關(guān)于版本的選擇

openshift 4的安裝需要用到很多文件枉长，如下：

ocp_bios: "https://mirror.openshift.com/pub/openshift-v4/dependencies/rhcos/4.3/4.3.8/rhcos-4.3.8-x86_64-metal.x86_64.raw.gz"
ocp_initramfs: "https://mirror.openshift.com/pub/openshift-v4/dependencies/rhcos/4.3/4.3.8/rhcos-4.3.8-x86_64-installer-initramfs.x86_64.img"
ocp_install_kernel: "https://mirror.openshift.com/pub/openshift-v4/dependencies/rhcos/4.3/4.3.8/rhcos-4.3.8-x86_64-installer-kernel-x86_64"
ocp_client: "https://mirror.openshift.com/pub/openshift-v4/clients/ocp/4.3.8/openshift-client-linux-4.3.8.tar.gz"
ocp_installer: "https://mirror.openshift.com/pub/openshift-v4/clients/ocp/4.3.8/openshift-install-linux-4.3.8.tar.gz"

• 首先我們要確認(rèn)版本，主要還是確認(rèn)rhcos相關(guān)文件的版本裆蒸，比如我打開鏈接： https://mirror.openshift.com/pub/openshift-v4/dependencies/rhcos/4.3/熔萧，里面只包含了rhcos 4.3.8相關(guān)的文件，其中l(wèi)atest也是4.3.8：
  
  1
• 其次再確認(rèn)oc 和openshift-install文件的版本光戈，打開鏈接：https://mirror.openshift.com/pub/openshift-v4/clients/ocp/哪痰，里面包含了很多版本：
  
  2

• 具體4.3.8的版本內(nèi)容：

  
  
  3
• 在 https://cloud.redhat.com/openshift/install/metal/user-provisioned上下載的client和installer也是最新版本：
  
  4
• 總結(jié)
  為了確保所有軟件版本的一致性忘衍，所以建議oc和installer以rhcos相關(guān)文件版本為主去下載堪夭，而不是使用最新版榆苞。

開始制作離線包

我使用在美國的VPS下載離線鏡像马胧，體驗(yàn)了一下飛一般的速度殿衰，不到一分鐘就同步好鏡像了幔妨，不過從VPS拉取打包的鏡像文件時(shí)還是遇到網(wǎng)絡(luò)慢的問題阅仔，我搭建了一個(gè)http服務(wù)薪伏，用迅雷去下載鏡像文件烂琴，速度好很多也穩(wěn)定爹殊。

• 下載oc命令客戶端

wget https://mirror.openshift.com/pub/openshift-v4/clients/ocp/4.3.8/openshift-client-linux-4.3.8.tar.gz

• 解壓，并且將oc命令復(fù)制到

tar -zxvf openshift-client-linux-4.3.8.tar.gz
cp oc /usr/local/bin

• 安裝工具

yum -y install podman httpd-tools

• 創(chuàng)建準(zhǔn)備給本地私有鏡像倉庫的相關(guān)目錄

mkdir -p /opt/registry/{auth,certs,data}

• 創(chuàng)建證書奸绷，然后會(huì)提示你輸入相關(guān)信息梗夸，

注意：Common Name (eg, your name or your server's hostname) 字段要填寫鏡像倉庫的域名，不能使用IP号醉。其他的可以空著反症，這一步我錯(cuò)了幾次辛块，如下：

cd /opt/registry/certs
openssl req -newkey rsa:4096 -nodes -sha256 -keyout domain.key -x509 -days 365 -out domain.crt
Generating a 4096 bit RSA private key
....................................++
................................................................................................................................................................................................................................................................................................................++
writing new private key to 'domain.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:shanghai
Locality Name (eg, city) [Default City]: 
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:registry.vps.apo.ocp4.com
Email Address []:

• 創(chuàng)建密碼文件

htpasswd -bBc /opt/registry/auth/htpasswd admin admin

• 使用一個(gè)鏡像來部署私有鏡像倉庫：

podman run --name mirror-registry -p 5000:5000 \ 
     -v /opt/registry/data:/var/lib/registry:z \
     -v /opt/registry/auth:/auth:z \
     -e "REGISTRY_AUTH=htpasswd" \
     -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
     -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
     -v /opt/registry/certs:/certs:z \
     -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt \
     -e REGISTRY_HTTP_TLS_KEY=/certs/domain.key \
     -d docker.io/library/registry:2

注意需要放行特定的防火墻端口，我這里直接關(guān)閉防火墻铅碍，所以不開放了润绵，也可以按照官方文檔開通防火墻：

firewall-cmd --add-port=5000/tcp --zone=internal --permanent 
firewall-cmd --add-port=5000/tcp --zone=public   --permanent 
firewall-cmd --reload

• 更新Linux系統(tǒng)證書

cp /opt/registry/certs/domain.crt /etc/pki/ca-trust/source/anchors/
update-ca-trust

• 測試鏡像倉庫是否能正常訪問：

需要在/etc/hosts文件中添加域名解析，否則無法解析 registry.vps.apo.ocp4.com地址胞谈。

curl -u admin:admin -k https://registry.vps.apo.ocp4.com:5000/v2/_catalog
{"repositories":[]}

• 將鏡像倉庫的用戶名密碼鏡像base64加密

echo -n ’admin:admin' | base64 -w0
YWRtaW46YWRtaW4=

• 去下載pull-secret.text文件尘盼，然后安裝jq，為了能夠?qū)⒚荑€文件進(jìn)行json格式化烦绳，好看些卿捎。

yum install jq

• json格式化生成新的文件

cat ./pull-secret.text | jq .  >  pull-secret2.text

• 文件內(nèi)容如下：

{
  "auths": {
    "cloud.openshift.com": {
      "auth": "b3BlbnNo...",
      "email": "you@example.com"
    },
    "quay.io": {
      "auth": "b3BlbnNo...",
      "email": "you@example.com"
    },
    "registry.connect.redhat.com": {
      "auth": "NTE3Njg5Nj...",
      "email": "you@example.com"
    },
    "registry.redhat.io": {
      "auth": "NTE3Njg5Nj...",
      "email": "you@example.com"
    }
  }
}

• 然后添加一下私有鏡像倉庫的內(nèi)容，用于將quay的鏡像同步到私有鏡像倉庫過程中需要做認(rèn)證爵嗅，這就是個(gè)認(rèn)證密碼文件娇澎，類似如下笨蚁。

  "auths": {
...
    "<local_registry_host_name>:<local_registry_host_port>": { 
      "auth": "<credentials>", 
      "email": "you@example.com"
  },
...

• 導(dǎo)入一些拉取鏡像需要的環(huán)境變量參數(shù)睹晒，就是一些鏡像倉庫的地址，版本之類的信息

export OCP_RELEASE=4.3.8-x86_64
export LOCAL_REGISTRY='registry.vps.apo.ocp4.com:5000'
export LOCAL_REPOSITORY='ocp4/openshift4'
export PRODUCT_REPO='openshift-release-dev'
export LOCAL_SECRET_JSON='/opt/registry/certs/pull-secret2.text'
export RELEASE_NAME="ocp-release" 

• 使用oc命令去同步

oc adm -a ${LOCAL_SECRET_JSON} release mirror \
     --from=quay.io/${PRODUCT_REPO}/${RELEASE_NAME}:${OCP_RELEASE} \
     --to=${LOCAL_REGISTRY}/${LOCAL_REPOSITORY} \
     --to-release-image=${LOCAL_REGISTRY}/${LOCAL_REPOSITORY}:${OCP_RELEASE}

• 同步的輸出日志如下

info: Mirroring 103 images to registry.vps.apo.ocp4.com:5000/ocp4/openshift4 ...
registry.vps.apo.ocp4.com:5000/
  ocp4/openshift4
    blobs:
Success
Update image:  registry.vps.apo.ocp4.com:5000/ocp4/openshift4:4.3.8-x86_64
Mirror prefix: registry.vps.apo.ocp4.com:5000/ocp4/openshift4

To use the new mirrored repository to install, add the following section to the install-config.yaml:

imageContentSources:
- mirrors:
  - registry.vps.apo.ocp4.com:5000/ocp4/openshift4
  source: quay.io/openshift-release-dev/ocp-release
- mirrors:
  - registry.vps.apo.ocp4.com:5000/ocp4/openshift4
  source: quay.io/openshift-release-dev/ocp-v4.0-art-dev


To use the new mirrored repository for upgrades, use the following to create an ImageContentSourcePolicy:

apiVersion: operator.openshift.io/v1alpha1
kind: ImageContentSourcePolicy
metadata:
  name: example
spec:
  repositoryDigestMirrors:
  - mirrors:
    - registry.vps.apo.ocp4.com:5000/ocp4/openshift4
    source: quay.io/openshift-release-dev/ocp-release
  - mirrors:
    - registry.vps.apo.ocp4.com:5000/ocp4/openshift4
    source: quay.io/openshift-release-dev/ocp-v4.0-art-dev

• 打包鏡像倉庫文件

在openshift3的時(shí)候是直接拉取鏡像括细，然后打包鏡像伪很，在4沒有提供這樣命令，所以我就將鏡像倉庫文件直接全部打包奋单，然后拉回國內(nèi)锉试，再放到一個(gè)虛擬機(jī)上，啟動(dòng)鏡像倉庫览濒。

cd /opt/registry/data/
tar -czvf ocp4.3.8-images.tar.gz docker/
ll
drwxr-xr-x 3 root root       4096 Apr 21 07:10 docker
-rw-r--r-- 1 root root 5585707233 Apr 21 07:24 ocp4.3.8-images.tar.gz

有意思的地方

在同步鏡像倉庫的時(shí)候輸出的日志呆盖，可以看見鏡像的名稱都是為openshift4，而tag為openshift版本加上具體的組件名稱贷笛，并且還有對應(yīng)的hash值

sha256:d57b9ab77f64cb3cc667d957d53248f004dfa3ba5c8e3270ad06465815fca9e1 registry.vps.apo.ocp4.com:5000/ocp4/openshift4:4.3.8-openshift-state-metrics