labels:                 <none>
Annotations:            openshift.io/description=
                        openshift.io/display-name=
                        openshift.io/requester=admin
                        openshift.io/sa.scc.mcs=s0:c27,c4
                        openshift.io/sa.scc.supplemental-groups=1000710000/10000
                        openshift.io/sa.scc.uid-range=1000710000/10000
Display Name:           <none>
Description:            <none>
Status:                 Active
Node Selector:          <none>
Quota:                  <none>
Resource limits:        <none>

2. 将创建项目操作输出为template文件，然后查看其内容。可以看到在创建project的同时会将创建用户设为这个project的admin类型的ClusterRole

$ oc adm create-bootstrap-project-template -o yaml > ~/template.yaml

apiVersion: template.openshift.io/v1
kind: Template
metadata:
  creationTimestamp: null
  name: project-request
objects:
- apiVersion: project.openshift.io/v1
  kind: Project
  metadata:
    annotations:
      openshift.io/description: ${PROJECT_DESCRIPTION}
      openshift.io/display-name: ${PROJECT_DISPLAYNAME}
      openshift.io/requester: ${PROJECT_REQUESTING_USER}
    creationTimestamp: null
    name: ${PROJECT_NAME}
  spec: {}
  status: {}
- apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    creationTimestamp: null
    name: admin
    namespace: ${PROJECT_NAME}
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: admin
  subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: User
    name: ${PROJECT_ADMIN_USER}
parameters:
- name: PROJECT_NAME
- name: PROJECT_DISPLAYNAME
- name: PROJECT_DESCRIPTION
- name: PROJECT_ADMIN_USER
- name: PROJECT_REQUESTING_USER

3. 在template.yaml文件中“parameters”前面增加以下内容，增加LimitRange和ResourceQuota的配置。

- apiVersion: v1
  kind: "LimitRange"
  metadata:
    name: project-limits
    namespace: ${PROJECT_NAME}
  spec:
    limits:
      - type: "Container"
        default:
          cpu: "1" 
          memory: "1Gi" 
        defaultRequest:
          cpu: "500m" 
          memory: "500Mi"
- apiVersion: v1
  kind: ResourceQuota
  metadata:
    name: project-quota
    namespace: ${PROJECT_NAME}
  spec:
    hard:
      pods: "10" 
      requests.cpu: "4" 
      requests.memory: 4Gi 
      limits.cpu: "6" 
      limits.memory: 8Gi
      requests.storage: "20G"

4. 根据更改的template.yaml文件在openshift-config项目中创建template对象。

$ oc create -f template.yaml -n openshift-config

5. 修改OpenShift系统内置的名为cluster的project.config.openshift.io对象，让它使用名为project-request的template创建project。

$ oc patch project.config.openshift.io/cluster --type merge -p '{"spec":{"projectRequestTemplate":{"name":"project-request"}}}'

6. 创建test2项目，然后查看项目的配置，确认已经为新建的项目分配了Quota和ResourceLimit限制。

$ oc new-project test2
$ oc describe project test2
Name:           test2
Created:        13 seconds ago
Labels:         <none>
Annotations:    openshift.io/description=
                openshift.io/display-name=
                openshift.io/requester=admin
                openshift.io/sa.scc.mcs=s0:c27,c14
                openshift.io/sa.scc.supplemental-groups=1000730000/10000
                openshift.io/sa.scc.uid-range=1000730000/10000
Display Name:   <none>
Description:    <none>
Status:         Active
Node Selector:  <none>
Quota:
        Name:                   test2-quota
        Resource                Used    Hard
        --------                ----    ----
        limits.cpu              0       6
        limits.memory           0       6Gi
        pods                    0       10
        requests.cpu            0       4
        requests.memory         0       8Gi
        requests.storage        0       20G
Resource limits:
        Name:           test2-limits
        Type            Resource        Min     Max     Default Request Default Limit   Max Limit/Request Ratio
        ----            --------        ---     ---     --------------- -------------   -----------------------
        Container       cpu             -       -       500m            1               -
        Container       memory          -       -       500Mi           1Gi             -