├── Chapter10
    ├── Istio1.4三层微服务限流的实现.pdf
    ├── Istio1.4中的微服务限流.pdf
    ├── Istio1.4的安装.pdf
    ├── Istio1.4的架构.pdf
    ├── Istio1.4的调优参考.pdf
    ├── Istio治理三层微服务.pdf
    ├── Spring Cloud在OpenShift上的实现.pdf
    ├── bookinfo1.0的部署.pdf
    ├── bookinfo微服务架构.pdf
    └── 三层微服务源码分析.pdf
├── Chapter2
    ├── Egress IP的配置与删除
    ├── OpenShift router支持tcp的实现.pdf
    ├── ocs外置存储方式.pdf
    ├── sdn pod启动日志
    ├── 可配置优先级列表
    ├── 默认静态Predicates
    └── 默认静态优先级策略
├── Chapter3
    ├── 3Xcontainer-registries
    ├── Image Registry增加持久化存储.pdf
    ├── Kibana安装后的配置.pdf
    ├── OpenShift 4.5.3在Openstack上的UPI离线安装.txt
    ├── OpenShift3.11安装.pdf
    ├── OpenShift4离线安装
    ├── create_pv.sh
    ├── dockerfile
    ├── haproxy.cfg
    ├── sample-registres.conf
    └── 自定义Prometheus规则并触发邮件告警.pdf
├── Chapter4
    ├── OpenShift API的调用.pdf
    ├── OpenShift中的Deployment 和DeploymentConfig.pdf
    ├── README
    └── 基于Fabric8在OpenShift上发布应用.pdf
├── Chapter5
    ├── 1.sh
    ├── CR of node-tuning-operator
    ├── OCP3备份脚本.txt
    ├── OCP3性能优化.pdf
    ├── Quarkus：超音速亚原子 Java 体验.pdf
    ├── README
    ├── macvlan性能优势说明.pdf
    ├── network performance report
    │   ├── Network Performance.pdf
    │   └── slides-104-bmwg-considerations-for-benchmarking-network-performance-in-containerized-infrastructures-00 (1).pdf
    ├── openshift-logging
    │   ├── README.md
    │   ├── fluentd-configmap
    │   │   ├── fluent.conf-external-es
    │   │   └── fluent.conf-origin
    │   └── kafka-fluentd-images
    │   │   ├── Dockerfile
    │   │   ├── base.repo
    │   │   ├── build.sh
    │   │   ├── kafka-plugin
    │   │       └── 0.1.3
    │   │       │   ├── fluent-plugin-kafka-0.1.3.gem
    │   │       │   ├── ltsv-0.1.0.gem
    │   │       │   ├── poseidon-0.0.5.gem
    │   │       │   ├── poseidon_cluster-0.3.3.gem
    │   │       │   ├── zk-1.9.6.gem
    │   │       │   └── zookeeper-1.4.11.gem
    │   │   ├── ruby-devel-2.0.0.648-35.el7_6.x86_64.rpm
    │   │   └── run.sh
    ├── 规避K8S APF问题.pdf
    └── 通过filetranspile修改ign
├── Chapter6
    ├── OpenShift Machine API Operator的架构与运维.txt
    ├── README
    ├── bluegreen-deploy-template.yaml
    ├── bluegreen-pipeline.jenkinsfile
    └── openshift4-on-aws-cn
    │   ├── README.md
    │   ├── bootstrap_node.yaml
    │   ├── control_plane_nodes.yaml
    │   ├── elb_dns.yaml
    │   ├── sg_role_template.yaml
    │   ├── vpc_template.yaml
    │   └── worker_nodes.yaml
├── Chapter7
    ├── Jenkinsfile
    ├── OpenShift中Jenkins工作方式的选择.pdf
    ├── openshift-cicd-template
    │   ├── Jenkinsfile
    │   ├── README.md
    │   ├── myapp-binary-template.yaml
    │   ├── myapp-pipeline-bc.yaml
    │   ├── myapp-template-jenkinsfile.yaml
    │   ├── myapp-template-no-trigger.yaml
    │   └── myapp-template.yaml
    └── tekton-cicd
    │   ├── openshift-client-task.yaml
    │   ├── petclinic-git-resource.yaml
    │   ├── petclinic-image-resource.yaml
    │   ├── petclinic.yaml
    │   ├── pipeline.yaml
    │   └── s2i-java-8-task.yaml
├── Chapter8
    ├── README
    └── jenkinsfile
├── Chapter9
    ├── GraalVM的限制.pdf
    ├── README
    ├── RHAMT安装和使用.pdf
    ├── Routing.java
    ├── ephemeral-template.yaml
    ├── quarkus-lab-validation-analyst-paper.pdf
    ├── register.json
    ├── strimzi-connect-s2i
    └── 如何将Spring Boot应用迁移到Quarkus.pdf
├── IMAGES
    ├── OCP企业实践v2.jpg
    └── README
└── README.md


/Chapter10/Istio1.4三层微服务限流的实现.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter10/Istio1.4三层微服务限流的实现.pdf


--------------------------------------------------------------------------------
/Chapter10/Istio1.4中的微服务限流.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter10/Istio1.4中的微服务限流.pdf


--------------------------------------------------------------------------------
/Chapter10/Istio1.4的安装.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter10/Istio1.4的安装.pdf


--------------------------------------------------------------------------------
/Chapter10/Istio1.4的架构.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter10/Istio1.4的架构.pdf


--------------------------------------------------------------------------------
/Chapter10/Istio1.4的调优参考.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter10/Istio1.4的调优参考.pdf


--------------------------------------------------------------------------------
/Chapter10/Istio治理三层微服务.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter10/Istio治理三层微服务.pdf


--------------------------------------------------------------------------------
/Chapter10/Spring Cloud在OpenShift上的实现.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter10/Spring Cloud在OpenShift上的实现.pdf


--------------------------------------------------------------------------------
/Chapter10/bookinfo1.0的部署.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter10/bookinfo1.0的部署.pdf


--------------------------------------------------------------------------------
/Chapter10/bookinfo微服务架构.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter10/bookinfo微服务架构.pdf


--------------------------------------------------------------------------------
/Chapter10/三层微服务源码分析.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter10/三层微服务源码分析.pdf


--------------------------------------------------------------------------------
/Chapter2/Egress IP的配置与删除:
--------------------------------------------------------------------------------
 1 | 在OCP3时代，我们可以通过：配置Egress Router、Egress IP、出口防火墙三种模式实现pod出口IP的固定。实际上常用的是前两种。Egress Router比Egress IP的方式的好处是，它除了可以设置pod的出口IP，还能设置pod的destination IP。缺点是这种配置比较复杂，而且无法自动实现高可用（需要部署两个Egress Router）​。Egress Router的方式，在OCP4已经不提了，或者说已经不用了。
 2 | 因此在OCP4时代，配置pod的Egress固定IP，使用Egress IP即可。它配置肩简单、自带（节点）高可。
 3 | 
 4 | 
 5 | egress ip在项目上设置后，我们会去设置ocp节点的subnet 。也就是说，哪些个节点可以允许这个项目的的pod出去，如果设置多个节点都能出 ，那项目会自动按照轮询方式选中一个节点， 从这个节点出；如果这个节点坏了，那就切换到其他节点出，节点恢复后 ，流量路径恢复 。
 6 | 如果pod不在出口节点 ，那pod 通过ovs走vxlan过去到出口节点，然后通过nat（在一个节点也走nat)的方式换成egress ip出去。
 7 | 
 8 | 
 9 | https://docs.openshift.com/container-platform/4.1/networking/openshift_sdn/assigning-egress-ips.html
10 | 使用egress IP为项目分配一个固定出口IP
11 | $ oc patch netnamespace project1 --type=merge -p \
12 |   '{"egressIPs": ["192.168.1.100"]}'
13 | 
14 | 指定了egress ip后，需要指定这些IP可以从哪个节点出去：
15 | oc patch hostsubnet worker-0 --type=merge -p \ '{"egressIPs": ["192.168.1.100", "192.168.1.101", "192.168.1.102"]}'
16 | 
17 | 也可以给节点直接分配Egress IP所在的网段，这样随着Egress IP的增加，也不用频繁修改节点的配置了。
18 | $ oc patch hostsubnet worker-0 --type=merge -p \
19 |   '{"egressCIDRs": ["192.168.1.0/24"]}'
20 | 
21 | 
22 | 删除namespace的Egress IP
23 |  oc patch --type=merge netnamespace project1 -p '{"egressIPs":[]}'     
24 |  删除节点的hostsubnet
25 |  oc patch --type=merge hostsubnet worker-0 -p '{"egressCIDRs":[]}'
26 | 


--------------------------------------------------------------------------------
/Chapter2/OpenShift router支持tcp的实现.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter2/OpenShift router支持tcp的实现.pdf


--------------------------------------------------------------------------------
/Chapter2/ocs外置存储方式.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter2/ocs外置存储方式.pdf


--------------------------------------------------------------------------------
/Chapter2/可配置优先级列表:
--------------------------------------------------------------------------------
  1 | CONFIGURABLE PRIORITIES
  2 | You can configure these priorities in the scheduler policy Configmap, in the openshift-config project, to add labels to affect how the priorities.
  3 | 
  4 | The type of the priority function is identified by the argument that they take. Since these are configurable, multiple priorities of the same type (but different configuration parameters) can be combined as long as their user-defined names are different.
  5 | 
  6 | For information on using these priorities, see Modifying Scheduler Policy.
  7 | 
  8 | ServiceAntiAffinity takes a label and ensures a good spread of the pods belonging to the same service across the group of nodes based on the label values. It gives the same score to all nodes that have the same value for the specified label. It gives a higher score to nodes within a group with the least concentration of pods.
  9 | 
 10 | 
 11 | {
 12 | "kind": "Policy",
 13 | "apiVersion": "v1",
 14 | 
 15 | "priorities":[
 16 |     {
 17 |         "name":"<name>", 
 18 |         "weight" : 1 
 19 |         "argument":{
 20 |             "serviceAntiAffinity":{
 21 |                 "label": "<label>" 
 22 |                 }
 23 |            }
 24 |        }
 25 |    ]
 26 | }
 27 | Specify a name for the priority.
 28 | Specify a weight. Enter a non-zero positive value.
 29 | Specify a label to match.
 30 | For example:
 31 | 
 32 | 
 33 | {
 34 | "kind": "Policy",
 35 | "apiVersion": "v1",
 36 | "priorities": [
 37 |     {
 38 |         "name":"RackSpread",
 39 |         "weight" : 1,
 40 |         "argument": {
 41 |             "serviceAntiAffinity": {
 42 |                 "label": "rack"
 43 |                 }
 44 |            }
 45 |        }
 46 |    ]
 47 | }
 48 | In some situations using ServiceAntiAffinity based on custom labels does not spread pod as expected. See this Red Hat Solution.
 49 | 
 50 | *The labelPreference parameter gives priority based on the specified label. If the label is present on a node, that node is given priority. If no label is specified, priority is given to nodes that do not have a label.
 51 | 
 52 | 
 53 | {
 54 | "kind": "Policy",
 55 | "apiVersion": "v1",
 56 | "priorities":[
 57 |     {
 58 |         "name":"<name>", 
 59 |         "weight" : 1 
 60 |         "argument":{
 61 |             "labelPreference":{
 62 |                 "label": "<label>", 
 63 |                 "presence": true 
 64 |                 }
 65 |             }
 66 |         }
 67 |     ]
 68 | }
 69 | Specify a name for the priority.
 70 | Specify a weight. Enter a non-zero positive value.
 71 | Specify a label to match.
 72 | Specify whether the label is required, either true or false.
 73 | Sample Policy Configurations
 74 | The configuration below specifies the default scheduler configuration, if it were to be specified using the scheduler policy file.
 75 | 
 76 | 
 77 | {
 78 | "kind": "Policy",
 79 | "apiVersion": "v1",
 80 | "predicates": [
 81 |     {
 82 |         "name": "RegionZoneAffinity", 
 83 |         "argument": {
 84 |             "serviceAffinity": {  
 85 |               "labels": ["region, zone"]  
 86 |            }
 87 |         }
 88 |      }
 89 |   ],
 90 | "priorities": [
 91 |     {
 92 |         "name":"RackSpread", 
 93 |         "weight" : 1,
 94 |         "argument": {
 95 |             "serviceAntiAffinity": {  
 96 |                 "label": "rack"  
 97 |                 }
 98 |            }
 99 |        }
100 |    ]
101 | }
102 | The name for the predicate.
103 | The type of predicate.
104 | The labels for the predicate.
105 | The name for the priority.
106 | The type of priority.
107 | The labels for the priority.
108 | In all of the sample configurations below, the list of predicates and priority functions is truncated to include only the ones that pertain to the use case specified. In practice, a complete/meaningful scheduler policy should include most, if not all, of the default predicates and priorities listed above.
109 | 
110 | The following example defines three topological levels, region (affinity) → zone (affinity) → rack (anti-affinity):
111 | 
112 | 
113 | {
114 | "kind": "Policy",
115 | "apiVersion": "v1",
116 | "predicates": [
117 |     {
118 |         "name": "RegionZoneAffinity",
119 |         "argument": {
120 |             "serviceAffinity": {
121 |               "labels": ["region, zone"]
122 |            }
123 |         }
124 |      }
125 |   ],
126 | "priorities": [
127 |     {
128 |         "name":"RackSpread",
129 |         "weight" : 1,
130 |         "argument": {
131 |             "serviceAntiAffinity": {
132 |                 "label": "rack"
133 |                 }
134 |            }
135 |        }
136 |    ]
137 | }
138 | The following example defines three topological levels, city (affinity) → building (anti-affinity) → room (anti-affinity):
139 | 
140 | 
141 | {
142 | "kind": "Policy",
143 | "apiVersion": "v1",
144 | "predicates": [
145 |     {
146 |         "name": "CityAffinity",
147 |         "argument": {
148 |             "serviceAffinity": {
149 |               "label": "city"
150 |            }
151 |         }
152 |      }
153 |   ],
154 | "priorities": [
155 |     {
156 |         "name":"BuildingSpread",
157 |         "weight" : 1,
158 |         "argument": {
159 |             "serviceAntiAffinity": {
160 |                 "label": "building"
161 |                 }
162 |            }
163 |        },
164 |     {
165 |         "name":"RoomSpread",
166 |         "weight" : 1,
167 |         "argument": {
168 |             "serviceAntiAffinity": {
169 |                 "label": "room"
170 |                 }
171 |            }
172 |        }
173 |    ]
174 | }
175 | The following example defines a policy to only use nodes with the 'region' label defined and prefer nodes with the 'zone' label defined:
176 | 
177 | 
178 | {
179 | "kind": "Policy",
180 | "apiVersion": "v1",
181 | "predicates": [
182 |     {
183 |         "name": "RequireRegion",
184 |         "argument": {
185 |             "labelPreference": {
186 |                 "labels": ["region"],
187 |                 "presence": true
188 |            }
189 |         }
190 |      }
191 |   ],
192 | "priorities": [
193 |     {
194 |         "name":"ZonePreferred",
195 |         "weight" : 1,
196 |         "argument": {
197 |             "labelPreference": {
198 |                 "label": "zone",
199 |                 "presence": true
200 |                 }
201 |            }
202 |        }
203 |    ]
204 | }
205 | The following example combines both static and configurable predicates and also priorities:
206 | 
207 | 
208 | {
209 | "kind": "Policy",
210 | "apiVersion": "v1",
211 | "predicates": [
212 |     {
213 |         "name": "RegionAffinity",
214 |         "argument": {
215 |             "serviceAffinity": {
216 |                 "labels": ["region"]
217 |            }
218 |         }
219 |      },
220 |     {
221 |         "name": "RequireRegion",
222 |         "argument": {
223 |             "labelsPresence": {
224 |                 "labels": ["region"],
225 |                 "presence": true
226 |            }
227 |         }
228 |      },
229 |     {
230 |         "name": "BuildingNodesAvoid",
231 |         "argument": {
232 |             "labelsPresence": {
233 |                 "label": "building",
234 |                 "presence": false
235 |            }
236 |         }
237 |      },
238 |      {"name" : "PodFitsPorts"},
239 |      {"name" : "MatchNodeSelector"}
240 |      ],
241 | "priorities": [
242 |     {
243 |         "name": "ZoneSpread",
244 |         "weight" : 2,
245 |         "argument": {
246 |             "serviceAntiAffinity":{
247 |                 "label": "zone"
248 |                 }
249 |            }
250 |        },
251 |     {
252 |         "name":"ZonePreferred",
253 |         "weight" : 1,
254 |         "argument": {
255 |             "labelPreference":{
256 |                 "label": "zone",
257 |                 "presence": true
258 |                 }
259 |            }
260 |        },
261 |     {"name" : "ServiceSpreadingPriority", "weight" : 1}
262 |     ]
263 | }
264 | 


--------------------------------------------------------------------------------
/Chapter2/默认静态Predicates:
--------------------------------------------------------------------------------
 1 | STATIC PREDICATES
 2 | These predicates do not take any configuration parameters or inputs from the user. These are specified in the scheduler configuration using their exact name.
 3 | 
 4 | Default Predicates
 5 | The default scheduler policy includes the following predicates:
 6 | 
 7 | NoVolumeZoneConflict checks that the volumes a pod requests are available in the zone.
 8 | 
 9 | 
10 | {"name" : "NoVolumeZoneConflict"}
11 | MaxEBSVolumeCount checks the maximum number of volumes that can be attached to an AWS instance.
12 | 
13 | 
14 | {"name" : "MaxEBSVolumeCount"}
15 | MaxAzureDiskVolumeCount checks the maximum number of Azure Disk Volumes.
16 | 
17 | 
18 | {"name" : "MaxAzureDiskVolumeCount"}
19 | PodToleratesNodeTaints checks if a pod can tolerate the node taints.
20 | 
21 | 
22 | {"name" : "PodToleratesNodeTaints"}
23 | CheckNodeUnschedulable checks if a pod can be scheduled on a node with Unschedulable spec.
24 | 
25 | 
26 | {"name" : "CheckNodeUnschedulable"}
27 | CheckVolumeBinding evaluates if a pod can fit based on the volumes, it requests, for both bound and unbound PVCs. * For PVCs that are bound, the predicate checks that the corresponding PV’s node affinity is satisfied by the given node. * For PVCs that are unbound, the predicate searched for available PVs that can satisfy the PVC requirements and that the PV node affinity is satisfied by the given node.
28 | 
29 | The predicate returns true if all bound PVCs have compatible PVs with the node, and if all unbound PVCs can be matched with an available and node-compatible PV.
30 | 
31 | 
32 | {"name" : "CheckVolumeBinding"}
33 | NoDiskConflict checks if the volume requested by a pod is available.
34 | 
35 | 
36 | {"name" : "NoDiskConflict"}
37 | MaxGCEPDVolumeCount checks the maximum number of Google Compute Engine (GCE) Persistent Disks (PD).
38 | 
39 | 
40 | {"name" : "MaxGCEPDVolumeCount"}
41 | MaxCSIVolumeCountPred
42 | 
43 | MatchInterPodAffinity checks if the pod affinity/anti-affinity rules permit the pod.
44 | 
45 | 
46 | {"name" : "MatchInterPodAffinity"}
47 | Other Static Predicates
48 | OpenShift Container Platform also supports the following predicates:
49 | 
50 | The CheckNode-* predicates cannot be used if the Taint Nodes By Condition feature is enabled. The Taint Nodes By Condition feature is enabled by default.
51 | 
52 | CheckNodeCondition checks if a pod can be scheduled on a node reporting out of disk, network unavailable, or not ready conditions.
53 | 
54 | 
55 | {"name" : "CheckNodeCondition"}
56 | CheckNodeLabelPresence checks if all of the specified labels exist on a node, regardless of their value.
57 | 
58 | 
59 | {"name" : "CheckNodeLabelPresence"}
60 | checkServiceAffinity checks that ServiceAffinity labels are homogeneous for pods that are scheduled on a node.
61 | 
62 | 
63 | {"name" : "checkServiceAffinity"}
64 | PodToleratesNodeNoExecuteTaints checks if a pod tolerations can tolerate a node NoExecute taints.
65 | 
66 | 
67 | {"name" : "PodToleratesNodeNoExecuteTaints"}
68 | 


--------------------------------------------------------------------------------
/Chapter2/默认静态优先级策略:
--------------------------------------------------------------------------------
 1 | STATIC PRIORITIES
 2 | Static priorities do not take any configuration parameters from the user, except weight. A weight is required to be specified and cannot be 0 or negative.
 3 | 
 4 | These are specified in the scheduler policy Configmap in the openshift-config project.
 5 | 
 6 | Default Priorities
 7 | The default scheduler policy includes the following priorities. Each of the priority function has a weight of 1 except NodePreferAvoidPodsPriority, which has a weight of 10000.
 8 | 
 9 | NodeAffinityPriority prioritizes nodes according to node affinity scheduling preferences
10 | 
11 | 
12 | {"name" : "NodeAffinityPriority", "weight" : 1}
13 | TaintTolerationPriority prioritizes nodes that have a fewer number of intolerable taints on them for a pod. An intolerable taint is one which has key PreferNoSchedule.
14 | 
15 | 
16 | {"name" : "TaintTolerationPriority", "weight" : 1}
17 | ImageLocalityPriority prioritizes nodes that already have requested pod container’s images.
18 | 
19 | 
20 | {"name" : "ImageLocalityPriority", "weight" : 1}
21 | SelectorSpreadPriority looks for services, replication controllers (RC), replication sets (RS), and stateful sets that match the pod, then finds existing pods that match those selectors. The scheduler favors nodes that have fewer existing matching pods. Then, it schedules the pod on a node with the smallest number of pods that match those selectors as the pod being scheduled.
22 | 
23 | 
24 | {"name" : "SelectorSpreadPriority", "weight" : 1}
25 | InterPodAffinityPriority computes a sum by iterating through the elements of weightedPodAffinityTerm and adding weight to the sum if the corresponding PodAffinityTerm is satisfied for that node. The node(s) with the highest sum are the most preferred.
26 | 
27 | 
28 | {"name" : "InterPodAffinityPriority", "weight" : 1}
29 | LeastRequestedPriority favors nodes with fewer requested resources. It calculates the percentage of memory and CPU requested by pods scheduled on the node, and prioritizes nodes that have the highest available/remaining capacity.
30 | 
31 | 
32 | {"name" : "LeastRequestedPriority", "weight" : 1}
33 | BalancedResourceAllocation favors nodes with balanced resource usage rate. It calculates the difference between the consumed CPU and memory as a fraction of capacity, and prioritizes the nodes based on how close the two metrics are to each other. This should always be used together with LeastRequestedPriority.
34 | 
35 | 
36 | {"name" : "BalancedResourceAllocation", "weight" : 1}
37 | NodePreferAvoidPodsPriority ignores pods that are owned by a controller other than a replication controller.
38 | 
39 | 
40 | {"name" : "NodePreferAvoidPodsPriority", "weight" : 10000}
41 | 
42 | 
43 | Other Static Priorities
44 | OpenShift Container Platform also supports the following priorities:
45 | 
46 | EqualPriority gives an equal weight of 1 to all nodes, if no priority configurations are provided. We recommend using this priority only for testing environments.
47 | 
48 | 
49 | {"name" : "EqualPriority", "weight" : 1}
50 | MostRequestedPriority prioritizes nodes with most requested resources. It calculates the percentage of memory and CPU requested by pods scheduled on the node, and prioritizes based on the maximum of the average of the fraction of requested to capacity.
51 | 
52 | 
53 | {"name" : "MostRequestedPriority", "weight" : 1}
54 | ServiceSpreadingPriority spreads pods by minimizing the number of pods belonging to the same service onto the same machine.
55 | 
56 | 
57 | {"name" : "ServiceSpreadingPriority", "weight" : 1}
58 | 


--------------------------------------------------------------------------------
/Chapter3/3Xcontainer-registries:
--------------------------------------------------------------------------------
 1 | 
 2 | # cat <<EOF > 99-master-container-registries.yaml
 3 | apiVersion: machineconfiguration.openshift.io/v1
 4 | kind: MachineConfig
 5 | metadata:
 6 |   annotations:
 7 |   labels:
 8 |     machineconfiguration.openshift.io/role: master
 9 |   name: 99-master-container-registry-conf
10 | spec:
11 |   config:
12 |     ignition:
13 |       version: 2.2.0
14 |     storage:
15 |       files:
16 |       - contents:
17 |           source: data:text/plain;charset=utf-8;base64,${REG_CONF_BASE64}
18 |           verification: {}
19 |         filesystem: root
20 |         mode: 420
21 |         path: /etc/containers/registries.conf
22 | EOF
23 | 
24 | 
25 | 
26 | 
27 | cat <<EOF > 99-app-container-registries.yaml
28 | apiVersion: machineconfiguration.openshift.io/v1
29 | kind: MachineConfig
30 | metadata:
31 |   annotations:
32 |   labels:
33 |     machineconfiguration.openshift.io/role: app
34 |   name: 99-worker-container-registry-conf
35 | spec:
36 |   config:
37 |     ignition:
38 |       version: 2.2.0
39 |     storage:
40 |       files:
41 |       - contents:
42 |           source: data:text/plain;charset=utf-8;base64,${REG_CONF_BASE64}
43 |           verification: {}
44 |         filesystem: root
45 |         mode: 420
46 |         path: /etc/containers/registries.conf
47 | EOF
48 | 
49 | 
50 | 
51 | 
52 | 
53 | cat <<EOF > 99-infra-container-registries.yaml
54 | apiVersion: machineconfiguration.openshift.io/v1
55 | kind: MachineConfig
56 | metadata:
57 |   annotations:
58 |   labels:
59 |     machineconfiguration.openshift.io/role: infra
60 |   name: 99-infra-container-registry-conf
61 | spec:
62 |   config:
63 |     ignition:
64 |       version: 2.2.0
65 |     storage:
66 |       files:
67 |       - contents:
68 |           source: data:text/plain;charset=utf-8;base64,${REG_CONF_BASE64}
69 |           verification: {}
70 |         filesystem: root
71 |         mode: 420
72 |         path: /etc/containers/registries.conf
73 | EOF
74 | 


--------------------------------------------------------------------------------
/Chapter3/Image Registry增加持久化存储.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter3/Image Registry增加持久化存储.pdf


--------------------------------------------------------------------------------
/Chapter3/Kibana安装后的配置.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter3/Kibana安装后的配置.pdf


--------------------------------------------------------------------------------
/Chapter3/OpenShift3.11安装.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter3/OpenShift3.11安装.pdf


--------------------------------------------------------------------------------
/Chapter3/create_pv.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | # -------参数说明
 3 | # SERVER：设置NFS Server的主机名或IP地址
 4 | # COUNT：创建PV的数量
 5 | # PV_CAPACITY：PV的容量大小
 6 | # PV_ACCESS_MODE: PV访问模式,支持ReadWriteOnce、ReadWriteMany、ReadOnlyMany
 7 | # STORAGE_CLASS_NAME: StorageClass名称
 8 | 
 9 | SERVER=xxx.xxx.xxx.xxx
10 | COUNT=100
11 | PV_CAPACITY=5Gi
12 | PV_ACCESS_MODE=ReadWriteOnce
13 | STORAGE_CLASS_NAME=standard
14 | 
15 | 
16 | for i in $(seq 1 $COUNT); do
17 |   PV=$(cat <<EOF
18 | apiVersion: v1
19 | kind: PersistentVolume
20 | metadata:
21 |   name: pv$(printf %04d $i)
22 | spec:
23 |   storageClassName: $STORAGE_CLASS_NAME
24 |   capacity:
25 |     storage: $PV_CAPACITY
26 |   accessModes:
27 |     - $PV_ACCESS_MODE
28 |   persistentVolumeReclaimPolicy: Recycle
29 |   nfs:
30 |     server: $SERVER
31 |     path: /exports/pv$(printf %04d $i)  #后端NFS Server创建相应的目录和配置权限
32 |   EOF
33 | )
34 | 
35 |   echo "$PV" | oc create -f -
36 | done
37 | 


--------------------------------------------------------------------------------
/Chapter3/dockerfile:
--------------------------------------------------------------------------------
 1 | FROM registry.access.redhat.com/rhel7/rhel 
 2 | # Generic labels
 3 | LABEL Component="httpd" \ 
 4 |       Name="david/httpd-parent" \
 5 |       Version="1.0" \
 6 |       Release="1"
 7 | # Labels consumed by OpenShift
 8 | LABEL io.k8s.description="A basic Apache HTTP Server image with ONBUILD instructions" \ 
 9 |       io.k8s.display-name="Apache HTTP Server parent image" \
10 |       io.openshift.expose-services="80:http" \
11 |       io.openshift.tags="apache, httpd"
12 | # DocumentRoot for Apache
13 | ENV DOCROOT=/var/www/html \
14 |     LANG=en_US \
15 |     LOG_PATH=/var/log/httpd
16 | RUN   yum install -y --setopt=tsflags=nodocs --noplugins httpd && \ 
17 |       yum clean all --noplugins -y && \
18 | # Allows child images to inject their own content into DocumentRoot
19 | ONBUILD COPY src/ ${DOCROOT}/ 
20 | EXPOSE 80
21 | # This stuff is needed to ensure a clean start
22 | RUN rm -rf /run/httpd && mkdir /run/httpd
23 | # Run as the root user
24 | USER root
25 | # Launch apache daemon
26 | CMD /usr/sbin/apachectl -DFOREGROUND 
27 | 


--------------------------------------------------------------------------------
/Chapter3/haproxy.cfg:
--------------------------------------------------------------------------------
 1 | # Global settings
 2 | #---------------------------------------------------------------------
 3 | global
 4 |     maxconn     20000
 5 |     log         /dev/log local0 info
 6 |     chroot      /var/lib/haproxy
 7 |     pidfile     /var/run/haproxy.pid
 8 |     user        haproxy
 9 |     group       haproxy
10 |     daemon
11 | 
12 |     # turn on stats unix socket
13 |     stats socket /var/lib/haproxy/stats
14 | 
15 | #---------------------------------------------------------------------
16 | # common defaults that all the 'listen' and 'backend' sections will
17 | # use if not designated in their block
18 | #---------------------------------------------------------------------
19 | defaults
20 |     mode                    http
21 |     log                     global
22 |     option                  httplog
23 |     option                  dontlognull
24 | #    option http-server-close
25 |     option forwardfor       except 127.0.0.0/8
26 |     option                  redispatch
27 |     retries                 3
28 |     timeout http-request    10s
29 |     timeout queue           1m
30 |     timeout connect         10s
31 |     timeout client          300s
32 |     timeout server          300s
33 |     timeout http-keep-alive 10s
34 |     timeout check           10s
35 |     maxconn                 20000
36 | listen stats
37 |     bind :9000
38 |     mode http
39 |     stats enable
40 |     stats uri /
41 | 
42 | # all frontend
43 | frontend  router-http-traffic
44 |     bind *:80
45 |     default_backend router-http-traffic
46 |     mode tcp
47 |     option tcplog
48 | 
49 | frontend  router-https-traffic
50 |     bind *:443
51 |     default_backend router-https-traffic
52 |     mode tcp
53 |     option tcplog
54 | 
55 | frontend  k8s-api-server
56 |     bind *:6443
57 |     default_backend k8s-api-server
58 |     mode tcp
59 |     option tcplog
60 | 
61 | frontend  machine-config-server
62 |     bind *:22623
63 |     default_backend machine-config-server
64 |     mode tcp
65 |     option tcplog
66 | 
67 | # all backend
68 | backend router-http-traffic
69 |     balance source
70 |     mode tcp
71 |     server      worker01.ocp4.example.com 28.4.184.105:80 check
72 |     server      worker02.ocp4.example.com 28.4.184.106:80 check
73 |     server      worker03.ocp4.example.com 28.4.184.107:80 check
74 | 
75 | backend router-https-traffic
76 |     balance source
77 |     mode tcp
78 |     server      worker01.ocp4.example.com 28.4.184.105:443 check
79 |     server      worker02.ocp4.example.com 28.4.184.106:443 check
80 |     server      worker03.ocp4.example.com 28.4.184.107:443 check
81 | 
82 | backend k8s-api-server
83 |     balance source
84 |     mode tcp
85 |     server      bootstrap.ocp4.example.com 28.4.184.100:6443 check
86 |     server      master01.ocp4.example.com 28.4.184.101:6443 check
87 |     server      master02.ocp4.example.com 28.4.184.102:6443 check
88 |     server      master03.ocp4.example.com 28.4.184.103:6443 check
89 | 
90 | backend machine-config-server
91 |     balance source
92 |     mode tcp
93 |     server      bootstrap.ocp4.example.com 28.4.184.100:22623 check
94 |     server      master01.ocp4.example.com 28.4.184.101:22623 check
95 |     server      master02.ocp4.example.com 28.4.184.102:22623 check
96 |     server      master03.ocp4.example.com 28.4.184.103:22623 check
97 | 


--------------------------------------------------------------------------------
/Chapter3/sample-registres.conf:
--------------------------------------------------------------------------------
 1 | # cat sample-registres.conf 
 2 | unqualified-search-registries = ["docker.io"]
 3 | 
 4 | [[registry]]
 5 |   location = "quay.io/openshift-release-dev/ocp-release"
 6 |   insecure = false
 7 |   blocked = false
 8 |   mirror-by-digest-only = false
 9 |   prefix = ""
10 | 
11 |   [[registry.mirror]]
12 |     location = "repo.apps.weixinyucluster.bluecat.ltd:5000/ocp4/openshift4"
13 |     insecure = true
14 | 
15 | [[registry]]
16 |   location = "quay.io/openshift-release-dev/ocp-v4.0-art-dev"
17 |   insecure = false
18 |   blocked = false
19 |   mirror-by-digest-only = false
20 |   prefix = ""
21 | 
22 |   [[registry.mirror]]
23 |     location = "repo.apps.weixinyucluster.bluecat.ltd:5000/ocp4/openshift4"
24 |     insecure = true
25 | 
26 | [[registry]]
27 |   location = "registry.redhat.io/distributed-tracing"
28 |   insecure = false
29 |   blocked = false
30 |   mirror-by-digest-only = false
31 |   prefix = ""
32 | 
33 |   [[registry.mirror]]
34 |     location = "repo.apps.weixinyucluster.bluecat.ltd:5000/distributed-tracing"
35 |     insecure = true
36 | 
37 | [[registry]]
38 |   location = "registry.redhat.io/openshift-service-mesh"
39 |   insecure = false
40 |   blocked = false
41 |   mirror-by-digest-only = false
42 |   prefix = ""
43 | 
44 |   [[registry.mirror]]
45 |     location = "repo.apps.weixinyucluster.bluecat.ltd:5000/openshift-service-mesh"
46 |     insecure = true
47 | 
48 | [[registry]]
49 |   location = "registry.redhat.io/openshift4"
50 |   insecure = true
51 |   blocked = false
52 |   mirror-by-digest-only = false
53 |   prefix = ""
54 | 
55 |   [[registry.mirror]]
56 |     location = "repo.apps.weixinyucluster.bluecat.ltd:5000/openshift4"
57 |     insecure = true
58 | 


--------------------------------------------------------------------------------
/Chapter3/自定义Prometheus规则并触发邮件告警.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter3/自定义Prometheus规则并触发邮件告警.pdf


--------------------------------------------------------------------------------
/Chapter4/OpenShift API的调用.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter4/OpenShift API的调用.pdf


--------------------------------------------------------------------------------
/Chapter4/OpenShift中的Deployment 和DeploymentConfig.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter4/OpenShift中的Deployment 和DeploymentConfig.pdf


--------------------------------------------------------------------------------
/Chapter4/README:
--------------------------------------------------------------------------------
1 | 
2 | 


--------------------------------------------------------------------------------
/Chapter4/基于Fabric8在OpenShift上发布应用.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter4/基于Fabric8在OpenShift上发布应用.pdf


--------------------------------------------------------------------------------
/Chapter5/1.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | chain_pem="${1}"
 4 | 
 5 | if [[ ! -f "${chain_pem}" ]]; then
 6 |     echo "Usage: $0 BASE64_CERTIFICATE_CHAIN_FILE" >&2
 7 |     exit 1
 8 | fi
 9 | 
10 | if ! openssl x509 -in "${chain_pem}" -noout 2>/dev/null ; then
11 |     echo "${chain_pem} is not a certificate" >&2
12 |     exit 1
13 | fi
14 | 
15 | awk -F'\n' '
16 |         BEGIN {
17 |             showcert = "openssl x509 -noout -subject -issuer -startdate -enddate && echo ''"
18 |         }
19 | 
20 |         /-----BEGIN CERTIFICATE-----/ {
21 |             printf "%2d: ", ind
22 |         }
23 | 
24 |         {
25 |             printf $0"\n" | showcert
26 |         }
27 | 
28 |         /-----END CERTIFICATE-----/ {
29 |             close(showcert)
30 |             ind ++
31 |         }
32 |     ' "${chain_pem}"
33 | 
34 | 


--------------------------------------------------------------------------------
/Chapter5/CR of node-tuning-operator:
--------------------------------------------------------------------------------
  1 | [root@lb.weixinyucluster ~]#  oc get Tuned/rendered  -o yaml
  2 | apiVersion: tuned.openshift.io/v1
  3 | kind: Tuned
  4 | metadata:
  5 |   creationTimestamp: "2020-06-19T16:35:22Z"
  6 |   generation: 1
  7 |   name: rendered
  8 |   namespace: openshift-cluster-node-tuning-operator
  9 |   ownerReferences:
 10 |   - apiVersion: tuned.openshift.io/v1
 11 |     blockOwnerDeletion: true
 12 |     controller: true
 13 |     kind: Tuned
 14 |     name: default
 15 |     uid: bde14d5d-84e3-43d8-b903-26c5011667e5
 16 |   resourceVersion: "75561"
 17 |   selfLink: /apis/tuned.openshift.io/v1/namespaces/openshift-cluster-node-tuning-operator/tuneds/rendered
 18 |   uid: a097193d-0405-4cd7-bcea-b234d3f4895a
 19 | spec:
 20 |   profile:
 21 |   - data: |
 22 |       [main]
 23 |       summary=Optimize systems running OpenShift (parent profile)
 24 |       include=${f:virt_check:virtual-guest:throughput-performance}
 25 | 
 26 |       [selinux]
 27 |       avc_cache_threshold=8192
 28 | 
 29 |       [net]
 30 |       nf_conntrack_hashsize=131072
 31 | 
 32 |       [sysctl]
 33 |       net.ipv4.ip_forward=1
 34 |       kernel.pid_max=>4194304
 35 |       net.netfilter.nf_conntrack_max=1048576
 36 |       net.ipv4.conf.all.arp_announce=2
 37 |       net.ipv4.neigh.default.gc_thresh1=8192
 38 |       net.ipv4.neigh.default.gc_thresh2=32768
 39 |       net.ipv4.neigh.default.gc_thresh3=65536
 40 |       net.ipv6.neigh.default.gc_thresh1=8192
 41 |       net.ipv6.neigh.default.gc_thresh2=32768
 42 |       net.ipv6.neigh.default.gc_thresh3=65536
 43 |       vm.max_map_count=262144
 44 | 
 45 |       [sysfs]
 46 |       /sys/module/nvme_core/parameters/io_timeout=4294967295
 47 |       /sys/module/nvme_core/parameters/max_retries=10
 48 |     name: openshift
 49 |   - data: |
 50 |       [main]
 51 |       summary=Optimize systems running OpenShift control plane
 52 |       include=openshift
 53 | 
 54 |       [sysctl]
 55 |       # ktune sysctl settings, maximizing i/o throughput
 56 |       #
 57 |       # Minimal preemption granularity for CPU-bound tasks:
 58 |       # (default: 1 msec#  (1 + ilog(ncpus)), units: nanoseconds)
 59 |       kernel.sched_min_granularity_ns=10000000
 60 |       # The total time the scheduler will consider a migrated process
 61 |       # "cache hot" and thus less likely to be re-migrated
 62 |       # (system default is 500000, i.e. 0.5 ms)
 63 |       kernel.sched_migration_cost_ns=5000000
 64 |       # SCHED_OTHER wake-up granularity.
 65 |       #
 66 |       # Preemption granularity when tasks wake up.  Lower the value to
 67 |       # improve wake-up latency and throughput for latency critical tasks.
 68 |       kernel.sched_wakeup_granularity_ns=4000000
 69 |     name: openshift-control-plane
 70 |   - data: |
 71 |       [main]
 72 |       summary=Optimize systems running OpenShift nodes
 73 |       include=openshift
 74 | 
 75 |       [sysctl]
 76 |       net.ipv4.tcp_fastopen=3
 77 |       fs.inotify.max_user_watches=65536
 78 |       fs.inotify.max_user_instances=8192
 79 |     name: openshift-node
 80 |   recommend: []
 81 | status: {}
 82 | [root@lb.weixinyucluster ~]#
 83 | 
 84 | 
 85 | 
 86 | 
 87 | 
 88 | 
 89 | 
 90 | 
 91 | [root@lb.weixinyucluster ~]# oc get tuned rendered -o yaml
 92 | apiVersion: tuned.openshift.io/v1
 93 | kind: Tuned
 94 | metadata:
 95 |   creationTimestamp: "2020-06-19T16:35:22Z"
 96 |   generation: 1
 97 |   name: rendered
 98 |   namespace: openshift-cluster-node-tuning-operator
 99 |   ownerReferences:
100 |   - apiVersion: tuned.openshift.io/v1
101 |     blockOwnerDeletion: true
102 |     controller: true
103 |     kind: Tuned
104 |     name: default
105 |     uid: bde14d5d-84e3-43d8-b903-26c5011667e5
106 |   resourceVersion: "75561"
107 |   selfLink: /apis/tuned.openshift.io/v1/namespaces/openshift-cluster-node-tuning-operator/tuneds/rendered
108 |   uid: a097193d-0405-4cd7-bcea-b234d3f4895a
109 | spec:
110 |   profile:
111 |   - data: |
112 |       [main]
113 |       summary=Optimize systems running OpenShift (parent profile)
114 |       include=${f:virt_check:virtual-guest:throughput-performance}
115 | 
116 |       [selinux]
117 |       avc_cache_threshold=8192
118 | 
119 |       [net]
120 |       nf_conntrack_hashsize=131072
121 | 
122 |       [sysctl]
123 |       net.ipv4.ip_forward=1
124 |       kernel.pid_max=>4194304
125 |       net.netfilter.nf_conntrack_max=1048576
126 |       net.ipv4.conf.all.arp_announce=2
127 |       net.ipv4.neigh.default.gc_thresh1=8192
128 |       net.ipv4.neigh.default.gc_thresh2=32768
129 |       net.ipv4.neigh.default.gc_thresh3=65536
130 |       net.ipv6.neigh.default.gc_thresh1=8192
131 |       net.ipv6.neigh.default.gc_thresh2=32768
132 |       net.ipv6.neigh.default.gc_thresh3=65536
133 |       vm.max_map_count=262144
134 | 
135 |       [sysfs]
136 |       /sys/module/nvme_core/parameters/io_timeout=4294967295
137 |       /sys/module/nvme_core/parameters/max_retries=10
138 |     name: openshift
139 |   - data: |
140 |       [main]
141 |       summary=Optimize systems running OpenShift control plane
142 |       include=openshift
143 | 
144 |       [sysctl]
145 |       # ktune sysctl settings, maximizing i/o throughput
146 |       #
147 |       # Minimal preemption granularity for CPU-bound tasks:
148 |       # (default: 1 msec#  (1 + ilog(ncpus)), units: nanoseconds)
149 |       kernel.sched_min_granularity_ns=10000000
150 |       # The total time the scheduler will consider a migrated process
151 |       # "cache hot" and thus less likely to be re-migrated
152 |       # (system default is 500000, i.e. 0.5 ms)
153 |       kernel.sched_migration_cost_ns=5000000
154 |       # SCHED_OTHER wake-up granularity.
155 |       #
156 |       # Preemption granularity when tasks wake up.  Lower the value to
157 |       # improve wake-up latency and throughput for latency critical tasks.
158 |       kernel.sched_wakeup_granularity_ns=4000000
159 |     name: openshift-control-plane
160 |   - data: |
161 |       [main]
162 |       summary=Optimize systems running OpenShift nodes
163 |       include=openshift
164 | 
165 |       [sysctl]
166 |       net.ipv4.tcp_fastopen=3
167 |       fs.inotify.max_user_watches=65536
168 |       fs.inotify.max_user_instances=8192
169 |     name: openshift-node
170 |   recommend: []
171 | status: {}
172 | 
173 | 


--------------------------------------------------------------------------------
/Chapter5/OCP3备份脚本.txt:
--------------------------------------------------------------------------------
 1 | 
 2 | 备份namespace的命令，以myproject为例。
 3 | # PROJECR=myproject
 4 | # oc get --export -o=json ns/${PROJECR} | jq '
 5 |     del(.status,
 6 |       .metadata.uid,
 7 |       .metadata.selfLink,
 8 |       .metadata.resourceVersion,
 9 |       .metadata.creationTimestamp,
10 |       .metadata.generation
11 |       )' > ${PROJECR}-ns.json
12 |       
13 |       
14 | 备份deploymentconfig的命令，以myproject为例。
15 | # PROJECT=myproject
16 | # DCS=$(oc get dc -n ${PROJECT} -o jsonpath="{.items[*].metadata.name}")
17 | # for dc in ${DCS}; do
18 |     oc get --export -o=json dc ${dc} -n ${PROJECT} | jq '
19 |       del(.status,
20 |           .metadata.uid,
21 |           .metadata.selfLink,
22 |           .metadata.resourceVersion,
23 |           .metadata.creationTimestamp,
24 |           .metadata.generation,
25 |           .spec.triggers[].imageChangeParams.lastTriggeredImage
26 |           )' > ${PROJECT}/dc_${dc}.json 
27 | if [ !$(cat ${PROJECT}/dc_${dc}.json | jq '.spec.triggers[].type' | grep -q "ImageChange") ]; then
28 |         sed -e 's#"image".*#"image": " ",#g' ${PROJECT}/dc_${dc}.json >> ${PROJECT}/dc_${dc}_patched.json
29 |         rm -rf ${PROJECT}/dc_${dc}.json
30 |     fi
31 | done
32 | 


--------------------------------------------------------------------------------
/Chapter5/OCP3性能优化.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter5/OCP3性能优化.pdf


--------------------------------------------------------------------------------
/Chapter5/Quarkus：超音速亚原子 Java 体验.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter5/Quarkus：超音速亚原子 Java 体验.pdf


--------------------------------------------------------------------------------
/Chapter5/README:
--------------------------------------------------------------------------------
1 | 
2 | 


--------------------------------------------------------------------------------
/Chapter5/macvlan性能优势说明.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter5/macvlan性能优势说明.pdf


--------------------------------------------------------------------------------
/Chapter5/network performance report/Network Performance.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter5/network performance report/Network Performance.pdf


--------------------------------------------------------------------------------
/Chapter5/network performance report/slides-104-bmwg-considerations-for-benchmarking-network-performance-in-containerized-infrastructures-00 (1).pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter5/network performance report/slides-104-bmwg-considerations-for-benchmarking-network-performance-in-containerized-infrastructures-00 (1).pdf


--------------------------------------------------------------------------------
/Chapter5/openshift-logging/README.md:
--------------------------------------------------------------------------------
1 | # openshift-logging


--------------------------------------------------------------------------------
/Chapter5/openshift-logging/fluentd-configmap/fluent.conf-external-es:
--------------------------------------------------------------------------------
  1 | # This file is the fluentd configuration entrypoint. Edit with care.
  2 | # 关于两个动态配置的生成阅读/opt/app-root/src目录下的脚本。
  3 | #@include configs.d/openshift/system.conf
  4 | <system>
  5 |   log_level warn
  6 | </system>
  7 | 
  8 | # In each section below, pre- and post- includes don't include anything initially;
  9 | # they exist to enable future additions to openshift conf as needed.
 10 | 
 11 | ## sources
 12 | ## ordered so that syslog always runs last...
 13 | #@include configs.d/openshift/input-pre-*.conf
 14 | #暂时删除了prometheus相关的采集，也就是input-pre-prometheus-metrics.conf中的内容
 15 | <source>   #通过journal采集节点操作系统日志和docker配置为--log-driver=journald下的容器日志。
 16 |   @type systemd
 17 |   @id systemd-input
 18 |   @label @INGRESS
 19 |   path "#{ENV['JOURNAL_SOURCE'] || '/run/log/journal'}"
 20 |   pos_file "#{ENV['JOURNAL_POS_FILE'] || '/var/log/journal.pos'}"
 21 |   filters "#{ENV['JOURNAL_FILTERS_JSON'] || '[]'}"
 22 |   tag journal
 23 |   read_from_head "#{ENV['JOURNAL_READ_FROM_HEAD'] || 'false'}"
 24 | </source>
 25 | #@include configs.d/dynamic/input-docker-*.conf
 26 | <source>     #通过/var/log/container采集容器标准输出日志。只有当docker配置为--log-driver=json-file才会从这里采集,默认的--log-driver=journald不会生成此配置。。
 27 |   @type tail
 28 |   @id docker-input
 29 |   @label @INGRESS
 30 |   path "/var/log/containers/*.log"
 31 |   pos_file "/var/log/es-containers.log.pos"
 32 |   time_format %Y-%m-%dT%H:%M:%S.%N%Z
 33 |   tag kubernetes.*
 34 |   format json
 35 |   keep_time_key true
 36 |   read_from_head "true"
 37 |   exclude_path []
 38 |   @label @CONCAT
 39 | </source>
 40 | <label @CONCAT>
 41 |   <filter kubernetes.**>
 42 |     @type concat
 43 |     key log
 44 |     partial_key logtag
 45 |     partial_value P
 46 |   </filter>
 47 |   <match kubernetes.**>
 48 |     @type relabel
 49 |     @label @INGRESS
 50 |   </match>
 51 | </label>
 52 | #@include configs.d/dynamic/input-syslog-*.conf
 53 | #@include configs.d/openshift/input-post-*.conf
 54 | ##
 55 | 
 56 | <label @INGRESS>
 57 | ## filters
 58 | #@include configs.d/openshift/filter-pre-*.conf
 59 | 
 60 | #@include configs.d/openshift/filter-retag-journal.conf
 61 | # journal entries from k8s containers look like this:
 62 | # The stream identification is encoded into the PRIORITY field as an
 63 | # integer: 6, or github.com/coreos/go-systemd/journal.Info, marks stdout,
 64 | # while 3, or github.com/coreos/go-systemd/journal.Err, marks stderr.
 65 | # PRIORITY=6
 66 | # CONTAINER_ID=b6cbb6e73c0a
 67 | # CONTAINER_ID_FULL=b6cbb6e73c0ad63ab820e4baa97cdc77cec729930e38a714826764ac0491341a
 68 | # CONTAINER_NAME=k8s_registry.a49f5318_docker-registry-1-hhoj0_default_ae3a9bdc-1f66-11e6-80a2-fa163e2fff3a_799e4035
 69 | # MESSAGE=172.17.0.1 - - [21/May/2016:16:52:05 +0000] "GET /healthz HTTP/1.1" 200 0 "" "Go-http-client/1.1"
 70 | # or
 71 | # MESSAGE=time="2016-05-21T15:14:17.216966675Z" level=info msg="version=v2.1.0+unknown"
 72 | # docker inspect:
 73 | # "io.kubernetes.container.hash": "a49f5318",
 74 | # "io.kubernetes.container.name": "registry",
 75 | # "io.kubernetes.pod.name": "docker-registry-1-hhoj0",
 76 | # "io.kubernetes.pod.namespace": "default",
 77 | # "io.kubernetes.pod.terminationGracePeriod": "30",
 78 | # "io.kubernetes.pod.uid": "ae3a9bdc-1f66-11e6-80a2-fa163e2fff3a",
 79 | # docker ps:
 80 | # da531d7cea12 172.30.38.242:5000/logging/logging-elasticsearch@sha256:4888a2a3f875555a46d233f9856964a8eaac716259599db0062051ba5647187e   "sh /opt/app-root/src"   About an hour ago   Up About an hour
 81 | # k8s_elasticsearch.8d3af8fd_logging-es-ops-gkfv06wi-1-7y682_logging_9612f891-1f68-11e6-80a2-fa163e2fff3a_d1cc32e1
 82 | # oc get pods -o yaml:
 83 | #      kubernetes.io/created-by: |
 84 | # {"name":"logging-es-ops-gkfv06wi-1","uid":"92d90581-1f68-11e6-80a2-fa163e2fff3a","apiVersion":"v1","resourceVersion":"829"}}
 85 | # openshift.io/deployment-config.name: logging-es-ops-gkfv06wi
 86 | # openshift.io/deployment.name: logging-es-ops-gkfv06wi-1
 87 | # uid: 9612f891-1f68-11e6-80a2-fa163e2fff3a
 88 | # image: 172.30.38.242:5000/logging/logging-elasticsearch@sha256:4888a2a3f875555a46d233f9856964a8eaac716259599db0062051ba5647187e
 89 | # containerStatuses:
 90 | #  - containerID: docker://da531d7cea12bf714f90c26d0fb9f275b02321d1bccd10013f087be33f4e6e5e
 91 | #    image: 172.30.38.242:5000/logging/logging-elasticsearch@sha256:4888a2a3f875555a46d233f9856964a8eaac716259599db0062051ba5647187e
 92 | #    imageID: docker://sha256:d5a02bf63b1f3e0d1aa06bf28928e181f67ab2c80b2a1d1fd1ba310f11c12955
 93 | # another example:
 94 | # CONTAINER_NAME=k8s_bob.94e110c7_bob-iq0d4_default_2d67916a-1eac-11e6-94ba-001c42e13e5d_8b4b7e3d
 95 | # From this, we can extract:
 96 | #    container name in pod: bob
 97 | #    pod name: bob-iq0d4
 98 | #    namespace: default
 99 | #    pod uid: 2d67916a-1eac-11e6-94ba-001c42e13e5d
100 | 
101 | # in addition, there are a few other differences about /var/log/messages and journal messages
102 | # * the default rsyslog.conf on el7 will only log messages to /var/log/messages at INFO level
103 | #   or higher
104 | # * the default rsyslog.d includes 21-cloudinit.conf which redirects all cloud-init messages
105 | #   to /var/log/cloud-init.log
106 | #   When using the journal, we keep the cloud-init messages and store
107 | #   them in elasticsearch.  But we filter out DEBUG messages.
108 | #   We should revisit this at a later date, when we have a good grasp of the storage
109 | #   requirements, so we can turn on this firehose.
110 | 
111 | @include filter-exclude-journal-debug.conf
112 | <match journal>
113 |   @type rewrite_tag_filter
114 |   # skip to @INGRESS label section
115 |   @label @INGRESS
116 |   # see if this is a kibana container for special log handling
117 |   # looks like this:
118 |   # k8s_kibana.a67f366_logging-kibana-1-d90e3_logging_26c51a61-2835-11e6-ad29-fa163e4944d5_f0db49a2
119 |   # we filter these logs through the kibana_transform.conf filter
120 |   rewriterule1 CONTAINER_NAME ^k8s_kibana\. kubernetes.journal.container.kibana
121 |   # mark eventrouter events
122 |   rewriterule2 CONTAINER_NAME ^k8s_[^_]+_logging-eventrouter-[^_]+_ kubernetes.journal.container._default_.kubernetes-event
123 |   # mark logs from default namespace for processing as k8s logs but stored as system logs
124 |   rewriterule3 CONTAINER_NAME ^k8s_[^_]+_[^_]+_default_ kubernetes.journal.container._default_
125 |   # mark logs from kube-* namespaces for processing as k8s logs but stored as system logs
126 |   rewriterule4 CONTAINER_NAME ^k8s_[^_]+_[^_]+_kube-(.+)_ kubernetes.journal.container._kube-$1_
127 |   # mark logs from openshift-* namespaces for processing as k8s logs but stored as system logs
128 |   rewriterule5 CONTAINER_NAME ^k8s_[^_]+_[^_]+_openshift-(.+)_ kubernetes.journal.container._openshift-$1_
129 |   # mark logs from openshift namespace for processing as k8s logs but stored as system logs
130 |   rewriterule6 CONTAINER_NAME ^k8s_[^_]+_[^_]+_openshift_ kubernetes.journal.container._openshift_
131 |   # mark fluentd container logs
132 |   rewriterule7 CONTAINER_NAME ^k8s_.*fluentd kubernetes.journal.container.fluentd
133 |   # this is a kubernetes container
134 |   rewriterule8 CONTAINER_NAME ^k8s_ kubernetes.journal.container
135 |   # not kubernetes - assume a system log or system container log
136 |   rewriterule9 _TRANSPORT .+ journal.system
137 | </match>
138 | 
139 | #@include configs.d/openshift/filter-k8s-meta.conf
140 | <filter kubernetes.**>
141 |   type kubernetes_metadata
142 |   kubernetes_url "#{ENV['K8S_HOST_URL']}"
143 |   cache_size "#{ENV['K8S_METADATA_CACHE_SIZE'] || '1000'}"
144 |   watch "#{ENV['K8S_METADATA_WATCH'] || 'false'}"
145 |   bearer_token_file /var/run/secrets/kubernetes.io/serviceaccount/token
146 |   ca_file /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
147 |   use_journal "#{ENV['USE_JOURNAL'] || 'false'}"
148 |   container_name_to_kubernetes_regexp '^(?<name_prefix>[^_]+)_(?<container_name>[^\._]+)(\.(?<container_hash>[^_]+))?_(?<pod_name>[^_]+)_(?<namespace>[^_]+)_[^_]+_[^_]+$'
149 | </filter>
150 | 
151 | <filter kubernetes.**>
152 |   @type parse_json_field
153 |   merge_json_log "#{ENV['MERGE_JSON_LOG'] || 'false'}"
154 |   preserve_json_log "#{ENV['PRESERVE_JSON_LOG'] || 'true'}"
155 |   json_fields "#{ENV['JSON_FIELDS'] || (ENV['USE_JOURNAL'] == 'true' ? 'MESSAGE,log' : 'log,MESSAGE')}"
156 | </filter>
157 | 
158 | #@include configs.d/openshift/filter-kibana-transform.conf
159 | <filter **kibana**>
160 |   @type record_transformer
161 |   enable_ruby
162 |   <record>
163 |     log ${record['err'] || record['msg'] || record['MESSAGE'] || record['log']}
164 |   </record>
165 |   remove_keys req,res,msg,name,level,v,pid,err
166 | </filter>
167 | 
168 | #@include configs.d/openshift/filter-k8s-flatten-hash.conf
169 | #@include configs.d/openshift/filter-k8s-record-transform.conf
170 | #@include configs.d/openshift/filter-syslog-record-transform.conf
171 | #@include configs.d/openshift/filter-viaq-data-model.conf
172 | <filter **>
173 |   @type viaq_data_model
174 |   process_kubernetes_events false
175 |   default_keep_fields CEE,docker,file,geoip,hostname,kubernetes,level,message,offset,pid,pipeline_metadata,rsyslog,service,systemd,tags,time,ovirt,collectd,tlog,aushape,namespace_name,namespace_uuid
176 |   extra_keep_fields "#{ENV['CDM_EXTRA_KEEP_FIELDS'] || ''}"
177 |   keep_empty_fields "#{ENV['CDM_KEEP_EMPTY_FIELDS'] || 'message'}"
178 |   use_undefined "#{ENV['CDM_USE_UNDEFINED'] || false}"
179 |   undefined_name "#{ENV['CDM_UNDEFINED_NAME'] || 'undefined'}"
180 |   rename_time "#{ENV['CDM_RENAME_TIME'] || true}"
181 |   rename_time_if_missing "#{ENV['CDM_RENAME_TIME_IF_MISSING'] || false}"
182 |   src_time_name "#{ENV['CDM_SRC_TIME_NAME'] || 'time'}"
183 |   dest_time_name "#{ENV['CDM_DEST_TIME_NAME'] || '@timestamp'}"
184 |   pipeline_type "#{ENV['PIPELINE_TYPE'] || 'collector'}"
185 |   <formatter>
186 |     enabled false
187 |     tag "audit.log**"
188 |     type sys_var_log
189 |   </formatter>
190 |   <formatter>
191 |     # already processed - just do index_name
192 |     enabled false
193 |     tag "**mux"
194 |     # type doesn't matter because it will be skipped
195 |     type sys_var_log
196 |   </formatter>
197 |   <formatter>
198 |     tag "system.var.log**"
199 |     type sys_var_log
200 |     remove_keys host,pid,ident
201 |   </formatter>
202 |   <formatter>
203 |     tag "journal.system**"
204 |     type sys_journal
205 |     remove_keys log,stream,MESSAGE,_SOURCE_REALTIME_TIMESTAMP,__REALTIME_TIMESTAMP,CONTAINER_ID,CONTAINER_ID_FULL,CONTAINER_NAME,PRIORITY,_BOOT_ID,_CAP_EFFECTIVE,_CMDLINE,_COMM,_EXE,_GID,_HOSTNAME,_MACHINE_ID,_PID,_SELINUX_CONTEXT,_SYSTEMD_CGROUP,_SYSTEMD_SLICE,_SYSTEMD_UNIT,_TRANSPORT,_UID,_AUDIT_LOGINUID,_AUDIT_SESSION,_SYSTEMD_OWNER_UID,_SYSTEMD_SESSION,_SYSTEMD_USER_UNIT,CODE_FILE,CODE_FUNCTION,CODE_LINE,ERRNO,MESSAGE_ID,RESULT,UNIT,_KERNEL_DEVICE,_KERNEL_SUBSYSTEM,_UDEV_SYSNAME,_UDEV_DEVNODE,_UDEV_DEVLINK,SYSLOG_FACILITY,SYSLOG_IDENTIFIER,SYSLOG_PID
206 |   </formatter>
207 |   <formatter>
208 |     tag "kubernetes.journal.container**"
209 |     type k8s_journal
210 |     remove_keys "#{ENV['K8S_FILTER_REMOVE_KEYS'] || 'log,stream,MESSAGE,_SOURCE_REALTIME_TIMESTAMP,__REALTIME_TIMESTAMP,CONTAINER_ID,CONTAINER_ID_FULL,CONTAINER_NAME,PRIORITY,_BOOT_ID,_CAP_EFFECTIVE,_CMDLINE,_COMM,_EXE,_GID,_HOSTNAME,_MACHINE_ID,_PID,_SELINUX_CONTEXT,_SYSTEMD_CGROUP,_SYSTEMD_SLICE,_SYSTEMD_UNIT,_TRANSPORT,_UID,_AUDIT_LOGINUID,_AUDIT_SESSION,_SYSTEMD_OWNER_UID,_SYSTEMD_SESSION,_SYSTEMD_USER_UNIT,CODE_FILE,CODE_FUNCTION,CODE_LINE,ERRNO,MESSAGE_ID,RESULT,UNIT,_KERNEL_DEVICE,_KERNEL_SUBSYSTEM,_UDEV_SYSNAME,_UDEV_DEVNODE,_UDEV_DEVLINK,SYSLOG_FACILITY,SYSLOG_IDENTIFIER,SYSLOG_PID'}"
211 |   </formatter>
212 |   <formatter>
213 |     tag "kubernetes.var.log.containers**"
214 |     type k8s_json_file
215 |     remove_keys log,stream,CONTAINER_ID_FULL,CONTAINER_NAME
216 |   </formatter>
217 |   <elasticsearch_index_name>
218 |     enabled "#{ENV['ENABLE_ES_INDEX_NAME'] || 'true'}"
219 |     tag "journal.system** system.var.log** audit.log**  **_default_** **_openshift_** **_openshift-*_** **_kube-*_**"
220 |     name_type operations_full
221 |   </elasticsearch_index_name>
222 |   <elasticsearch_index_name>
223 |     enabled "#{ENV['ENABLE_ES_INDEX_NAME'] || 'true'}"
224 |     tag "**"
225 |     name_type project_full
226 |   </elasticsearch_index_name>
227 | </filter>
228 | 
229 | #@include configs.d/openshift/filter-post-*.conf
230 | # generate ids at source mitigate creating duplicate records
231 | # requires fluent-plugin-elasticsearch
232 | <filter **>
233 |   @type elasticsearch_genid_ext
234 |   hash_id_key viaq_msg_id
235 |   alt_key kubernetes.event.metadata.uid
236 |   alt_tags "#{ENV['GENID_ALT_TAG'] || 'kubernetes.var.log.containers.logging-eventrouter-*.** kubernetes.journal.container._default_.kubernetes-event'}"
237 | </filter>
238 | <match mux.** **.fluentd>
239 |   @type relabel
240 |   @label @OUTPUT
241 | </match>
242 | 
243 | <match **>
244 |   @type rewrite_tag_filter
245 |   @label @OUTPUT
246 |   rewriterule1 message .+ output_tag
247 |   rewriterule2 message !.+ output_tag
248 | </match>
249 | ##
250 | </label>
251 | 
252 | <label @OUTPUT>
253 | ## matches
254 | #@include configs.d/openshift/output-pre-*.conf
255 | #@include configs.d/openshift/output-operations.conf
256 | #@include configs.d/openshift/output-applications.conf
257 | <match retry_es>
258 |    @type copy
259 |    #@include output-es-retry.conf
260 |    <store>
261 |      @type elasticsearch
262 |      hosts "#{ENV['ES_HOST']}"
263 |      port "#{ENV['ES_PORT']}"
264 |      scheme http
265 |      target_index_key viaq_index_name
266 |      id_key viaq_msg_id
267 |      remove_keys viaq_index_name
268 | 
269 |      type_name com.redhat.viaq.common
270 | 
271 |      reload_connections "#{ENV['ES_RELOAD_CONNECTIONS'] || 'true'}"
272 |      # https://github.com/uken/fluent-plugin-elasticsearch#reload-after
273 |      reload_after "#{ENV['ES_RELOAD_AFTER'] || '200'}"
274 |      # https://github.com/uken/fluent-plugin-elasticsearch#sniffer-class-name
275 |      sniffer_class_name "#{ENV['ES_SNIFFER_CLASS_NAME'] || 'Fluent::ElasticsearchSimpleSniffer'}"
276 |      reload_on_failure false
277 |      flush_interval "#{ENV['ES_FLUSH_INTERVAL'] || '1s'}"
278 |      max_retry_wait "#{ENV['ES_RETRY_WAIT'] || '300'}"
279 |      disable_retry_limit true
280 |      buffer_type file
281 |      buffer_path '/var/lib/fluentd/es-retry'
282 |      buffer_queue_limit "#{ENV['BUFFER_QUEUE_LIMIT'] || '32' }"
283 |      buffer_chunk_limit "#{ENV['BUFFER_SIZE_LIMIT'] || '8m' }"
284 |      buffer_queue_full_action "#{ENV['BUFFER_QUEUE_FULL_ACTION'] || 'block'}"
285 |      flush_at_shutdown "#{ENV['FLUSH_AT_SHUTDOWN'] || 'false'}"
286 | 
287 |      write_operation 'create'
288 | 
289 |      # 2 ^ 31
290 |      request_timeout 2147483648
291 |    </store>
292 | </match>
293 | <match **>
294 |    @type copy
295 |    #@include output-es-config.conf
296 |    <store>
297 |      @type elasticsearch
298 |      @id elasticsearch-apps
299 |      hosts "#{ENV['ES_HOST']}"
300 |      port "#{ENV['ES_PORT']}"
301 |      scheme http
302 |      target_index_key viaq_index_name
303 |      id_key viaq_msg_id
304 |      remove_keys viaq_index_name
305 | 
306 |      type_name com.redhat.viaq.common
307 |      retry_tag "retry_es"
308 | 
309 |      reload_connections "#{ENV['ES_RELOAD_CONNECTIONS'] || 'true'}"
310 |      # https://github.com/uken/fluent-plugin-elasticsearch#reload-after
311 |      reload_after "#{ENV['ES_RELOAD_AFTER'] || '200'}"
312 |      # https://github.com/uken/fluent-plugin-elasticsearch#sniffer-class-name
313 |      sniffer_class_name "#{ENV['ES_SNIFFER_CLASS_NAME'] || 'Fluent::ElasticsearchSimpleSniffer'}"
314 |      reload_on_failure false
315 |      flush_interval "#{ENV['ES_FLUSH_INTERVAL'] || '1s'}"
316 |      max_retry_wait "#{ENV['ES_RETRY_WAIT'] || '300'}"
317 |      disable_retry_limit true
318 |      buffer_type file
319 |      buffer_path '/var/lib/fluentd/buffer-output-es-config'
320 |      buffer_queue_limit "#{ENV['BUFFER_QUEUE_LIMIT'] || '32' }"
321 |      buffer_chunk_limit "#{ENV['BUFFER_SIZE_LIMIT'] || '8m' }"
322 |      buffer_queue_full_action "#{ENV['BUFFER_QUEUE_FULL_ACTION'] || 'block'}"
323 |      flush_at_shutdown "#{ENV['FLUSH_AT_SHUTDOWN'] || 'false'}"
324 | 
325 |      write_operation 'create'
326 | 
327 |      # 2 ^ 31
328 |      request_timeout 2147483648
329 |    </store>
330 |    #@include ../dynamic/output-remote-syslog.conf
331 |    #@include ../user/output-extra-*.conf
332 |    #@include ../user/secure-forward.conf
333 | </match>
334 | # no post - applications.conf matches everything left
335 | ##
336 | </label>
337 | 


--------------------------------------------------------------------------------
/Chapter5/openshift-logging/fluentd-configmap/fluent.conf-origin:
--------------------------------------------------------------------------------
  1 | # This file is the fluentd configuration entrypoint. Edit with care.
  2 | # 关于两个动态配置的生成阅读/opt/app-root/src目录下的脚本。
  3 | #@include configs.d/openshift/system.conf
  4 | <system>
  5 |   log_level warn
  6 | </system>
  7 | 
  8 | # In each section below, pre- and post- includes don't include anything initially;
  9 | # they exist to enable future additions to openshift conf as needed.
 10 | 
 11 | ## sources
 12 | ## ordered so that syslog always runs last...
 13 | #@include configs.d/openshift/input-pre-*.conf
 14 | #暂时删除了prometheus相关的采集，也就是input-pre-prometheus-metrics.conf中的内容
 15 | <source>   #通过journal采集节点操作系统日志和docker配置为--log-driver=journald下的容器日志。
 16 |   @type systemd
 17 |   @id systemd-input
 18 |   @label @INGRESS
 19 |   path "#{ENV['JOURNAL_SOURCE'] || '/run/log/journal'}"
 20 |   pos_file "#{ENV['JOURNAL_POS_FILE'] || '/var/log/journal.pos'}"
 21 |   filters "#{ENV['JOURNAL_FILTERS_JSON'] || '[]'}"
 22 |   tag journal
 23 |   read_from_head "#{ENV['JOURNAL_READ_FROM_HEAD'] || 'false'}"
 24 | </source>
 25 | #@include configs.d/dynamic/input-docker-*.conf
 26 | <source>     #通过/var/log/container采集容器标准输出日志。只有当docker配置为--log-driver=json-file才会从这里采集,默认的--log-driver=journald不会生成此配置。。
 27 |   @type tail
 28 |   @id docker-input
 29 |   @label @INGRESS
 30 |   path "/var/log/containers/*.log"
 31 |   pos_file "/var/log/es-containers.log.pos"
 32 |   time_format %Y-%m-%dT%H:%M:%S.%N%Z
 33 |   tag kubernetes.*
 34 |   format json
 35 |   keep_time_key true
 36 |   read_from_head "true"
 37 |   exclude_path []
 38 |   @label @CONCAT
 39 | </source>
 40 | <label @CONCAT>
 41 |   <filter kubernetes.**>
 42 |     @type concat
 43 |     key log
 44 |     partial_key logtag
 45 |     partial_value P
 46 |   </filter>
 47 |   <match kubernetes.**>
 48 |     @type relabel
 49 |     @label @INGRESS
 50 |   </match>
 51 | </label>
 52 | #@include configs.d/dynamic/input-syslog-*.conf
 53 | #@include configs.d/openshift/input-post-*.conf
 54 | ##
 55 | 
 56 | <label @INGRESS>
 57 | ## filters
 58 | #@include configs.d/openshift/filter-pre-*.conf
 59 | 
 60 | #@include configs.d/openshift/filter-retag-journal.conf
 61 | # journal entries from k8s containers look like this:
 62 | # The stream identification is encoded into the PRIORITY field as an
 63 | # integer: 6, or github.com/coreos/go-systemd/journal.Info, marks stdout,
 64 | # while 3, or github.com/coreos/go-systemd/journal.Err, marks stderr.
 65 | # PRIORITY=6
 66 | # CONTAINER_ID=b6cbb6e73c0a
 67 | # CONTAINER_ID_FULL=b6cbb6e73c0ad63ab820e4baa97cdc77cec729930e38a714826764ac0491341a
 68 | # CONTAINER_NAME=k8s_registry.a49f5318_docker-registry-1-hhoj0_default_ae3a9bdc-1f66-11e6-80a2-fa163e2fff3a_799e4035
 69 | # MESSAGE=172.17.0.1 - - [21/May/2016:16:52:05 +0000] "GET /healthz HTTP/1.1" 200 0 "" "Go-http-client/1.1"
 70 | # or
 71 | # MESSAGE=time="2016-05-21T15:14:17.216966675Z" level=info msg="version=v2.1.0+unknown"
 72 | # docker inspect:
 73 | # "io.kubernetes.container.hash": "a49f5318",
 74 | # "io.kubernetes.container.name": "registry",
 75 | # "io.kubernetes.pod.name": "docker-registry-1-hhoj0",
 76 | # "io.kubernetes.pod.namespace": "default",
 77 | # "io.kubernetes.pod.terminationGracePeriod": "30",
 78 | # "io.kubernetes.pod.uid": "ae3a9bdc-1f66-11e6-80a2-fa163e2fff3a",
 79 | # docker ps:
 80 | # da531d7cea12 172.30.38.242:5000/logging/logging-elasticsearch@sha256:4888a2a3f875555a46d233f9856964a8eaac716259599db0062051ba5647187e   "sh /opt/app-root/src"   About an hour ago   Up About an hour
 81 | # k8s_elasticsearch.8d3af8fd_logging-es-ops-gkfv06wi-1-7y682_logging_9612f891-1f68-11e6-80a2-fa163e2fff3a_d1cc32e1
 82 | # oc get pods -o yaml:
 83 | #      kubernetes.io/created-by: |
 84 | # {"name":"logging-es-ops-gkfv06wi-1","uid":"92d90581-1f68-11e6-80a2-fa163e2fff3a","apiVersion":"v1","resourceVersion":"829"}}
 85 | # openshift.io/deployment-config.name: logging-es-ops-gkfv06wi
 86 | # openshift.io/deployment.name: logging-es-ops-gkfv06wi-1
 87 | # uid: 9612f891-1f68-11e6-80a2-fa163e2fff3a
 88 | # image: 172.30.38.242:5000/logging/logging-elasticsearch@sha256:4888a2a3f875555a46d233f9856964a8eaac716259599db0062051ba5647187e
 89 | # containerStatuses:
 90 | #  - containerID: docker://da531d7cea12bf714f90c26d0fb9f275b02321d1bccd10013f087be33f4e6e5e
 91 | #    image: 172.30.38.242:5000/logging/logging-elasticsearch@sha256:4888a2a3f875555a46d233f9856964a8eaac716259599db0062051ba5647187e
 92 | #    imageID: docker://sha256:d5a02bf63b1f3e0d1aa06bf28928e181f67ab2c80b2a1d1fd1ba310f11c12955
 93 | # another example:
 94 | # CONTAINER_NAME=k8s_bob.94e110c7_bob-iq0d4_default_2d67916a-1eac-11e6-94ba-001c42e13e5d_8b4b7e3d
 95 | # From this, we can extract:
 96 | #    container name in pod: bob
 97 | #    pod name: bob-iq0d4
 98 | #    namespace: default
 99 | #    pod uid: 2d67916a-1eac-11e6-94ba-001c42e13e5d
100 | 
101 | # in addition, there are a few other differences about /var/log/messages and journal messages
102 | # * the default rsyslog.conf on el7 will only log messages to /var/log/messages at INFO level
103 | #   or higher
104 | # * the default rsyslog.d includes 21-cloudinit.conf which redirects all cloud-init messages
105 | #   to /var/log/cloud-init.log
106 | #   When using the journal, we keep the cloud-init messages and store
107 | #   them in elasticsearch.  But we filter out DEBUG messages.
108 | #   We should revisit this at a later date, when we have a good grasp of the storage
109 | #   requirements, so we can turn on this firehose.
110 | 
111 | @include filter-exclude-journal-debug.conf
112 | <match journal>
113 |   @type rewrite_tag_filter
114 |   # skip to @INGRESS label section
115 |   @label @INGRESS
116 |   # see if this is a kibana container for special log handling
117 |   # looks like this:
118 |   # k8s_kibana.a67f366_logging-kibana-1-d90e3_logging_26c51a61-2835-11e6-ad29-fa163e4944d5_f0db49a2
119 |   # we filter these logs through the kibana_transform.conf filter
120 |   rewriterule1 CONTAINER_NAME ^k8s_kibana\. kubernetes.journal.container.kibana
121 |   # mark eventrouter events
122 |   rewriterule2 CONTAINER_NAME ^k8s_[^_]+_logging-eventrouter-[^_]+_ kubernetes.journal.container._default_.kubernetes-event
123 |   # mark logs from default namespace for processing as k8s logs but stored as system logs
124 |   rewriterule3 CONTAINER_NAME ^k8s_[^_]+_[^_]+_default_ kubernetes.journal.container._default_
125 |   # mark logs from kube-* namespaces for processing as k8s logs but stored as system logs
126 |   rewriterule4 CONTAINER_NAME ^k8s_[^_]+_[^_]+_kube-(.+)_ kubernetes.journal.container._kube-$1_
127 |   # mark logs from openshift-* namespaces for processing as k8s logs but stored as system logs
128 |   rewriterule5 CONTAINER_NAME ^k8s_[^_]+_[^_]+_openshift-(.+)_ kubernetes.journal.container._openshift-$1_
129 |   # mark logs from openshift namespace for processing as k8s logs but stored as system logs
130 |   rewriterule6 CONTAINER_NAME ^k8s_[^_]+_[^_]+_openshift_ kubernetes.journal.container._openshift_
131 |   # mark fluentd container logs
132 |   rewriterule7 CONTAINER_NAME ^k8s_.*fluentd kubernetes.journal.container.fluentd
133 |   # this is a kubernetes container
134 |   rewriterule8 CONTAINER_NAME ^k8s_ kubernetes.journal.container
135 |   # not kubernetes - assume a system log or system container log
136 |   rewriterule9 _TRANSPORT .+ journal.system
137 | </match>
138 | 
139 | #@include configs.d/openshift/filter-k8s-meta.conf
140 | <filter kubernetes.**>
141 |   type kubernetes_metadata
142 |   kubernetes_url "#{ENV['K8S_HOST_URL']}"
143 |   cache_size "#{ENV['K8S_METADATA_CACHE_SIZE'] || '1000'}"
144 |   watch "#{ENV['K8S_METADATA_WATCH'] || 'false'}"
145 |   bearer_token_file /var/run/secrets/kubernetes.io/serviceaccount/token
146 |   ca_file /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
147 |   use_journal "#{ENV['USE_JOURNAL'] || 'false'}"
148 |   container_name_to_kubernetes_regexp '^(?<name_prefix>[^_]+)_(?<container_name>[^\._]+)(\.(?<container_hash>[^_]+))?_(?<pod_name>[^_]+)_(?<namespace>[^_]+)_[^_]+_[^_]+$'
149 | </filter>
150 | 
151 | <filter kubernetes.**>
152 |   @type parse_json_field
153 |   merge_json_log "#{ENV['MERGE_JSON_LOG'] || 'false'}"
154 |   preserve_json_log "#{ENV['PRESERVE_JSON_LOG'] || 'true'}"
155 |   json_fields "#{ENV['JSON_FIELDS'] || (ENV['USE_JOURNAL'] == 'true' ? 'MESSAGE,log' : 'log,MESSAGE')}"
156 | </filter>
157 | 
158 | #@include configs.d/openshift/filter-kibana-transform.conf
159 | <filter **kibana**>
160 |   @type record_transformer
161 |   enable_ruby
162 |   <record>
163 |     log ${record['err'] || record['msg'] || record['MESSAGE'] || record['log']}
164 |   </record>
165 |   remove_keys req,res,msg,name,level,v,pid,err
166 | </filter>
167 | 
168 | #@include configs.d/openshift/filter-k8s-flatten-hash.conf
169 | #@include configs.d/openshift/filter-k8s-record-transform.conf
170 | #@include configs.d/openshift/filter-syslog-record-transform.conf
171 | #@include configs.d/openshift/filter-viaq-data-model.conf
172 | <filter **>
173 |   @type viaq_data_model
174 |   process_kubernetes_events false
175 |   default_keep_fields CEE,docker,file,geoip,hostname,kubernetes,level,message,offset,pid,pipeline_metadata,rsyslog,service,systemd,tags,time,ovirt,collectd,tlog,aushape,namespace_name,namespace_uuid
176 |   extra_keep_fields "#{ENV['CDM_EXTRA_KEEP_FIELDS'] || ''}"
177 |   keep_empty_fields "#{ENV['CDM_KEEP_EMPTY_FIELDS'] || 'message'}"
178 |   use_undefined "#{ENV['CDM_USE_UNDEFINED'] || false}"
179 |   undefined_name "#{ENV['CDM_UNDEFINED_NAME'] || 'undefined'}"
180 |   rename_time "#{ENV['CDM_RENAME_TIME'] || true}"
181 |   rename_time_if_missing "#{ENV['CDM_RENAME_TIME_IF_MISSING'] || false}"
182 |   src_time_name "#{ENV['CDM_SRC_TIME_NAME'] || 'time'}"
183 |   dest_time_name "#{ENV['CDM_DEST_TIME_NAME'] || '@timestamp'}"
184 |   pipeline_type "#{ENV['PIPELINE_TYPE'] || 'collector'}"
185 |   <formatter>
186 |     enabled false
187 |     tag "audit.log**"
188 |     type sys_var_log
189 |   </formatter>
190 |   <formatter>
191 |     # already processed - just do index_name
192 |     enabled false
193 |     tag "**mux"
194 |     # type doesn't matter because it will be skipped
195 |     type sys_var_log
196 |   </formatter>
197 |   <formatter>
198 |     tag "system.var.log**"
199 |     type sys_var_log
200 |     remove_keys host,pid,ident
201 |   </formatter>
202 |   <formatter>
203 |     tag "journal.system**"
204 |     type sys_journal
205 |     remove_keys log,stream,MESSAGE,_SOURCE_REALTIME_TIMESTAMP,__REALTIME_TIMESTAMP,CONTAINER_ID,CONTAINER_ID_FULL,CONTAINER_NAME,PRIORITY,_BOOT_ID,_CAP_EFFECTIVE,_CMDLINE,_COMM,_EXE,_GID,_HOSTNAME,_MACHINE_ID,_PID,_SELINUX_CONTEXT,_SYSTEMD_CGROUP,_SYSTEMD_SLICE,_SYSTEMD_UNIT,_TRANSPORT,_UID,_AUDIT_LOGINUID,_AUDIT_SESSION,_SYSTEMD_OWNER_UID,_SYSTEMD_SESSION,_SYSTEMD_USER_UNIT,CODE_FILE,CODE_FUNCTION,CODE_LINE,ERRNO,MESSAGE_ID,RESULT,UNIT,_KERNEL_DEVICE,_KERNEL_SUBSYSTEM,_UDEV_SYSNAME,_UDEV_DEVNODE,_UDEV_DEVLINK,SYSLOG_FACILITY,SYSLOG_IDENTIFIER,SYSLOG_PID
206 |   </formatter>
207 |   <formatter>
208 |     tag "kubernetes.journal.container**"
209 |     type k8s_journal
210 |     remove_keys "#{ENV['K8S_FILTER_REMOVE_KEYS'] || 'log,stream,MESSAGE,_SOURCE_REALTIME_TIMESTAMP,__REALTIME_TIMESTAMP,CONTAINER_ID,CONTAINER_ID_FULL,CONTAINER_NAME,PRIORITY,_BOOT_ID,_CAP_EFFECTIVE,_CMDLINE,_COMM,_EXE,_GID,_HOSTNAME,_MACHINE_ID,_PID,_SELINUX_CONTEXT,_SYSTEMD_CGROUP,_SYSTEMD_SLICE,_SYSTEMD_UNIT,_TRANSPORT,_UID,_AUDIT_LOGINUID,_AUDIT_SESSION,_SYSTEMD_OWNER_UID,_SYSTEMD_SESSION,_SYSTEMD_USER_UNIT,CODE_FILE,CODE_FUNCTION,CODE_LINE,ERRNO,MESSAGE_ID,RESULT,UNIT,_KERNEL_DEVICE,_KERNEL_SUBSYSTEM,_UDEV_SYSNAME,_UDEV_DEVNODE,_UDEV_DEVLINK,SYSLOG_FACILITY,SYSLOG_IDENTIFIER,SYSLOG_PID'}"
211 |   </formatter>
212 |   <formatter>
213 |     tag "kubernetes.var.log.containers**"
214 |     type k8s_json_file
215 |     remove_keys log,stream,CONTAINER_ID_FULL,CONTAINER_NAME
216 |   </formatter>
217 |   <elasticsearch_index_name>
218 |     enabled "#{ENV['ENABLE_ES_INDEX_NAME'] || 'true'}"
219 |     tag "journal.system** system.var.log** audit.log**  **_default_** **_openshift_** **_openshift-*_** **_kube-*_**"
220 |     name_type operations_full
221 |   </elasticsearch_index_name>
222 |   <elasticsearch_index_name>
223 |     enabled "#{ENV['ENABLE_ES_INDEX_NAME'] || 'true'}"
224 |     tag "**"
225 |     name_type project_full
226 |   </elasticsearch_index_name>
227 | </filter>
228 | 
229 | #@include configs.d/openshift/filter-post-*.conf
230 | # generate ids at source mitigate creating duplicate records
231 | # requires fluent-plugin-elasticsearch
232 | <filter **>
233 |   @type elasticsearch_genid_ext
234 |   hash_id_key viaq_msg_id
235 |   alt_key kubernetes.event.metadata.uid
236 |   alt_tags "#{ENV['GENID_ALT_TAG'] || 'kubernetes.var.log.containers.logging-eventrouter-*.** kubernetes.journal.container._default_.kubernetes-event'}"
237 | </filter>
238 | <match mux.** **.fluentd>
239 |   @type relabel
240 |   @label @OUTPUT
241 | </match>
242 | 
243 | <match **>
244 |   @type rewrite_tag_filter
245 |   @label @OUTPUT
246 |   rewriterule1 message .+ output_tag
247 |   rewriterule2 message !.+ output_tag
248 | </match>
249 | ##
250 | </label>
251 | 
252 | <label @OUTPUT>
253 | ## matches
254 | #@include configs.d/openshift/output-pre-*.conf
255 | #@include configs.d/openshift/output-operations.conf
256 | #@include configs.d/openshift/output-applications.conf
257 | <match retry_es>
258 |    @type copy
259 |    #@include output-es-retry.conf
260 |    <store>
261 |      @type elasticsearch
262 |      host "#{ENV['ES_HOST']}"
263 |      port "#{ENV['ES_PORT']}"
264 |      scheme https
265 |      ssl_version TLSv1_2
266 |      target_index_key viaq_index_name
267 |      id_key viaq_msg_id
268 |      remove_keys viaq_index_name
269 |      user fluentd
270 |      password changeme
271 | 
272 |      client_key "#{ENV['ES_CLIENT_KEY']}"
273 |      client_cert "#{ENV['ES_CLIENT_CERT']}"
274 |      ca_file "#{ENV['ES_CA']}"
275 | 
276 |      type_name com.redhat.viaq.common
277 | 
278 |      reload_connections "#{ENV['ES_RELOAD_CONNECTIONS'] || 'true'}"
279 |      # https://github.com/uken/fluent-plugin-elasticsearch#reload-after
280 |      reload_after "#{ENV['ES_RELOAD_AFTER'] || '200'}"
281 |      # https://github.com/uken/fluent-plugin-elasticsearch#sniffer-class-name
282 |      sniffer_class_name "#{ENV['ES_SNIFFER_CLASS_NAME'] || 'Fluent::ElasticsearchSimpleSniffer'}"
283 |      reload_on_failure false
284 |      flush_interval "#{ENV['ES_FLUSH_INTERVAL'] || '1s'}"
285 |      max_retry_wait "#{ENV['ES_RETRY_WAIT'] || '300'}"
286 |      disable_retry_limit true
287 |      buffer_type file
288 |      buffer_path '/var/lib/fluentd/es-retry'
289 |      buffer_queue_limit "#{ENV['BUFFER_QUEUE_LIMIT'] || '32' }"
290 |      buffer_chunk_limit "#{ENV['BUFFER_SIZE_LIMIT'] || '8m' }"
291 |      buffer_queue_full_action "#{ENV['BUFFER_QUEUE_FULL_ACTION'] || 'block'}"
292 |      flush_at_shutdown "#{ENV['FLUSH_AT_SHUTDOWN'] || 'false'}"
293 | 
294 |      write_operation 'create'
295 | 
296 |      # 2 ^ 31
297 |      request_timeout 2147483648
298 |    </store>
299 | </match>
300 | <match **>
301 |    @type copy
302 |    #@include output-es-config.conf
303 |    <store>
304 |      @type elasticsearch
305 |      @id elasticsearch-apps
306 |      host "#{ENV['ES_HOST']}"
307 |      port "#{ENV['ES_PORT']}"
308 |      scheme https
309 |      ssl_version TLSv1_2
310 |      target_index_key viaq_index_name
311 |      id_key viaq_msg_id
312 |      remove_keys viaq_index_name
313 |      user fluentd
314 |      password changeme
315 | 
316 |      client_key "#{ENV['ES_CLIENT_KEY']}"
317 |      client_cert "#{ENV['ES_CLIENT_CERT']}"
318 |      ca_file "#{ENV['ES_CA']}"
319 | 
320 |      type_name com.redhat.viaq.common
321 |      retry_tag "retry_es"
322 | 
323 |      reload_connections "#{ENV['ES_RELOAD_CONNECTIONS'] || 'true'}"
324 |      # https://github.com/uken/fluent-plugin-elasticsearch#reload-after
325 |      reload_after "#{ENV['ES_RELOAD_AFTER'] || '200'}"
326 |      # https://github.com/uken/fluent-plugin-elasticsearch#sniffer-class-name
327 |      sniffer_class_name "#{ENV['ES_SNIFFER_CLASS_NAME'] || 'Fluent::ElasticsearchSimpleSniffer'}"
328 |      reload_on_failure false
329 |      flush_interval "#{ENV['ES_FLUSH_INTERVAL'] || '1s'}"
330 |      max_retry_wait "#{ENV['ES_RETRY_WAIT'] || '300'}"
331 |      disable_retry_limit true
332 |      buffer_type file
333 |      buffer_path '/var/lib/fluentd/buffer-output-es-config'
334 |      buffer_queue_limit "#{ENV['BUFFER_QUEUE_LIMIT'] || '32' }"
335 |      buffer_chunk_limit "#{ENV['BUFFER_SIZE_LIMIT'] || '8m' }"
336 |      buffer_queue_full_action "#{ENV['BUFFER_QUEUE_FULL_ACTION'] || 'block'}"
337 |      flush_at_shutdown "#{ENV['FLUSH_AT_SHUTDOWN'] || 'false'}"
338 | 
339 |      write_operation 'create'
340 | 
341 |      # 2 ^ 31
342 |      request_timeout 2147483648
343 |    </store>
344 |    #@include ../dynamic/output-remote-syslog.conf
345 |    #@include ../user/output-extra-*.conf
346 |    #@include ../user/secure-forward.conf
347 | </match>
348 | # no post - applications.conf matches everything left
349 | ##
350 | </label>
351 | 


--------------------------------------------------------------------------------
/Chapter5/openshift-logging/kafka-fluentd-images/Dockerfile:
--------------------------------------------------------------------------------
 1 | FROM registry.access.redhat.com/openshift3/logging-fluentd:v3.11
 2 | 
 3 | ADD base.repo /etc/yum.repos.d/
 4 | RUN yum -y install --setopt=tsflags=nodocs \
 5 |     gcc-c++ ruby-devel patch make iputils net-tools telnet && \
 6 |     yum clean all && \
 7 |     rm -rf /etc/yum.repos.d/base.repo
 8 | 
 9 | ADD kafka-plugin/ ${HOME}/
10 | WORKDIR ${HOME}
11 | RUN fluent-gem install 0.1.3/zookeeper-1.4.11.gem --local && \
12 |     fluent-gem install 0.1.3/zk-1.9.6.gem --local && \
13 |     fluent-gem install 0.1.3/poseidon-0.0.5.gem --local && \
14 |     fluent-gem install 0.1.3/poseidon_cluster-0.3.3.gem --local && \
15 |     fluent-gem install 0.1.3/ltsv-0.1.0.gem --local && \
16 |     fluent-gem install 0.1.3/fluent-plugin-kafka-0.1.3.gem --local
17 | 
18 | ADD run.sh  ${HOME}/
19 | 
20 | USER 0
21 | CMD ["sh", "run.sh"]
22 | 


--------------------------------------------------------------------------------
/Chapter5/openshift-logging/kafka-fluentd-images/base.repo:
--------------------------------------------------------------------------------
 1 | [base]
 2 | name=base
 3 | baseurl=http://192.168.1.250:8080/rhel-7-server-rpms
 4 | enabled=1
 5 | gpgcheck=0
 6 | #pacth contains only ruby-devel
 7 | [patch]
 8 | name=patch
 9 | baseurl=http://192.168.1.259:8080/patch
10 | enabled=1
11 | gpgcheck=0
12 | 


--------------------------------------------------------------------------------
/Chapter5/openshift-logging/kafka-fluentd-images/build.sh:
--------------------------------------------------------------------------------
1 | docker build -t registry.example.com/openshift3/kafka-logging-fluentd:v3.11 .
2 | 


--------------------------------------------------------------------------------
/Chapter5/openshift-logging/kafka-fluentd-images/kafka-plugin/0.1.3/fluent-plugin-kafka-0.1.3.gem:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter5/openshift-logging/kafka-fluentd-images/kafka-plugin/0.1.3/fluent-plugin-kafka-0.1.3.gem


--------------------------------------------------------------------------------
/Chapter5/openshift-logging/kafka-fluentd-images/kafka-plugin/0.1.3/ltsv-0.1.0.gem:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter5/openshift-logging/kafka-fluentd-images/kafka-plugin/0.1.3/ltsv-0.1.0.gem


--------------------------------------------------------------------------------
/Chapter5/openshift-logging/kafka-fluentd-images/kafka-plugin/0.1.3/poseidon-0.0.5.gem:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter5/openshift-logging/kafka-fluentd-images/kafka-plugin/0.1.3/poseidon-0.0.5.gem


--------------------------------------------------------------------------------
/Chapter5/openshift-logging/kafka-fluentd-images/kafka-plugin/0.1.3/poseidon_cluster-0.3.3.gem:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter5/openshift-logging/kafka-fluentd-images/kafka-plugin/0.1.3/poseidon_cluster-0.3.3.gem


--------------------------------------------------------------------------------
/Chapter5/openshift-logging/kafka-fluentd-images/kafka-plugin/0.1.3/zk-1.9.6.gem:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter5/openshift-logging/kafka-fluentd-images/kafka-plugin/0.1.3/zk-1.9.6.gem


--------------------------------------------------------------------------------
/Chapter5/openshift-logging/kafka-fluentd-images/kafka-plugin/0.1.3/zookeeper-1.4.11.gem:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter5/openshift-logging/kafka-fluentd-images/kafka-plugin/0.1.3/zookeeper-1.4.11.gem


--------------------------------------------------------------------------------
/Chapter5/openshift-logging/kafka-fluentd-images/ruby-devel-2.0.0.648-35.el7_6.x86_64.rpm:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter5/openshift-logging/kafka-fluentd-images/ruby-devel-2.0.0.648-35.el7_6.x86_64.rpm


--------------------------------------------------------------------------------
/Chapter5/openshift-logging/kafka-fluentd-images/run.sh:
--------------------------------------------------------------------------------
  1 | #!/bin/bash
  2 | 
  3 | export MERGE_JSON_LOG=${MERGE_JSON_LOG:-true}
  4 | CFG_DIR=/etc/fluent/configs.d
  5 | ENABLE_PROMETHEUS_ENDPOINT=${ENABLE_PROMETHEUS_ENDPOINT:-"true"}
  6 | OCP_OPERATIONS_PROJECTS=${OCP_OPERATIONS_PROJECTS:-"default openshift openshift- kube-"}
  7 | OCP_FLUENTD_TAGS=""
  8 | for p in ${OCP_OPERATIONS_PROJECTS}; do
  9 |     if [[ "${p}" == *- ]] ; then
 10 |       p="${p}*"
 11 |     fi
 12 |     OCP_FLUENTD_TAGS+=" **_${p}_**"
 13 | done
 14 | ocp_fluentd_files=$( grep -l %OCP_FLUENTD_TAGS% ${CFG_DIR}/* ${CFG_DIR}/*/* 2> /dev/null || : )
 15 | for file in ${ocp_fluentd_files} ; do
 16 |     sed -i -e "s/%OCP_FLUENTD_TAGS%/${OCP_FLUENTD_TAGS}/" $file
 17 | done
 18 | 
 19 | echo "============================="
 20 | echo "Fluentd logs have been redirected to: $LOGGING_FILE_PATH"
 21 | echo "If you want to print out the logs, use command:"
 22 | echo "oc exec <pod_name> -- logs"
 23 | echo "============================="
 24 | 
 25 | if [ ! -d `dirname $LOGGING_FILE_PATH` ]; then
 26 |   mkdir -p `dirname $LOGGING_FILE_PATH`
 27 | fi
 28 | touch $LOGGING_FILE_PATH; exec >> $LOGGING_FILE_PATH 2>&1
 29 | 
 30 | fluentdargs="--no-supervisor"
 31 | if [[ $VERBOSE ]]; then
 32 |   set -ex
 33 |   fluentdargs="$fluentdargs -vv"
 34 |   echo ">>>>>> ENVIRONMENT VARS <<<<<"
 35 |   env | sort
 36 |   echo ">>>>>>>>>>>>><<<<<<<<<<<<<<<<"
 37 | else
 38 |   set -e
 39 | fi
 40 | 
 41 | #NOTE: USE_CRIO variable used in generate_throttle_configs.rb as well
 42 | export USE_CRIO=false
 43 | node_config=/etc/origin/node/node-config.yaml
 44 | if [[ -f "$node_config" ]]; then
 45 |     cre=$(ruby -e "require 'yaml'; y=YAML.load_file('${node_config}')
 46 |         puts (y['kubeletArguments']||{})['container-runtime-endpoint']")
 47 |     if [[ "$cre" =~ crio ]]; then
 48 |         USE_CRIO=true
 49 |     fi
 50 | else
 51 |     echo "WARNING: Unable to check for cri-o"
 52 | fi
 53 | 
 54 | issue_deprecation_warnings() {
 55 |     : # none at the moment
 56 | }
 57 | 
 58 | docker_uses_journal() {
 59 |     # need to be able to handle cases like
 60 |     # OPTIONS='--log-driver=json-file ....' # or use --log-driver=journald
 61 |     # if "log-driver" is set in /etc/docker/daemon.json, assume that it is
 62 |     # authoritative
 63 |     # otherwise, look for /etc/sysconfig/docker
 64 |     # also note the unintuitive logic - in this case, a 0 return means true, and a 1
 65 |     # return means false
 66 |     if grep -q '^[^#].*"log-driver":' /etc/docker/daemon.json 2> /dev/null ; then
 67 |         if grep -q '^[^#].*"log-driver":.*journald' /etc/docker/daemon.json 2> /dev/null ; then
 68 |             return 0
 69 |         fi
 70 |     elif grep -q "^OPTIONS='[^']*--log-driver[   =][     ]*journald" /etc/sysconfig/docker 2> /dev/null ; then
 71 |         return 0
 72 |     fi
 73 |     return 1
 74 | }
 75 | 
 76 | if [ -z "${USE_MUX:-}" -o "${USE_MUX:-}" = "false" ] ; then
 77 |     if [ -z "${JOURNAL_SOURCE:-}" ] ; then
 78 |         if [ -d /var/log/journal ] ; then
 79 |             export JOURNAL_SOURCE=/var/log/journal
 80 |         else
 81 |             export JOURNAL_SOURCE=/run/log/journal
 82 |         fi
 83 |     fi
 84 |     if [[ "$USE_CRIO" == true ]]; then
 85 |         export USE_JOURNAL=false
 86 |     elif docker_uses_journal ; then
 87 |         export USE_JOURNAL=true
 88 |     else
 89 |         export USE_JOURNAL=false
 90 |     fi
 91 |     unset MUX_FILE_BUFFER_STORAGE_TYPE
 92 | else
 93 |     # mux requires USE_JOURNAL=true so that the k8s meta plugin will look
 94 |     # for CONTAINER_NAME instead of the kubernetes.var.log.containers.* tag
 95 |     export USE_JOURNAL=true
 96 | fi
 97 | 
 98 | if [ ! -d /etc/fluent/muxkeys ]; then
 99 |     unset MUX_CLIENT_MODE
100 | fi
101 | 
102 | IPADDR4=`/usr/sbin/ip -4 addr show dev eth0 | grep inet | sed -e "s/[ \t]*inet \([0-9.]*\).*/\1/"`
103 | IPADDR6=`/usr/sbin/ip -6 addr show dev eth0 | grep inet6 | sed "s/[ \t]*inet6 \([a-f0-9:]*\).*/\1/"`
104 | export IPADDR4 IPADDR6
105 | 
106 | BUFFER_SIZE_LIMIT=${BUFFER_SIZE_LIMIT:-16777216}
107 | 
108 | # Check the existing main fluent.conf has the @OUTPUT label
109 | # If it exists, we could use the label and take advantage.
110 | # If not, give up one output tag per plugin for now.
111 | output_label=$( egrep "<label @OUTPUT>" $CFG_DIR/../fluent.conf || : )
112 | 
113 | if [ "${USE_MUX:-}" = "true" ] ; then
114 |     # copy our standard mux configs to the openshift dir
115 |     cp $CFG_DIR/input-*-mux.conf $CFG_DIR/filter-*-mux.conf $CFG_DIR/openshift
116 |     # copy any user defined files, possibly overwriting the standard ones
117 |     for file in $CFG_DIR/user/input-*-mux.conf $CFG_DIR/user/filter-*-mux.conf ; do
118 |         if [ -f "$file" ] ; then
119 |             cp -f $file $CFG_DIR/openshift
120 |         fi
121 |     done
122 |     rm -f $CFG_DIR/dynamic/input-docker-* $CFG_DIR/dynamic/input-syslog-*
123 |     # disable systemd input
124 |     rm -f $CFG_DIR/openshift/input-pre-systemd.conf
125 |     touch $CFG_DIR/openshift/input-pre-systemd.conf
126 |     # mux is a normalizer
127 |     export PIPELINE_TYPE=normalizer
128 | else
129 |     ruby generate_throttle_configs.rb
130 |     rm -f $CFG_DIR/openshift/*mux*.conf
131 |     # have output plugins handle back pressure
132 |     # if you want the old behavior to be forced anyway, set env
133 |     # BUFFER_QUEUE_FULL_ACTION=exception
134 |     export BUFFER_QUEUE_FULL_ACTION=${BUFFER_QUEUE_FULL_ACTION:-block}
135 | fi
136 | 
137 | # this is the list of keys to remove when the record is transformed from the raw systemd journald
138 | # output to the viaq data model format
139 | K8S_FILTER_REMOVE_KEYS="log,stream,MESSAGE,_SOURCE_REALTIME_TIMESTAMP,__REALTIME_TIMESTAMP,CONTAINER_ID,CONTAINER_ID_FULL,CONTAINER_NAME,PRIORITY,_BOOT_ID,_CAP_EFFECTIVE,_CMDLINE,_COMM,_EXE,_GID,_HOSTNAME,_MACHINE_ID,_PID,_SELINUX_CONTEXT,_SYSTEMD_CGROUP,_SYSTEMD_SLICE,_SYSTEMD_UNIT,_TRANSPORT,_UID,_AUDIT_LOGINUID,_AUDIT_SESSION,_SYSTEMD_OWNER_UID,_SYSTEMD_SESSION,_SYSTEMD_USER_UNIT,CODE_FILE,CODE_FUNCTION,CODE_LINE,ERRNO,MESSAGE_ID,RESULT,UNIT,_KERNEL_DEVICE,_KERNEL_SUBSYSTEM,_UDEV_SYSNAME,_UDEV_DEVNODE,_UDEV_DEVLINK,SYSLOG_FACILITY,SYSLOG_IDENTIFIER,SYSLOG_PID"
140 | 
141 | if [ -n "${MUX_CLIENT_MODE:-}" ] ; then
142 |     if [ "${MUX_CLIENT_MODE:-}" = maximal ] ; then
143 |         # do not remove the CONTAINER_ fields - pass them through to mux
144 |         # sed assumes CONTAINER_ fields are neither first nor last fields in list
145 |         K8S_FILTER_REMOVE_KEYS=$( echo $K8S_FILTER_REMOVE_KEYS | \
146 |                                   sed -e 's/,CONTAINER_NAME,/,/g' -e 's/,CONTAINER_ID_FULL,/,/g' )
147 |         # tell the viaq filter not to construct an elasticsearch index name
148 |         # for project because we have no kubernetes metadata yet
149 |     elif [ "${MUX_CLIENT_MODE:-}" = minimal ] ; then
150 |         # retag container logs with .raw suffix so mux server will know it has to process
151 |         cp -f $CFG_DIR/filter-pre-mux-client-retag-raw.conf $CFG_DIR/openshift/filter-pre-mux-client-retag-raw.conf
152 |         if [ -z "${output_label}" ] ; then
153 |             # the above relies on having an output label - if there is no output label, rely
154 |             # on the fact that the input plugins all send their input directly to the
155 |             # @INGRESS label, rather than simply falling through to the next line
156 |             # in fluent.conf - add an input-post-output.conf which has the @OUTPUT
157 |             # label
158 |             cp -f $CFG_DIR/input-post-output.conf $CFG_DIR/openshift/input-post-output.conf
159 |         fi
160 |     fi
161 |     cp $CFG_DIR/filter-pre-mux-client.conf $CFG_DIR/openshift/output-pre-mux-client.conf
162 |     # copy any user defined files, possibly overwriting the standard ones
163 |     if [ -f $CFG_DIR/user/filter-pre-mux-client.conf ] ; then
164 |         cp -f $CFG_DIR/user/filter-pre-mux-client.conf $CFG_DIR/openshift/output-pre-mux-client.conf
165 |     fi
166 |     # rm k8s meta plugin - do not hit the API server - just do json parsing
167 |     if [ "${MUX_CLIENT_MODE:-}" = maximal ] ; then
168 |         cp -f $CFG_DIR/filter-parse-json-field.conf $CFG_DIR/openshift/filter-k8s-meta.conf
169 |     fi
170 |     # mux clients do not create elasticsearch index names
171 |     ENABLE_ES_INDEX_NAME=false
172 | else
173 |     rm -f $CFG_DIR/openshift/filter-pre-mux-client.conf $CFG_DIR/openshift/output-pre-mux-client.conf
174 | fi
175 | export K8S_FILTER_REMOVE_KEYS ENABLE_ES_INDEX_NAME
176 | 
177 | if [ -z $ES_HOST ]; then
178 |     echo "ERROR: Environment variable ES_HOST for Elasticsearch host name is not set."
179 |     exit 1
180 | fi
181 | if [ -z $ES_PORT ]; then
182 |     echo "ERROR: Environment variable ES_PORT for Elasticsearch port number is not set."
183 |     exit 1
184 | fi
185 | 
186 | # How many outputs?
187 | if [ -n "${MUX_CLIENT_MODE:-}" ] ; then
188 |     # A fluentd collector configured as a mux client has just one output: sending to a mux.
189 |     NUM_OUTPUTS=1
190 |     rm -f $CFG_DIR/openshift/filter-post-z-retag-*.conf
191 |     if [ -n "$output_label" ]; then
192 |         cp $CFG_DIR/{,openshift}/filter-post-z-mux-client.conf
193 |     fi
194 |     # Enable "output-es-ops-config.conf in output-operations.conf"
195 |     # we need something there so output-operations.conf won't have an empty @copy without a <store> block
196 |     # but it won't actually be used in this case - output-pre-mux-client.conf will match everything
197 |     # before we get here
198 |     cp $CFG_DIR/{openshift,dynamic}/output-es-ops-config.conf
199 | else
200 |     # check ES_HOST vs. OPS_HOST; ES_PORT vs. OPS_PORT
201 |     if [ "$ES_HOST" = ${OPS_HOST:-""} -a $ES_PORT -eq ${OPS_PORT:-0} ]; then
202 |         # There is one output Elasticsearch
203 |         NUM_OUTPUTS=1
204 |         # Disable "output-operations.conf"
205 |         rm -f $CFG_DIR/openshift/output-operations.conf
206 |         touch $CFG_DIR/openshift/output-operations.conf
207 |         rm -f $CFG_DIR/openshift/filter-post-z-retag-*.conf $CFG_DIR/openshift/filter-post-mux-client.conf
208 |         if [ -n "$output_label"  ]; then
209 |             cp $CFG_DIR/{,openshift}/filter-post-z-retag-one.conf
210 |         fi
211 |     else
212 |         NUM_OUTPUTS=2
213 |         # Enable "output-es-ops-config.conf in output-operations.conf"
214 |         cp $CFG_DIR/{openshift,dynamic}/output-es-ops-config.conf
215 |         rm -f $CFG_DIR/openshift/filter-post-z-retag-*.conf $CFG_DIR/openshift/filter-post-mux-client.conf
216 |         if [ -n "$output_label" ]; then
217 |             cp $CFG_DIR/{,openshift}/filter-post-z-retag-two.conf
218 |         fi
219 |     fi
220 | fi
221 | 
222 | # If FILE_BUFFER_PATH exists and it is not a directory, mkdir fails with the error.
223 | FILE_BUFFER_PATH=/var/lib/fluentd
224 | mkdir -p $FILE_BUFFER_PATH
225 | 
226 | # Get the available disk size.
227 | DF_LIMIT=$(df -B1 $FILE_BUFFER_PATH | grep -v Filesystem | awk '{print $2}')
228 | DF_LIMIT=${DF_LIMIT:-0}
229 | if [ "${MUX_FILE_BUFFER_STORAGE_TYPE:-}" = "hostmount" ]; then
230 |     # Use 1/4 of the disk space for hostmount.
231 |     DF_LIMIT=$(expr $DF_LIMIT / 4) || :
232 | fi
233 | if [ $DF_LIMIT -eq 0 ]; then
234 |     echo "ERROR: No disk space is available for file buffer in $FILE_BUFFER_PATH."
235 |     exit 1
236 | fi
237 | # Determine final total given the number of outputs we have.
238 | TOTAL_LIMIT=$(echo ${FILE_BUFFER_LIMIT:-2Gi} | sed -e "s/[Kk]/*1024/g;s/[Mm]/*1024*1024/g;s/[Gg]/*1024*1024*1024/g;s/i//g" | bc) || :
239 | if [ $TOTAL_LIMIT -le 0 ]; then
240 |     echo "ERROR: Invalid file buffer limit ($FILE_BUFFER_LIMIT) is given.  Failed to convert to bytes."
241 |     exit 1
242 | fi
243 | 
244 | # If forward and secure-forward outputs are configured, add them to NUM_OUTPUTS.
245 | forward_files=$( grep -l "@type .*forward" ${CFG_DIR}/*/* 2> /dev/null || : )
246 | for afile in ${forward_files} ; do
247 |     file=$( basename $afile )
248 |     if [ "$file" != "${mux_client_filename:-}" ]; then
249 |         grep "@type .*forward" $afile | while read -r line; do
250 |             if [ $( expr "$line" : "^ *#" ) -eq 0 ]; then
251 |                 NUM_OUTPUTS=$( expr $NUM_OUTPUTS + 1 )
252 |             fi
253 |         done
254 |     fi
255 | done
256 | 
257 | TOTAL_LIMIT=$(expr $TOTAL_LIMIT \* $NUM_OUTPUTS) || :
258 | if [ $DF_LIMIT -lt $TOTAL_LIMIT ]; then
259 |     echo "WARNING: Available disk space ($DF_LIMIT bytes) is less than the user specified file buffer limit ($FILE_BUFFER_LIMIT times $NUM_OUTPUTS)."
260 |     TOTAL_LIMIT=$DF_LIMIT
261 | fi
262 | 
263 | BUFFER_SIZE_LIMIT=$(echo $BUFFER_SIZE_LIMIT |  sed -e "s/[Kk]/*1024/g;s/[Mm]/*1024*1024/g;s/[Gg]/*1024*1024*1024/g;s/i//g" | bc)
264 | BUFFER_SIZE_LIMIT=${BUFFER_SIZE_LIMIT:-16777216}
265 | 
266 | # TOTAL_BUFFER_SIZE_LIMIT per buffer
267 | TOTAL_BUFFER_SIZE_LIMIT=$(expr $TOTAL_LIMIT / $NUM_OUTPUTS) || :
268 | if [ -z $TOTAL_BUFFER_SIZE_LIMIT -o $TOTAL_BUFFER_SIZE_LIMIT -eq 0 ]; then
269 |     echo "ERROR: Calculated TOTAL_BUFFER_SIZE_LIMIT is 0. TOTAL_LIMIT $TOTAL_LIMIT is too small compared to NUM_OUTPUTS $NUM_OUTPUTS. Please increase FILE_BUFFER_LIMIT $FILE_BUFFER_LIMIT and/or the volume size of $FILE_BUFFER_PATH."
270 |     exit 1
271 | fi
272 | BUFFER_QUEUE_LIMIT=$(expr $TOTAL_BUFFER_SIZE_LIMIT / $BUFFER_SIZE_LIMIT) || :
273 | if [ -z $BUFFER_QUEUE_LIMIT -o $BUFFER_QUEUE_LIMIT -eq 0 ]; then
274 |     echo "ERROR: Calculated BUFFER_QUEUE_LIMIT is 0. TOTAL_BUFFER_SIZE_LIMIT $TOTAL_BUFFER_SIZE_LIMIT is too small compared to BUFFER_SIZE_LIMIT $BUFFER_SIZE_LIMIT. Please increase FILE_BUFFER_LIMIT $FILE_BUFFER_LIMIT and/or the volume size of $FILE_BUFFER_PATH."
275 |     exit 1
276 | fi
277 | export BUFFER_QUEUE_LIMIT BUFFER_SIZE_LIMIT
278 | 
279 | # http://docs.fluentd.org/v0.12/articles/monitoring
280 | if [ "${ENABLE_MONITOR_AGENT:-}" = true ] ; then
281 |     cp $CFG_DIR/input-pre-monitor.conf $CFG_DIR/openshift
282 |     # copy any user defined files, possibly overwriting the standard ones
283 |     if [ -f $CFG_DIR/user/input-pre-monitor.conf ] ; then
284 |         cp -f $CFG_DIR/user/input-pre-monitor.conf $CFG_DIR/openshift
285 |     fi
286 | else
287 |     rm -f $CFG_DIR/openshift/input-pre-monitor.conf
288 | fi
289 | 
290 | # http://docs.fluentd.org/v0.12/articles/monitoring#debug-port
291 | if [ "${ENABLE_DEBUG_AGENT:-}" = true ] ; then
292 |     cp $CFG_DIR/input-pre-debug.conf $CFG_DIR/openshift
293 |     # copy any user defined files, possibly overwriting the standard ones
294 |     if [ -f $CFG_DIR/user/input-pre-debug.conf ] ; then
295 |         cp -f $CFG_DIR/user/input-pre-debug.conf $CFG_DIR/openshift
296 |     fi
297 | else
298 |     rm -f $CFG_DIR/openshift/input-pre-debug.conf
299 | fi
300 | 
301 | # bug https://bugzilla.redhat.com/show_bug.cgi?id=1437952
302 | # pods unable to be terminated because fluentd has them busy
303 | if [ "${USE_MUX:-}" = "true" ] ; then
304 |     : # skip umount
305 | elif [ "${USE_CRIO:false}" = "false" ] ; then
306 |     # If oci-umount is fixed, we can remove this. 
307 |     echo "umounts of dead containers will fail. Ignoring..."
308 |     umount /var/lib/docker/containers/*/shm || :
309 | fi
310 | 
311 | if [[ "${USE_REMOTE_SYSLOG:-}" = "true" ]] ; then
312 |     # The symlink is a workaround for https://github.com/openshift/origin-aggregated-logging/issues/604
313 |     found=
314 |     for file in /usr/share/gems/gems/fluent-plugin-remote-syslog-*/lib/fluentd/plugin/*.rb ; do
315 |         bname=$(basename $file)
316 |         if [ ! -e "/etc/fluent/plugin/$bname" -a -f "$file" ] ; then
317 |             ln -s $file /etc/fluent/plugin/
318 |             found=true
319 |         fi
320 |     done
321 |     if [ -z "${found:-}" ] ; then
322 |         # not found in rpm location - look in alternate location
323 |         for file in /opt/app-root/src/gems/fluent-plugin-remote-syslog*/lib/fluentd/plugin/*.rb ; do
324 |             bname=$(basename $file)
325 |             if [ ! -e "/etc/fluent/plugin/$bname" -a -f "$file" ] ; then
326 |                 ln -s $file /etc/fluent/plugin/
327 |             fi
328 |         done
329 |     fi
330 |     if [[ $REMOTE_SYSLOG_HOST ]] ; then
331 |         ruby generate_syslog_config.rb
332 |     fi
333 | fi
334 | 
335 | # Disable process_kubernetes_events if TRANSFORM_EVENTS is false or MUX client.
336 | if [ "${TRANSFORM_EVENTS:-}" != true -o -n "${MUX_CLIENT_MODE:-}" ] ; then
337 |     sed -i 's/\(.*@type viaq_data_model.*\)/\1\n  process_kubernetes_events false/' $CFG_DIR/openshift/filter-viaq-data-model.conf
338 | fi
339 | 
340 | if [ "${AUDIT_CONTAINER_ENGINE:-}" = "true" ] ; then
341 |     cp -f $CFG_DIR/input-pre-audit-log.conf $CFG_DIR/openshift
342 |     cp -f $CFG_DIR/filter-pre-a-audit-exclude.conf $CFG_DIR/openshift
343 | else
344 |     touch $CFG_DIR/openshift/input-pre-audit-log.conf
345 |     touch $CFG_DIR/openshift/filter-pre-a-audit-exclude.conf
346 | fi
347 | 
348 | if [ "${ENABLE_UTF8_FILTER:-}" != true ] ; then
349 |     rm -f $CFG_DIR/openshift/filter-pre-force-utf8.conf
350 |     touch $CFG_DIR/openshift/filter-pre-force-utf8.conf
351 | fi
352 | 
353 | if type -p jemalloc-config > /dev/null 2>&1 && [ "${USE_JEMALLOC:-true}" = true ] ; then
354 |     export LD_PRELOAD=$( jemalloc-config --libdir )/libjemalloc.so.$( jemalloc-config --revision )
355 |     export LD_BIND_NOW=1 # workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1544815
356 | fi
357 | 
358 | # Include DEBUG log level messages when collecting from journald
359 | # https://bugzilla.redhat.com/show_bug.cgi?id=1505602
360 | if [ "${COLLECT_JOURNAL_DEBUG_LOGS:-true}" = true ] ; then
361 |   rm -f $CFG_DIR/openshift/filter-exclude-journal-debug.conf
362 |   touch $CFG_DIR/openshift/filter-exclude-journal-debug.conf
363 | fi
364 | 
365 | if [ "${ENABLE_PROMETHEUS_ENDPOINT}" != "true" ] ; then
366 |   echo "INFO: Disabling Prometheus endpint"
367 |   rm -f ${CFG_DIR}/openshift/input-pre-prometheus-metrics.conf
368 | fi
369 | 
370 | # Create a directory for Fluentd log files
371 | mkdir -p /var/log/fluentd/
372 | 
373 | issue_deprecation_warnings
374 | if [[ $DEBUG ]] ; then
375 |     exec fluentd $fluentdargs > /var/log/fluentd.log 2>&1
376 | else
377 |     exec fluentd $fluentdargs
378 | fi
379 | 


--------------------------------------------------------------------------------
/Chapter5/规避K8S APF问题.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter5/规避K8S APF问题.pdf


--------------------------------------------------------------------------------
/Chapter5/通过filetranspile修改ign:
--------------------------------------------------------------------------------
 1 | 修改Ignition有两种方法，第一种是通过base64转换想要注入的内容文件，然后将转换后的内容手工注入到Ignition对应的位置，这种方法较为繁琐，容易出错，这里我们不进行介绍。
 2 | 第二种方法是借助于filetranspile工具实现配置修改。
 3 | 我们首先在一台RHEL主机上安装filetranspile工具，这个工具的运行安装python，我先将RHEL上安装Python的步骤写出：
 4 | #subscription-manager register
 5 | #subscription-manager list --available
 6 | #subscription-manager attach --pool=8a85f99c6c2a4252016c3b86a6e130e4
 7 | #subscription-manager repos --enable rhel-7-server-optional-rpms --enable rhel-server-rhscl-7-rpms
 8 | #yum -y install python36 python-pip rh-python36-PyYAML
 9 | #scl enable rh-python36 bash
10 | 下面步骤是安装Python后，安装filetranspile的步骤。
11 | #curl -o filetranspile https://raw.githubusercontent.com/ashcrow/filetranspiler/master/filetranspile
12 | #chmod +x filetranspile
13 | #cp filetranspile /usr/bin/
14 | 
15 | 接下来，我们展示在OpenShift安装之前，如何通过filetranspile修改ignition的配置：
16 | 首先创建manifests并生在pre-install目录中成ignition配置，如下面步骤所示：
17 | [root@repo html]# openshift-install create manifests --dir pre-install/
18 | [root@repo html]# openshift-install create ignition-configs --dir=pre-install
19 | 
20 | 切换到pre-install目录，查看生成的文件，此时ign文件是没有定制化配置的。
21 | [root@repo html]# cd pre-install/
22 | [root@repo pre-install]# ls
23 | auth  bootstrap.ign  master.ign  metadata.json  rhcos-4.3.0-x86_64-metal.raw.gz  worker.ign
24 | 接下来，我们创建目录，先为master0创建：
25 | [root@repo pre-install]# mkdir -p master0/etc/sysconfig/network-scripts
26 | 在进行下面步骤之前，首先要通过CoreOS引导宿主机启动（虚拟机或者物理机），查看系统启动默认的网卡名（如ens33）名称，记录下来。
27 | 然后在目录中创建网卡配置文件，如下所示配置相应的网络相关的参数：
28 | [root@repo pre-install]# cat << EOF > master0/etc/sysconfig/network-scripts/ifcfg-ens33
29 | TYPE=Ethernet
30 | BOOTPROTO=none
31 | NAME=ens33
32 | DEVICE=ens33
33 | ONBOOT=yes
34 | IPADDR=192.168.137.203
35 | NETMASK=255.255.255.0
36 | GATEWAY=192.168.137.2
37 | DOMAIN=ocp4.example.com
38 | DNS1=192.168.137.202
39 | EOF
40 | 
41 | 接下来，创建DNS服务器配置文件，如下所示：
42 | [root@repo pre-install]# cat << EOF > master0/etc/resolv.conf
43 | nameserver 192.168.137.202
44 | EOF
45 | 
46 | 配置主机名文件：
47 | [root@repo pre-install]# cat << EOF > master0/etc/hostname
48 | master-0.ocp4.example.com
49 | EOF
50 | 然后利用filetranspile工具，以原始master.ign为蓝本，以上面书写的配置文件为参数注入，生成定制化的master0-static.ign文件。
51 | [root@repo pre-install]# filetranspile -i master.ign -f master0 -o master0-static.ign
52 | 我们用同样的方法，生成master1-static.ign、master2-static.ign文件，以及Worker节点的配置ign文件，如worker0-static.ign、master1-static.ign、master2-static.ign等。然后进行OpenShift安装，配置就可以被注入到CoreOS中了。
53 | 


--------------------------------------------------------------------------------
/Chapter6/README:
--------------------------------------------------------------------------------
1 | 
2 | 


--------------------------------------------------------------------------------
/Chapter6/bluegreen-deploy-template.yaml:
--------------------------------------------------------------------------------
  1 | apiVersion: v1
  2 | kind: Template
  3 | labels:
  4 |   template: bluegreen-deploy-template
  5 | message: A Jenkins server will be automatically instantiated in this project to manage
  6 |   the Pipeline BuildConfig created by this template.  You will be able to log in to
  7 |   it using your OpenShift user credentials.
  8 | metadata:
  9 |   annotations:
 10 |     description: This example showcases a blue green deployment using a Jenkins pipeline
 11 |       that pauses for approval.
 12 |     iconClass: icon-jenkins
 13 |     tags: instant-app,jenkins
 14 |   creationTimestamp: null
 15 |   name: bluegreen-deploy-pipeline
 16 | objects:
 17 | - apiVersion: v1
 18 |   kind: ImageStream
 19 |   metadata:
 20 |     name: ${NAME}
 21 |   spec:
 22 |     dockerImageRepository: ${IMAGE_NAME}
 23 | - apiVersion: v1
 24 |   kind: Route
 25 |   metadata:
 26 |     name: blue-${NAME}
 27 |   spec:
 28 |     to:
 29 |       kind: Service
 30 |       name: ${NAME}-blue
 31 | - apiVersion: v1
 32 |   kind: Route
 33 |   metadata:
 34 |     name: green-${NAME}
 35 |   spec:
 36 |     to:
 37 |       kind: Service
 38 |       name: ${NAME}-green
 39 | - apiVersion: v1
 40 |   kind: Route
 41 |   metadata:
 42 |     name: ${NAME}
 43 |   spec:
 44 |     alternateBackends:
 45 |     - name: ${NAME}-blue
 46 |       weight: 0
 47 |     to:
 48 |       kind: Service
 49 |       name: ${NAME}-green
 50 |       weight: 100
 51 | - apiVersion: v1
 52 |   kind: Service
 53 |   metadata:
 54 |     name: ${NAME}-blue
 55 |   spec:
 56 |     ports:
 57 |     - name: web
 58 |       port: 8080
 59 |       targetPort: 8080
 60 |     selector:
 61 |       name: ${NAME}-blue
 62 | - apiVersion: v1
 63 |   kind: DeploymentConfig
 64 |   metadata:
 65 |     annotations:
 66 |       description: Deploy the blue application.
 67 |     name: ${NAME}-blue
 68 |   spec:
 69 |     replicas: 1
 70 |     selector:
 71 |       name: ${NAME}-blue
 72 |     strategy:
 73 |       type: Rolling
 74 |     template:
 75 |       metadata:
 76 |         labels:
 77 |           name: ${NAME}-blue
 78 |         name: ${NAME}-blue
 79 |       spec:
 80 |         containers:
 81 |         - image: ' '
 82 |           name: jboss-tasks
 83 |           ports:
 84 |           - containerPort: 8080
 85 |     triggers:
 86 |     - imageChangeParams:
 87 |         automatic: true
 88 |         containerNames:
 89 |         - jboss-tasks
 90 |         from:
 91 |           kind: ImageStreamTag
 92 |           name: ${NAME}:blue
 93 |       type: ImageChange
 94 |     - type: ConfigChange
 95 | - apiVersion: v1
 96 |   kind: Service
 97 |   metadata:
 98 |     name: ${NAME}-green
 99 |   spec:
100 |     ports:
101 |     - name: web
102 |       port: 8080
103 |       targetPort: 8080
104 |     selector:
105 |       name: ${NAME}-green
106 | - apiVersion: v1
107 |   kind: DeploymentConfig
108 |   metadata:
109 |     annotations:
110 |       description: Deploy the application green.
111 |     name: ${NAME}-green
112 |   spec:
113 |     replicas: 1
114 |     selector:
115 |       name: ${NAME}-green
116 |     strategy:
117 |       type: Rolling
118 |     template:
119 |       metadata:
120 |         labels:
121 |           name: ${NAME}-green
122 |         name: ${NAME}-green
123 |       spec:
124 |         containers:
125 |         - image: ' '
126 |           name: jboss-tasks
127 |           ports:
128 |           - containerPort: 8080
129 |     triggers:
130 |     - imageChangeParams:
131 |         automatic: true
132 |         containerNames:
133 |         - jboss-tasks
134 |         from:
135 |           kind: ImageStreamTag
136 |           name: ${NAME}:green
137 |       type: ImageChange
138 |     - type: ConfigChange
139 | parameters:
140 | - description: The name assigned to all of the frontend objects defined in this template.
141 |   displayName: Name
142 |   name: NAME
143 |   required: true
144 |   value: jboss-tasks
145 | - description: The exposed hostname that will route to the Node.js service, if left
146 |     blank a value will be defaulted.
147 |   displayName: Application Hostname
148 |   name: APPLICATION_DOMAIN
149 | - description: Which image you want to deploy.
150 |   displayName: Release Image Name
151 |   name: IMAGE_NAME
152 |   required: true
153 |   value: registry.example.com/myapp/jboss-tasks
154 | 


--------------------------------------------------------------------------------
/Chapter6/bluegreen-pipeline.jenkinsfile:
--------------------------------------------------------------------------------
 1 | def newversion = 'prod-v1.1'
 2 | def stage_image_tag = 'stage-v1.1'
 3 | def prod_project_name = 'myapp-prod'
 4 | def appName="jboss-tasks"
 5 | try {
 6 |    timeout(time: 1, unit: 'HOURS') {
 7 |       def tag="blue"
 8 |       def altTag="green"
 9 |       def verbose="false"
10 | 
11 |       node {
12 |         project = prod_project_name
13 |         stage('Sync Image To Prod'){
14 |           def src = "docker://registry-stage.example.com/myapp/${appName}:${stage_image_tag}"
15 |           def dest = "docker://registry.example.com/myapp/${appName}:${newversion}"
16 |           sh 'skopeo  copy --src-tls-verify=false --dest-tls-verify=false --screds user1:<passwd> --dcreds user1:<passwd>  ' + src + ' ' + dest
17 |         }
18 | 
19 |         stage('Waitting for Approve'){
20 |           timeout(time:1, unit:'HOURS') {
21 |             println "是否允许发布${stage_image_tag}版本镜像到生产环境？"
22 |             input message: "Promote to Prod?", ok: "Promote"
23 |           }
24 |         }
25 | 
26 |         stage("Import New Images to OpenShift") {
27 |           echo "import images registry.example.com/myapp/${appName}:${newversion}"
28 |           sh "oc import-image jboss-tasks --all --insecure -n ${project}"
29 |         }
30 | 
31 |         stage("Initialize") {
32 |           sh "oc get route ${appName} -n ${project} -o jsonpath='{ .spec.to.name }' --loglevel=4 > activeservice"
33 |           activeService = readFile('activeservice').trim()
34 |           if (activeService == "${appName}-blue") {
35 |             tag = "green"
36 |             altTag = "blue"
37 |           }
38 |           sh "oc get route ${tag}-${appName} -n ${project} -o jsonpath='{ .spec.host }' --loglevel=4 > routehost"
39 |           routeHost = readFile('routehost').trim()
40 |         }
41 | 
42 | 
43 |         stage("Deploy Test") {
44 |           openshiftTag srcStream: appName, srcTag: newversion, destinationStream: appName, destinationTag: tag, verbose: verbose
45 |           openshiftVerifyDeployment deploymentConfig: "${appName}-${tag}", verbose: verbose
46 |         }
47 | 
48 |         stage("Test Traffic") {
49 |           input message: "Test deployment: http://${routeHost}. Approve to change Traffic?", id: "approval"
50 |         }
51 | 
52 |         stage("Go Live") {
53 |           sh "oc set -n ${project} route-backends ${appName} ${appName}-${tag}=100 ${appName}-${altTag}=0 --loglevel=4"
54 |         }
55 |       }
56 |    }
57 | } catch (err) {
58 |    echo "in catch block"
59 |    echo "Caught: ${err}"
60 |    currentBuild.result = 'FAILURE'
61 |    throw err
62 | }
63 | 


--------------------------------------------------------------------------------
/Chapter6/openshift4-on-aws-cn/README.md:
--------------------------------------------------------------------------------
1 | # openshift4-on-aws-cn
2 | 


--------------------------------------------------------------------------------
/Chapter6/openshift4-on-aws-cn/bootstrap_node.yaml:
--------------------------------------------------------------------------------
  1 | AWSTemplateFormatVersion: 2010-09-09
  2 | Description: Template for OpenShift Cluster Bootstrap (EC2 Instance, Security Groups and IAM)
  3 | 
  4 | Parameters:
  5 |   InfrastructureName:
  6 |     AllowedPattern: ^([a-zA-Z][a-zA-Z0-9\-]{0,26})$
  7 |     MaxLength: 27
  8 |     MinLength: 1
  9 |     ConstraintDescription: Infrastructure name must be alphanumeric, start with a letter, and have a maximum of 27 characters.
 10 |     Description: A short, unique cluster ID used to tag cloud resources and identify items owned or used by the cluster.
 11 |     Type: String
 12 |   RhcosAmi:
 13 |     Description: Current Red Hat Enterprise Linux CoreOS AMI to use for bootstrap.
 14 |     Type: AWS::EC2::Image::Id
 15 |   AllowedBootstrapSshCidr:
 16 |     AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|1[0-9]|2[0-9]|3[0-2]))$
 17 |     ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/0-32.
 18 |     Default: 0.0.0.0/0
 19 |     Description: CIDR block to allow SSH access to the bootstrap node.
 20 |     Type: String
 21 |   PublicSubnet:
 22 |     Description: The public subnet to launch the bootstrap node into.
 23 |     Type: AWS::EC2::Subnet::Id
 24 |   MasterSecurityGroupId:
 25 |     Description: The master security group ID for registering temporary rules.
 26 |     Type: AWS::EC2::SecurityGroup::Id
 27 |   VpcId:
 28 |     Description: The VPC-scoped resources will belong to this VPC.
 29 |     Type: AWS::EC2::VPC::Id
 30 |   BootstrapIgnitionLocation:
 31 |     Default: s3://my-s3-bucket/bootstrap.ign
 32 |     Description: Ignition config file location.
 33 |     Type: String
 34 |   AutoRegisterELB:
 35 |     Default: "yes"
 36 |     AllowedValues:
 37 |     - "yes"
 38 |     - "no"
 39 |     Description: Do you want to invoke NLB registration, which requires a Lambda ARN parameter?
 40 |     Type: String
 41 |   RegisterNlbIpTargetsLambdaArn:
 42 |     Description: ARN for NLB IP target registration lambda.
 43 |     Type: String
 44 |   ExternalApiTargetGroupArn:
 45 |     Description: ARN for external API load balancer target group.
 46 |     Type: String
 47 |   InternalApiTargetGroupArn:
 48 |     Description: ARN for internal API load balancer target group.
 49 |     Type: String
 50 |   InternalServiceTargetGroupArn:
 51 |     Description: ARN for internal service load balancer target group.
 52 |     Type: String
 53 | 
 54 | Metadata:
 55 |   AWS::CloudFormation::Interface:
 56 |     ParameterGroups:
 57 |     - Label:
 58 |         default: "Cluster Information"
 59 |       Parameters:
 60 |       - InfrastructureName
 61 |     - Label:
 62 |         default: "Host Information"
 63 |       Parameters:
 64 |       - RhcosAmi
 65 |       - BootstrapIgnitionLocation
 66 |       - MasterSecurityGroupId
 67 |     - Label:
 68 |         default: "Network Configuration"
 69 |       Parameters:
 70 |       - VpcId
 71 |       - AllowedBootstrapSshCidr
 72 |       - PublicSubnet
 73 |     - Label:
 74 |         default: "Load Balancer Automation"
 75 |       Parameters:
 76 |       - AutoRegisterELB
 77 |       - RegisterNlbIpTargetsLambdaArn
 78 |       - ExternalApiTargetGroupArn
 79 |       - InternalApiTargetGroupArn
 80 |       - InternalServiceTargetGroupArn
 81 |     ParameterLabels:
 82 |       InfrastructureName:
 83 |         default: "Infrastructure Name"
 84 |       VpcId:
 85 |         default: "VPC ID"
 86 |       AllowedBootstrapSshCidr:
 87 |         default: "Allowed SSH Source"
 88 |       PublicSubnet:
 89 |         default: "Public Subnet"
 90 |       RhcosAmi:
 91 |         default: "Red Hat Enterprise Linux CoreOS AMI ID"
 92 |       BootstrapIgnitionLocation:
 93 |         default: "Bootstrap Ignition Source"
 94 |       MasterSecurityGroupId:
 95 |         default: "Master Security Group ID"
 96 |       AutoRegisterELB:
 97 |         default: "Use Provided ELB Automation"
 98 | 
 99 | Conditions:
100 |   DoRegistration: !Equals ["yes", !Ref AutoRegisterELB]
101 | 
102 | Resources:
103 |   BootstrapIamRole:
104 |     Type: AWS::IAM::Role
105 |     Properties:
106 |       AssumeRolePolicyDocument:
107 |         Version: "2012-10-17"
108 |         Statement:
109 |         - Effect: "Allow"
110 |           Principal:
111 |             Service:
112 |             - !Sub "ec2.${AWS::URLSuffix}"
113 |           Action:
114 |           - "sts:AssumeRole"
115 |       Path: "/"
116 |       Policies:
117 |       - PolicyName: !Join ["-", [!Ref InfrastructureName, "bootstrap", "policy"]]
118 |         PolicyDocument:
119 |           Version: "2012-10-17"
120 |           Statement:
121 |           - Effect: "Allow"
122 |             Action: "ec2:Describe*"
123 |             Resource: "*"
124 |           - Effect: "Allow"
125 |             Action: "ec2:AttachVolume"
126 |             Resource: "*"
127 |           - Effect: "Allow"
128 |             Action: "ec2:DetachVolume"
129 |             Resource: "*"
130 |           - Effect: "Allow"
131 |             Action: "s3:GetObject"
132 |             Resource: "*"
133 | 
134 |   BootstrapInstanceProfile:
135 |     Type: "AWS::IAM::InstanceProfile"
136 |     Properties:
137 |       Path: "/"
138 |       Roles:
139 |       - Ref: "BootstrapIamRole"
140 | 
141 |   BootstrapSecurityGroup:
142 |     Type: AWS::EC2::SecurityGroup
143 |     Properties:
144 |       GroupDescription: Cluster Bootstrap Security Group
145 |       SecurityGroupIngress:
146 |       - IpProtocol: tcp
147 |         FromPort: 22
148 |         ToPort: 22
149 |         CidrIp: !Ref AllowedBootstrapSshCidr
150 |       - IpProtocol: tcp
151 |         ToPort: 19531
152 |         FromPort: 19531
153 |         CidrIp: 0.0.0.0/0
154 |       VpcId: !Ref VpcId
155 | 
156 |   BootstrapInstance:
157 |     Type: AWS::EC2::Instance
158 |     Properties:
159 |       ImageId: !Ref RhcosAmi
160 |       IamInstanceProfile: !Ref BootstrapInstanceProfile
161 |       InstanceType: "i3.large"
162 |       NetworkInterfaces:
163 |       - AssociatePublicIpAddress: "true"
164 |         DeviceIndex: "0"
165 |         GroupSet:
166 |         - !Ref "BootstrapSecurityGroup"
167 |         - !Ref "MasterSecurityGroupId"
168 |         SubnetId: !Ref "PublicSubnet"
169 |       UserData:
170 |         Fn::Base64: !Sub
171 |         - '{"ignition":{"config":{"replace":{"source":"${S3Loc}","verification":{}}},"timeouts":{},"version":"2.1.0"},"networkd":{},"passwd":{},"storage":{},"systemd":{}}'
172 |         - {
173 |           S3Loc: !Ref BootstrapIgnitionLocation
174 |         }
175 | 
176 |   RegisterBootstrapApiTarget:
177 |     Condition: DoRegistration
178 |     Type: Custom::NLBRegister
179 |     Properties:
180 |       ServiceToken: !Ref RegisterNlbIpTargetsLambdaArn
181 |       TargetArn: !Ref ExternalApiTargetGroupArn
182 |       TargetIp: !GetAtt BootstrapInstance.PrivateIp
183 | 
184 |   RegisterBootstrapInternalApiTarget:
185 |     Condition: DoRegistration
186 |     Type: Custom::NLBRegister
187 |     Properties:
188 |       ServiceToken: !Ref RegisterNlbIpTargetsLambdaArn
189 |       TargetArn: !Ref InternalApiTargetGroupArn
190 |       TargetIp: !GetAtt BootstrapInstance.PrivateIp
191 | 
192 |   RegisterBootstrapInternalServiceTarget:
193 |     Condition: DoRegistration
194 |     Type: Custom::NLBRegister
195 |     Properties:
196 |       ServiceToken: !Ref RegisterNlbIpTargetsLambdaArn
197 |       TargetArn: !Ref InternalServiceTargetGroupArn
198 |       TargetIp: !GetAtt BootstrapInstance.PrivateIp
199 | 
200 | Outputs:
201 |   BootstrapInstanceId:
202 |     Description: Bootstrap Instance ID.
203 |     Value: !Ref BootstrapInstance
204 | 
205 |   BootstrapPublicIp:
206 |     Description: The bootstrap node public IP address.
207 |     Value: !GetAtt BootstrapInstance.PublicIp
208 | 
209 |   BootstrapPrivateIp:
210 |     Description: The bootstrap node private IP address.
211 |     Value: !GetAtt BootstrapInstance.PrivateIp
212 | 


--------------------------------------------------------------------------------
/Chapter6/openshift4-on-aws-cn/control_plane_nodes.yaml:
--------------------------------------------------------------------------------
  1 | AWSTemplateFormatVersion: 2010-09-09
  2 | Description: Template for OpenShift Cluster Node Launch (EC2 master instances)
  3 | 
  4 | Parameters:
  5 |   InfrastructureName:
  6 |     AllowedPattern: ^([a-zA-Z][a-zA-Z0-9\-]{0,26})$
  7 |     MaxLength: 27
  8 |     MinLength: 1
  9 |     ConstraintDescription: Infrastructure name must be alphanumeric, start with a letter, and have a maximum of 27 characters.
 10 |     Description: A short, unique cluster ID used to tag nodes for the kubelet cloud provider.
 11 |     Type: String
 12 |   RhcosAmi:
 13 |     Description: Current Red Hat Enterprise Linux CoreOS AMI to use for bootstrap.
 14 |     Type: AWS::EC2::Image::Id
 15 |   AutoRegisterDNS:
 16 |     Default: "yes"
 17 |     AllowedValues:
 18 |     - "yes"
 19 |     - "no"
 20 |     Description: Do you want to invoke DNS etcd registration, which requires Hosted Zone information?
 21 |     Type: String
 22 |   PrivateHostedZoneId:
 23 |     Description: The Route53 private zone ID to register the etcd targets with, such as Z21IXYZABCZ2A4.
 24 |     Type: String
 25 |   PrivateHostedZoneName:
 26 |     Description: The Route53 zone to register the targets with, such as cluster.example.com. Omit the trailing period.
 27 |     Type: String
 28 |   Master0Subnet:
 29 |     Description: The subnets, recommend private, to launch the master nodes into.
 30 |     Type: AWS::EC2::Subnet::Id
 31 |   Master1Subnet:
 32 |     Description: The subnets, recommend private, to launch the master nodes into.
 33 |     Type: AWS::EC2::Subnet::Id
 34 |   Master2Subnet:
 35 |     Description: The subnets, recommend private, to launch the master nodes into.
 36 |     Type: AWS::EC2::Subnet::Id
 37 |   MasterSecurityGroupId:
 38 |     Description: The master security group ID to associate with master nodes.
 39 |     Type: AWS::EC2::SecurityGroup::Id
 40 |   IgnitionLocation:
 41 |     Default: https://api-int.$CLUSTER_NAME.$DOMAIN:22623/config/master
 42 |     Description: Ignition config file location.
 43 |     Type: String
 44 |   CertificateAuthorities:
 45 |     Default: data:text/plain;charset=utf-8;base64,ABC...xYz==
 46 |     Description: Base64 encoded certificate authority string to use.
 47 |     Type: String
 48 |   MasterInstanceProfileName:
 49 |     Description: IAM profile to associate with master nodes.
 50 |     Type: String
 51 |   MasterInstanceType:
 52 |     Default: m4.xlarge
 53 |     Type: String
 54 |     AllowedValues:
 55 |     - "m4.xlarge"
 56 |     - "m4.2xlarge"
 57 |     - "m4.4xlarge"
 58 |     - "m4.8xlarge"
 59 |     - "m4.10xlarge"
 60 |     - "m4.16xlarge"
 61 |     - "c4.2xlarge"
 62 |     - "c4.4xlarge"
 63 |     - "c4.8xlarge"
 64 |     - "r4.xlarge"
 65 |     - "r4.2xlarge"
 66 |     - "r4.4xlarge"
 67 |     - "r4.8xlarge"
 68 |     - "r4.16xlarge"
 69 |   AutoRegisterELB:
 70 |     Default: "yes"
 71 |     AllowedValues:
 72 |     - "yes"
 73 |     - "no"
 74 |     Description: Do you want to invoke NLB registration, which requires a Lambda ARN parameter?
 75 |     Type: String
 76 |   RegisterNlbIpTargetsLambdaArn:
 77 |     Description: ARN for NLB IP target registration lambda. Supply the value from the cluster infrastructure or select "no" for AutoRegisterELB.
 78 |     Type: String
 79 |   ExternalApiTargetGroupArn:
 80 |     Description: ARN for external API load balancer target group. Supply the value from the cluster infrastructure or select "no" for AutoRegisterELB.
 81 |     Type: String
 82 |   InternalApiTargetGroupArn:
 83 |     Description: ARN for internal API load balancer target group. Supply the value from the cluster infrastructure or select "no" for AutoRegisterELB.
 84 |     Type: String
 85 |   InternalServiceTargetGroupArn:
 86 |     Description: ARN for internal service load balancer target group. Supply the value from the cluster infrastructure or select "no" for AutoRegisterELB.
 87 |     Type: String
 88 | 
 89 | Metadata:
 90 |   AWS::CloudFormation::Interface:
 91 |     ParameterGroups:
 92 |     - Label:
 93 |         default: "Cluster Information"
 94 |       Parameters:
 95 |       - InfrastructureName
 96 |     - Label:
 97 |         default: "Host Information"
 98 |       Parameters:
 99 |       - MasterInstanceType
100 |       - RhcosAmi
101 |       - IgnitionLocation
102 |       - CertificateAuthorities
103 |       - MasterSecurityGroupId
104 |       - MasterInstanceProfileName
105 |     - Label:
106 |         default: "Network Configuration"
107 |       Parameters:
108 |       - VpcId
109 |       - AllowedBootstrapSshCidr
110 |       - Master0Subnet
111 |       - Master1Subnet
112 |       - Master2Subnet
113 |     - Label:
114 |         default: "DNS"
115 |       Parameters:
116 |       - AutoRegisterDNS
117 |       - PrivateHostedZoneName
118 |       - PrivateHostedZoneId
119 |     - Label:
120 |         default: "Load Balancer Automation"
121 |       Parameters:
122 |       - AutoRegisterELB
123 |       - RegisterNlbIpTargetsLambdaArn
124 |       - ExternalApiTargetGroupArn
125 |       - InternalApiTargetGroupArn
126 |       - InternalServiceTargetGroupArn
127 |     ParameterLabels:
128 |       InfrastructureName:
129 |         default: "Infrastructure Name"
130 |       VpcId:
131 |         default: "VPC ID"
132 |       Master0Subnet:
133 |         default: "Master-0 Subnet"
134 |       Master1Subnet:
135 |         default: "Master-1 Subnet"
136 |       Master2Subnet:
137 |         default: "Master-2 Subnet"
138 |       MasterInstanceType:
139 |         default: "Master Instance Type"
140 |       MasterInstanceProfileName:
141 |         default: "Master Instance Profile Name"
142 |       RhcosAmi:
143 |         default: "Red Hat Enterprise Linux CoreOS AMI ID"
144 |       IgnitionLocation:
145 |         default: "Master Ignition Source"
146 |       CertificateAuthorities:
147 |         default: "Ignition CA String"
148 |       MasterSecurityGroupId:
149 |         default: "Master Security Group ID"
150 |       AutoRegisterDNS:
151 |         default: "Use Provided DNS Automation"
152 |       AutoRegisterELB:
153 |         default: "Use Provided ELB Automation"
154 |       PrivateHostedZoneName:
155 |         default: "Private Hosted Zone Name"
156 |       PrivateHostedZoneId:
157 |         default: "Private Hosted Zone ID"
158 | 
159 | Conditions:
160 |   DoRegistration: !Equals ["yes", !Ref AutoRegisterELB]
161 |   DoDns: !Equals ["yes", !Ref AutoRegisterDNS]
162 | 
163 | Resources:
164 |   Master0:
165 |     Type: AWS::EC2::Instance
166 |     Properties:
167 |       ImageId: !Ref RhcosAmi
168 |       BlockDeviceMappings:
169 |       - DeviceName: /dev/xvda
170 |         Ebs:
171 |           VolumeSize: "120"
172 |           VolumeType: "gp2"
173 |       IamInstanceProfile: !Ref MasterInstanceProfileName
174 |       InstanceType: !Ref MasterInstanceType
175 |       NetworkInterfaces:
176 |       - AssociatePublicIpAddress: "false"
177 |         DeviceIndex: "0"
178 |         GroupSet:
179 |         - !Ref "MasterSecurityGroupId"
180 |         SubnetId: !Ref "Master0Subnet"
181 |       UserData:
182 |         Fn::Base64: !Sub
183 |         - '{"ignition":{"config":{"append":[{"source":"${SOURCE}","verification":{}}]},"security":{"tls":{"certificateAuthorities":[{"source":"${CA_BUNDLE}","verification":{}}]}},"timeouts":{},"version":"2.2.0"},"networkd":{},"passwd":{},"storage":{},"systemd":{}}'
184 |         - {
185 |           SOURCE: !Ref IgnitionLocation,
186 |           CA_BUNDLE: !Ref CertificateAuthorities,
187 |         }
188 |       Tags:
189 |       - Key: !Join ["", ["kubernetes.io/cluster/", !Ref InfrastructureName]]
190 |         Value: "shared"
191 | 
192 |   RegisterMaster0:
193 |     Condition: DoRegistration
194 |     Type: Custom::NLBRegister
195 |     Properties:
196 |       ServiceToken: !Ref RegisterNlbIpTargetsLambdaArn
197 |       TargetArn: !Ref ExternalApiTargetGroupArn
198 |       TargetIp: !GetAtt Master0.PrivateIp
199 | 
200 |   RegisterMaster0InternalApiTarget:
201 |     Condition: DoRegistration
202 |     Type: Custom::NLBRegister
203 |     Properties:
204 |       ServiceToken: !Ref RegisterNlbIpTargetsLambdaArn
205 |       TargetArn: !Ref InternalApiTargetGroupArn
206 |       TargetIp: !GetAtt Master0.PrivateIp
207 | 
208 |   RegisterMaster0InternalServiceTarget:
209 |     Condition: DoRegistration
210 |     Type: Custom::NLBRegister
211 |     Properties:
212 |       ServiceToken: !Ref RegisterNlbIpTargetsLambdaArn
213 |       TargetArn: !Ref InternalServiceTargetGroupArn
214 |       TargetIp: !GetAtt Master0.PrivateIp
215 | 
216 |   Master1:
217 |     Type: AWS::EC2::Instance
218 |     Properties:
219 |       ImageId: !Ref RhcosAmi
220 |       BlockDeviceMappings:
221 |       - DeviceName: /dev/xvda
222 |         Ebs:
223 |           VolumeSize: "120"
224 |           VolumeType: "gp2"
225 |       IamInstanceProfile: !Ref MasterInstanceProfileName
226 |       InstanceType: !Ref MasterInstanceType
227 |       NetworkInterfaces:
228 |       - AssociatePublicIpAddress: "false"
229 |         DeviceIndex: "0"
230 |         GroupSet:
231 |         - !Ref "MasterSecurityGroupId"
232 |         SubnetId: !Ref "Master1Subnet"
233 |       UserData:
234 |         Fn::Base64: !Sub
235 |         - '{"ignition":{"config":{"append":[{"source":"${SOURCE}","verification":{}}]},"security":{"tls":{"certificateAuthorities":[{"source":"${CA_BUNDLE}","verification":{}}]}},"timeouts":{},"version":"2.2.0"},"networkd":{},"passwd":{},"storage":{},"systemd":{}}'
236 |         - {
237 |           SOURCE: !Ref IgnitionLocation,
238 |           CA_BUNDLE: !Ref CertificateAuthorities,
239 |         }
240 |       Tags:
241 |       - Key: !Join ["", ["kubernetes.io/cluster/", !Ref InfrastructureName]]
242 |         Value: "shared"
243 | 
244 |   RegisterMaster1:
245 |     Condition: DoRegistration
246 |     Type: Custom::NLBRegister
247 |     Properties:
248 |       ServiceToken: !Ref RegisterNlbIpTargetsLambdaArn
249 |       TargetArn: !Ref ExternalApiTargetGroupArn
250 |       TargetIp: !GetAtt Master1.PrivateIp
251 | 
252 |   RegisterMaster1InternalApiTarget:
253 |     Condition: DoRegistration
254 |     Type: Custom::NLBRegister
255 |     Properties:
256 |       ServiceToken: !Ref RegisterNlbIpTargetsLambdaArn
257 |       TargetArn: !Ref InternalApiTargetGroupArn
258 |       TargetIp: !GetAtt Master1.PrivateIp
259 | 
260 |   RegisterMaster1InternalServiceTarget:
261 |     Condition: DoRegistration
262 |     Type: Custom::NLBRegister
263 |     Properties:
264 |       ServiceToken: !Ref RegisterNlbIpTargetsLambdaArn
265 |       TargetArn: !Ref InternalServiceTargetGroupArn
266 |       TargetIp: !GetAtt Master1.PrivateIp
267 | 
268 |   Master2:
269 |     Type: AWS::EC2::Instance
270 |     Properties:
271 |       ImageId: !Ref RhcosAmi
272 |       BlockDeviceMappings:
273 |       - DeviceName: /dev/xvda
274 |         Ebs:
275 |           VolumeSize: "120"
276 |           VolumeType: "gp2"
277 |       IamInstanceProfile: !Ref MasterInstanceProfileName
278 |       InstanceType: !Ref MasterInstanceType
279 |       NetworkInterfaces:
280 |       - AssociatePublicIpAddress: "false"
281 |         DeviceIndex: "0"
282 |         GroupSet:
283 |         - !Ref "MasterSecurityGroupId"
284 |         SubnetId: !Ref "Master2Subnet"
285 |       UserData:
286 |         Fn::Base64: !Sub
287 |         - '{"ignition":{"config":{"append":[{"source":"${SOURCE}","verification":{}}]},"security":{"tls":{"certificateAuthorities":[{"source":"${CA_BUNDLE}","verification":{}}]}},"timeouts":{},"version":"2.2.0"},"networkd":{},"passwd":{},"storage":{},"systemd":{}}'
288 |         - {
289 |           SOURCE: !Ref IgnitionLocation,
290 |           CA_BUNDLE: !Ref CertificateAuthorities,
291 |         }
292 |       Tags:
293 |       - Key: !Join ["", ["kubernetes.io/cluster/", !Ref InfrastructureName]]
294 |         Value: "shared"
295 | 
296 |   RegisterMaster2:
297 |     Condition: DoRegistration
298 |     Type: Custom::NLBRegister
299 |     Properties:
300 |       ServiceToken: !Ref RegisterNlbIpTargetsLambdaArn
301 |       TargetArn: !Ref ExternalApiTargetGroupArn
302 |       TargetIp: !GetAtt Master2.PrivateIp
303 | 
304 |   RegisterMaster2InternalApiTarget:
305 |     Condition: DoRegistration
306 |     Type: Custom::NLBRegister
307 |     Properties:
308 |       ServiceToken: !Ref RegisterNlbIpTargetsLambdaArn
309 |       TargetArn: !Ref InternalApiTargetGroupArn
310 |       TargetIp: !GetAtt Master2.PrivateIp
311 | 
312 |   RegisterMaster2InternalServiceTarget:
313 |     Condition: DoRegistration
314 |     Type: Custom::NLBRegister
315 |     Properties:
316 |       ServiceToken: !Ref RegisterNlbIpTargetsLambdaArn
317 |       TargetArn: !Ref InternalServiceTargetGroupArn
318 |       TargetIp: !GetAtt Master2.PrivateIp
319 | 
320 |   EtcdSrvRecords:
321 |     Condition: DoDns
322 |     Type: AWS::Route53::RecordSet
323 |     Properties:
324 |       HostedZoneId: !Ref PrivateHostedZoneId
325 |       Name: !Join [".", ["_etcd-server-ssl._tcp", !Ref PrivateHostedZoneName]]
326 |       ResourceRecords:
327 |       - !Join [
328 |         " ",
329 |         ["0 10 2380", !Join [".", ["etcd-0", !Ref PrivateHostedZoneName]]],
330 |       ]
331 |       - !Join [
332 |         " ",
333 |         ["0 10 2380", !Join [".", ["etcd-1", !Ref PrivateHostedZoneName]]],
334 |       ]
335 |       - !Join [
336 |         " ",
337 |         ["0 10 2380", !Join [".", ["etcd-2", !Ref PrivateHostedZoneName]]],
338 |       ]
339 |       TTL: 60
340 |       Type: SRV
341 | 
342 |   Etcd0Record:
343 |     Condition: DoDns
344 |     Type: AWS::Route53::RecordSet
345 |     Properties:
346 |       HostedZoneId: !Ref PrivateHostedZoneId
347 |       Name: !Join [".", ["etcd-0", !Ref PrivateHostedZoneName]]
348 |       ResourceRecords:
349 |       - !GetAtt Master0.PrivateIp
350 |       TTL: 60
351 |       Type: A
352 | 
353 |   Etcd1Record:
354 |     Condition: DoDns
355 |     Type: AWS::Route53::RecordSet
356 |     Properties:
357 |       HostedZoneId: !Ref PrivateHostedZoneId
358 |       Name: !Join [".", ["etcd-1", !Ref PrivateHostedZoneName]]
359 |       ResourceRecords:
360 |       - !GetAtt Master1.PrivateIp
361 |       TTL: 60
362 |       Type: A
363 | 
364 |   Etcd2Record:
365 |     Condition: DoDns
366 |     Type: AWS::Route53::RecordSet
367 |     Properties:
368 |       HostedZoneId: !Ref PrivateHostedZoneId
369 |       Name: !Join [".", ["etcd-2", !Ref PrivateHostedZoneName]]
370 |       ResourceRecords:
371 |       - !GetAtt Master2.PrivateIp
372 |       TTL: 60
373 |       Type: A
374 | 
375 | Outputs:
376 |   PrivateIPs:
377 |     Description: The control-plane node private IP addresses.
378 |     Value:
379 |       !Join [
380 |         ",",
381 |         [!GetAtt Master0.PrivateIp, !GetAtt Master1.PrivateIp, !GetAtt Master2.PrivateIp]
382 |       ]
383 | 


--------------------------------------------------------------------------------
/Chapter6/openshift4-on-aws-cn/elb_dns.yaml:
--------------------------------------------------------------------------------
  1 | AWSTemplateFormatVersion: 2010-09-09
  2 | Description: Template for OpenShift Cluster Network Elements (Route53 & LBs)
  3 | 
  4 | Parameters:
  5 |   ClusterName:
  6 |     AllowedPattern: ^([a-zA-Z][a-zA-Z0-9\-]{0,26})$
  7 |     MaxLength: 27
  8 |     MinLength: 1
  9 |     ConstraintDescription: Cluster name must be alphanumeric, start with a letter, and have a maximum of 27 characters.
 10 |     Description: A short, representative cluster name to use for host names and other identifying names.
 11 |     Type: String
 12 |   InfrastructureName:
 13 |     AllowedPattern: ^([a-zA-Z][a-zA-Z0-9\-]{0,26})$
 14 |     MaxLength: 27
 15 |     MinLength: 1
 16 |     ConstraintDescription: Infrastructure name must be alphanumeric, start with a letter, and have a maximum of 27 characters.
 17 |     Description: A short, unique cluster ID used to tag cloud resources and identify items owned or used by the cluster.
 18 |     Type: String
 19 |   HostedZoneId:
 20 |     Description: The Route53 public zone ID to register the targets with, such as Z21IXYZABCZ2A4.
 21 |     Type: String
 22 |   HostedZoneName:
 23 |     Description: The Route53 zone to register the targets with, such as example.com. Omit the trailing period.
 24 |     Type: String
 25 |     Default: "example.com"
 26 |   PublicSubnets:
 27 |     Description: The internet-facing subnets.
 28 |     Type: List<AWS::EC2::Subnet::Id>
 29 |   PrivateSubnets:
 30 |     Description: The internal subnets.
 31 |     Type: List<AWS::EC2::Subnet::Id>
 32 |   VpcId:
 33 |     Description: The VPC-scoped resources will belong to this VPC.
 34 |     Type: AWS::EC2::VPC::Id
 35 | 
 36 | Metadata:
 37 |   AWS::CloudFormation::Interface:
 38 |     ParameterGroups:
 39 |     - Label:
 40 |         default: "Cluster Information"
 41 |       Parameters:
 42 |       - ClusterName
 43 |       - InfrastructureName
 44 |     - Label:
 45 |         default: "Network Configuration"
 46 |       Parameters:
 47 |       - VpcId
 48 |       - PublicSubnets
 49 |       - PrivateSubnets
 50 |     - Label:
 51 |         default: "DNS"
 52 |       Parameters:
 53 |       - HostedZoneName
 54 |       - HostedZoneId
 55 |     ParameterLabels:
 56 |       ClusterName:
 57 |         default: "Cluster Name"
 58 |       InfrastructureName:
 59 |         default: "Infrastructure Name"
 60 |       VpcId:
 61 |         default: "VPC ID"
 62 |       PublicSubnets:
 63 |         default: "Public Subnets"
 64 |       PrivateSubnets:
 65 |         default: "Private Subnets"
 66 |       HostedZoneName:
 67 |         default: "Public Hosted Zone Name"
 68 |       HostedZoneId:
 69 |         default: "Public Hosted Zone ID"
 70 | 
 71 | Resources:
 72 |   ExtApiElb:
 73 |     Type: AWS::ElasticLoadBalancingV2::LoadBalancer
 74 |     Properties:
 75 |       Name: !Join ["-", [!Ref InfrastructureName, "ext"]]
 76 |       IpAddressType: ipv4
 77 |       Subnets: !Ref PublicSubnets
 78 |       Type: network
 79 | 
 80 |   IntApiElb:
 81 |     Type: AWS::ElasticLoadBalancingV2::LoadBalancer
 82 |     Properties:
 83 |       Name: !Join ["-", [!Ref InfrastructureName, "int"]]
 84 |       Scheme: internal
 85 |       IpAddressType: ipv4
 86 |       Subnets: !Ref PrivateSubnets
 87 |       Type: network
 88 | 
 89 |   IntDns:
 90 |     Type: "AWS::Route53::HostedZone"
 91 |     Properties:
 92 |       HostedZoneConfig:
 93 |         Comment: "Managed by CloudFormation"
 94 |       Name: !Join [".", [!Ref ClusterName, !Ref HostedZoneName]]
 95 |       HostedZoneTags:
 96 |       - Key: Name
 97 |         Value: !Join ["-", [!Ref InfrastructureName, "int"]]
 98 |       - Key: !Join ["", ["kubernetes.io/cluster/", !Ref InfrastructureName]]
 99 |         Value: "owned"
100 |       VPCs:
101 |       - VPCId: !Ref VpcId
102 |         VPCRegion: !Ref "AWS::Region"
103 | 
104 |   ExternalApiServerRecord:
105 |     Type: AWS::Route53::RecordSetGroup
106 |     Properties:
107 |       Comment: Alias record for the API server
108 |       HostedZoneId: !Ref HostedZoneId
109 |       RecordSets:
110 |       - Name:
111 |           !Join [
112 |             ".",
113 |             ["api", !Ref ClusterName, !Join ["", [!Ref HostedZoneName, "."]]],
114 |           ]
115 |         Type: A
116 |         AliasTarget:
117 |           HostedZoneId: !GetAtt ExtApiElb.CanonicalHostedZoneID
118 |           DNSName: !GetAtt ExtApiElb.DNSName
119 | 
120 |   InternalApiServerRecord:
121 |     Type: AWS::Route53::RecordSetGroup
122 |     Properties:
123 |       Comment: Alias record for the API server
124 |       HostedZoneId: !Ref IntDns
125 |       RecordSets:
126 |       - Name:
127 |           !Join [
128 |             ".",
129 |             ["api", !Ref ClusterName, !Join ["", [!Ref HostedZoneName, "."]]],
130 |           ]
131 |         Type: A
132 |         AliasTarget:
133 |           HostedZoneId: !GetAtt IntApiElb.CanonicalHostedZoneID
134 |           DNSName: !GetAtt IntApiElb.DNSName
135 |       - Name:
136 |           !Join [
137 |             ".",
138 |             ["api-int", !Ref ClusterName, !Join ["", [!Ref HostedZoneName, "."]]],
139 |           ]
140 |         Type: A
141 |         AliasTarget:
142 |           HostedZoneId: !GetAtt IntApiElb.CanonicalHostedZoneID
143 |           DNSName: !GetAtt IntApiElb.DNSName
144 | 
145 |   ExternalApiListener:
146 |     Type: AWS::ElasticLoadBalancingV2::Listener
147 |     Properties:
148 |       DefaultActions:
149 |       - Type: forward
150 |         TargetGroupArn:
151 |           Ref: ExternalApiTargetGroup
152 |       LoadBalancerArn:
153 |         Ref: ExtApiElb
154 |       Port: 6443
155 |       Protocol: TCP
156 | 
157 |   ExternalApiTargetGroup:
158 |     Type: AWS::ElasticLoadBalancingV2::TargetGroup
159 |     Properties:
160 |       Port: 6443
161 |       Protocol: TCP
162 |       TargetType: ip
163 |       VpcId:
164 |         Ref: VpcId
165 |       TargetGroupAttributes:
166 |       - Key: deregistration_delay.timeout_seconds
167 |         Value: 60
168 | 
169 |   InternalApiListener:
170 |     Type: AWS::ElasticLoadBalancingV2::Listener
171 |     Properties:
172 |       DefaultActions:
173 |       - Type: forward
174 |         TargetGroupArn:
175 |           Ref: InternalApiTargetGroup
176 |       LoadBalancerArn:
177 |         Ref: IntApiElb
178 |       Port: 6443
179 |       Protocol: TCP
180 | 
181 |   InternalApiTargetGroup:
182 |     Type: AWS::ElasticLoadBalancingV2::TargetGroup
183 |     Properties:
184 |       Port: 6443
185 |       Protocol: TCP
186 |       TargetType: ip
187 |       VpcId:
188 |         Ref: VpcId
189 |       TargetGroupAttributes:
190 |       - Key: deregistration_delay.timeout_seconds
191 |         Value: 60
192 | 
193 |   InternalServiceInternalListener:
194 |     Type: AWS::ElasticLoadBalancingV2::Listener
195 |     Properties:
196 |       DefaultActions:
197 |       - Type: forward
198 |         TargetGroupArn:
199 |           Ref: InternalServiceTargetGroup
200 |       LoadBalancerArn:
201 |         Ref: IntApiElb
202 |       Port: 22623
203 |       Protocol: TCP
204 | 
205 |   InternalServiceTargetGroup:
206 |     Type: AWS::ElasticLoadBalancingV2::TargetGroup
207 |     Properties:
208 |       Port: 22623
209 |       Protocol: TCP
210 |       TargetType: ip
211 |       VpcId:
212 |         Ref: VpcId
213 |       TargetGroupAttributes:
214 |       - Key: deregistration_delay.timeout_seconds
215 |         Value: 60
216 | 
217 |   RegisterTargetLambdaIamRole:
218 |     Type: AWS::IAM::Role
219 |     Properties:
220 |       RoleName: !Join ["-", [!Ref InfrastructureName, "nlb", "lambda", "role"]]
221 |       AssumeRolePolicyDocument:
222 |         Version: "2012-10-17"
223 |         Statement:
224 |         - Effect: "Allow"
225 |           Principal:
226 |             Service:
227 |             - "lambda.amazonaws.com"
228 |           Action:
229 |           - "sts:AssumeRole"
230 |       Path: "/"
231 |       Policies:
232 |       - PolicyName: !Join ["-", [!Ref InfrastructureName, "master", "policy"]]
233 |         PolicyDocument:
234 |           Version: "2012-10-17"
235 |           Statement:
236 |           - Effect: "Allow"
237 |             Action:
238 |               [
239 |                 "elasticloadbalancing:RegisterTargets",
240 |                 "elasticloadbalancing:DeregisterTargets",
241 |               ]
242 |             Resource: !Ref InternalApiTargetGroup
243 |           - Effect: "Allow"
244 |             Action:
245 |               [
246 |                 "elasticloadbalancing:RegisterTargets",
247 |                 "elasticloadbalancing:DeregisterTargets",
248 |               ]
249 |             Resource: !Ref InternalServiceTargetGroup
250 |           - Effect: "Allow"
251 |             Action:
252 |               [
253 |                 "elasticloadbalancing:RegisterTargets",
254 |                 "elasticloadbalancing:DeregisterTargets",
255 |               ]
256 |             Resource: !Ref ExternalApiTargetGroup
257 | 
258 |   RegisterNlbIpTargets:
259 |     Type: "AWS::Lambda::Function"
260 |     Properties:
261 |       Handler: "index.handler"
262 |       Role:
263 |         Fn::GetAtt:
264 |         - "RegisterTargetLambdaIamRole"
265 |         - "Arn"
266 |       Code:
267 |         ZipFile: |
268 |           import json
269 |           import boto3
270 |           import cfnresponse
271 |           def handler(event, context):
272 |             elb = boto3.client('elbv2')
273 |             if event['RequestType'] == 'Delete':
274 |               elb.deregister_targets(TargetGroupArn=event['ResourceProperties']['TargetArn'],Targets=[{'Id': event['ResourceProperties']['TargetIp']}])
275 |             elif event['RequestType'] == 'Create':
276 |               elb.register_targets(TargetGroupArn=event['ResourceProperties']['TargetArn'],Targets=[{'Id': event['ResourceProperties']['TargetIp']}])
277 |             responseData = {}
278 |             cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData, event['ResourceProperties']['TargetArn']+event['ResourceProperties']['TargetIp'])
279 |       Runtime: "python3.7"
280 |       Timeout: 120
281 | 
282 |   RegisterSubnetTagsLambdaIamRole:
283 |     Type: AWS::IAM::Role
284 |     Properties:
285 |       RoleName: !Join ["-", [!Ref InfrastructureName, "subnet-tags-lambda-role"]]
286 |       AssumeRolePolicyDocument:
287 |         Version: "2012-10-17"
288 |         Statement:
289 |         - Effect: "Allow"
290 |           Principal:
291 |             Service:
292 |             - "lambda.amazonaws.com"
293 |           Action:
294 |           - "sts:AssumeRole"
295 |       Path: "/"
296 |       Policies:
297 |       - PolicyName: !Join ["-", [!Ref InfrastructureName, "subnet-tagging-policy"]]
298 |         PolicyDocument:
299 |           Version: "2012-10-17"
300 |           Statement:
301 |           - Effect: "Allow"
302 |             Action:
303 |               [
304 |                 "ec2:DeleteTags",
305 |                 "ec2:CreateTags"
306 |               ]
307 |             Resource: !Sub "arn:${AWS::Partition}:ec2:*:*:subnet/*"
308 |           - Effect: "Allow"
309 |             Action:
310 |               [
311 |                 "ec2:DescribeSubnets",
312 |                 "ec2:DescribeTags"
313 |               ]
314 |             Resource: "*"
315 | 
316 |   RegisterSubnetTags:
317 |     Type: "AWS::Lambda::Function"
318 |     Properties:
319 |       Handler: "index.handler"
320 |       Role:
321 |         Fn::GetAtt:
322 |         - "RegisterSubnetTagsLambdaIamRole"
323 |         - "Arn"
324 |       Code:
325 |         ZipFile: |
326 |           import json
327 |           import boto3
328 |           import cfnresponse
329 |           def handler(event, context):
330 |             ec2_client = boto3.client('ec2')
331 |             if event['RequestType'] == 'Delete':
332 |               for subnet_id in event['ResourceProperties']['Subnets']:
333 |                 ec2_client.delete_tags(Resources=[subnet_id], Tags=[{'Key': 'kubernetes.io/cluster/' + event['ResourceProperties']['InfrastructureName']}]);
334 |             elif event['RequestType'] == 'Create':
335 |               for subnet_id in event['ResourceProperties']['Subnets']:
336 |                 ec2_client.create_tags(Resources=[subnet_id], Tags=[{'Key': 'kubernetes.io/cluster/' + event['ResourceProperties']['InfrastructureName'], 'Value': 'shared'}]);
337 |             responseData = {}
338 |             cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData, event['ResourceProperties']['InfrastructureName']+event['ResourceProperties']['Subnets'][0])
339 |       Runtime: "python3.7"
340 |       Timeout: 120
341 | 
342 |   RegisterPublicSubnetTags:
343 |     Type: Custom::SubnetRegister
344 |     Properties:
345 |       ServiceToken: !GetAtt RegisterSubnetTags.Arn
346 |       InfrastructureName: !Ref InfrastructureName
347 |       Subnets: !Ref PublicSubnets
348 | 
349 |   RegisterPrivateSubnetTags:
350 |     Type: Custom::SubnetRegister
351 |     Properties:
352 |       ServiceToken: !GetAtt RegisterSubnetTags.Arn
353 |       InfrastructureName: !Ref InfrastructureName
354 |       Subnets: !Ref PrivateSubnets
355 | 
356 | Outputs:
357 |   PrivateHostedZoneId:
358 |     Description: Hosted zone ID for the private DNS, which is required for private records.
359 |     Value: !Ref IntDns
360 |   ExternalApiLoadBalancerName:
361 |     Description: Full name of the External API load balancer created.
362 |     Value: !GetAtt ExtApiElb.LoadBalancerFullName
363 |   InternalApiLoadBalancerName:
364 |     Description: Full name of the Internal API load balancer created.
365 |     Value: !GetAtt IntApiElb.LoadBalancerFullName
366 |   ApiServerDnsName:
367 |     Description: Full hostname of the API server, which is required for the Ignition config files.
368 |     Value: !Join [".", ["api-int", !Ref ClusterName, !Ref HostedZoneName]]
369 |   RegisterNlbIpTargetsLambda:
370 |     Description: Lambda ARN useful to help register or deregister IP targets for these load balancers.
371 |     Value: !GetAtt RegisterNlbIpTargets.Arn
372 |   ExternalApiTargetGroupArn:
373 |     Description: ARN of External API target group.
374 |     Value: !Ref ExternalApiTargetGroup
375 |   InternalApiTargetGroupArn:
376 |     Description: ARN of Internal API target group.
377 |     Value: !Ref InternalApiTargetGroup
378 |   InternalServiceTargetGroupArn:
379 |     Description: ARN of internal service target group.
380 |     Value: !Ref InternalServiceTargetGroup
381 | 


--------------------------------------------------------------------------------
/Chapter6/openshift4-on-aws-cn/sg_role_template.yaml:
--------------------------------------------------------------------------------
  1 | AWSTemplateFormatVersion: 2010-09-09
  2 | Description: Template for OpenShift Cluster Security Elements (Security Groups & IAM)
  3 | 
  4 | Parameters:
  5 |   InfrastructureName:
  6 |     AllowedPattern: ^([a-zA-Z][a-zA-Z0-9\-]{0,26})$
  7 |     MaxLength: 27
  8 |     MinLength: 1
  9 |     ConstraintDescription: Infrastructure name must be alphanumeric, start with a letter, and have a maximum of 27 characters.
 10 |     Description: A short, unique cluster ID used to tag cloud resources and identify items owned or used by the cluster.
 11 |     Type: String
 12 |   VpcCidr:
 13 |     AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-4]))$
 14 |     ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-24.
 15 |     Default: 10.0.0.0/16
 16 |     Description: CIDR block for VPC.
 17 |     Type: String
 18 |   VpcId:
 19 |     Description: The VPC-scoped resources will belong to this VPC.
 20 |     Type: AWS::EC2::VPC::Id
 21 |   PrivateSubnets:
 22 |     Description: The internal subnets.
 23 |     Type: List<AWS::EC2::Subnet::Id>
 24 | 
 25 | Metadata:
 26 |   AWS::CloudFormation::Interface:
 27 |     ParameterGroups:
 28 |     - Label:
 29 |         default: "Cluster Information"
 30 |       Parameters:
 31 |       - InfrastructureName
 32 |     - Label:
 33 |         default: "Network Configuration"
 34 |       Parameters:
 35 |       - VpcId
 36 |       - VpcCidr
 37 |       - PrivateSubnets
 38 |     ParameterLabels:
 39 |       InfrastructureName:
 40 |         default: "Infrastructure Name"
 41 |       VpcId:
 42 |         default: "VPC ID"
 43 |       VpcCidr:
 44 |         default: "VPC CIDR"
 45 |       PrivateSubnets:
 46 |         default: "Private Subnets"
 47 | 
 48 | Resources:
 49 |   MasterSecurityGroup:
 50 |     Type: AWS::EC2::SecurityGroup
 51 |     Properties:
 52 |       GroupDescription: Cluster Master Security Group
 53 |       SecurityGroupIngress:
 54 |       - IpProtocol: icmp
 55 |         FromPort: 0
 56 |         ToPort: 0
 57 |         CidrIp: !Ref VpcCidr
 58 |       - IpProtocol: tcp
 59 |         FromPort: 22
 60 |         ToPort: 22
 61 |         CidrIp: !Ref VpcCidr
 62 |       - IpProtocol: tcp
 63 |         ToPort: 6443
 64 |         FromPort: 6443
 65 |         CidrIp: !Ref VpcCidr
 66 |       - IpProtocol: tcp
 67 |         FromPort: 22623
 68 |         ToPort: 22623
 69 |         CidrIp: !Ref VpcCidr
 70 |       VpcId: !Ref VpcId
 71 |       Tags:
 72 |       - Key: Name
 73 |         Value: !Sub ${AWS::StackName}-master-sg
 74 | 
 75 |   WorkerSecurityGroup:
 76 |     Type: AWS::EC2::SecurityGroup
 77 |     Properties:
 78 |       GroupDescription: Cluster Worker Security Group
 79 |       SecurityGroupIngress:
 80 |       - IpProtocol: icmp
 81 |         FromPort: 0
 82 |         ToPort: 0
 83 |         CidrIp: !Ref VpcCidr
 84 |       - IpProtocol: tcp
 85 |         FromPort: 22
 86 |         ToPort: 22
 87 |         CidrIp: !Ref VpcCidr
 88 |       VpcId: !Ref VpcId
 89 |       Tags:
 90 |       - Key: Name
 91 |         Value: !Sub ${AWS::StackName}-worker-sg
 92 | 
 93 |   MasterIngressEtcd:
 94 |     Type: AWS::EC2::SecurityGroupIngress
 95 |     Properties:
 96 |       GroupId: !GetAtt MasterSecurityGroup.GroupId
 97 |       SourceSecurityGroupId: !GetAtt MasterSecurityGroup.GroupId
 98 |       Description: etcd
 99 |       FromPort: 2379
100 |       ToPort: 2380
101 |       IpProtocol: tcp
102 | 
103 |   MasterIngressVxlan:
104 |     Type: AWS::EC2::SecurityGroupIngress
105 |     Properties:
106 |       GroupId: !GetAtt MasterSecurityGroup.GroupId
107 |       SourceSecurityGroupId: !GetAtt MasterSecurityGroup.GroupId
108 |       Description: Vxlan packets
109 |       FromPort: 4789
110 |       ToPort: 4789
111 |       IpProtocol: udp
112 | 
113 |   MasterIngressWorkerVxlan:
114 |     Type: AWS::EC2::SecurityGroupIngress
115 |     Properties:
116 |       GroupId: !GetAtt MasterSecurityGroup.GroupId
117 |       SourceSecurityGroupId: !GetAtt WorkerSecurityGroup.GroupId
118 |       Description: Vxlan packets
119 |       FromPort: 4789
120 |       ToPort: 4789
121 |       IpProtocol: udp
122 | 
123 |   MasterIngressInternal:
124 |     Type: AWS::EC2::SecurityGroupIngress
125 |     Properties:
126 |       GroupId: !GetAtt MasterSecurityGroup.GroupId
127 |       SourceSecurityGroupId: !GetAtt MasterSecurityGroup.GroupId
128 |       Description: Internal cluster communication
129 |       FromPort: 9000
130 |       ToPort: 9999
131 |       IpProtocol: tcp
132 | 
133 |   MasterIngressWorkerInternal:
134 |     Type: AWS::EC2::SecurityGroupIngress
135 |     Properties:
136 |       GroupId: !GetAtt MasterSecurityGroup.GroupId
137 |       SourceSecurityGroupId: !GetAtt WorkerSecurityGroup.GroupId
138 |       Description: Internal cluster communication
139 |       FromPort: 9000
140 |       ToPort: 9999
141 |       IpProtocol: tcp
142 | 
143 |   MasterIngressKube:
144 |     Type: AWS::EC2::SecurityGroupIngress
145 |     Properties:
146 |       GroupId: !GetAtt MasterSecurityGroup.GroupId
147 |       SourceSecurityGroupId: !GetAtt MasterSecurityGroup.GroupId
148 |       Description: Kubernetes kubelet, scheduler and controller manager
149 |       FromPort: 10250
150 |       ToPort: 10259
151 |       IpProtocol: tcp
152 | 
153 |   MasterIngressWorkerKube:
154 |     Type: AWS::EC2::SecurityGroupIngress
155 |     Properties:
156 |       GroupId: !GetAtt MasterSecurityGroup.GroupId
157 |       SourceSecurityGroupId: !GetAtt WorkerSecurityGroup.GroupId
158 |       Description: Kubernetes kubelet, scheduler and controller manager
159 |       FromPort: 10250
160 |       ToPort: 10259
161 |       IpProtocol: tcp
162 | 
163 |   MasterIngressIngressServices:
164 |     Type: AWS::EC2::SecurityGroupIngress
165 |     Properties:
166 |       GroupId: !GetAtt MasterSecurityGroup.GroupId
167 |       SourceSecurityGroupId: !GetAtt MasterSecurityGroup.GroupId
168 |       Description: Kubernetes ingress services
169 |       FromPort: 30000
170 |       ToPort: 32767
171 |       IpProtocol: tcp
172 | 
173 |   MasterIngressWorkerIngressServices:
174 |     Type: AWS::EC2::SecurityGroupIngress
175 |     Properties:
176 |       GroupId: !GetAtt MasterSecurityGroup.GroupId
177 |       SourceSecurityGroupId: !GetAtt WorkerSecurityGroup.GroupId
178 |       Description: Kubernetes ingress services
179 |       FromPort: 30000
180 |       ToPort: 32767
181 |       IpProtocol: tcp
182 | 
183 |   WorkerIngressVxlan:
184 |     Type: AWS::EC2::SecurityGroupIngress
185 |     Properties:
186 |       GroupId: !GetAtt WorkerSecurityGroup.GroupId
187 |       SourceSecurityGroupId: !GetAtt WorkerSecurityGroup.GroupId
188 |       Description: Vxlan packets
189 |       FromPort: 4789
190 |       ToPort: 4789
191 |       IpProtocol: udp
192 | 
193 |   WorkerIngressWorkerVxlan:
194 |     Type: AWS::EC2::SecurityGroupIngress
195 |     Properties:
196 |       GroupId: !GetAtt WorkerSecurityGroup.GroupId
197 |       SourceSecurityGroupId: !GetAtt MasterSecurityGroup.GroupId
198 |       Description: Vxlan packets
199 |       FromPort: 4789
200 |       ToPort: 4789
201 |       IpProtocol: udp
202 | 
203 |   WorkerIngressInternal:
204 |     Type: AWS::EC2::SecurityGroupIngress
205 |     Properties:
206 |       GroupId: !GetAtt WorkerSecurityGroup.GroupId
207 |       SourceSecurityGroupId: !GetAtt WorkerSecurityGroup.GroupId
208 |       Description: Internal cluster communication
209 |       FromPort: 9000
210 |       ToPort: 9999
211 |       IpProtocol: tcp
212 | 
213 |   WorkerIngressWorkerInternal:
214 |     Type: AWS::EC2::SecurityGroupIngress
215 |     Properties:
216 |       GroupId: !GetAtt WorkerSecurityGroup.GroupId
217 |       SourceSecurityGroupId: !GetAtt MasterSecurityGroup.GroupId
218 |       Description: Internal cluster communication
219 |       FromPort: 9000
220 |       ToPort: 9999
221 |       IpProtocol: tcp
222 | 
223 |   WorkerIngressKube:
224 |     Type: AWS::EC2::SecurityGroupIngress
225 |     Properties:
226 |       GroupId: !GetAtt WorkerSecurityGroup.GroupId
227 |       SourceSecurityGroupId: !GetAtt WorkerSecurityGroup.GroupId
228 |       Description: Kubernetes secure kubelet port
229 |       FromPort: 10250
230 |       ToPort: 10250
231 |       IpProtocol: tcp
232 | 
233 |   WorkerIngressWorkerKube:
234 |     Type: AWS::EC2::SecurityGroupIngress
235 |     Properties:
236 |       GroupId: !GetAtt WorkerSecurityGroup.GroupId
237 |       SourceSecurityGroupId: !GetAtt MasterSecurityGroup.GroupId
238 |       Description: Internal Kubernetes communication
239 |       FromPort: 10250
240 |       ToPort: 10250
241 |       IpProtocol: tcp
242 | 
243 |   WorkerIngressIngressServices:
244 |     Type: AWS::EC2::SecurityGroupIngress
245 |     Properties:
246 |       GroupId: !GetAtt WorkerSecurityGroup.GroupId
247 |       SourceSecurityGroupId: !GetAtt WorkerSecurityGroup.GroupId
248 |       Description: Kubernetes ingress services
249 |       FromPort: 30000
250 |       ToPort: 32767
251 |       IpProtocol: tcp
252 | 
253 |   WorkerIngressWorkerIngressServices:
254 |     Type: AWS::EC2::SecurityGroupIngress
255 |     Properties:
256 |       GroupId: !GetAtt WorkerSecurityGroup.GroupId
257 |       SourceSecurityGroupId: !GetAtt MasterSecurityGroup.GroupId
258 |       Description: Kubernetes ingress services
259 |       FromPort: 30000
260 |       ToPort: 32767
261 |       IpProtocol: tcp
262 | 
263 |   MasterIamRole:
264 |     Type: AWS::IAM::Role
265 |     Properties:
266 |       AssumeRolePolicyDocument:
267 |         Version: "2012-10-17"
268 |         Statement:
269 |         - Effect: "Allow"
270 |           Principal:
271 |             Service:
272 |             - !Sub "ec2.${AWS::URLSuffix}"
273 |           Action:
274 |           - "sts:AssumeRole"
275 |       Policies:
276 |       - PolicyName: !Join ["-", [!Ref InfrastructureName, "master", "policy"]]
277 |         PolicyDocument:
278 |           Version: "2012-10-17"
279 |           Statement:
280 |           - Effect: "Allow"
281 |             Action: "ec2:*"
282 |             Resource: "*"
283 |           - Effect: "Allow"
284 |             Action: "elasticloadbalancing:*"
285 |             Resource: "*"
286 |           - Effect: "Allow"
287 |             Action: "iam:PassRole"
288 |             Resource: "*"
289 |           - Effect: "Allow"
290 |             Action: "s3:GetObject"
291 |             Resource: "*"
292 | 
293 |   MasterInstanceProfile:
294 |     Type: "AWS::IAM::InstanceProfile"
295 |     Properties:
296 |       Roles:
297 |       - Ref: "MasterIamRole"
298 | 
299 |   WorkerIamRole:
300 |     Type: AWS::IAM::Role
301 |     Properties:
302 |       AssumeRolePolicyDocument:
303 |         Version: "2012-10-17"
304 |         Statement:
305 |         - Effect: "Allow"
306 |           Principal:
307 |             Service:
308 |             - !Sub "ec2.${AWS::URLSuffix}"
309 |           Action:
310 |           - "sts:AssumeRole"
311 |       Policies:
312 |       - PolicyName: !Join ["-", [!Ref InfrastructureName, "worker", "policy"]]
313 |         PolicyDocument:
314 |           Version: "2012-10-17"
315 |           Statement:
316 |           - Effect: "Allow"
317 |             Action: "ec2:Describe*"
318 |             Resource: "*"
319 | 
320 |   WorkerInstanceProfile:
321 |     Type: "AWS::IAM::InstanceProfile"
322 |     Properties:
323 |       Roles:
324 |       - Ref: "WorkerIamRole"
325 | 
326 | Outputs:
327 |   MasterSecurityGroupId:
328 |     Description: Master Security Group ID
329 |     Value: !GetAtt MasterSecurityGroup.GroupId
330 | 
331 |   WorkerSecurityGroupId:
332 |     Description: Worker Security Group ID
333 |     Value: !GetAtt WorkerSecurityGroup.GroupId
334 | 
335 |   MasterInstanceProfile:
336 |     Description: Master IAM Instance Profile
337 |     Value: !Ref MasterInstanceProfile
338 | 
339 |   WorkerInstanceProfile:
340 |     Description: Worker IAM Instance Profile
341 |     Value: !Ref WorkerInstanceProfile
342 | 


--------------------------------------------------------------------------------
/Chapter6/openshift4-on-aws-cn/vpc_template.yaml:
--------------------------------------------------------------------------------
  1 | AWSTemplateFormatVersion: 2010-09-09
  2 | Description: Template for Best Practice VPC with 1-3 AZs
  3 | 
  4 | Parameters:
  5 |   VpcCidr:
  6 |     AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-4]))$
  7 |     ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-24.
  8 |     Default: 10.0.0.0/16
  9 |     Description: CIDR block for VPC.
 10 |     Type: String
 11 |   AvailabilityZoneCount:
 12 |     ConstraintDescription: "The number of availability zones. (Min: 1, Max: 3)"
 13 |     MinValue: 1
 14 |     MaxValue: 3
 15 |     Default: 1
 16 |     Description: "How many AZs to create VPC subnets for. (Min: 1, Max: 3)"
 17 |     Type: Number
 18 |   SubnetBits:
 19 |     ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/19-27.
 20 |     MinValue: 5
 21 |     MaxValue: 13
 22 |     Default: 12
 23 |     Description: "Size of each subnet to create within the availability zones. (Min: 5 = /27, Max: 13 = /19)"
 24 |     Type: Number
 25 | 
 26 | Metadata:
 27 |   AWS::CloudFormation::Interface:
 28 |     ParameterGroups:
 29 |     - Label:
 30 |         default: "Network Configuration"
 31 |       Parameters:
 32 |       - VpcCidr
 33 |       - SubnetBits
 34 |     - Label:
 35 |         default: "Availability Zones"
 36 |       Parameters:
 37 |       - AvailabilityZoneCount
 38 |     ParameterLabels:
 39 |       AvailabilityZoneCount:
 40 |         default: "Availability Zone Count"
 41 |       VpcCidr:
 42 |         default: "VPC CIDR"
 43 |       SubnetBits:
 44 |         default: "Bits Per Subnet"
 45 | 
 46 | Conditions:
 47 |   DoAz3: !Equals [3, !Ref AvailabilityZoneCount]
 48 |   DoAz2: !Or [!Equals [2, !Ref AvailabilityZoneCount], Condition: DoAz3]
 49 | 
 50 | Resources:
 51 |   VPC:
 52 |     Type: "AWS::EC2::VPC"
 53 |     Properties:
 54 |       EnableDnsSupport: true
 55 |       EnableDnsHostnames: true
 56 |       CidrBlock: !Ref VpcCidr
 57 |       Tags:
 58 |       - Key: Name
 59 |         Value: !Sub ${AWS::StackName}     
 60 |   PublicSubnet:
 61 |     Type: "AWS::EC2::Subnet"
 62 |     Properties:
 63 |       VpcId: !Ref VPC
 64 |       CidrBlock: !Select [0, !Cidr [!Ref VpcCidr, 6, !Ref SubnetBits]]
 65 |       AvailabilityZone: !Select
 66 |       - 0
 67 |       - Fn::GetAZs: !Ref "AWS::Region"
 68 |       Tags:
 69 |       - Key: Name
 70 |         Value: !Sub ${AWS::StackName}-Public-AZ1
 71 |   PublicSubnet2:
 72 |     Type: "AWS::EC2::Subnet"
 73 |     Condition: DoAz2
 74 |     Properties:
 75 |       VpcId: !Ref VPC
 76 |       CidrBlock: !Select [1, !Cidr [!Ref VpcCidr, 6, !Ref SubnetBits]]
 77 |       AvailabilityZone: !Select
 78 |       - 1
 79 |       - Fn::GetAZs: !Ref "AWS::Region"
 80 |       Tags:
 81 |       - Key: Name
 82 |         Value: !Sub ${AWS::StackName}-Public-AZ2
 83 |   PublicSubnet3:
 84 |     Type: "AWS::EC2::Subnet"
 85 |     Condition: DoAz3
 86 |     Properties:
 87 |       VpcId: !Ref VPC
 88 |       CidrBlock: !Select [2, !Cidr [!Ref VpcCidr, 6, !Ref SubnetBits]]
 89 |       AvailabilityZone: !Select
 90 |       - 2
 91 |       - Fn::GetAZs: !Ref "AWS::Region"
 92 |       Tags:
 93 |       - Key: Name
 94 |         Value: !Sub ${AWS::StackName}-Public-AZ3
 95 |   InternetGateway:
 96 |     Type: "AWS::EC2::InternetGateway"
 97 |   GatewayToInternet:
 98 |     Type: "AWS::EC2::VPCGatewayAttachment"
 99 |     Properties:
100 |       VpcId: !Ref VPC
101 |       InternetGatewayId: !Ref InternetGateway
102 |   PublicRouteTable:
103 |     Type: "AWS::EC2::RouteTable"
104 |     Properties:
105 |       VpcId: !Ref VPC
106 |   PublicRoute:
107 |     Type: "AWS::EC2::Route"
108 |     DependsOn: GatewayToInternet
109 |     Properties:
110 |       RouteTableId: !Ref PublicRouteTable
111 |       DestinationCidrBlock: 0.0.0.0/0
112 |       GatewayId: !Ref InternetGateway
113 |   PublicSubnetRouteTableAssociation:
114 |     Type: "AWS::EC2::SubnetRouteTableAssociation"
115 |     Properties:
116 |       SubnetId: !Ref PublicSubnet
117 |       RouteTableId: !Ref PublicRouteTable
118 |   PublicSubnetRouteTableAssociation2:
119 |     Type: "AWS::EC2::SubnetRouteTableAssociation"
120 |     Condition: DoAz2
121 |     Properties:
122 |       SubnetId: !Ref PublicSubnet2
123 |       RouteTableId: !Ref PublicRouteTable
124 |   PublicSubnetRouteTableAssociation3:
125 |     Condition: DoAz3
126 |     Type: "AWS::EC2::SubnetRouteTableAssociation"
127 |     Properties:
128 |       SubnetId: !Ref PublicSubnet3
129 |       RouteTableId: !Ref PublicRouteTable
130 |   PrivateSubnet:
131 |     Type: "AWS::EC2::Subnet"
132 |     Properties:
133 |       VpcId: !Ref VPC
134 |       CidrBlock: !Select [3, !Cidr [!Ref VpcCidr, 6, !Ref SubnetBits]]
135 |       AvailabilityZone: !Select
136 |       - 0
137 |       - Fn::GetAZs: !Ref "AWS::Region"
138 |       Tags:
139 |       - Key: Name
140 |         Value: !Sub ${AWS::StackName}-Private-AZ1      
141 |   PrivateRouteTable:
142 |     Type: "AWS::EC2::RouteTable"
143 |     Properties:
144 |       VpcId: !Ref VPC
145 |   PrivateSubnetRouteTableAssociation:
146 |     Type: "AWS::EC2::SubnetRouteTableAssociation"
147 |     Properties:
148 |       SubnetId: !Ref PrivateSubnet
149 |       RouteTableId: !Ref PrivateRouteTable
150 |   NAT:
151 |     DependsOn:
152 |     - GatewayToInternet
153 |     Type: "AWS::EC2::NatGateway"
154 |     Properties:
155 |       AllocationId:
156 |         "Fn::GetAtt":
157 |         - EIP
158 |         - AllocationId
159 |       SubnetId: !Ref PublicSubnet
160 |   EIP:
161 |     Type: "AWS::EC2::EIP"
162 |     Properties:
163 |       Domain: vpc
164 |   Route:
165 |     Type: "AWS::EC2::Route"
166 |     Properties:
167 |       RouteTableId:
168 |         Ref: PrivateRouteTable
169 |       DestinationCidrBlock: 0.0.0.0/0
170 |       NatGatewayId:
171 |         Ref: NAT
172 |   PrivateSubnet2:
173 |     Type: "AWS::EC2::Subnet"
174 |     Condition: DoAz2
175 |     Properties:
176 |       VpcId: !Ref VPC
177 |       CidrBlock: !Select [4, !Cidr [!Ref VpcCidr, 6, !Ref SubnetBits]]
178 |       AvailabilityZone: !Select
179 |       - 1
180 |       - Fn::GetAZs: !Ref "AWS::Region"
181 |       Tags:
182 |       - Key: Name
183 |         Value: !Sub ${AWS::StackName}-Private-AZ2      
184 |   PrivateRouteTable2:
185 |     Type: "AWS::EC2::RouteTable"
186 |     Condition: DoAz2
187 |     Properties:
188 |       VpcId: !Ref VPC
189 |   PrivateSubnetRouteTableAssociation2:
190 |     Type: "AWS::EC2::SubnetRouteTableAssociation"
191 |     Condition: DoAz2
192 |     Properties:
193 |       SubnetId: !Ref PrivateSubnet2
194 |       RouteTableId: !Ref PrivateRouteTable2
195 |   NAT2:
196 |     DependsOn:
197 |     - GatewayToInternet
198 |     Type: "AWS::EC2::NatGateway"
199 |     Condition: DoAz2
200 |     Properties:
201 |       AllocationId:
202 |         "Fn::GetAtt":
203 |         - EIP2
204 |         - AllocationId
205 |       SubnetId: !Ref PublicSubnet2
206 |   EIP2:
207 |     Type: "AWS::EC2::EIP"
208 |     Condition: DoAz2
209 |     Properties:
210 |       Domain: vpc
211 |   Route2:
212 |     Type: "AWS::EC2::Route"
213 |     Condition: DoAz2
214 |     Properties:
215 |       RouteTableId:
216 |         Ref: PrivateRouteTable2
217 |       DestinationCidrBlock: 0.0.0.0/0
218 |       NatGatewayId:
219 |         Ref: NAT2
220 |   PrivateSubnet3:
221 |     Type: "AWS::EC2::Subnet"
222 |     Condition: DoAz3
223 |     Properties:
224 |       VpcId: !Ref VPC
225 |       CidrBlock: !Select [5, !Cidr [!Ref VpcCidr, 6, !Ref SubnetBits]]
226 |       AvailabilityZone: !Select
227 |       - 2
228 |       - Fn::GetAZs: !Ref "AWS::Region"
229 |       Tags:
230 |       - Key: Name
231 |         Value: !Sub ${AWS::StackName}-Private-AZ3      
232 |   PrivateRouteTable3:
233 |     Type: "AWS::EC2::RouteTable"
234 |     Condition: DoAz3
235 |     Properties:
236 |       VpcId: !Ref VPC
237 |   PrivateSubnetRouteTableAssociation3:
238 |     Type: "AWS::EC2::SubnetRouteTableAssociation"
239 |     Condition: DoAz3
240 |     Properties:
241 |       SubnetId: !Ref PrivateSubnet3
242 |       RouteTableId: !Ref PrivateRouteTable3
243 |   NAT3:
244 |     DependsOn:
245 |     - GatewayToInternet
246 |     Type: "AWS::EC2::NatGateway"
247 |     Condition: DoAz3
248 |     Properties:
249 |       AllocationId:
250 |         "Fn::GetAtt":
251 |         - EIP3
252 |         - AllocationId
253 |       SubnetId: !Ref PublicSubnet3
254 |   EIP3:
255 |     Type: "AWS::EC2::EIP"
256 |     Condition: DoAz3
257 |     Properties:
258 |       Domain: vpc
259 |   Route3:
260 |     Type: "AWS::EC2::Route"
261 |     Condition: DoAz3
262 |     Properties:
263 |       RouteTableId:
264 |         Ref: PrivateRouteTable3
265 |       DestinationCidrBlock: 0.0.0.0/0
266 |       NatGatewayId:
267 |         Ref: NAT3
268 |   S3Endpoint:
269 |     Type: AWS::EC2::VPCEndpoint
270 |     Properties:
271 |       PolicyDocument:
272 |         Version: 2012-10-17
273 |         Statement:
274 |         - Effect: Allow
275 |           Principal: '*'
276 |           Action:
277 |           - '*'
278 |           Resource:
279 |           - '*'
280 |       RouteTableIds:
281 |       - !Ref PublicRouteTable
282 |       - !Ref PrivateRouteTable
283 |       - !If [DoAz2, !Ref PrivateRouteTable2, !Ref "AWS::NoValue"]
284 |       - !If [DoAz3, !Ref PrivateRouteTable3, !Ref "AWS::NoValue"]
285 |       ServiceName: !Join
286 |       - ''
287 |       - - com.amazonaws.
288 |         - !Ref 'AWS::Region'
289 |         - .s3
290 |       VpcId: !Ref VPC
291 | 
292 | Outputs:
293 |   VpcId:
294 |     Description: ID of the new VPC.
295 |     Value: !Ref VPC
296 |     Export: 
297 |       Name: !Sub "${AWS::StackName}-VpcId"
298 |   PublicSubnetIds:
299 |     Description: Subnet IDs of the public subnets.
300 |     Value:
301 |       !Join [
302 |         ",",
303 |         [!Ref PublicSubnet, !If [DoAz2, !Ref PublicSubnet2, !Ref "AWS::NoValue"], !If [DoAz3, !Ref PublicSubnet3, !Ref "AWS::NoValue"]]
304 |       ]
305 |     Export:
306 |       Name: !Sub "${AWS::StackName}-PublicSubnetIds"
307 |   PublicSubnet1Id:
308 |     Description: Subnet ID of the public subnet 1.
309 |     Value: !Ref PublicSubnet
310 |     Export:
311 |       Name: !Sub "${AWS::StackName}-PublicSubnet1Id"
312 |   PrivateSubnetIds:
313 |     Description: Subnet IDs of the private subnets.
314 |     Value:
315 |       !Join [
316 |         ",",
317 |         [!Ref PrivateSubnet, !If [DoAz2, !Ref PrivateSubnet2, !Ref "AWS::NoValue"], !If [DoAz3, !Ref PrivateSubnet3, !Ref "AWS::NoValue"]]
318 |       ]
319 |     Export:
320 |       Name: !Sub "${AWS::StackName}-PrivateSubnetIds"
321 | 


--------------------------------------------------------------------------------
/Chapter6/openshift4-on-aws-cn/worker_nodes.yaml:
--------------------------------------------------------------------------------
  1 | AWSTemplateFormatVersion: 2010-09-09
  2 | Description: Template for OpenShift Cluster Node Launch (EC2 worker instance)
  3 | 
  4 | Parameters:
  5 |   InfrastructureName:
  6 |     AllowedPattern: ^([a-zA-Z][a-zA-Z0-9\-]{0,26})$
  7 |     MaxLength: 27
  8 |     MinLength: 1
  9 |     ConstraintDescription: Infrastructure name must be alphanumeric, start with a letter, and have a maximum of 27 characters.
 10 |     Description: A short, unique cluster ID used to tag nodes for the kubelet cloud provider.
 11 |     Type: String
 12 |   RhcosAmi:
 13 |     Description: Current Red Hat Enterprise Linux CoreOS AMI to use for bootstrap.
 14 |     Type: AWS::EC2::Image::Id
 15 |   Subnet:
 16 |     Description: The subnets, recommend private, to launch the worker nodes into.
 17 |     Type: AWS::EC2::Subnet::Id
 18 |   WorkerSecurityGroupId:
 19 |     Description: The master security group ID to associate with worker nodes.
 20 |     Type: AWS::EC2::SecurityGroup::Id
 21 |   IgnitionLocation:
 22 |     Default: https://api-int.$CLUSTER_NAME.$DOMAIN:22623/config/worker
 23 |     Description: Ignition config file location.
 24 |     Type: String
 25 |   CertificateAuthorities:
 26 |     Default: data:text/plain;charset=utf-8;base64,ABC...xYz==
 27 |     Description: Base64 encoded certificate authority string to use.
 28 |     Type: String
 29 |   WorkerInstanceProfileName:
 30 |     Description: IAM profile to associate with worker nodes.
 31 |     Type: String
 32 |   WorkerInstanceType:
 33 |     Default: m4.large
 34 |     Type: String
 35 |     AllowedValues:
 36 |     - "m4.large"
 37 |     - "m4.xlarge"
 38 |     - "m4.2xlarge"
 39 |     - "m4.4xlarge"
 40 |     - "m4.8xlarge"
 41 |     - "m4.10xlarge"
 42 |     - "m4.16xlarge"
 43 |     - "c4.large"
 44 |     - "c4.xlarge"
 45 |     - "c4.2xlarge"
 46 |     - "c4.4xlarge"
 47 |     - "c4.8xlarge"
 48 |     - "r4.large"
 49 |     - "r4.xlarge"
 50 |     - "r4.2xlarge"
 51 |     - "r4.4xlarge"
 52 |     - "r4.8xlarge"
 53 |     - "r4.16xlarge"
 54 | 
 55 | Metadata:
 56 |   AWS::CloudFormation::Interface:
 57 |     ParameterGroups:
 58 |     - Label:
 59 |         default: "Cluster Information"
 60 |       Parameters:
 61 |       - InfrastructureName
 62 |     - Label:
 63 |         default: "Host Information"
 64 |       Parameters:
 65 |       - WorkerInstanceType
 66 |       - RhcosAmi
 67 |       - IgnitionLocation
 68 |       - CertificateAuthorities
 69 |       - WorkerSecurityGroupId
 70 |       - WorkerInstanceProfileName
 71 |     - Label:
 72 |         default: "Network Configuration"
 73 |       Parameters:
 74 |       - Subnet
 75 |     ParameterLabels:
 76 |       Subnet:
 77 |         default: "Subnet"
 78 |       InfrastructureName:
 79 |         default: "Infrastructure Name"
 80 |       WorkerInstanceType:
 81 |         default: "Worker Instance Type"
 82 |       WorkerInstanceProfileName:
 83 |         default: "Worker Instance Profile Name"
 84 |       RhcosAmi:
 85 |         default: "Red Hat Enterprise Linux CoreOS AMI ID"
 86 |       IgnitionLocation:
 87 |         default: "Worker Ignition Source"
 88 |       CertificateAuthorities:
 89 |         default: "Ignition CA String"
 90 |       WorkerSecurityGroupId:
 91 |         default: "Worker Security Group ID"
 92 | 
 93 | Resources:
 94 |   Worker0:
 95 |     Type: AWS::EC2::Instance
 96 |     Properties:
 97 |       ImageId: !Ref RhcosAmi
 98 |       BlockDeviceMappings:
 99 |       - DeviceName: /dev/xvda
100 |         Ebs:
101 |           VolumeSize: "120"
102 |           VolumeType: "gp2"
103 |       IamInstanceProfile: !Ref WorkerInstanceProfileName
104 |       InstanceType: !Ref WorkerInstanceType
105 |       NetworkInterfaces:
106 |       - AssociatePublicIpAddress: "false"
107 |         DeviceIndex: "0"
108 |         GroupSet:
109 |         - !Ref "WorkerSecurityGroupId"
110 |         SubnetId: !Ref "Subnet"
111 |       UserData:
112 |         Fn::Base64: !Sub
113 |         - '{"ignition":{"config":{"append":[{"source":"${SOURCE}","verification":{}}]},"security":{"tls":{"certificateAuthorities":[{"source":"${CA_BUNDLE}","verification":{}}]}},"timeouts":{},"version":"2.2.0"},"networkd":{},"passwd":{},"storage":{},"systemd":{}}'
114 |         - {
115 |           SOURCE: !Ref IgnitionLocation,
116 |           CA_BUNDLE: !Ref CertificateAuthorities,
117 |         }
118 |       Tags:
119 |       - Key: !Join ["", ["kubernetes.io/cluster/", !Ref InfrastructureName]]
120 |         Value: "shared"
121 | 
122 | Outputs:
123 |   PrivateIP:
124 |     Description: The compute node private IP address.
125 |     Value: !GetAtt Worker0.PrivateIp
126 | 


--------------------------------------------------------------------------------
/Chapter7/Jenkinsfile:
--------------------------------------------------------------------------------
  1 |     // Jenkinsfile
  2 |     pipeline {
  3 |       agent { label 'maven' }
  4 | 
  5 | 
  6 |       stages {
  7 | 
  8 |         stage('Checkout') {
  9 |           steps {
 10 |            git url: "http://gogs-ocp-workshop.${JENKINS_APP_DOMAIN}/${JENKINS_GOGS_USER}/SecurityDemos.git"
 11 |           } // steps
 12 |         } // stage
 13 | 
 14 |         stage('Build') {
 15 |         steps {
 16 |              sh "mvn -Dmaven.test.skip=true clean package"
 17 |           } // steps
 18 |         } // stage
 19 | 
 20 |         stage('Run tests') {
 21 |         steps {
 22 |              sh "mvn test"
 23 |              junit 'target/surefire-reports/*.xml'
 24 |           } // steps
 25 | 
 26 |         } // stage
 27 | 
 28 |         stage('SonarQube Scan') {
 29 |           steps {
 30 |             sh "mvn sonar:sonar -Dsonar.host.url=http://sonarqube.ocp-workshop.svc:9000 -Dsonar.projectkey=${JENKINS_GOGS_USER}-ecommerce -Dsonar.projectName=\"${JENKINS_GOGS_USER} E-Commerce Project\""
 31 |           } // steps
 32 |         } // stage
 33 | 
 34 |         stage('Archive to nexus') {
 35 |           steps {
 36 |             sh "mvn --settings mvn.xml deploy -Dmaven.test.skip=true"
 37 |           } // steps
 38 |         } // stage
 39 | 
 40 |         stage('Build Image') {
 41 |           steps {
 42 |             sh "oc new-build --name ecommerce --strategy=docker --binary || true"
 43 |             sh "mkdir deploy || true"
 44 |             sh "cp target/spring-boot-angular-ecommerce-0.0.1-SNAPSHOT.jar deploy"
 45 |             sh "cp Dockerfile deploy"
 46 |             sh "oc start-build ecommerce --from-dir=deploy --follow --wait"
 47 |           } // steps
 48 |         } // stage
 49 | 
 50 |         stage('Push Image to Quay') {
 51 |           agent { label 'image-management' }
 52 |           steps {
 53 |             sh "oc login -u ${JENKINS_GOGS_USER} -p r3dh4t1! --insecure-skip-tls-verify ${JENKINS_OCP_API_ENDPOINT}"
 54 |             sh 'skopeo --debug copy --src-creds="$(oc whoami)":"$(oc whoami -t)" --src-tls-verify=false --dest-tls-verify=false' + " --dest-creds=admin:admin123 docker://${JENKINS_INTERNAL_REGISTRY}/${JENKINS_GOGS_USER}/ecommerce:latest docker://quay-secure-quay-enterprise.${JENKINS_APP_DOMAIN}/admin/ecommerce:${JENKINS_GOGS_USER} || true"
 55 |           } // steps
 56 |         } //stage
 57 | 
 58 |         stage('OpenSCAP Scans') {
 59 |           agent { label 'master' }
 60 |           steps {
 61 | 
 62 |           script {
 63 |              def remote = [:]
 64 |              remote.name = "bastion"
 65 |              //remote.host = "bastion.${JENKINS_GUID}.openshiftworkshop.com"
 66 |              remote.host = "${JENKINS_BASTION}"
 67 |              remote.allowAnyHosts = true
 68 |              remote.user="${JENKINS_GOGS_USER}"
 69 |              remote.password="${JENKINS_SSH_PASSWORD}"
 70 |              
 71 |              sshCommand remote: remote, command: "oc login -u ${JENKINS_GOGS_USER} -p r3dh4t1! --insecure-skip-tls-verify ${JENKINS_OCP_API_ENDPOINT}"
 72 |              sshCommand remote: remote, command: "docker login -u ${JENKINS_GOGS_USER} -p " + '"$(oc whoami -t)"' + " ${JENKINS_INTERNAL_REGISTRY}"
 73 |              sshCommand remote: remote, command: "docker pull ${JENKINS_INTERNAL_REGISTRY}/${JENKINS_GOGS_USER}/ecommerce:latest"
 74 |              sshCommand remote: remote, command: "sudo oscap-docker image ${JENKINS_INTERNAL_REGISTRY}/${JENKINS_GOGS_USER}/ecommerce:latest xccdf eval --profile xccdf_org.ssgproject.content_profile_stig-rhel7-disa --report report.html /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml"
 75 |              sshCommand remote: remote, command: "sudo oscap-docker image-cve ${JENKINS_INTERNAL_REGISTRY}/${JENKINS_GOGS_USER}/ecommerce:latest --report report-cve.html"
 76 |              sshGet remote: remote, from: "/home/${JENKINS_GOGS_USER}/report.html", into: 'openscap-compliance-report.html', override: true
 77 |              sshGet remote: remote, from: "/home/${JENKINS_GOGS_USER}/report-cve.html", into: 'openscap-cve-report.html', override: true
 78 |              publishHTML([alwaysLinkToLastBuild: false, keepAll: false, reportDir: './', reportFiles: 'openscap-compliance-report.html', reportName: 'OpenSCAP Compliance Report', reportTitles: 'OpenSCAP Compliance Report'])
 79 |              publishHTML([alwaysLinkToLastBuild: false, keepAll: false, reportDir: './', reportFiles: 'openscap-cve-report.html', reportName: 'OpenSCAP Vulnerability Report', reportTitles: 'OpenSCAP Vulnerability Report'])
 80 |              archiveArtifacts 'openscap-compliance-report.html,openscap-cve-report.html'
 81 |             } // script
 82 |           } // steps
 83 |         } // stage
 84 | 
 85 |         stage('Deploy') {
 86 |           steps {
 87 |             sh "oc new-app ecommerce || true"
 88 |             sh "oc set env dc/ecommerce JAVA_ARGS=/deployments/root.jar"
 89 |             sh "oc expose svc/ecommerce || true"
 90 |             sh "oc rollout status dc/ecommerce"
 91 |           } // steps
 92 |         } // stage
 93 | 
 94 |         stage('OWASP ZAP Scan') {
 95 |           agent { label 'zap' }
 96 |           steps {
 97 |             script {
 98 |               sh "/zap/zap-baseline.py -r owasp-zap-baseline.html -t http://ecommerce.${JENKINS_GOGS_USER}.svc:8080/ -t http://ecommerce.${JENKINS_GOGS_USER}.svc:8080/api/products -t http://ecommerce.${JENKINS_GOGS_USER}.svc:8080/api/orders || true"
 99 |               sh "cp /zap/wrk/owasp-zap-baseline.html ."
100 |               publishHTML([alwaysLinkToLastBuild: false, keepAll: false, reportDir: './', reportFiles: 'owasp-zap-baseline.html', reportName: 'OWASP ZAP Baseline Report', reportTitles: ''])
101 |               archiveArtifacts 'owasp-zap-baseline.html'
102 |             } // script
103 |           } // steps
104 |         } // stage
105 | 
106 |         stage('Configure Stage Project') {
107 |           steps {
108 |             script {
109 |               sh "set +x ; oc login -u ${JENKINS_GOGS_USER} -p ${JENKINS_SSH_PASSWORD} --insecure-skip-tls-verify https://kubernetes.default.svc"
110 |               sh "oc create is ecommerce -n ${JENKINS_GOGS_USER}-stage || true"
111 |               sh "oc new-app ecommerce --image-stream=ecommerce --allow-missing-images --allow-missing-imagestream-tags -n ${JENKINS_GOGS_USER}-stage || true"
112 |               sh "oc expose dc/ecommerce -n ${JENKINS_GOGS_USER}-stage || true"
113 |               sh "oc expose dc/ecommerce --port 8080 -n ${JENKINS_GOGS_USER}-stage || true"
114 |               sh "oc expose svc/ecommerce -n ${JENKINS_GOGS_USER}-stage || true"
115 |             } // script
116 |           }// steps
117 |         } // stage
118 | 
119 |         stage('Promote to Stage?') {
120 |           steps {
121 |             timeout(time: 7, unit: 'DAYS') {
122 |               input message: "Do you want to deploy to ${JENKINS_GOGS_USER}-stage?"
123 |             } // timeout
124 |             sh "oc tag ${JENKINS_GOGS_USER}/ecommerce:latest ${JENKINS_GOGS_USER}-stage/ecommerce:latest"
125 |             sh "oc rollout status dc/ecommerce -n ${JENKINS_GOGS_USER}-stage"
126 |           } // steps
127 |         } // stage
128 | 
129 |         stage('Configure Prod Project') {
130 |           steps {
131 |             script {
132 |               sh "set +x ; oc login -u ${JENKINS_GOGS_USER} -p ${JENKINS_SSH_PASSWORD} --insecure-skip-tls-verify https://kubernetes.default.svc"
133 |               sh "oc create is ecommerce -n ${JENKINS_GOGS_USER}-prod || true"
134 |               sh "oc new-app ecommerce --image-stream=ecommerce --allow-missing-images --allow-missing-imagestream-tags -n ${JENKINS_GOGS_USER}-prod || true"
135 |               sh "oc expose dc/ecommerce -n ${JENKINS_GOGS_USER}-prod || true"
136 |               sh "oc expose dc/ecommerce --port 8080 -n ${JENKINS_GOGS_USER}-prod || true"
137 |               sh "oc expose svc/ecommerce -n ${JENKINS_GOGS_USER}-prod || true"
138 |             } // script
139 |           }// steps
140 |         } // stage
141 | 
142 |         stage('Promote to Prod?') {
143 |           steps {
144 |             timeout(time: 7, unit: 'DAYS') {
145 |               input message: "Do you want to deploy to ${JENKINS_GOGS_USER}-prod?"
146 |             } // timeout
147 |             sh "oc tag ${JENKINS_GOGS_USER}-stage/ecommerce:latest ${JENKINS_GOGS_USER}-prod/ecommerce:latest"
148 |             sh "oc rollout status dc/ecommerce -n ${JENKINS_GOGS_USER}-prod"
149 |           } // steps
150 |         } // stage
151 | 
152 |       } // stages
153 | 
154 |     } // pipeline
155 | 
156 | 
157 | 
158 | 
159 | 
160 | 


--------------------------------------------------------------------------------
/Chapter7/OpenShift中Jenkins工作方式的选择.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter7/OpenShift中Jenkins工作方式的选择.pdf


--------------------------------------------------------------------------------
/Chapter7/openshift-cicd-template/Jenkinsfile:
--------------------------------------------------------------------------------
 1 | node('maven') {
 2 |   // define commands
 3 |   def mvnCmd = "mvn"
 4 |   // injection of environment variables is not done so set them here...
 5 |   def sourceRef = "eap-7"
 6 |   def sourceUrl = "https://github.com/ocp-msa-devops/openshift-tasks.git"
 7 |   def devProject = "dev"
 8 |   def applicationName = "myapp-tasks"
 9 | 
10 |   stage 'build'
11 |     git branch: sourceRef, url: sourceUrl
12 |     sh "${mvnCmd} clean install -DskipTests=true"
13 |   stage 'test'
14 |     sh "${mvnCmd} test"
15 |   stage 'deployInDev'
16 |     sh "rm -rf oc-build && mkdir -p oc-build/deployments"
17 |     sh "cp target/openshift-tasks.war oc-build/deployments/ROOT.war"
18 |     // clean up. keep the image stream
19 |     sh "oc project ${devProject}"
20 |     sh "oc delete bc,dc,svc,route -l application=${applicationName} -n ${devProject}"
21 |     // create build. override the exit code since it complains about existing imagestream
22 |     sh "oc new-build --name=${applicationName} --image-stream=jboss-eap72-openshift:1.1 --binary=true --labels=application=${applicationName} -n ${devProject} || true"
23 |     // build image
24 |     sh "oc start-build ${applicationName} --from-dir=oc-build --wait=true -n ${devProject}"
25 |     // deploy image
26 |     sh "oc new-app ${applicationName}:latest -n ${devProject}"
27 |     sh "oc expose svc/${applicationName} -n ${devProject}"
28 | }
29 | 


--------------------------------------------------------------------------------
/Chapter7/openshift-cicd-template/README.md:
--------------------------------------------------------------------------------
 1 | # openshift-cicd-template
 2 | 
 3 | 注意：
 4 | 1. 如果project名称不是myapp，则需要修改myapp-template-no-trigger.yaml的image字段:
 5 | image: docker-registry.default.svc:5000/<your_project_name>/${APPLICATION_NAME}:latest
 6 | 2. 如果project名称部署myapp，则需要修改Jenkinsfile中项目的定义：
 7 | def devProject = "<your_project_name>"
 8 | 3. 如果jenkins所在的project与部署应用所在的project不是同一个，则需要执行如下命令赋予权限：
 9 | oc policy add-role-to-user edit system:serviceaccount:<jenkins_project_name>:jenkins -n <myapp_project_name>
10 | 


--------------------------------------------------------------------------------
/Chapter7/openshift-cicd-template/myapp-binary-template.yaml:
--------------------------------------------------------------------------------
  1 | apiVersion: template.openshift.io/v1
  2 | kind: Template
  3 | labels:
  4 |   template: myapp-binary-template
  5 | message: Myapp has been created in your project.
  6 | metadata:
  7 |   annotations:
  8 |     description: An example EAP 7 application for myapp.
  9 |     iconClass: icon-eap
 10 |     openshift.io/display-name: Myapp Binary deploy
 11 |     tags: eap,javaee,java,jboss
 12 |     template.openshift.io/long-description: This template defines resources needed to develop myapp.
 13 |     version: "1.0"
 14 |   name: myapp-binary-template
 15 | objects:
 16 | - apiVersion: v1
 17 |   kind: Service
 18 |   metadata:
 19 |     annotations:
 20 |       description: The web server's http port.
 21 |     labels:
 22 |       application: ${APPLICATION_NAME}
 23 |     name: ${APPLICATION_NAME}
 24 |   spec:
 25 |     ports:
 26 |     - port: 8080
 27 |       targetPort: 8080
 28 |     selector:
 29 |       deploymentConfig: ${APPLICATION_NAME}
 30 | - apiVersion: v1
 31 |   kind: Service
 32 |   metadata:
 33 |     annotations:
 34 |       description: The JGroups ping port for clustering.
 35 |       service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
 36 |     labels:
 37 |       application: ${APPLICATION_NAME}
 38 |     name: ${APPLICATION_NAME}-ping
 39 |   spec:
 40 |     clusterIP: None
 41 |     ports:
 42 |     - name: ping
 43 |       port: 8888
 44 |     selector:
 45 |       deploymentConfig: ${APPLICATION_NAME}
 46 | - apiVersion: v1
 47 |   id: ${APPLICATION_NAME}-http
 48 |   kind: Route
 49 |   metadata:
 50 |     annotations:
 51 |       description: Route for application's http service.
 52 |     labels:
 53 |       application: ${APPLICATION_NAME}
 54 |     name: ${APPLICATION_NAME}
 55 |   spec:
 56 |     to:
 57 |       name: ${APPLICATION_NAME}
 58 | - apiVersion: v1
 59 |   kind: ImageStream
 60 |   metadata:
 61 |     labels:
 62 |       application: ${APPLICATION_NAME}
 63 |     name: ${APPLICATION_NAME}
 64 | - apiVersion: v1
 65 |   kind: BuildConfig
 66 |   metadata:
 67 |     labels:
 68 |       application: ${APPLICATION_NAME}
 69 |     name: ${APPLICATION_NAME}
 70 |   spec:
 71 |     output:
 72 |       to:
 73 |         kind: ImageStreamTag
 74 |         name: ${APPLICATION_NAME}:latest
 75 |     source:
 76 |       contextDir: /
 77 |       git:
 78 |         ref: ${SOURCE_REPOSITORY_REF}
 79 |         uri: ${SOURCE_REPOSITORY_URL}
 80 |       type: Git
 81 |     strategy:
 82 |       sourceStrategy:
 83 |         env:
 84 |         - name: MAVEN_ARGS_APPEND
 85 |           value: -Dcom.redhat.xpaas.repo.jbossorg
 86 |         - name: WAR_FILE_URL
 87 |           value: ${WAR_FILE_URL}
 88 |         - name: WAR_FILE_USER
 89 |           value: ${WAR_FILE_USER}
 90 |         - name: WAR_FILE_PASSWORD
 91 |           value: ${WAR_FILE_PASSWORD}
 92 |         forcePull: true
 93 |         from:
 94 |           kind: ImageStreamTag
 95 |           name: jboss-eap72-openshift:1.1
 96 |           namespace: openshift
 97 |       type: Source
 98 |     triggers:
 99 |     - github:
100 |         secret: gtUi3NKF
101 |       type: GitHub
102 |     - generic:
103 |         secret: VOj31y6s
104 |       type: Generic
105 |     - imageChange: {}
106 |       type: ImageChange
107 |     - type: ConfigChange
108 | - apiVersion: v1
109 |   kind: DeploymentConfig
110 |   metadata:
111 |     labels:
112 |       application: ${APPLICATION_NAME}
113 |     name: ${APPLICATION_NAME}
114 |   spec:
115 |     replicas: 1
116 |     selector:
117 |       deploymentConfig: ${APPLICATION_NAME}
118 |     strategy:
119 |       type: Recreate
120 |     template:
121 |       metadata:
122 |         labels:
123 |           application: ${APPLICATION_NAME}
124 |           deploymentConfig: ${APPLICATION_NAME}
125 |         name: ${APPLICATION_NAME}
126 |       spec:
127 |         containers:
128 |         - env:
129 |           - name: JGROUPS_PING_PROTOCOL
130 |             value: openshift.DNS_PING
131 |           - name: OPENSHIFT_DNS_PING_SERVICE_NAME
132 |             value: ${APPLICATION_NAME}-ping
133 |           - name: OPENSHIFT_DNS_PING_SERVICE_PORT
134 |             value: "8888"
135 |           - name: MQ_CLUSTER_PASSWORD
136 |             value: "openshift"
137 |           - name: JGROUPS_CLUSTER_PASSWORD
138 |             value: "openshift"
139 |           - name: AUTO_DEPLOY_EXPLODED
140 |             value: "false"
141 |           image: ${APPLICATION_NAME}
142 |           imagePullPolicy: Always
143 |           livenessProbe:
144 |             exec:
145 |               command:
146 |               - /bin/bash
147 |               - -c
148 |               - /opt/eap/bin/livenessProbe.sh
149 |             initialDelaySeconds: 60
150 |           name: ${APPLICATION_NAME}
151 |           ports:
152 |           - containerPort: 8778
153 |             name: jolokia
154 |             protocol: TCP
155 |           - containerPort: 8080
156 |             name: http
157 |             protocol: TCP
158 |           - containerPort: 8888
159 |             name: ping
160 |             protocol: TCP
161 |           readinessProbe:
162 |             exec:
163 |               command:
164 |               - /bin/bash
165 |               - -c
166 |               - /opt/eap/bin/readinessProbe.sh false
167 |           resources:
168 |             limits:
169 |               memory: 1Gi
170 |         terminationGracePeriodSeconds: 75
171 |     triggers:
172 |     - imageChangeParams:
173 |         automatic: true
174 |         containerNames:
175 |         - ${APPLICATION_NAME}
176 |         from:
177 |           kind: ImageStreamTag
178 |           name: ${APPLICATION_NAME}:latest
179 |       type: ImageChange
180 |     - type: ConfigChange
181 | parameters:
182 | - description: The name for the application.
183 |   displayName: Application Name
184 |   name: APPLICATION_NAME
185 |   required: true
186 |   value: myapp-binary
187 | - description: Git source URI for application
188 |   displayName: Git Repository URL
189 |   name: SOURCE_REPOSITORY_URL
190 |   required: true
191 |   value: https://github.com/ocp-msa-devops/openshift-binary-deploy.git
192 | - description: Git branch/tag reference
193 |   displayName: Git Reference
194 |   name: SOURCE_REPOSITORY_REF
195 |   value: master
196 | - description: Binary File URI for application
197 |   displayName: Binary File URL
198 |   name: WAR_FILE_URL
199 |   required: true
200 | - description: User For Access Binary File
201 |   displayName: Binary File User
202 |   name: WAR_FILE_USER
203 |   required: true
204 | - description: Password For Access Binary File
205 |   displayName: Binary File Password
206 |   name: WAR_FILE_PASSWORD
207 |   required: true
208 | 


--------------------------------------------------------------------------------
/Chapter7/openshift-cicd-template/myapp-pipeline-bc.yaml:
--------------------------------------------------------------------------------
 1 | apiVersion: build.openshift.io/v1
 2 | kind: BuildConfig
 3 | metadata:
 4 |   labels:
 5 |     name: myapp-pipeline
 6 |   name: myapp-pipeline
 7 | spec:
 8 |   strategy:
 9 |     jenkinsPipelineStrategy:
10 |       jenkinsfile: |-
11 |         node('maven') {
12 |             stage 'build'
13 |             openshiftBuild(buildConfig: 'myapp-no-trigger', showBuildLogs: 'true')
14 | 
15 |             stage 'deploy'
16 |             openshiftDeploy(deploymentConfig: 'myapp-no-trigger')
17 |         }
18 |     type: JenkinsPipeline
19 |   triggers:
20 |   - github:
21 |       secret: CzgPZAZ5m2
22 |     type: GitHub
23 |   - generic:
24 |       secret: CzgPZAZ5m2
25 |     type: Generic
26 | 


--------------------------------------------------------------------------------
/Chapter7/openshift-cicd-template/myapp-template-jenkinsfile.yaml:
--------------------------------------------------------------------------------
 1 | apiVersion: template.openshift.io/v1
 2 | kind: Template
 3 | labels:
 4 |   template: myapp-jenkinsfile
 5 | metadata:
 6 |   name: myapp-jenkinsfile
 7 | objects:
 8 | - apiVersion: v1
 9 |   kind: BuildConfig
10 |   metadata:
11 |     labels:
12 |       application: ${PIPELINE_NAME}-jenkinsfile
13 |     name: ${PIPELINE_NAME}-jenkinsfile
14 |   spec:
15 |     source:
16 |       contextDir: /Chapter5/openshift-cicd-template
17 |       git:
18 |         ref: ${SOURCE_REF}
19 |         uri: ${SOURCE_URL}
20 |       type: Git
21 |     strategy:
22 |       jenkinsPipelineStrategy:
23 |         jenkinsfilePath: Jenkinsfile
24 |       type: JenkinsPipeline
25 |     triggers:
26 |     - github:
27 |         secret: kJZLvfQr3hZg
28 |       type: GitHub
29 |     - generic:
30 |         secret: kJZLvfQr3hZg
31 |       type: Generic
32 | parameters:
33 | - description: The name for the pipeline.
34 |   name: PIPELINE_NAME
35 |   required: true
36 |   value: myapp-tasks
37 | - description: Git source URI for Jenkinsfile
38 |   name: SOURCE_URL
39 |   required: true
40 |   value: https://github.com/ocp-msa-devops/Version-2.git
41 | - description: Git branch/tag reference for Jenkinsfile
42 |   name: SOURCE_REF
43 |   value: master
44 | 


--------------------------------------------------------------------------------
/Chapter7/openshift-cicd-template/myapp-template-no-trigger.yaml:
--------------------------------------------------------------------------------
  1 | apiVersion: template.openshift.io/v1
  2 | kind: Template
  3 | labels:
  4 |   template: myapp-eap72-no-trigger
  5 | metadata:
  6 |   annotations:
  7 |     description: An example EAP 7 application for myapp.
  8 |     iconClass: icon-eap
  9 |     openshift.io/display-name: Myapp EAP 7.2 no trigger
 10 |     tags: eap,javaee,java,jboss
 11 |     template.openshift.io/long-description: This template defines resources needed to develop myapp.
 12 |     version: "1.0"
 13 |   name: myapp-eap72-no-trigger
 14 | objects:
 15 | - apiVersion: v1
 16 |   kind: ImageStream
 17 |   metadata:
 18 |     labels:
 19 |       application: ${APPLICATION_NAME}
 20 |     name: ${APPLICATION_NAME}
 21 | - apiVersion: v1
 22 |   kind: Service
 23 |   metadata:
 24 |     annotations:
 25 |       description: The web server's http port.
 26 |     labels:
 27 |       application: ${APPLICATION_NAME}
 28 |     name: ${APPLICATION_NAME}
 29 |   spec:
 30 |     ports:
 31 |     - port: 8080
 32 |       targetPort: 8080
 33 |     selector:
 34 |       deploymentConfig: ${APPLICATION_NAME}
 35 | - apiVersion: v1
 36 |   id: ${APPLICATION_NAME}-http
 37 |   kind: Route
 38 |   metadata:
 39 |     annotations:
 40 |       description: Route for application's http service.
 41 |     labels:
 42 |       application: ${APPLICATION_NAME}
 43 |     name: ${APPLICATION_NAME}
 44 |   spec:
 45 |     to:
 46 |       name: ${APPLICATION_NAME}
 47 | - apiVersion: v1
 48 |   kind: BuildConfig
 49 |   metadata:
 50 |     labels:
 51 |       application: ${APPLICATION_NAME}
 52 |     name: ${APPLICATION_NAME}
 53 |   spec:
 54 |     output:
 55 |       to:
 56 |         kind: ImageStreamTag
 57 |         name: ${APPLICATION_NAME}:latest
 58 |     source:
 59 |       git:
 60 |         ref: ${SOURCE_REF}
 61 |         uri: ${SOURCE_URL}
 62 |       type: Git
 63 |     strategy:
 64 |       sourceStrategy:
 65 |         forcePull: true
 66 |         from:
 67 |           kind: ImageStreamTag
 68 |           name: jboss-eap72-openshift:1.1
 69 |           namespace: openshift
 70 |       type: Source
 71 |     triggers:
 72 |     - github:
 73 |         secret: kJZLvfQr3hZg
 74 |       type: GitHub
 75 |     - generic:
 76 |         secret: kJZLvfQr3hZg
 77 |       type: Generic
 78 |     - imageChange: {}
 79 |       type: ImageChange
 80 |     - type: ConfigChange
 81 | - apiVersion: v1
 82 |   kind: DeploymentConfig
 83 |   metadata:
 84 |     labels:
 85 |       application: ${APPLICATION_NAME}
 86 |     name: ${APPLICATION_NAME}
 87 |   spec:
 88 |     replicas: 1
 89 |     selector:
 90 |       deploymentConfig: ${APPLICATION_NAME}
 91 |     strategy:
 92 |       resources: {}
 93 |       rollingParams:
 94 |         intervalSeconds: 1
 95 |         maxSurge: 25%
 96 |         maxUnavailable: 25%
 97 |         timeoutSeconds: 600
 98 |         updatePeriodSeconds: 1
 99 |       type: Rolling
100 |     template:
101 |       metadata:
102 |         labels:
103 |           application: ${APPLICATION_NAME}
104 |           deploymentConfig: ${APPLICATION_NAME}
105 |         name: ${APPLICATION_NAME}
106 |       spec:
107 |         containers:
108 |         - env:
109 |             - name: JGROUPS_PING_PROTOCOL
110 |               value: dns.DNS_PING
111 |             - name: OPENSHIFT_DNS_PING_SERVICE_NAME
112 |               value: myapp-ping
113 |             - name: OPENSHIFT_DNS_PING_SERVICE_PORT
114 |               value: '8888'
115 |             - name: MQ_CLUSTER_PASSWORD
116 |               value: mlrFWyAF
117 |             - name: MQ_QUEUES
118 |             - name: MQ_TOPICS
119 |             - name: JGROUPS_CLUSTER_PASSWORD
120 |               value: qaxNJoaK
121 |             - name: AUTO_DEPLOY_EXPLODED
122 |               value: 'false'
123 |           image: image-registry.openshift-image-registry.svc:5000/myapp/${APPLICATION_NAME}:latest
124 |           imagePullPolicy: Always
125 |           livenessProbe:
126 |             exec:
127 |               command:
128 |                 - /bin/bash
129 |                 - '-c'
130 |                 - /opt/eap/bin/livenessProbe.sh
131 |             initialDelaySeconds: 60
132 |             timeoutSeconds: 1
133 |             periodSeconds: 10
134 |             successThreshold: 1
135 |             failureThreshold: 3
136 |           name: ${APPLICATION_NAME}
137 |           ports:
138 |           - containerPort: 8778
139 |             name: jolokia
140 |             protocol: TCP
141 |           - containerPort: 8080
142 |             name: http
143 |             protocol: TCP
144 |           - containerPort: 8888
145 |             name: ping
146 |             protocol: TCP
147 |           readinessProbe:
148 |             exec:
149 |               command:
150 |                 - /bin/bash
151 |                 - '-c'
152 |                 - /opt/eap/bin/readinessProbe.sh false
153 |             initialDelaySeconds: 10
154 |             timeoutSeconds: 1
155 |             periodSeconds: 10
156 |             successThreshold: 1
157 |             failureThreshold: 3
158 |         terminationGracePeriodSeconds: 60
159 |     triggers:
160 |     - type: ConfigChange
161 | parameters:
162 | - description: The name for the application.
163 |   name: APPLICATION_NAME
164 |   required: true
165 |   value: myapp-no-trigger
166 | - description: Git source URI for application
167 |   name: SOURCE_URL
168 |   required: true
169 |   value: https://github.com/ocp-msa-devops/openshift-tasks.git
170 | - description: Git branch/tag reference
171 |   name: SOURCE_REF
172 |   value: eap-7
173 | 


--------------------------------------------------------------------------------
/Chapter7/openshift-cicd-template/myapp-template.yaml:
--------------------------------------------------------------------------------
  1 | apiVersion: template.openshift.io/v1
  2 | kind: Template
  3 | labels:
  4 |   template: myapp-eap72-s2i
  5 |   xpaas: 1.1.0
  6 | message: A new myapp based application has been created in your project.
  7 | metadata:
  8 |   annotations:
  9 |     description: An example Red Hat JBoss EAP 7 application. For more information
 10 |       about using this template, see https://github.com/jboss-container-images/jboss-eap-7-openshift-image/blob/eap72/README.adoc
 11 |     iconClass: icon-eap
 12 |     openshift.io/display-name: Myapp EAP 7.2
 13 |     openshift.io/provider-display-name: Red Hat, Inc.
 14 |     samples.operator.openshift.io/version: 4.4.6
 15 |     tags: eap,javaee,java,jboss
 16 |     template.openshift.io/documentation-url: https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/
 17 |     template.openshift.io/long-description: This template defines resources needed
 18 |       to develop a Red Hat JBoss Enterprise Application Platform 7.2 based application,
 19 |       including a build configuration, application deployment configuration and secure
 20 |       communication using edge TLS.
 21 |     template.openshift.io/support-url: https://access.redhat.com
 22 |     version: 1.1.0
 23 |   labels:
 24 |     samples.operator.openshift.io/managed: "true"
 25 |   name: myapp-eap72-s2i
 26 | objects:
 27 | - apiVersion: v1
 28 |   kind: Service
 29 |   metadata:
 30 |     annotations:
 31 |       description: The web server's http port.
 32 |     labels:
 33 |       application: ${APPLICATION_NAME}
 34 |     name: ${APPLICATION_NAME}
 35 |   spec:
 36 |     ports:
 37 |     - port: 8080
 38 |       targetPort: 8080
 39 |     selector:
 40 |       deploymentConfig: ${APPLICATION_NAME}
 41 | - apiVersion: v1
 42 |   kind: Service
 43 |   metadata:
 44 |     annotations:
 45 |       description: The JGroups ping port for clustering.
 46 |       service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
 47 |     labels:
 48 |       application: ${APPLICATION_NAME}
 49 |     name: ${APPLICATION_NAME}-ping
 50 |   spec:
 51 |     clusterIP: None
 52 |     ports:
 53 |     - name: ping
 54 |       port: 8888
 55 |     publishNotReadyAddresses: true
 56 |     selector:
 57 |       deploymentConfig: ${APPLICATION_NAME}
 58 | - apiVersion: v1
 59 |   id: ${APPLICATION_NAME}-https
 60 |   kind: Route
 61 |   metadata:
 62 |     annotations:
 63 |       description: Route for application's https service.
 64 |     labels:
 65 |       application: ${APPLICATION_NAME}
 66 |     name: ${APPLICATION_NAME}
 67 |   spec:
 68 |     tls:
 69 |       insecureEdgeTerminationPolicy: Redirect
 70 |       termination: edge
 71 |     to:
 72 |       name: ${APPLICATION_NAME}
 73 | - apiVersion: v1
 74 |   kind: ImageStream
 75 |   metadata:
 76 |     labels:
 77 |       application: ${APPLICATION_NAME}
 78 |     name: ${APPLICATION_NAME}
 79 | - apiVersion: v1
 80 |   kind: BuildConfig
 81 |   metadata:
 82 |     labels:
 83 |       application: ${APPLICATION_NAME}
 84 |     name: ${APPLICATION_NAME}
 85 |   spec:
 86 |     output:
 87 |       to:
 88 |         kind: ImageStreamTag
 89 |         name: ${APPLICATION_NAME}:latest
 90 |     source:
 91 |       contextDir: /
 92 |       git:
 93 |         ref: ${SOURCE_REPOSITORY_REF}
 94 |         uri: ${SOURCE_REPOSITORY_URL}
 95 |       type: Git
 96 |     strategy:
 97 |       sourceStrategy:
 98 |         env:
 99 |         - name: MAVEN_ARGS_APPEND
100 |           value: "-Dcom.redhat.xpaas.repo.jbossorg"
101 |         forcePull: true
102 |         from:
103 |           kind: ImageStreamTag
104 |           name: jboss-eap72-openshift:1.1
105 |           namespace: openshift
106 |         incremental: true
107 |       type: Source
108 |     triggers:
109 |     - github:
110 |         secret: 7JJHT3JQ
111 |       type: GitHub
112 |     - generic:
113 |         secret: Po13vxrE
114 |       type: Generic
115 |     - imageChange: {}
116 |       type: ImageChange
117 |     - type: ConfigChange
118 | - apiVersion: v1
119 |   kind: DeploymentConfig
120 |   metadata:
121 |     labels:
122 |       application: ${APPLICATION_NAME}
123 |     name: ${APPLICATION_NAME}
124 |   spec:
125 |     replicas: 1
126 |     selector:
127 |       deploymentConfig: ${APPLICATION_NAME}
128 |     strategy:
129 |       type: Recreate
130 |     template:
131 |       metadata:
132 |         labels:
133 |           application: ${APPLICATION_NAME}
134 |           deploymentConfig: ${APPLICATION_NAME}
135 |         name: ${APPLICATION_NAME}
136 |       spec:
137 |         containers:
138 |         - env:
139 |           - name: JGROUPS_PING_PROTOCOL
140 |             value: dns.DNS_PING
141 |           - name: OPENSHIFT_DNS_PING_SERVICE_NAME
142 |             value: ${APPLICATION_NAME}-ping
143 |           - name: OPENSHIFT_DNS_PING_SERVICE_PORT
144 |             value: "8888"
145 |           - name: JGROUPS_CLUSTER_PASSWORD
146 |             value: "admin"
147 |           - name: AUTO_DEPLOY_EXPLODED
148 |             value: "false"
149 |           image: ${APPLICATION_NAME}
150 |           imagePullPolicy: Always
151 |           livenessProbe:
152 |             exec:
153 |               command:
154 |               - /bin/bash
155 |               - -c
156 |               - /opt/eap/bin/livenessProbe.sh
157 |             initialDelaySeconds: 60
158 |           name: ${APPLICATION_NAME}
159 |           ports:
160 |           - containerPort: 8778
161 |             name: jolokia
162 |             protocol: TCP
163 |           - containerPort: 8080
164 |             name: http
165 |             protocol: TCP
166 |           - containerPort: 8888
167 |             name: ping
168 |             protocol: TCP
169 |           readinessProbe:
170 |             exec:
171 |               command:
172 |               - /bin/bash
173 |               - -c
174 |               - /opt/eap/bin/readinessProbe.sh false
175 |             initialDelaySeconds: 10
176 |           resources:
177 |             limits:
178 |               memory: 1Gi
179 |         terminationGracePeriodSeconds: 75
180 |     triggers:
181 |     - imageChangeParams:
182 |         automatic: true
183 |         containerNames:
184 |         - ${APPLICATION_NAME}
185 |         from:
186 |           kind: ImageStreamTag
187 |           name: ${APPLICATION_NAME}:latest
188 |       type: ImageChange
189 |     - type: ConfigChange
190 | parameters:
191 | - description: The name for the application.
192 |   displayName: Application Name
193 |   name: APPLICATION_NAME
194 |   required: true
195 |   value: myapp
196 | - description: Git source URI for application
197 |   displayName: Git Repository URL
198 |   name: SOURCE_REPOSITORY_URL
199 |   required: true
200 |   value: https://github.com/ocp-msa-devops/openshift-tasks.git
201 | - description: Git branch/tag reference
202 |   displayName: Git Reference
203 |   name: SOURCE_REPOSITORY_REF
204 |   value: eap-7
205 | 


--------------------------------------------------------------------------------
/Chapter7/tekton-cicd/openshift-client-task.yaml:
--------------------------------------------------------------------------------
 1 | apiVersion: tekton.dev/v1alpha1
 2 | kind: Task
 3 | metadata:
 4 |   name: openshift-client
 5 | spec:
 6 |   inputs:
 7 |     params:
 8 |       - name: ARGS
 9 |         description: The OpenShift CLI arguments to run
10 |         default: help
11 |   steps:
12 |     - name: oc
13 |       image: quay.io/openshift-pipeline/openshift-cli:latest
14 |       command: ["/usr/local/bin/oc"]
15 |       args:
16 |         - "${inputs.params.ARGS}"
17 | 


--------------------------------------------------------------------------------
/Chapter7/tekton-cicd/petclinic-git-resource.yaml:
--------------------------------------------------------------------------------
 1 | apiVersion: tekton.dev/v1alpha1
 2 | kind: PipelineResource
 3 | metadata:
 4 |   name: petclinic-git
 5 | spec:
 6 |   type: git
 7 |   params:
 8 |   - name: url
 9 |     value: https://github.com/siamaksade/spring-petclinic
10 |   - name: depth
11 |     value: "0"
12 | 


--------------------------------------------------------------------------------
/Chapter7/tekton-cicd/petclinic-image-resource.yaml:
--------------------------------------------------------------------------------
 1 | apiVersion: tekton.dev/v1alpha1
 2 | kind: PipelineResource
 3 | metadata:
 4 |   name: petclinic-image
 5 | spec:
 6 |   type: image
 7 |   params:
 8 |   - name: url
 9 |     value: image-registry.openshift-image-registry.svc:5000/pipelines-tutorial/spring-petclinic
10 | 


--------------------------------------------------------------------------------
/Chapter7/tekton-cicd/petclinic.yaml:
--------------------------------------------------------------------------------
  1 | ---
  2 | apiVersion: image.openshift.io/v1
  3 | kind: ImageStream
  4 | metadata:
  5 |   labels:
  6 |     app: spring-petclinic
  7 |   name: spring-petclinic
  8 | ---
  9 | apiVersion: apps.openshift.io/v1
 10 | kind: DeploymentConfig
 11 | metadata:
 12 |   labels:
 13 |     app: spring-petclinic
 14 |   name: spring-petclinic
 15 | spec:
 16 |   replicas: 1
 17 |   revisionHistoryLimit: 10
 18 |   selector:
 19 |     app: spring-petclinic
 20 |     deploymentconfig: spring-petclinic
 21 |   strategy:
 22 |     activeDeadlineSeconds: 21600
 23 |     resources: {}
 24 |     rollingParams:
 25 |       intervalSeconds: 1
 26 |       maxSurge: 25%
 27 |       maxUnavailable: 25%
 28 |       timeoutSeconds: 600
 29 |       updatePeriodSeconds: 1
 30 |     type: Rolling
 31 |   template:
 32 |     metadata:
 33 |       labels:
 34 |         app: spring-petclinic
 35 |         deploymentconfig: spring-petclinic
 36 |     spec:
 37 |       containers:
 38 |       - image: spring-petclinic:latest
 39 |         imagePullPolicy: Always
 40 |         livenessProbe:
 41 |           failureThreshold: 3
 42 |           httpGet:
 43 |             path: /
 44 |             port: 8080
 45 |             scheme: HTTP
 46 |           initialDelaySeconds: 45
 47 |           periodSeconds: 10
 48 |           successThreshold: 1
 49 |           timeoutSeconds: 1
 50 |         name: spring-petclinic
 51 |         ports:
 52 |         - containerPort: 8080
 53 |           protocol: TCP
 54 |         - containerPort: 8443
 55 |           protocol: TCP
 56 |         - containerPort: 8778
 57 |           protocol: TCP
 58 |         readinessProbe:
 59 |           failureThreshold: 3
 60 |           httpGet:
 61 |             path: /
 62 |             port: 8080
 63 |             scheme: HTTP
 64 |           initialDelaySeconds: 45
 65 |           periodSeconds: 10
 66 |           successThreshold: 1
 67 |           timeoutSeconds: 5
 68 |         resources: {}
 69 |         terminationMessagePath: /dev/termination-log
 70 |         terminationMessagePolicy: File
 71 |       dnsPolicy: ClusterFirst
 72 |       restartPolicy: Always
 73 |       schedulerName: default-scheduler
 74 |       securityContext: {}
 75 |       terminationGracePeriodSeconds: 30
 76 |   test: false
 77 |   triggers:
 78 |   - imageChangeParams:
 79 |       containerNames:
 80 |       - spring-petclinic
 81 |       from:
 82 |         kind: ImageStreamTag
 83 |         name: spring-petclinic:latest
 84 |         namespace: pipelines-tutorial
 85 |     type: ImageChange
 86 | ---
 87 | apiVersion: v1
 88 | kind: Service
 89 | metadata:
 90 |   labels:
 91 |     app: spring-petclinic
 92 |   name: spring-petclinic
 93 | spec:
 94 |   ports:
 95 |   - name: 8080-tcp
 96 |     port: 8080
 97 |     protocol: TCP
 98 |     targetPort: 8080
 99 |   - name: 8443-tcp
100 |     port: 8443
101 |     protocol: TCP
102 |     targetPort: 8443
103 |   - name: 8778-tcp
104 |     port: 8778
105 |     protocol: TCP
106 |     targetPort: 8778
107 |   selector:
108 |     app: spring-petclinic
109 |     deploymentconfig: spring-petclinic
110 |   sessionAffinity: None
111 |   type: ClusterIP
112 | ---
113 | apiVersion: route.openshift.io/v1
114 | kind: Route
115 | metadata:
116 |   labels:
117 |     app: spring-petclinic
118 |   name: spring-petclinic
119 | spec:
120 |   port:
121 |     targetPort: 8080-tcp
122 |   to:
123 |     kind: Service
124 |     name: spring-petclinic
125 |     weight: 100
126 | 


--------------------------------------------------------------------------------
/Chapter7/tekton-cicd/pipeline.yaml:
--------------------------------------------------------------------------------
 1 | apiVersion: tekton.dev/v1alpha1
 2 | kind: Pipeline
 3 | metadata:
 4 |   name: deploy-pipeline
 5 | spec:
 6 |   resources:
 7 |   - name: app-git
 8 |     type: git
 9 |   - name: app-image
10 |     type: image
11 |   tasks:
12 |   - name: build
13 |     taskRef:
14 |       name: s2i-java-8
15 |     params:
16 |       - name: TLSVERIFY
17 |         value: "false"
18 |     resources:
19 |       inputs:
20 |       - name: source
21 |         resource: app-git
22 |       outputs:
23 |       - name: image
24 |         resource: app-image
25 |   - name: deploy
26 |     taskRef:
27 |       name: openshift-client
28 |     runAfter:
29 |       - build
30 |     params:
31 |     - name: ARGS
32 |       value: "rollout latest spring-petclinic"
33 | 


--------------------------------------------------------------------------------
/Chapter7/tekton-cicd/s2i-java-8-task.yaml:
--------------------------------------------------------------------------------
 1 | apiVersion: tekton.dev/v1alpha1
 2 | kind: Task
 3 | metadata:
 4 |   name: s2i-java-8
 5 | spec:
 6 |   inputs:
 7 |     resources:
 8 |       - name: source
 9 |         type: git
10 |     params:
11 |       - name: PATH_CONTEXT
12 |         description: The location of the path to run s2i from.
13 |         default: .
14 |       - name: TLSVERIFY
15 |         description: Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)
16 |         default: "true"
17 |   outputs:
18 |     resources:
19 |       - name: image
20 |         type: image
21 |   steps:
22 |     - name: generate
23 |       image: quay.io/openshift-pipeline/s2i
24 |       workingdir: /workspace/source
25 |       command: ['s2i', 'build', '${inputs.params.PATH_CONTEXT}', 'registry.access.redhat.com/redhat-openjdk-18/openjdk18-openshift', '--image-scripts-url', 'image:///usr/local/s2i', '--as-dockerfile', '/gen-source/Dockerfile.gen']
26 |       volumeMounts:
27 |         - name: gen-source
28 |           mountPath: /gen-source
29 |     - name: build
30 |       image: quay.io/buildah/stable
31 |       workingdir: /gen-source
32 |       command: ['buildah', 'bud', '--tls-verify=${inputs.params.TLSVERIFY}', '--layers', '-f', '/gen-source/Dockerfile.gen', '-t', '${outputs.resources.image.url}', '.']
33 |       volumeMounts:
34 |         - name: varlibcontainers
35 |           mountPath: /var/lib/containers
36 |         - name: gen-source
37 |           mountPath: /gen-source
38 |       securityContext:
39 |         privileged: true
40 |     - name: push
41 |       image: quay.io/buildah/stable
42 |       command: ['buildah', 'push', '--tls-verify=${inputs.params.TLSVERIFY}', '${outputs.resources.image.url}', 'docker://${outputs.resources.image.url}']
43 |       volumeMounts:
44 |         - name: varlibcontainers
45 |           mountPath: /var/lib/containers
46 |       securityContext:
47 |         privileged: true
48 |   volumes:
49 |     - name: varlibcontainers
50 |       emptyDir: {}
51 |     - name: gen-source
52 |       emptyDir: {}
53 | 


--------------------------------------------------------------------------------
/Chapter8/README:
--------------------------------------------------------------------------------
1 | 
2 | 


--------------------------------------------------------------------------------
/Chapter8/jenkinsfile:
--------------------------------------------------------------------------------
  1 | // define git info
  2 | def gitlab_url = 'http://192.168.1.251/yuejun/openshift-tasks.git'
  3 | def gitlab_credentialsId = 'gitlab-yuejun'
  4 | def gitlab_branch = "release"
  5 | 
  6 | // define openshift project name
  7 | def project_name = 'myapp-sit'
  8 | // define application service name
  9 | def service_name = "jboss-tasks"
 10 | // define target path
 11 | def target_path = 'target'
 12 | // define target name
 13 | def target_name = 'openshift-tasks.war'
 14 | // define maven commands
 15 | def mvnCmd = 'mvn -s configuration/cicd-settings.xml'
 16 | // define sonar host url
 17 | def sonar_url = 'http://192.168.1.249:9000'
 18 | // define sonar project key
 19 | def sonar_project_key = "myapp:jboss-tasks"
 20 | 
 21 | pipeline {
 22 |   agent {
 23 |     label 'maven'
 24 |   }
 25 |   options {
 26 |   timeout(time:2, unit: 'HOURS')
 27 |   }
 28 | stages {
 29 |   stage('Pull Source') {
 30 |     steps {
 31 |       git branch: "${gitlab_branch}", credentialsId: "${gitlab_credentialsId}", url: "${gitlab_url}"
 32 | 	  }
 33 |   }
 34 |   stage('Build Package') {
 35 |     steps {
 36 |       sh "${mvnCmd} clean install -DskipTests=true"
 37 |     }
 38 |   }
 39 |   stage('JUnit Test') {
 40 |     steps {
 41 |       sh "${mvnCmd} test"
 42 |       step([$class: 'JUnitResultArchiver', testResults: '**/target/surefire-reports/TEST-*.xml'])
 43 |     }
 44 |   }
 45 |   stage('Code Analysis') {
 46 |     steps {
 47 |        withSonarQubeEnv('sonarqube5.6.6') {
 48 |          sh "${mvnCmd} jacoco:report sonar:sonar -Dsonar.branch=${gitlab_branch} -Dsonar.projectKey=${sonar_project_key} -DskipTests=true"
 49 |          }
 50 |     }
 51 |   }
 52 |   stage("Check Quality Gate") {
 53 |     steps {
 54 |       script {
 55 |             timeout(time: 300, unit: 'SECONDS') {
 56 |               def qg = waitForQualityGate()
 57 |               if (qg.status != 'OK') {
 58 |                   error "Pipeline aborted due to quality gate failure: ${qg.status}"
 59 |               }
 60 |             }
 61 |       }
 62 |     }
 63 |   }
 64 |   stage('Archive App') {
 65 |     steps {
 66 | 	    sh "${mvnCmd} deploy -DskipTests=true -P nexus3"
 67 | 	  }
 68 |   }
 69 |   stage('Create Image Builder') {
 70 |     when {
 71 |         expression {
 72 |             openshift.withCluster() {
 73 |                 openshift.withProject("${project_name}") {
 74 |                     return !openshift.selector("bc", "${service_name}").exists();
 75 |                 }
 76 |             }
 77 |         }
 78 |     }
 79 |     steps {
 80 |         script {
 81 |             openshift.withCluster() {
 82 |                 openshift.withProject("${project_name}") {
 83 |                     openshift.newBuild("--name=${service_name}", "--image-stream=openshift/jboss-eap64-openshift", "--binary=true")
 84 |                 }
 85 |             }
 86 |         }
 87 |     }
 88 |   }
 89 |   stage('Build Image') {
 90 |     steps {
 91 |       sh "rm -rf oc-build && mkdir -p oc-build/deployments"
 92 |       sh "cp ${target_path}/${target_name} oc-build/deployments/"
 93 |       script {
 94 |         openshift.withCluster() {
 95 |           openshift.withProject("${project_name}") {
 96 |             openshift.selector("bc", "${service_name}").startBuild("--from-dir=oc-build", "--wait=true")
 97 |           }
 98 |         }
 99 |       }
100 |     }
101 |   }
102 |   stage('Develop APP') {
103 |     steps {
104 |         script {
105 |             openshift.withCluster() {
106 |                 openshift.withProject("${project_name}") {
107 |                     if (!openshift.selector('dc', "${service_name}").exists()) {
108 |                         def app = openshift.newApp("${service_name}:latest")
109 |                         def dc = openshift.selector("dc", "${service_name}")
110 |                         while (dc.object().spec.replicas != dc.object().status.availableReplicas) {
111 |                             sleep 10
112 |                         }
113 |                         openshift.set("triggers", "dc/${service_name}", "--manual")
114 |                         app.narrow("svc").delete();
115 |                         dc.expose("--port=8080");
116 |                         app.narrow("svc").expose("--port=8080")
117 |                     } else {
118 |                         openshift.selector("dc", "${service_name}").rollout().latest();
119 |                     }
120 |                 }
121 |             }
122 |         }
123 |     }
124 |   }
125 |   stage('Automatic Testing') {
126 |     steps {
127 |       script {
128 |         sh 'echo starting Automatic Testing.'
129 |         // add something test.
130 |       }
131 |     }
132 |   }
133 | }
134 | 
135 | post {
136 |   success{
137 |     emailext (
138 |         attachLog: false,
139 |         attachmentsPattern: '',
140 |         body: """
141 |         <h1>Jenkins构建信息</h1>
142 |         <b>项目名称：</b>${env.JOB_NAME}<br/>
143 |         <b>构建编号：</b>#${env.BUILD_NUMBER}<br/>
144 |         <b>构建状态：</b><span style="color:green">SUCCESS</span><br/>
145 |         <b>Jenkins链接：</b><a href="${env.BUILD_URL}">${env.BUILD_URL}</a><br/>
146 |         <h1>Sonar扫描结果</h1>
147 |         <b>Sonar链接：</b><a href="${sonar_url}/dashboard/index/${sonar_project_key}:${gitlab_branch}">${sonar_url}/dashboard/index/${sonar_project_key}:${gitlab_branch}</a><br/>
148 |         """,
149 |         recipientProviders: [[$class: 'DevelopersRecipientProvider'], [$class: 'RequesterRecipientProvider']],
150 |         subject: '[RELEASE-JENKINS]: ${PROJECT_NAME} - Build #${BUILD_NUMBER} - SUCCESS!',
151 |         to: 'developer-manager@example.com,tester@example.com'
152 |     )
153 |   }
154 |   failure{
155 |     emailext (
156 |         attachLog: false,
157 |         attachmentsPattern: '',
158 |         body: """
159 |         <h1>Jenkins构建信息</h1>
160 |         <b>项目名称：</b>${env.JOB_NAME}<br/>
161 |         <b>构建编号：</b>#${env.BUILD_NUMBER}<br/>
162 |         <b>构建状态：</b><span style="color:red">FAILED</span><br/>
163 |         <b>Jenkins链接：</b><a href="${env.BUILD_URL}">${env.BUILD_URL}</a>
164 |         <h1>Sonar扫描结果</h1>
165 |         <b>Sonar链接：</b><a href="${sonar_url}/dashboard/index/${sonar_project_key}:${gitlab_branch}">${sonar_url}/dashboard/index/${sonar_project_key}:${gitlab_branch}</a><br/>
166 |         """,
167 |         recipientProviders: [[$class: 'DevelopersRecipientProvider'], [$class: 'RequesterRecipientProvider']],
168 |         subject: '[RELEASE-JENKINS]: ${PROJECT_NAME} - Build #${BUILD_NUMBER} - FAILED!',
169 |         to: 'developer-manager@example.com'
170 |     )
171 |   }
172 |   unstable{
173 |     //add something you want
174 |     sh 'echo "nothing"'
175 |   }
176 | }
177 | }
178 | 


--------------------------------------------------------------------------------
/Chapter9/GraalVM的限制.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter9/GraalVM的限制.pdf


--------------------------------------------------------------------------------
/Chapter9/README:
--------------------------------------------------------------------------------
1 | 
2 | 


--------------------------------------------------------------------------------
/Chapter9/RHAMT安装和使用.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter9/RHAMT安装和使用.pdf


--------------------------------------------------------------------------------
/Chapter9/Routing.java:
--------------------------------------------------------------------------------
 1 | // camel-k: language=java
 2 | 
 3 | import java.util.Random;
 4 | 
 5 | import org.apache.camel.PropertyInject;
 6 | import org.apache.camel.builder.RouteBuilder;
 7 | 
 8 | public class Routing extends RouteBuilder {
 9 | 
10 |   private Random random = new Random();
11 | 
12 | @PropertyInject("priority-marker")
13 |   private String priorityMarker;
14 | 
15 |   @Override
16 |   public void configure() throws Exception {
17 | 
18 | 
19 | 
20 |       from("timer:java?period=3000")
21 |         .id("generator")
22 |         .bean(this, "generateRandomItem({{items}})")
23 |         .choice()
24 |           .when().simple("${body.startsWith('{{priority-marker}}')}")
25 |             .transform().body(String.class, item -> item.substring(priorityMarker.length()))
26 |             .to("direct:priorityQueue")
27 |           .otherwise()
28 |             .to("direct:standardQueue");
29 | 
30 |       from("direct:standardQueue")
31 |         .id("standard")
32 |         .log("Standard item: ${body}");
33 | 
34 |       from("direct:priorityQueue")
35 |         .id("priority")
36 |         .log("!!Priority item: ${body}");
37 | 
38 |   }
39 | 
40 |   public String generateRandomItem(String items) {
41 |     if (items == null || items.equals("")) {
42 |       return "[no items configured]";
43 |     }
44 |     String[] list = items.split("\\s");
45 |     return list[random.nextInt(list.length)];
46 |   }
47 | 
48 | }
49 | 


--------------------------------------------------------------------------------
/Chapter9/ephemeral-template.yaml:
--------------------------------------------------------------------------------
  1 | apiVersion: v1
  2 | kind: Template
  3 | metadata:
  4 |   name: strimzi-ephemeral
  5 |   annotations:
  6 |     openshift.io/display-name: "Apache Kafka (Ephemeral storage)"
  7 |     description: >-
  8 |       This template installs Apache Zookeeper and Apache Kafka clusters. For more information
  9 |       about using this template see https://strimzi.io
 10 |       WARNING: Any data stored will be lost upon pod destruction. Only use this
 11 |       template for testing."
 12 |     tags: "messaging,datastore"
 13 |     iconClass: "fa fa-share-alt fa-flip-horizontal"
 14 |     template.openshift.io/documentation-url: "https://strimzi.io"
 15 | message: "Kafka cluster ${CLUSTER_NAME} is being deployed. Use '${CLUSTER_NAME}-kafka-bootstrap:9092' as bootstrap server in your application"
 16 | parameters:
 17 | - description: All Kubernetes resources will be named after the cluster name
 18 |   displayName: Name of the cluster
 19 |   name: CLUSTER_NAME
 20 |   value: my-cluster
 21 | - description: Number of Zookeeper cluster nodes which will be deployed (odd number of nodes is recommended)
 22 |   displayName: Number of Zookeeper cluster nodes (odd number of nodes is recommended)
 23 |   name: ZOOKEEPER_NODE_COUNT
 24 |   required: true
 25 |   value: "3"
 26 | - description: Number of Kafka cluster nodes which will be deployed
 27 |   displayName: Number of Kafka cluster nodes
 28 |   name: KAFKA_NODE_COUNT
 29 |   required: true
 30 |   value: "3"
 31 | - description: The Kafka version to use for this cluster.
 32 |   displayName: The Kafka version to use
 33 |   name: KAFKA_VERSION
 34 |   required: true
 35 |   value: "2.5.0"
 36 | - description: Number of seconds after the container has started before healthcheck probes are initiated.
 37 |   displayName: Zookeeper healthcheck initial delay
 38 |   name: ZOOKEEPER_HEALTHCHECK_DELAY
 39 |   value: "15"
 40 | - description: Number of seconds after which the probe times out.
 41 |   displayName: Zookeeper healthcheck timeout
 42 |   name: ZOOKEEPER_HEALTHCHECK_TIMEOUT
 43 |   value: "5"
 44 | - description: Number of seconds after the container has started before healthcheck probes are initiated.
 45 |   displayName: Kafka healthcheck initial delay
 46 |   name: KAFKA_HEALTHCHECK_DELAY
 47 |   value: "15"
 48 | - description: Number of seconds after which the probe times out.
 49 |   displayName: Kafka healthcheck timeout
 50 |   name: KAFKA_HEALTHCHECK_TIMEOUT
 51 |   value: "5"
 52 | - description: Default replication factor for newly created topics
 53 |   displayName: Default replication factor
 54 |   name: KAFKA_DEFAULT_REPLICATION_FACTOR
 55 |   value: "1"
 56 | - description: Replication factor for offsets topic
 57 |   displayName: Offsets replication factor
 58 |   name: KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR
 59 |   value: "3"
 60 | - description: Replication factor for transactions state log topic
 61 |   displayName: Transaction state replication factor
 62 |   name: KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR
 63 |   value: "3"
 64 | objects:
 65 | - apiVersion: kafka.strimzi.io/v1beta1
 66 |   kind: Kafka
 67 |   metadata:
 68 |     name: ${CLUSTER_NAME}
 69 |   spec:
 70 |     kafka:
 71 |       version: ${{KAFKA_VERSION}}
 72 |       replicas: ${{KAFKA_NODE_COUNT}}
 73 |       listeners:
 74 |         plain: {}
 75 |         tls: {}
 76 |       livenessProbe:
 77 |         initialDelaySeconds: ${{KAFKA_HEALTHCHECK_DELAY}}
 78 |         timeoutSeconds: ${{KAFKA_HEALTHCHECK_TIMEOUT}}
 79 |       readinessProbe:
 80 |         initialDelaySeconds: ${{KAFKA_HEALTHCHECK_DELAY}}
 81 |         timeoutSeconds: ${{KAFKA_HEALTHCHECK_TIMEOUT}}
 82 |       storage:
 83 |         type: ephemeral
 84 |       config:
 85 |         default.replication.factor: ${KAFKA_DEFAULT_REPLICATION_FACTOR}
 86 |         offsets.topic.replication.factor: ${KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR}
 87 |         transaction.state.log.replication.factor: ${KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR}
 88 |         log.message.format.version: ${KAFKA_VERSION}
 89 |     zookeeper:
 90 |       replicas: ${{ZOOKEEPER_NODE_COUNT}}
 91 |       livenessProbe:
 92 |         initialDelaySeconds: ${{ZOOKEEPER_HEALTHCHECK_DELAY}}
 93 |         timeoutSeconds: ${{ZOOKEEPER_HEALTHCHECK_TIMEOUT}}
 94 |       readinessProbe:
 95 |         initialDelaySeconds: ${{ZOOKEEPER_HEALTHCHECK_DELAY}}
 96 |         timeoutSeconds: ${{ZOOKEEPER_HEALTHCHECK_TIMEOUT}}
 97 |       storage:
 98 |         type: ephemeral
 99 |     entityOperator:
100 |       topicOperator: {}
101 |       userOperator: {}
102 | 


--------------------------------------------------------------------------------
/Chapter9/quarkus-lab-validation-analyst-paper.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter9/quarkus-lab-validation-analyst-paper.pdf


--------------------------------------------------------------------------------
/Chapter9/register.json:
--------------------------------------------------------------------------------
 1 | {
 2 |     "name": "inventory-connector",
 3 |     "config": {
 4 |         "connector.class": "io.debezium.connector.mysql.MySqlConnector",
 5 |         "tasks.max": "1",
 6 |         "database.hostname": "mysql",
 7 |         "database.port": "3306",
 8 |         "database.user": "debezium",
 9 |         "database.password": "dbz",
10 |         "database.server.id": "184054",
11 |         "database.server.name": "dbserver1",
12 |         "database.whitelist": "inventory",
13 |         "database.history.kafka.bootstrap.servers": "my-cluster-kafka-bootstrap:9092",
14 |         "database.history.kafka.topic": "schema-changes.inventory"
15 |     }
16 | }
17 | 


--------------------------------------------------------------------------------
/Chapter9/strimzi-connect-s2i:
--------------------------------------------------------------------------------
  1 | apiVersion: v1
  2 | kind: Template
  3 | metadata:
  4 |   name: strimzi-connect-s2i
  5 |   annotations:
  6 |     openshift.io/display-name: "Apache Kafka Connect S2I"
  7 |     description: >-
  8 |       This template installes Apache Kafka Connect in distributed mode together with build pipeline
  9 |       for new Kafka Connect images with additional plugins. For more information about using this
 10 |       template see https://strimzi.io
 11 |     tags: "messaging"
 12 |     iconClass: "fa fa-exchange"
 13 |     template.openshift.io/documentation-url: "https://strimzi.io"
 14 | message: "Kafka Connect S2I cluster ${CLUSTER_NAME} is being deployed. Use '${CLUSTER_NAME}-connect-api:8083' to access Kafka Connect REST API."
 15 | parameters:
 16 | - description: All Kubernetes resources will be named after the cluster name
 17 |   displayName: Name of the cluster
 18 |   name: CLUSTER_NAME
 19 |   value: my-connect-cluster
 20 | - description: Specifies the number of Kafka Connect instances to be started by default.
 21 |   displayName: Number of Kafka Connect instances
 22 |   name: INSTANCES
 23 |   required: true
 24 |   value: "1"
 25 | - description: The Kafka version to use for this Kafka connect cluster.
 26 |   displayName: The Kafka version to use
 27 |   name: KAFKA_VERSION
 28 |   required: true
 29 |   value: "2.5.0"
 30 | - description: A list of host:port pairs to use for establishing the initial connection to the Kafka cluster.
 31 |   displayName: Kafka bootstrap servers
 32 |   name: KAFKA_CONNECT_BOOTSTRAP_SERVERS
 33 |   required: true
 34 |   value: my-cluster-kafka-bootstrap:9092
 35 | - description: A unique string that identifies the Connect cluster group this worker belongs to. Note this must not conflict with any consumer group IDs.
 36 |   displayName: Group ID
 37 |   name: KAFKA_CONNECT_GROUP_ID
 38 |   required: true
 39 |   value: "connect-cluster"
 40 | - description: Converter class used to convert between Kafka Connect format and the serialized form that is written to Kafka.
 41 |   displayName: Key Converter
 42 |   name: KAFKA_CONNECT_KEY_CONVERTER
 43 |   required: true
 44 |   value: org.apache.kafka.connect.json.JsonConverter
 45 | - description: Set to false to use schemaless format
 46 |   displayName: Enable schemas for key converters
 47 |   name: KAFKA_CONNECT_KEY_CONVERTER_SCHEMAS_ENABLE
 48 |   value: "true"
 49 | - description: Converter class used to convert between Kafka Connect format and the serialized form that is written to Kafka.
 50 |   displayName: Value Converter
 51 |   name: KAFKA_CONNECT_VALUE_CONVERTER
 52 |   required: true
 53 |   value: org.apache.kafka.connect.json.JsonConverter
 54 | - description: Set to false to use schemaless format
 55 |   displayName: Enable schemas for value converters
 56 |   name: KAFKA_CONNECT_VALUE_CONVERTER_SCHEMAS_ENABLE
 57 |   value: "true"
 58 | - description: Replication factor for config storage topic
 59 |   displayName: Config replication factor
 60 |   name: KAFKA_CONNECT_CONFIG_STORAGE_REPLICATION_FACTOR
 61 |   value: "3"
 62 | - description: Replication factor for offset storage topic
 63 |   displayName: Offset replication factor
 64 |   name: KAFKA_CONNECT_OFFSET_STORAGE_REPLICATION_FACTOR
 65 |   value: "3"
 66 | - description: Replication factor for status storage topic
 67 |   displayName: Status replication factor
 68 |   name: KAFKA_CONNECT_STATUS_STORAGE_REPLICATION_FACTOR
 69 |   value: "3"
 70 | - description: Number of seconds after the container has started before healthcheck probes are initiated.
 71 |   displayName: Kafka Connect healthcheck initial delay
 72 |   name: HEALTHCHECK_DELAY
 73 |   value: "60"
 74 | - description: Number of seconds after which the probe times out.
 75 |   displayName: Kafka Connect healthcheck timeout
 76 |   name: HEALTHCHECK_TIMEOUT
 77 |   value: "5"
 78 | objects:
 79 | - apiVersion: kafka.strimzi.io/v1beta1
 80 |   kind: KafkaConnectS2I
 81 |   metadata:
 82 |     name: ${CLUSTER_NAME}
 83 |   spec:
 84 |     version: ${{KAFKA_VERSION}}
 85 |     replicas: ${{INSTANCES}}
 86 |     livenessProbe:
 87 |       initialDelaySeconds: ${{HEALTHCHECK_DELAY}}
 88 |       timeoutSeconds: ${{HEALTHCHECK_TIMEOUT}}
 89 |     readinessProbe:
 90 |       initialDelaySeconds: ${{HEALTHCHECK_DELAY}}
 91 |       timeoutSeconds: ${{HEALTHCHECK_TIMEOUT}}
 92 |     bootstrapServers: "${KAFKA_CONNECT_BOOTSTRAP_SERVERS}"
 93 |     config:
 94 |       group.id: "${KAFKA_CONNECT_GROUP_ID}"
 95 |       offset.storage.topic: "${KAFKA_CONNECT_GROUP_ID}-offsets"
 96 |       config.storage.topic: "${KAFKA_CONNECT_GROUP_ID}-configs"
 97 |       status.storage.topic: "${KAFKA_CONNECT_GROUP_ID}-status"
 98 |       key.converter: "${KAFKA_CONNECT_KEY_CONVERTER}"
 99 |       value.converter: "${KAFKA_CONNECT_VALUE_CONVERTER}"
100 |       key.converter.schemas.enable: ${{KAFKA_CONNECT_KEY_CONVERTER_SCHEMAS_ENABLE}}
101 |       value.converter.schemas.enable: ${{KAFKA_CONNECT_VALUE_CONVERTER_SCHEMAS_ENABLE}}
102 |       config.storage.replication.factor: ${{KAFKA_CONNECT_CONFIG_STORAGE_REPLICATION_FACTOR}}
103 |       offset.storage.replication.factor: ${{KAFKA_CONNECT_OFFSET_STORAGE_REPLICATION_FACTOR}}
104 |       status.storage.replication.factor: ${{KAFKA_CONNECT_STATUS_STORAGE_REPLICATION_FACTOR}}
105 | 


--------------------------------------------------------------------------------
/Chapter9/如何将Spring Boot应用迁移到Quarkus.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/Chapter9/如何将Spring Boot应用迁移到Quarkus.pdf


--------------------------------------------------------------------------------
/IMAGES/OCP企业实践v2.jpg:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ocp-msa-devops/Version-2/53148bec25a4434ab43a6beecbbdb0ed99832aba/IMAGES/OCP企业实践v2.jpg


--------------------------------------------------------------------------------
/IMAGES/README:
--------------------------------------------------------------------------------
1 | 
2 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # Version-2
2 | 本Repo包含《OpenShift在企业中的实践: PaaS DevOps 微服务》第二版的测试代码和配置文件，以及删除的第一版内容。
3 | 
4 | 更多AI相关知识和实践，关注：https://github.com/xinyuwei-david/david-share.git
5 | ![image](https://github.com/ocp-msa-devops/Version-2/blob/master/IMAGES/OCP%E4%BC%81%E4%B8%9A%E5%AE%9E%E8%B7%B5v2.jpg)
6 | 
7 | 


--------------------------------------------------------------------------------