自动配置OpenShift集群的脚本

本文目录导读：

1. 基础自动化部署脚本
2. 使用说明
3. 安全注意事项

我来提供一个自动配置OpenShift集群的脚本示例,这个脚本包含了常见的自动化任务。

基础自动化部署脚本

#!/bin/bash
# OpenShift 集群自动配置脚本
# 支持 OpenShift 4.x 版本
set -e
# 颜色定义
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color
# 日志函数
log_info() {
    echo -e "${GREEN}[INFO]${NC} $1"
}
log_warn() {
    echo -e "${YELLOW}[WARN]${NC} $1"
}
log_error() {
    echo -e "${RED}[ERROR]${NC} $1"
}
# 配置变量
CLUSTER_NAME="my-cluster"
BASE_DOMAIN="example.com"
OCP_VERSION="4.12"
INSTALL_DIR="/root/ocp-install"
PULL_SECRET_FILE="/root/pull-secret.json"
SSH_KEY_FILE="$HOME/.ssh/id_rsa.pub"
# 检查必需工具
check_prerequisites() {
    log_info "检查必需工具..."
    command -v oc >/dev/null 2>&1 || { log_error "oc CLI 未安装"; exit 1; }
    command -v openshift-install >/dev/null 2>&1 || { log_error "openshift-install 未安装"; exit 1; }
    log_info "检查 OpenShift 版本..."
    oc version
    openshift-install version
}
# 生成安装配置
generate_install_config() {
    log_info "生成安装配置..."
    mkdir -p $INSTALL_DIR
    cat > $INSTALL_DIR/install-config.yaml << EOF
apiVersion: v1
baseDomain: $BASE_DOMAIN
metadata:
  name: $CLUSTER_NAME
platform:
  none: {}
pullSecret: '$(cat $PULL_SECRET_FILE)'
sshKey: '$(cat $SSH_KEY_FILE)'
EOF
    # 备份配置
    cp $INSTALL_DIR/install-config.yaml $INSTALL_DIR/install-config.yaml.bak
}
# 生成集群配置
generate_cluster_configs() {
    log_info "生成集群配置文件..."
    cd $INSTALL_DIR
    openshift-install create install-config
    log_info "生成 manifests 文件..."
    openshift-install create manifests
    log_info "生成 ignition 文件..."
    openshift-install create ignition-configs
}
# 创建集群
create_cluster() {
    log_info "开始创建集群..."
    cd $INSTALL_DIR
    openshift-install create cluster --log-level=info
    # 检查集群状态
    if [ $? -eq 0 ]; then
        log_info "集群创建成功!"
        wait_for_cluster_ready
    else
        log_error "集群创建失败，查看日志: $INSTALL_DIR/.openshift_install.log"
        exit 1
    fi
}
# 等待集群就绪
wait_for_cluster_ready() {
    log_info "等待集群完全就绪..."
    # 设置 KUBECONFIG
    export KUBECONFIG=$INSTALL_DIR/auth/kubeconfig
    # 等待所有节点就绪
    log_info "等待节点就绪..."
    oc wait --for=condition=Ready nodes --all --timeout=30m
    # 等待 cluster operators 就绪
    log_info "等待集群操作器就绪..."
    oc wait --for=condition=Available clusteroperators --all --timeout=30m
    log_info "集群已就绪!"
}
# 配置存储
configure_storage() {
    log_info "配置存储..."
    export KUBECONFIG=$INSTALL_DIR/auth/kubeconfig
    # 创建存储类
    cat > storage-class.yaml << EOF
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: managed-nfs-storage
provisioner: fuseim.pri/ifs
parameters:
  archiveOnDelete: "false"
EOF
    oc apply -f storage-class.yaml
    # 创建 PV
    for i in {1..5}; do
        cat > pv-$i.yaml << EOF
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-$i
spec:
  capacity:
    storage: 10Gi
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  storageClassName: manual
  hostPath:
    path: /data/pv-$i
EOF
        oc apply -f pv-$i.yaml
    done
}
# 配置网络策略
configure_network_policies() {
    log_info "配置网络策略..."
    export KUBECONFIG=$INSTALL_DIR/auth/kubeconfig
    # 创建默认拒绝策略
    cat > default-deny.yaml << EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: default
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
EOF
    oc apply -f default-deny.yaml
}
# 配置监控和日志
configure_monitoring() {
    log_info "配置监控和日志..."
    export KUBECONFIG=$INSTALL_DIR/auth/kubeconfig
    # 配置集群日志转发
    cat > cluster-logging.yaml << EOF
apiVersion: "logging.openshift.io/v1"
kind: "ClusterLogging"
metadata:
  name: "instance"
  namespace: "openshift-logging"
spec:
  managementState: "Managed"
  logStore:
    type: "elasticsearch"
    retentionPolicy:
      application:
        maxAge: 1d
      infra:
        maxAge: 7d
      audit:
        maxAge: 7d
    elasticsearch:
      nodeCount: 1
      storage:
        size: 100Gi
      resources:
        limits:
          memory: 8Gi
        requests:
          memory: 4Gi
      redundancyPolicy: "ZeroRedundancy"
  visualization:
    type: "kibana"
    kibana:
      replicas: 1
  curation:
    type: "curator"
    curator:
      schedule: "30 3 * * *"
  collection:
    logs:
      type: "fluentd"
      fluentd: {}
EOF
    oc apply -f cluster-logging.yaml
}
# 配置用户权限
configure_users() {
    log_info "配置用户权限..."
    export KUBECONFIG=$INSTALL_DIR/auth/kubeconfig
    # 创建管理员用户
    # 注意: 生产环境应使用更安全的认证方式
    htpasswd -c -B -b users.htpasswd admin Admin123!
    htpasswd -b users.htpasswd developer Dev@123
    # 创建 secret
    oc create secret generic htpasswd-secret \
        --from-file=htpasswd=users.htpasswd \
        -n openshift-config
    # 配置 OAuth
    cat > oauth-config.yaml << EOF
apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
  name: cluster
spec:
  identityProviders:
  - name: htpasswd_provider
    mappingMethod: claim
    type: HTPasswd
    htpasswd:
      fileData:
        name: htpasswd-secret
EOF
    oc apply -f oauth-config.yaml
}
# 配置备份
configure_backup() {
    log_info "配置备份策略..."
    # 创建备份脚本
    cat > /usr/local/bin/backup-ocp.sh << 'EOF'
#!/bin/bash
BACKUP_DIR="/backup/ocp/$(date +%Y%m%d)"
mkdir -p $BACKUP_DIR
# 备份 etcd
ssh master-0 "sudo /usr/local/bin/cluster-backup.sh $BACKUP_DIR"
# 备份集群配置
oc get all --all-namespaces -o yaml > $BACKUP_DIR/all-resources.yaml
oc get pv -o yaml > $BACKUP_DIR/pv.yaml
oc get pvc --all-namespaces -o yaml > $BACKUP_DIR/pvc.yaml
# 备份 etcd 快照
export ETCDCTL_API=3
ETCDCTL_ENDPOINTS=https://127.0.0.1:2379 \
ETCDCTL_CACERT=/etc/etcd/ca.crt \
ETCDCTL_CERT=/etc/etcd/server.crt \
ETCDCTL_KEY=/etc/etcd/server.key \
etcdctl snapshot save $BACKUP_DIR/etcd-snapshot.db
echo "备份完成: $BACKUP_DIR"
EOF
    chmod +x /usr/local/bin/backup-ocp.sh
    # 添加定时任务
    (crontab -l 2>/dev/null; echo "0 2 * * * /usr/local/bin/backup-ocp.sh") | crontab -
}
# 清理临时文件
cleanup() {
    log_info "清理临时文件..."
    rm -f *.yaml users.htpasswd
}
# 主函数
main() {
    echo "==========================================="
    echo "   OpenShift 集群自动配置脚本"
    echo "==========================================="
    check_prerequisites
    # 执行配置步骤
    generate_install_config
    generate_cluster_configs
    create_cluster
    configure_storage
    configure_network_policies
    configure_monitoring
    configure_users
    configure_backup
    cleanup
    log_info "集群配置完成!"
    echo "==========================================="
    echo "访问信息:"
    echo "  API URL: https://api.$CLUSTER_NAME.$BASE_DOMAIN:6443"
    echo "  Console URL: https://console-openshift-console.apps.$CLUSTER_NAME.$BASE_DOMAIN"
    echo "  admin 密码: Admin123!"
    echo "  developer 密码: Dev@123"
    echo "==========================================="
}
# 运行主函数
main

使用说明

1. 配置脚本参数

   # 修改脚本开头的配置变量
   CLUSTER_NAME="your-cluster-name"
   BASE_DOMAIN="your-domain.com"

2. 准备必需文件

   # 准备 Red Hat pull secret
   # 从 https://cloud.redhat.com 下载
   # 生成 SSH 密钥（如果还没有）
   ssh-keygen -t rsa -b 4096

3. 设置执行权限

   chmod +x configure-openshift.sh

4. 运行脚本

   ./configure-openshift.sh

安全注意事项

1. 生产环境使用前必须修改：

   • 默认密码
   • TLS 证书配置
   • 存储类配置
   • 网络策略

2. 建议增加的功能：

   • 证书自动续期
   • 日志轮转策略
   • 资源配额设置
   • 命名空间模板

这个脚本提供了基础框架,根据实际环境需求进行调整和扩展。