OpenShift 4 - 安装 ODF 并部署红帽 Quay (1 Worker)

《OpenShift 4.x HOL教程汇总》
说明：本文已经在 OpenShift 4.13 + Quay 3.9.0 环境中验证

安装配置 OpenShift Data Foundation

因为 Quay 需要用到对象存储，所以我们先安装 OpenShift Data Foundation 提供对象存储。

安装 ODF Operator

使用默认配置将 OpenShift Data Foundation Operator 安装到 openshift-storage 项目中。

配置 Noobaa

1. 执行以下命令创建 NooBaa 对象。

$ cat << EOF | oc apply -f -
apiVersion: noobaa.io/v1alpha1
kind: NooBaa
metadata:
  name: noobaa
  namespace: openshift-storage
spec:
 dbResources:
   requests:
     cpu: '0.1'
     memory: 1Gi
 dbType: postgres
 coreResources:
   requests:
     cpu: '0.1'
     memory: 1Gi
EOF

2. 执行命令创建 BackingStore 对象。其中 gp2 是 OpenShift 集群中已有的 StorageClass 名称。

$ cat << EOF | oc apply -f -
apiVersion: noobaa.io/v1alpha1
kind: BackingStore
metadata:
  finalizers:
  - noobaa.io/finalizer
  labels:
    app: noobaa
  name: noobaa-pv-backing-store
  namespace: openshift-storage
spec:
  pvPool:
    numVolumes: 2
    resources:
      requests:
        storage: 100Gi
    storageClass: gp2
  type: pv-pool
EOF

3. 部署完后可以查看部署好的资源。

$ oc get pod -n openshift-storage
NAME                                               READY   STATUS    RESTARTS   AGE
csi-addons-controller-manager-58765ffdb9-l9r4h     2/2     Running   0          25m
noobaa-core-0                                      1/1     Running   0          25m
noobaa-db-pg-0                                     1/1     Running   0          25m
noobaa-endpoint-76b76b7457-lbnww                   1/1     Running   0          11m
noobaa-operator-6c8b57f6f7-5qq2v                   1/1     Running   0          26m
noobaa-pv-backing-store-noobaa-pod-05a665d4        1/1     Running   0          11m
noobaa-pv-backing-store-noobaa-pod-d7fd9e71        1/1     Running   0          11m
ocs-metrics-exporter-8488bdfbc5-648qg              1/1     Running   0          26m
ocs-operator-8499fdf689-slrdb                      1/1     Running   0          26m
odf-console-65f5595bb9-z4hz8                       1/1     Running   0          26m
odf-operator-controller-manager-77b4fc5c49-89tfd   2/2     Running   0          26m
rook-ceph-operator-9795c956f-lh8gt                 1/1     Running   0          26m

4. 执行命令查看相关对象。

$ oc get storageclass openshift-storage.noobaa.io
NAME                          PROVISIONER                       RECLAIMPOLICY   VOLUMEBINDINGMODE   ALLOWVOLUMEEXPANSION   AGE
openshift-storage.noobaa.io   openshift-storage.noobaa.io/obc   Delete          Immediate           false                  105s
 
$ oc get pvc -n openshift-storage
NAME                                          STATUS   VOLUME                                     CAPACITY   ACCESS MODES   STORAGECLASS   AGE
db-noobaa-db-pg-0                             Bound    pvc-903f225e-92a0-4c50-aa33-0090a41d79e8   50Gi       RWO            gp2            4m15s
noobaa-pv-backing-store-noobaa-pvc-6168f68a   Bound    pvc-07d5c176-c4d7-43c3-a852-a8842114ace7   300Gi      RWO            gp2            2m31s
noobaa-pv-backing-store-noobaa-pvc-7acf1cbb   Bound    pvc-4bd33ead-722d-42ef-b4b1-69b5ab975779   300Gi      RWO            gp2            2m31s
 
$ oc get BackingStore -n openshift-storage
NAME                           TYPE      PHASE   AGE
noobaa-default-backing-store   aws-s3    Ready   2m44s
noobaa-pv-backing-store        pv-pool   Ready   4m16s
 
$ oc get noobaa -n openshift-storage
NAME     S3-ENDPOINTS                     STS-ENDPOINTS                    IMAGE                                                                                                            PHASE   AGE
noobaa   ["https://10.0.226.238:30852"]   ["https://10.0.226.238:30341"]   registry.redhat.io/odf4/mcg-core-rhel8@sha256:bed794f5d396e04ff6e5041369f012f849402ac8a31a38c1acf054ff8c3b0874   Ready   5m

$ oc get bucketclass -n openshift-storage
NAME                          PLACEMENT                                                        NAMESPACEPOLICY   QUOTA   PHASE   AGE
noobaa-default-bucket-class   {"tiers":[{"backingStores":["noobaa-default-backing-store"]}]}                             Ready   2m28s

5. 执行命令更新 noobaa-default-bucket-class 对象使用的 backingStores 配置。

$ oc patch bucketclass noobaa-default-bucket-class --patch '{"spec":{"placementPolicy":{"tiers":[{"backingStores":["noobaa-pv-backing-store"]}]}}}' --type merge -n openshift-storage

安装 Quay

1. 使用默认配置将 Quay Operator 安装到默认的命名空间。
   
2. 创建名为 redhat-quay 的项目。
3. 执行命令创建 QuayRegistry 实例。完成后可以在 OpenShift 的开发者视图中看到下图的部署拓扑。

$ cat << EOF | oc apply -f -
apiVersion: quay.redhat.com/v1
kind: QuayRegistry
metadata:
  name: example-registry
  namespace: redhat-quay
spec:
  {}
EOF

注意：在部署过程中有可能会在事件中提示申请资源超过 LimitRange。此时可以进入控制台的 “管理”-“限制范围” 菜单，然后删除对应的 LimitRange 即可。

5. 执行命令获得 Quay 控制台访问地址。

$ QUAY_HOST=$(oc get route example-registry-quay -n redhat-quay -o jsonpath='{.spec.host}')

6. 在浏览器中打开上一步 QUAY_HOST 变量中的地址，然后在控制台中创建名为 quayadmin 的账户即可。
   

验证测试 Quay

1. 获得 hello-openshift 镜像到本地。

$ podman pull docker.io/openshift/hello-openshift
Trying to pull docker.io/openshift/hello-openshift:latest...
Getting image source signatures
Copying blob 4f4fb700ef54 done
Copying blob 8b32988996c5 done
Copying config 7af3297a3f done
Writing manifest to image destination
Storing signatures
7af3297a3fb4487b740ed6798163f618e6eddea1ee5fa0ba340329fcae31c8f6

2. 对镜像重新打标签。

podman tag docker.io/openshift/hello-openshift ${QUAY_HOST}/quayadmin/hello-openshift:latest

3. 登录 Quay 后将本地镜像推送到 Quay上。

$ podman login ${QUAY_HOST} --username=quayadmin --password=<YOUR-PASSWORD>
Login Succeeded!
 
$ podman push ${QUAY_HOST}/quayadmin/hello-openshift:latest
Getting image source signatures
Copying blob 5f70bf18a086 done
Copying blob da0e4d9121c7 done
Copying config 7af3297a3f done
Writing manifest to image destination
Storing signatures

注意：

• 如果在 login 的时候出现 “x509: certificate signed by unknown authority” 的错误提示，则需要增加 “–tls-verify=false” 参数。
• 如果镜像因为有签名而无法推送，可以添加 --remove-signatures 命令参数。

4. 最后可以在 Quay 中确认已经有了 hello-openshift 镜像。
   

参考

https://github.com/liuxiaoyu-git/OpenShift-Labs/tree/main/userOperators/Quay
https://github.com/liuxiaoyu-git/ocp-quay-demo
https://olleb.com/quay-workshop/setup.html