# 登录Red Hat账户后，搜索OpenShift Container Platform
# 选择对应版本下载安装介质

# 下载OpenShift安装程序
$ wget https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/4.15.10/openshift-install-linux.tar.gz

# 下载OpenShift客户端工具
$ wget https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/4.15.10/openshift-client-linux.tar.gz

# 下载Red Hat CoreOS镜像
$ wget https://mirror.openshift.com/pub/openshift-v4/x86_64/dependencies/rhcos/4.15/4.15.10/rhcos-4.15.10-x86_64-live.x86_64.iso

# 验证下载文件
$ sha256sum openshift-install-linux.tar.gz

输出示例如下：
abc123def456789012345678901234567890123456789012345678901234 openshift-install-linux.tar.gz

方式二：OKD社区版下载（免费版）

# 下载OKD安装程序
$ wget https://github.com/openshift/okd/releases/download/4.15.0-0.okd-2024-03-15-123456/openshift-install-linux.tar.gz

# 下载OKD客户端
$ wget https://github.com/openshift/okd/releases/download/4.15.0-0.okd-2024-03-15-123456/openshift-client-linux.tar.gz

# 下载Fedora CoreOS镜像（OKD使用FCOS）
$ wget https://builds.coreos.fedoraproject.org/prod/streams/stable/builds/39.20240315.1.0/x86_64/fedora-coreos-39.20240315.1.0-live.x86_64.iso

# 解压安装程序
$ tar -xzf openshift-install-linux.tar.gz

# 查看解压内容
$ ls -la

输出示例如下：
total 125824
drwxr-xr-x 2 root root 4096 Mar 15 10:00 .
drwxr-xr-x 3 root root 4096 Mar 15 10:00 ..
-rwxr-xr-x 1 root root 83886080 Mar 15 10:00 openshift-install
-rw-r–r– 1 root root 1234 Mar 15 10:00 README.md

方式三：CRC本地开发环境下载

$ wget https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/crc/2.35.0/crc-linux-amd64.tar.xz

# 解压安装
$ tar -xJf crc-linux-amd64.tar.xz

# 移动到系统目录
$ sudo mv crc-linux-2.35.0-amd64/crc /usr/local/bin/

# 验证安装
$ crc version

输出示例如下：
CRC version: 2.35.0+abc123d
OpenShift version: 4.15.10
Podman version: 4.9.4

# 设置CRC
$ crc setup

输出示例如下：
INFO Using bundle path /home/user/.crc/cache/crc_libvirt_4.15.10_amd64.crcbundle
INFO Checking if running as non-root
INFO Checking if running inside WSL2
INFO Checking if crc-executable is cached
INFO Checking if podman remote executable is cached
INFO Checking if admin-helper executable is cached
INFO Checking if CRC bundle is extracted in ‘$HOME/.crc’
INFO Checking if /usr/libexec/crc is present
INFO Checking if CA bundle certificates are installed
INFO Checking if the CRC daemon is running
INFO Checking if ssh key is generated
Setup is complete, you can now run ‘crc start’ to start the OpenShift cluster

# 检查操作系统版本
$ cat /etc/redhat-release
Red Hat Enterprise Linux release 9.3 (Plow)

# 检查内存大小（建议至少16GB）
$ free -h

输出示例如下：
total used free shared buff/cache available
Mem: 62Gi 2.1Gi 58Gi 8.5Mi 1.8Gi 59Gi
Swap: 32Gi 0B 32Gi

# 检查磁盘空间（建议至少100GB）
$ df -h /

输出示例如下：
Filesystem Size Used Avail Use% Mounted on
/dev/sda1 200G 15G 185G 8% /

# 检查CPU核心数（建议至少4核）
$ nproc
32

# 检查网络配置
$ ip addr show

输出示例如下：
1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
2: eth0: mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 00:50:56:a1:b2:c3 brd ff:ff:ff:ff:ff:ff
inet 192.168.1.51/24 brd 192.168.1.255 scope global noprefixroute eth0
valid_lft forever preferred_lft forever

步骤2：安装依赖工具

输出示例如下：
Dependencies resolved.
================================================================================
Package Architecture Version Repository Size
================================================================================
Installing:
jq x86_64 1.6-14.el9 appstream 190 k
unzip x86_64 6.0-56.el9 baseos 180 k
wget x86_64 1.21.1-7.el9 appstream 790 k

Transaction Summary
================================================================================
Install 3 Packages

Total download size: 1.1 M
Installed size: 4.2 M
Downloading Packages:
(1/3): jq-1.6-14.el9.x86_64.rpm 2.5 MB/s | 190 kB 00:00
(2/3): unzip-6.0-56.el9.x86_64.rpm 2.0 MB/s | 180 kB 00:00
(3/3): wget-1.21.1-7.el9.x86_64.rpm 5.0 MB/s | 790 kB 00:00
——————————————————————————–
Total 3.5 MB/s | 1.1 MB 00:00
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing : 1/1
Installing : wget-1.21.1-7.el9.x86_64 1/3
Installing : jq-1.6-14.el9.x86_64 2/3
Installing : unzip-6.0-56.el9.x86_64 3/3
Verifying : jq-1.6-14.el9.x86_64 1/3
Verifying : unzip-6.0-56.el9.x86_64 2/3
Verifying : wget-1.21.1-7.el9.x86_64 3/3

Installed:
jq-1.6-14.el9.x86_64 unzip-6.0-56.el9.x86_64
wget-1.21.1-7.el9.x86_64

Complete!

# 解压安装
$ tar -xzf openshift-client-linux.tar.gz

# 安装oc和kubectl命令
$ sudo mv oc kubectl /usr/local/bin/

# 验证安装
$ oc version

输出示例如下：
Client Version: 4.15.10
Kubernetes Version: v1.28.5

$ kubectl version –client

输出示例如下：
Client Version: v1.28.5
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3

# 配置oc命令自动补全
$ source <(oc completion bash) $ echo 'source <(oc completion bash)' >> ~/.bashrc

# 验证自动补全
$ oc com
completion component config

步骤2：配置oc客户端

输出示例如下：
The server uses a certificate signed by an unknown authority.
You can bypass the certificate check, but any data you send to the server could be intercepted by others.
Use insecure connections? (y/n): y

Login successful.

You have access to 67 projects, the list has been suppressed. You can list all projects with:

oc get projects

You can now run ‘oc status’ to view the current status of your project.

# 查看当前项目
$ oc project

输出示例如下：
Using project “default” on server “https://api.fgedu.net.cn:6443”.

# 查看集群信息
$ oc cluster-info

输出示例如下：
Kubernetes control plane is running at https://api.fgedu.net.cn:6443

To further debug and diagnose cluster problems, use ‘kubectl cluster-info dump’.

# 登录后下载pull secret文件
# 或复制pull secret内容保存到本地

# 保存pull secret
$ mkdir -p ~/.openshift
$ cat > ~/.openshift/pull-secret << EOF {"auths":{"cloud.openshift.com":{"auth":"abc123...","email":"admin@fgedu.net.cn"},...}} EOF # 设置权限 $ chmod 600 ~/.openshift/pull-secret

步骤2：生成SSH密钥

输出示例如下：
Generating public/private ed25519 key pair.
Your identification has been saved in /home/user/.ssh/openshift_key
Your public key has been saved in /home/user/.ssh/openshift_key.pub
The key fingerprint is:
SHA256:abc123def456 user@fgedu.net.cn
The key’s randomart image is:
+–[ED25519 256]–+
| .o. |
| … |
| . . |
| . . . |
| . . S |
| . . o |
| . . . |
| . . |
| .. |
+—-[SHA256]—–+

# 查看公钥内容
$ cat ~/.ssh/openshift_key.pub

输出示例如下：
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAbc123def456 user@fgedu.net.cn

# 启动SSH代理
$ eval “$(ssh-agent -s)”

输出示例如下：
Agent pid 12345

# 添加密钥到代理
$ ssh-add ~/.ssh/openshift_key

输出示例如下：
Identity added: /home/user/.ssh/openshift_key (user@fgedu.net.cn)

步骤3：下载安装程序

# 解压安装
$ tar -xzf openshift-install-linux.tar.gz

# 移动到系统目录
$ sudo mv openshift-install /usr/local/bin/

# 验证安装
$ openshift-install version

输出示例如下：
openshift-install 4.15.10
built from commit abc123def4567890123456789012345678901234
release image quay.io/openshift-release-dev/ocp-release@sha256:abc123
release architecture amd64

# 创建install-config.yaml
$ cat > install-config.yaml << EOF apiVersion: v1 baseDomain: net.cn compute: - architecture: amd64 hyperthreading: Enabled name: worker platform: {} replicas: 3 controlPlane: architecture: amd64 hyperthreading: Enabled name: master platform: {} replicas: 3 metadata: creationTimestamp: null name: fgedu networking: clusterNetwork: - cidr: 10.128.0.0/14 hostPrefix: 23 machineNetwork: - cidr: 192.168.1.0/24 networkType: OVNKubernetes serviceNetwork: - 172.30.0.0/16 platform: none: {} publish: External pullSecret: '$(cat ~/.openshift/pull-secret)' sshKey: '$(cat ~/.ssh/openshift_key.pub)' EOF # 验证配置文件 $ cat install-config.yaml 输出示例如下： apiVersion: v1 baseDomain: net.cn compute: - architecture: amd64 hyperthreading: Enabled name: worker platform: {} replicas: 3 controlPlane: architecture: amd64 hyperthreading: Enabled name: master platform: {} replicas: 3 metadata: creationTimestamp: null name: fgedu ...

步骤2：生成安装清单

输出示例如下：
INFO Consuming Install Config from target directory
WARNING Making control-plane schedulable by setting MastersSchedulable to true for Scheduler cluster settings
INFO Manifests created in: /home/user/openshift-install/manifests and /home/user/openshift-install/openshift

# 查看生成的清单文件
$ ls manifests/

输出示例如下：
cluster-config.yaml
cluster-network-01-crd.yml
cluster-network-02-config.yml
cluster-scheduler-02-config.yml
cluster-dns-02-config.yml
cluster-infrastructure-02-config.yml
cluster-proxy-01-config.yaml
cluster-ingress-02-config.yml
kube-system-configmap-root-ca.yaml
openshift-config-secret-pull-secret.yaml

# 查看openshift目录
$ ls openshift/

输出示例如下：
99_openshift-cluster-api_master-machines-0.yaml
99_openshift-cluster-api_master-machines-1.yaml
99_openshift-cluster-api_master-machines-2.yaml
99_openshift-cluster-api_worker-machineset-0.yaml
99_openshift-cluster-api_worker-machineset-1.yaml
99_openshift-cluster-api_worker-machineset-2.yaml

步骤3：启动集群安装

输出示例如下：
INFO Consuming Common Manifests from target directory
INFO Consuming Master Machines from target directory
INFO Consuming OpenShift Install Manifests from target directory
INFO Consuming Worker Machines from target directory
INFO Ignition-Configs created in: . and auth

# 查看生成的文件
$ ls -la

输出示例如下：
total 125824
drwxr-xr-x 4 root root 4096 Mar 15 10:00 .
drwxr-xr-x 3 root root 4096 Mar 15 10:00 ..
drwxr-xr-x 2 root root 4096 Mar 15 10:00 auth
-rw-r–r– 1 root root 12345 Mar 15 10:00 bootstrap.ign
-rw-r–r– 1 root root 23456 Mar 15 10:00 master.ign
-rw-r–r– 1 root root 34567 Mar 15 10:00 worker.ign
-rw-r–r– 1 root root 1024 Mar 15 10:00 metadata.json

# 查看认证信息
$ cat auth/kubeadmin-password

输出示例如下：
abcD-1234-EFGh-5678

# 开始安装集群（裸金属环境需要手动配置节点）
$ openshift-install wait-for install-complete –dir=. –log-level=info

输出示例如下：
INFO Waiting up to 40m0s (until 2:00PM) for the Kubernetes API at https://api.fgedu.net.cn:6443…
INFO API v1.28.5+abc123d up
INFO Waiting up to 30m0s (until 2:30PM) for bootstrapping to complete…
INFO It is now safe to remove the bootstrap resources
INFO Waiting up to 30m0s (until 3:00PM) for the cluster at https://api.fgedu.net.cn:6443 to initialize…
INFO Waiting up to 10m0s (until 3:10PM) for the openshift-console route to be created…
INFO Install complete!
INFO To access the cluster as the system:admin user when using ‘oc’, run ‘export KUBECONFIG=/home/user/openshift-install/auth/kubeconfig’
INFO Access the OpenShift web-console here: https://console-openshift-console.apps.fgedu.net.cn
INFO Login to the console with user: “kubeadmin”, and password: “abcD-1234-EFGh-5678”
INFO Time elapsed: 45m12s

# 验证集群访问
$ oc whoami

输出示例如下：
system:admin

# 查看集群节点
$ oc get nodes

输出示例如下：
NAME STATUS ROLES AGE VERSION
master-0.fgedu.net.cn Ready control-plane,master,worker 1h v1.28.5+abc123d
master-1.fgedu.net.cn Ready control-plane,master,worker 1h v1.28.5+abc123d
master-2.fgedu.net.cn Ready control-plane,master,worker 1h v1.28.5+abc123d
worker-0.fgedu.net.cn Ready worker 1h v1.28.5+abc123d
worker-1.fgedu.net.cn Ready worker 1h v1.28.5+abc123d
worker-2.fgedu.net.cn Ready worker 1h v1.28.5+abc123d

# 查看集群版本
$ oc get clusterversion

输出示例如下：
NAME VERSION AVAILABLE PROGRESSING SINCE STATUS
version 4.15.10 True False 10m Cluster version is 4.15.10

# 查看集群操作员状态
$ oc get co

输出示例如下：
NAME VERSION AVAILABLE PROGRESSING DEGRADED SINCE MESSAGE
authentication 4.15.10 True False False 10m
baremetal 4.15.10 True False False 10m
cloud-controller-manager 4.15.10 True False False 10m
cloud-credential 4.15.10 True False False 10m
cluster-autoscaler 4.15.10 True False False 10m
config-operator 4.15.10 True False False 10m
console 4.15.10 True False False 10m
control-plane-machine-set 4.15.10 True False False 10m
csi-snapshot-controller 4.15.10 True False False 10m
dns 4.15.10 True False False 10m
etcd 4.15.10 True False False 10m
image-registry 4.15.10 True False False 10m
ingress 4.15.10 True False False 10m
insights 4.15.10 True False False 10m
kube-apiserver 4.15.10 True False False 10m
kube-controller-manager 4.15.10 True False False 10m
kube-scheduler 4.15.10 True False False 10m
kube-storage-version-migrator 4.15.10 True False False 10m
machine-api 4.15.10 True False False 10m
machine-approver 4.15.10 True False False 10m
machine-config 4.15.10 True False False 10m
marketplace 4.15.10 True False False 10m
monitoring 4.15.10 True False False 10m
network 4.15.10 True False False 10m
node-tuning 4.15.10 True False False 10m
openshift-apiserver 4.15.10 True False False 10m
openshift-controller-manager 4.15.10 True False False 10m
openshift-samples 4.15.10 True False False 10m
operator-lifecycle-manager 4.15.10 True False False 10m
operator-lifecycle-manager-catalog 4.15.10 True False False 10m
operator-lifecycle-manager-packageserver 4.15.10 True False False 10m
service-ca 4.15.10 True False False 10m
storage 4.15.10 True False False 10m

步骤2：配置用户认证

输出示例如下：
Adding password for user admin

# 创建secret
$ oc create secret generic htpass-secret –from-file=htpasswd=users.htpasswd -n openshift-config

输出示例如下：
secret/htpass-secret created

# 配置OAuth
$ cat > oauth.yaml << EOF apiVersion: config.openshift.io/v1 kind: OAuth metadata: name: cluster spec: identityProviders: - name: htpasswd_provider mappingMethod: claim type: HTPasswd htpasswd: fileData: name: htpass-secret EOF $ oc apply -f oauth.yaml 输出示例如下： oauth.config.openshift.io/cluster configured # 授予用户集群管理员权限 $ oc adm policy add-cluster-role-to-user cluster-admin admin 输出示例如下： clusterrole.rbac.authorization.k8s.io/cluster-admin added: "admin"

输出示例如下：
Now using project “test-project” on server “https://api.fgedu.net.cn:6443”.

# 部署测试应用
$ oc new-app nginx:alpine –name nginx-test

输出示例如下：
–> Found image abc123d (10 days old) in container image registry “docker.io”
* The source repository appears to match: httpd
* A container image “nginx:alpine” will be created
* Port 80/tcp will be load balanced by service “nginx-test”
–> Creating resources …
deployment.apps “nginx-test” created
service “nginx-test” created
–> Success
Application is not exposed. You can expose services to the outside world by executing one or more of the commands below:
‘oc expose service/nginx-test’
Run ‘oc status’ to view your app.

# 查看部署状态
$ oc get pods

输出示例如下：
NAME READY STATUS RESTARTS AGE
nginx-test-abc123-def456 1/1 Running 0 30s

# 暴露服务
$ oc expose service nginx-test –hostname nginx-test.apps.fgedu.net.cn

输出示例如下：
route.route.openshift.io/nginx-test exposed

# 查看路由
$ oc get route

输出示例如下：
NAME HOST/PORT PATH SERVICES PORT TERMINATION WILDCARD
nginx-test nginx-test.apps.fgedu.net.cn nginx-test 80 None

# 测试访问
$ curl -I http://nginx-test.apps.fgedu.net.cn

输出示例如下：
HTTP/1.1 200 OK
Server: nginx/1.25.4
Date: Fri, 15 Mar 2026 11:00:00 GMT
Content-Type: text/html
Connection: keep-alive