《OpenShift 4.x HOL教程汇总》
说明:本文已经在OpenShift 4.9环境中验证
安装 Resource Locker Operator
在 OpenShift 中使用缺省配置安装 Resource Locker Operator 即可。
配置被保护的 OpenShift 资源
- 执行命令,创建项目
$ oc new-project resource-locker-test
- 创建一个 Role(注意:角色可以对 configmaps 类对象进行修改),并绑定到 serviceaccount。
$ oc create serviceaccount sa-resource-locker -n resource-locker-test
$ oc apply -f - << EOF
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: role-configmaps
namespace: resource-locker-test
rules:
- apiGroups:
- ""
resources:
- configmaps
verbs:
- list
- get
- watch
- create
- update
- patch
EOF
$ oc apply -f - << EOF
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: sa-resource-locker-can-manage-configmaps
namespace: resource-locker-test
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: role-configmaps
subjects:
- kind: ServiceAccount
name: sa-resource-locker
namespace: resource-locker-test
EOF
- 创建一个 ResourceLocker 对象,其中包含被保护的 ConfigMap 对象,并使用前面创建的 ServiceAccount。注意:“excludedPaths”部分是不受保护的部分
$ oc apply -f - << EOF
apiVersion: redhatcop.redhat.io/v1alpha1
kind: ResourceLocker
metadata:
name: resourelocker-configmap
namespace: resource-locker-test
spec:
resources:
- excludedPaths:
- .metadata
- .status
- .spec.replicas
object:
apiVersion: v1
kind: ConfigMap
metadata:
name: locked-configmap
namespace: resource-locker-test
data:
key1: value1
serviceAccountRef:
name: sa-resource-locker
EOF
- 查看 ConfigMap 对象的内容。
$ oc get configmap locked-configmap -n resource-locker-test
NAME DATA AGE
locked-configmap 1 48s
$ oc get configmap locked-configmap -n resource-locker-test -oyaml
apiVersion: v1
data:
key1: value1
kind: ConfigMap
。。。
- 修改 ConfigMap 对象,确认虽然提示修改成功。但是再查看 ConfigMap 对象内容,确认对象实际没有发生变化。
$ oc apply -n resource-locker-test -f - << EOF
apiVersion: v1
kind: ConfigMap
metadata:
name: locked-configmap
namespace: resource-locker-test
data:
key1: modified-value1
EOF
$ oc get configmap locked-configmap -n resource-locker-test -oyaml
- 删除 ConfigMap 对象,确认虽然提示删除成功。但是再查看 ConfigMap 对象,确认对象实际没有被删除。
$ oc delete configmap locked-configmap -n resource-locker-test
configmap "locked-configmap" deleted
$ oc get configmap locked-configmap -n resource-locker-test
NAME DATA AGE
locked-configmap 1 7s
更改被保护OpenShift 资源
- 删除名为 resourelocker-configmap 的 ResourceLocker。
$ oc delete ResourceLocker resourelocker-configmap -n resource-locker-test
- 确认此时 locked-configmap 对象还有存在。
$ oc get configmap locked-configmap -n resource-locker-test -oyaml
apiVersion: v1
data:
key1: value1
kind: ConfigMap
。。。
- 修改 locked-configmap 对象,确认此时可以修改了。
$ oc patch configmap locked-configmap -p '{"data": {"key1": "value1-new"}}'
configmap/locked-configmap patched
$ oc get configmap locked-configmap -n resource-locker-test -oyaml
apiVersion: v1
data:
key1: value1-new
kind: ConfigMap
。。。
- 执行命令,创建新的 ResourceLocker 对象,其中定义了 locked-configmap 对象的新内容。
$ oc apply -f - << EOF
apiVersion: redhatcop.redhat.io/v1alpha1
kind: ResourceLocker
metadata:
name: resourelocker-configmap-modified
namespace: resource-locker-test
spec:
resources:
- excludedPaths:
- .metadata
- .status
- .spec.replicas
object:
apiVersion: v1
kind: ConfigMap
metadata:
name: locked-configmap
namespace: resource-locker-test
data:
key1: value1-modified
serviceAccountRef:
name: sa-resource-locker
EOF
- 确认此时 locked-configmap 对象的内容又被新的 ResourceLocker 对象锁定了。
$ oc get configmap locked-configmap -n resource-locker-test -oyaml
apiVersion: v1
data:
key1: value1-modified
kind: ConfigMap
。。。
演示视频
参考
https://github.com/redhat-cop/resource-locker-operator