虚拟机配置：
– 控制平面节点：
– vCPU：8核
– 内存：32GB
– 磁盘：系统盘120GB SSD + 数据盘200GB SSD
– 网络：VMXNET3网卡，10Gbps网络

– 工作节点：
– vCPU：16核
– 内存：64GB
– 磁盘：系统盘120GB SSD + 数据盘500GB SSD
– 网络：VMXNET3网卡，10Gbps网络

资源池配置：
– CPU预留：控制平面4GHz，工作节点8GHz
– 内存预留：控制平面16GB，工作节点32GB
– 内存限制：控制平面32GB，工作节点64GB
– CPU份额：正常
– 内存份额：正常

云主机规格（阿里云/腾讯云/华为云）：
– 控制平面节点：
– 实例规格：ecs.g6.4xlarge或同等规格
– vCPU：16核
– 内存：64GB
– 系统盘：SSD云盘 120GB
– 数据盘：SSD云盘 200GB
– 网络带宽：10Gbps以上

– 工作节点：
– 实例规格：ecs.g6.8xlarge或同等规格
– vCPU：32核
– 内存：128GB
– 系统盘：SSD云盘 120GB
– 数据盘：SSD云盘 500GB
– 网络带宽：10Gbps以上

存储配置：
– OSS对象存储：用于存储镜像和备份
– NAS文件存储：用于共享数据
– 云盘快照：定期备份集群数据

# 检查操作系统版本
# cat /etc/os-release
NAME=”Red Hat Enterprise Linux CoreOS”
VERSION=”414.92.202404011200-0″
ID=”rhcos”
PRETTY_NAME=”Red Hat Enterprise Linux CoreOS 414.92.202404011200-0 (Ootpa)”

# 检查内核版本
# uname -r
5.14.0-284.30.1.el9_2.x86_64

# 检查SELinux状态
# getenforce
Enforcing

# 检查防火墙状态
# systemctl status firewalld
● firewalld.service – firewalld – dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
Active: active (running)

# 编辑sysctl.conf文件
# vi /etc/sysctl.conf

# 添加以下内核参数
fs.file-max = 6815744
kernel.sem = 250 32000 100 128
kernel.shmmni = 4096
kernel.shmall = 4294967296
kernel.shmmax = 68719476736
net.ipv4.ip_local_port_range = 9000 65500
net.core.rmem_default = 262144
net.core.rmem_max = 4194304
net.core.wmem_default = 262144
net.core.wmem_max = 1048576
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 30
net.ipv4.tcp_keepalive_time = 1200
net.ipv4.tcp_max_syn_backlog = 8192
net.core.somaxconn = 1024
vm.swappiness = 10
vm.dirty_ratio = 15
vm.dirty_background_ratio = 5

# 容器相关内核参数
net.ipv4.ip_forward = 1
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1

# 使内核参数生效
# sysctl -p

# 验证参数设置
# sysctl -a | grep fs.file-max
fs.file-max = 6815744

# 配置用户资源限制
# vi /etc/security/limits.conf

# 添加以下内容
* soft nproc 65535
* hard nproc 65535
* soft nofile 65535
* hard nofile 65535
* soft stack 10240
* hard stack 32768

# 验证配置
# ulimit -a
core file size (blocks, -c) 0
data seg size (kbytes, -d) unlimited
scheduling priority (-e) 0
file size (blocks, -f) unlimited
pending signals (-i) 63499
max locked memory (kbytes, -l) 64
max memory size (kbytes, -m) unlimited
open files (-n) 65535
pipe size (512 bytes, -p) 8
POSIX message queues (bytes, -q) 819200
real-time priority (-r) 0
stack size (kbytes, -s) 10240
cpu time (seconds, -t) unlimited
max user processes (-u) 65535
virtual memory (kbytes, -v) unlimited

# 安装必要的依赖包
# yum install -y curl wget git jq openssl

# 验证依赖安装
# rpm -qa | grep -E “curl|wget|git|jq|openssl”
curl-7.88.1-10.el9_2.2.x86_64
wget-1.21.3-10.el9.x86_64
git-2.39.3-1.el9.x86_64
jq-1.6-12.el9.x86_64
openssl-3.0.7-21.el9_2.x86_64

# 下载OpenShift Installer
# cd /tmp
# wget https://mirror.openshift.com/pub/openshift-v4/clients/ocp/4.14.0/openshift-install-linux-4.14.0.tar.gz

# 解压Installer
# tar -xzf openshift-install-linux-4.14.0.tar.gz

# 复制到/usr/local/bin
# cp openshift-install /usr/local/bin/

# 验证安装
# openshift-install version
openshift-install 4.14.0
built from commit xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
release image quay.io/openshift-release-dev/ocp-release:4.14.0-x86_64

# 下载oc命令行工具
# wget https://mirror.openshift.com/pub/openshift-v4/clients/ocp/4.14.0/openshift-client-linux-4.14.0.tar.gz

# 解压oc命令
# tar -xzf openshift-client-linux-4.14.0.tar.gz

# 复制到/usr/local/bin
# cp oc kubectl /usr/local/bin/

# 验证oc命令
# oc version
Client Version: 4.14.0

# 创建安装目录
# mkdir -p /data/openshift-install
# cd /data/openshift-install

# 创建安装配置文件
# vi install-config.yaml

apiVersion: v1
baseDomain: fgedu.net.cn
metadata:
name: openshift-cluster
controlPlane:
name: master
replicas: 3
platform:
none:
hyperthreading: Enabled
resources:
requests:
cpu: “4”
memory: “16Gi”
compute:
– name: worker
replicas: 2
platform:
none:
hyperthreading: Enabled
resources:
requests:
cpu: “8”
memory: “32Gi”
networking:
networkType: OVNKubernetes
clusterNetwork:
– cidr: 10.128.0.0/14
hostPrefix: 23
serviceNetwork:
– 172.30.0.0/16
machineNetwork:
– cidr: 192.168.1.0/24
platform:
none:
pullSecret: ‘{
“auths”: {
“cloud.openshift.com”: {
“auth”: “xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx”
},
“quay.io”: {
“auth”: “xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx”
},
“registry.connect.redhat.com”: {
“auth”: “xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx”
},
“registry.redhat.io”: {
“auth”: “xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx”
}
}
}’
sshKey: “ssh-rsa xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx”

# 验证配置文件
# cat install-config.yaml

# 生成安装清单
# openshift-install create manifests

# 查看生成的文件
# ls -la
-rw-r–r– 1 root root 2048 Apr 5 10:00 install-config.yaml
-rw-r–r– 1 root root 1024 Apr 5 10:00 manifests/
-rw-r–r– 1 root root 1024 Apr 5 10:00 openshift/

# 禁用内置的CSR批准器
# sed -i ‘s/mastersSchedulable: true/mastersSchedulable: false/’ manifests/cluster-scheduler-02-config.yml

# 验证修改
# cat manifests/cluster-scheduler-02-config.yml | grep mastersSchedulable
mastersSchedulable: false

# 创建引导ISO
# openshift-install create ignition-configs

# 查看生成的文件
# ls -la
-rw-r–r– 1 root root 2048 Apr 5 10:00 install-config.yaml
-rw-r–r– 1 root root 1024 Apr 5 10:00 manifests/
-rw-r–r– 1 root root 1024 Apr 5 10:00 openshift/
-rw-r–r– 1 root root 1024 Apr 5 10:00 bootstrap.ign
-rw-r–r– 1 root root 1024 Apr 5 10:00 master.ign
-rw-r–r– 1 root root 1024 Apr 5 10:00 worker.ign

# 生成引导ISO
# coreos-installer iso ignition embed -i bootstrap.ign /path/to/rhcos-live.x86_64.iso

# 启动引导节点
# 使用生成的ISO启动bootstrap节点

# 启动控制平面节点
# 使用master.ign配置启动master节点

# 启动工作节点
# 使用worker.ign配置启动worker节点

# 监控安装进度
# openshift-install wait-for bootstrap-complete

# 输出案例如下：
INFO Waiting up to 20m0s for the Kubernetes API at https://api.openshift-cluster.fgedu.net.cn:6443…
INFO API v1.27.0 up
INFO Waiting up to 30m0s for bootstrapping to complete…
INFO Bootstrapping complete

# 完成安装
# openshift-install wait-for install-complete

# 输出案例如下：
INFO Waiting up to 30m0s for the cluster to complete installation…
INFO Cluster is ready

# 验证集群状态
# oc get clusterversion
NAME VERSION AVAILABLE PROGRESSING SINCE STATUS
version 4.14.0 True False 10m Cluster version is 4.14.0

# 验证节点状态
# oc get nodes
NAME STATUS ROLES AGE VERSION
master01.fgedu.net.cn Ready control-plane,master 1h v1.27.0
master02.fgedu.net.cn Ready control-plane,master 1h v1.27.0
master03.fgedu.net.cn Ready control-plane,master 1h v1.27.0
worker01.fgedu.net.cn Ready worker 1h v1.27.0
worker02.fgedu.net.cn Ready worker 1h v1.27.0

# 验证集群服务
# oc get pods -n openshift-kube-apiserver
NAME READY STATUS RESTARTS AGE
kube-apiserver-master01 2/2 Running 0 1h
kube-apiserver-master02 2/2 Running 0 1h
kube-apiserver-master03 2/2 Running 0 1h

# 编辑集群配置
# oc edit clusterversion version

spec:
channel: stable-4.14
desiredUpdate:
version: 4.14.0
overrides:
– group: machineconfiguration.openshift.io
kind: MachineConfigPool
name: master
patch: |-
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfigPool
metadata:
name: master
spec:
machineConfigSelector:
matchLabels:
machineconfiguration.openshift.io/role: master
nodeSelector:
matchLabels:
node-role.kubernetes.io/master: “”
paused: false

# 应用配置
# oc apply -f cluster-config.yaml

# 创建节点配置
# vi node-config.yaml

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
name: 99-worker-kernel-args
labels:
machineconfiguration.openshift.io/role: worker
spec:
kernelArguments:
– ntp=time.google.com
– hugepages=1G
– default_hugepagesz=1G

# 应用配置
# oc apply -f node-config.yaml

# 验证配置
# oc get machineconfig | grep worker
NAME GENERATEDBYCONTROLLER IGNITIONVERSION AGE
99-worker-kernel-args False 3.2.0 10m

# 编辑网络配置
# oc edit network.operator.openshift.io cluster

spec:
defaultNetwork:
ovnKubernetesConfig:
mtu: 1450
genevePort: 6081
gatewayConfig:
routingViaHost: true

# 验证网络配置
# oc get network.operator.openshift.io cluster -o yaml

# 编辑存储配置
# oc edit storage.operator.openshift.io cluster

spec:
managementState: Managed
operatorLogLevel: Normal
observedConfig:
storageclass.kubernetes.io/is-default-class: “true”

# 验证存储配置
# oc get storage.operator.openshift.io cluster -o yaml

# 查看集群版本
# oc get clusterversion
NAME VERSION AVAILABLE PROGRESSING SINCE STATUS
version 4.14.0 True False 10m Cluster version is 4.14.0

# 查看集群操作
# oc get clusteroperator
NAME VERSION AVAILABLE PROGRESSING DEGRADED SINCE
authentication 4.14.0 True False False 1h
cloud-credential 4.14.0 True False False 1h
cluster-autoscaler 4.14.0 True False False 1h
config-operator 4.14.0 True False False 1h
console 4.14.0 True False False 1h
csi-snapshot-controller 4.14.0 True False False 1h
dns 4.14.0 True False False 1h
events 4.14.0 True False False 1h
image-registry 4.14.0 True False False 1h
ingress 4.14.0 True False False 1h
insights 4.14.0 True False False 1h
kube-apiserver 4.14.0 True False False 1h
kube-controller-manager 4.14.0 True False False 1h
kube-scheduler 4.14.0 True False False 1h
machine-api 4.14.0 True False False 1h
machine-config 4.14.0 True False False 1h
marketplace 4.14.0 True False False 1h
monitoring 4.14.0 True False False 1h
network 4.14.0 True False False 1h
node-tuning 4.14.0 True False False 1h
openshift-apiserver 4.14.0 True False False 1h
openshift-controller-manager 4.14.0 True False False 1h
openshift-samples 4.14.0 True False False 1h
operator-lifecycle-manager 4.14.0 True False False 1h
operator-lifecycle-manager-catalog 4.14.0 True False False 1h
operator-lifecycle-manager-packageserver 4.14.0 True False False 1h
service-ca 4.14.0 True False False 1h
service-catalog-apiserver 4.14.0 True False False 1h
service-catalog-controller-manager 4.14.0 True False False 1h
storage 4.14.0 True False False 1h

# 查看节点状态
# oc get nodes
NAME STATUS ROLES AGE VERSION
master01.fgedu.net.cn Ready control-plane,master 1h v1.27.0
master02.fgedu.net.cn Ready control-plane,master 1h v1.27.0
master03.fgedu.net.cn Ready control-plane,master 1h v1.27.0
worker01.fgedu.net.cn Ready worker 1h v1.27.0
worker02.fgedu.net.cn Ready worker 1h v1.27.0

# 查看节点详细信息
# oc describe node master01.fgedu.net.cn

# 标记节点为不可调度
# oc cordon worker01.fgedu.net.cn

# 驱逐节点上的Pod
# oc drain worker01.fgedu.net.cn –ignore-daemonsets

# 标记节点为可调度
# oc uncordon worker01.fgedu.net.cn

# 创建项目
# oc new-project fgedu-project

# 查看项目
# oc get projects

# 切换项目
# oc project fgedu-project

# 删除项目
# oc delete project fgedu-project

# 部署应用
# oc new-app –name=nginx docker.io/library/nginx:latest

# 查看部署
# oc get deployments

# 查看Pod
# oc get pods

# 暴露服务
# oc expose deployment nginx –port=80 –type=LoadBalancer

# 查看服务
# oc get services

# 查看网络配置
# oc get network.config.openshift.io cluster -o yaml

# 编辑网络配置
# oc edit network.config.openshift.io cluster

# 查看网络插件
# oc get network.operator.openshift.io cluster -o yaml

# 查看网络状态
# oc get networkpolicy -A

# 创建网络策略
# vi network-policy.yaml

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-nginx
namespace: fgedu-project
spec:
podSelector:
matchLabels:
app: nginx
ingress:
– from:
– podSelector:
matchLabels:
app: frontend
ports:
– protocol: TCP
port: 80

# 应用网络策略
# oc apply -f network-policy.yaml

# 查看网络策略
# oc get networkpolicy -n fgedu-project

# 检查网络接口
# oc debug node/master01.fgedu.net.cn — chroot /host ip addr

# 检查网络路由
# oc debug node/master01.fgedu.net.cn — chroot /host ip route

# 测试网络连接
# oc exec -it nginx-1234567890-abcde — ping -c 4 www.baidu.com

# 检查网络插件状态
# oc get pods -n openshift-network-operator

# 查看存储类
# oc get storageclass

# 创建存储类
# vi storageclass.yaml

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: nfs-storage
provisioner: kubernetes.io/nfs
parameters:
server: 192.168.1.100
path: /data/nfs
readOnly: “false”
reclaimPolicy: Retain
allowVolumeExpansion: true
volumeBindingMode: Immediate

# 应用存储类
# oc apply -f storageclass.yaml

# 设置默认存储类
# oc patch storageclass nfs-storage -p ‘{“metadata”: {“annotations”: {“storageclass.kubernetes.io/is-default-class”: “true”}}}’

# 创建持久卷
# vi persistentvolume.yaml

apiVersion: v1
kind: PersistentVolume
metadata:
name: nfs-pv
labels:
type: nfs
spec:
capacity:
storage: 10Gi
accessModes:
– ReadWriteMany
nfs:
server: 192.168.1.100
path: /data/nfs

# 应用持久卷
# oc apply -f persistentvolume.yaml

# 查看持久卷
# oc get persistentvolume

# 创建持久卷声明
# vi persistentvolumeclaim.yaml

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: nfs-pvc
namespace: fgedu-project
spec:
accessModes:
– ReadWriteMany
resources:
requests:
storage: 5Gi
storageClassName: nfs-storage

# 应用持久卷声明
# oc apply -f persistentvolumeclaim.yaml

# 查看持久卷声明
# oc get persistentvolumeclaim -n fgedu-project

# 检查存储类状态
# oc describe storageclass nfs-storage

# 检查持久卷状态
# oc describe persistentvolume nfs-pv

# 检查持久卷声明状态
# oc describe persistentvolumeclaim nfs-pvc -n fgedu-project

# 检查存储插件状态
# oc get pods -n openshift-storage

# 编辑集群资源配置
# vi cluster-resources.yaml

apiVersion: config.openshift.io/v1
kind: ClusterVersion
metadata:
name: version
spec:
channel: stable-4.14
desiredUpdate:
version: 4.14.0
overrides:
– group: machineconfiguration.openshift.io
kind: KubeletConfig
name: worker-kubelet-config
patch: |-
apiVersion: machineconfiguration.openshift.io/v1
kind: KubeletConfig
metadata:
name: worker-kubelet-config
spec:
machineConfigPoolSelector:
matchLabels:
pools.operator.machineconfiguration.openshift.io/worker: “”
kubeletConfig:
cpuManagerPolicy: static
cpuCfsQuota: true
cpuCfsQuotaPeriod: 100ms
memoryManagerPolicy: Static
topologyManagerPolicy: best-effort

# 应用配置
# oc apply -f cluster-resources.yaml

# 验证配置
# oc get kubeletconfig worker-kubelet-config -o yaml

# 编辑调度器配置
# vi scheduler-config.yaml

apiVersion: config.openshift.io/v1
kind: Scheduler
metadata:
name: cluster
spec:
mastersSchedulable: false
policy:
name: “”
defaultNodeSelector: “”

# 应用配置
# oc apply -f scheduler-config.yaml

# 验证配置
# oc get scheduler cluster -o yaml

# 编辑监控配置
# vi monitoring-config.yaml

apiVersion: monitoring.coreos.com/v1
kind: Alertmanager
metadata:
name: main
namespace: openshift-monitoring
spec:
replicas: 3
resources:
requests:
cpu: 1
memory: 1Gi
limits:
cpu: 2
memory: 2Gi

# 应用配置
# oc apply -f monitoring-config.yaml

# 验证配置
# oc get alertmanager main -n openshift-monitoring -o yaml

# 编辑日志配置
# vi logging-config.yaml

apiVersion: logging.openshift.io/v1
kind: ClusterLogging
metadata:
name: instance
namespace: openshift-logging
spec:
managementState: Managed
logStore:
type: elasticsearch
elasticsearch:
nodeCount: 3
storage:
storageClassName: nfs-storage
size: 100Gi
resources:
requests:
cpu: 2
memory: 8Gi
limits:
cpu: 4
memory: 16Gi

# 应用配置
# oc apply -f logging-config.yaml

# 验证配置
# oc get clusterlogging instance -n openshift-logging -o yaml