1. 在 Oracle Private Cloud Appliance 上建立 Oracle Cloud 原生環境
  2. 安裝 Oracle Cloud Native Environment

安裝 Oracle Cloud Native Environment

這些步驟描述如何在 Oracle Private Cloud Appliance 上安裝 Oracle Cloud Native Environment 。

在操作員節點上安裝 Oracle Cloud Native Environment API Server

API server 
if ! systemctl status olcne-api-server.service | grep 'Loaded: loaded'; then
 echo "No platform olcne-api-server.service seen on `hostname`, so the way is clear to install it..."
 pm_action=install
else
 sudo systemctl stop olcne-api-server.service
 pm_action=reinstall
fi
sudo dnf --best --setopt=keepcache=1 --allowerasing $pm_action -y olcne olcne-api-server olcne-utils
sudo systemctl enable olcne-api-server.service

在控制層和工作節點上安裝 Oracle Cloud Native Environment Platform Agent

platform agents 
if ! systemctl status olcne-agent.service | grep 'Loaded: loaded'; then
 echo "No platform olcne-agent.service seen on `hostname`, so the way is clear to 
install it..."
 pm_action=install
else
 sudo systemctl stop olcne-agent.service
 pm_action=reinstall
fi
sudo dnf --best --setopt=keepcache=1 --allowerasing $pm_action -y olcne-agent olcne-utils
sudo systemctl enable olcne-agent.service 
sudo mkdir -p /etc/systemd/system/crio.service.d
cat <<EOD > /tmp/t
[Service]
Environment="HTTP_PROXY=http://proxy-host:proxy-port"
Environment="HTTPS_PROXY=http://proxy-host:proxy-port"
Environment="NO_PROXY=localhost,127.0.0.1,. proxy-host.us.oracle.com,.oraclecorp.com,.oraclevcn.com,10.0.1.0/24,10.0.0.0/24,.svc,/var/run/crio/crio.sock,10.96.0.0/12"
EOD
sudo mv /tmp/t /etc/systemd/system/crio.service.d/proxy.conf
if ! systemctl status docker.service 2>&1 | grep -l 'could not be found.' > /dev/null 2>&1; 
then
 sudo systemctl disable --now docker.service
fi
if ! systemctl status containerd.service 2>&1 | grep -l 'could not be found.' > /dev/null 
2>&1; then
 sudo systemctl disable --now containerd.service
fi

為控制層上的內部負載平衡器準備防火牆

control plane firewall for HA
sudo firewall-cmd --add-port=6444/tcp
sudo firewall-cmd --add-port=6444/tcp --permanent
sudo firewall-cmd --add-protocol=vrrp
sudo firewall-cmd --add-protocol=vrrp --permanent
scp /path/to/your/id_rsa ocneoperator.dm.com:/home/opc/.ssh/id_rsa

在操作員節點上產生 X509 憑證

generate certificates 
if [ -f /home/opc/.olcne/certificates/127.0.0.1:8091/node.cert ]; then
 # should we call
 # olcne --api-server 127.0.0.1:8091 environment report --environment-name myenvironment
 # this file is searched for. Skip the call and just check for the file; if we see it, 
attempt to delete existing env:
 echo signs of myenvironment seen, will try to delete it...
 olcne --api-server 127.0.0.1:8091 environment delete --environment-name myenvironment
else
 echo "no environment seen, as expected. But will attempt to delete anyway to account for the case that the env is not reflected in that file check above"
 olcne --api-server 127.0.0.1:8091 environment delete --environment-name myenvironment
fi
cd /etc/olcne
if systemctl status olcne-api-server.service; then
 echo running olcne-api-server.service seen, stopping it...
 sudo systemctl stop olcne-api-server.service
else
 echo no running olcne-api-server.service seen, as expected
fi
sudo ./gen-certs-helper.sh --cert-request-organization-unit "Paper Sales" --cert-request-organization "Dunder Mifflin" --cert-request-locality "Scranton" --cert-request-state "WA" --cert-request-country "US" --cert-request-common-name "dm.com" --nodes olcneoperator.dm.com,olcnecontrol.dm.com,olcneworker.dm.com,olcneworker2.dm.com,ocneworker3.dm.com

在操作員節點上啟動 Oracle Cloud Native Environment API 伺服器

start API server 
sudo bash -x /etc/olcne/bootstrap-olcne.sh --secret-manager-type file --olcne-node-cert-path 
/etc/olcne/configs/certificates/production/node.cert --olcne-ca-path 
/etc/olcne/configs/certificates/production/ca.cert --olcne-node-key-path 
/etc/olcne/configs/certificates/production/node.key --olcne-component api-server
systemctl status olcne-api-server.service

啟動控制層和工作節點上的平台代理程式

start platform agents 
sudo /etc/olcne/bootstrap-olcne.sh \
--secret-manager-type file \
--olcne-component agent \
--olcne-node-cert-path /etc/olcne/configs/certificates/production/node.cert \
--olcne-ca-path /etc/olcne/configs/certificates/production/ca.cert \
--olcne-node-key-path /etc/olcne/configs/certificates/production/node.key
systemctl status olcne-agent.service

驗證執行中的平台代理程式

驗證控制層 (例如控制節點) 和工作節點上執行的平台代理程式。 

verify platform agents up 
ps auxww | grep /usr/libexec/olcne-agent | grep -v grep > /tmp/kk.26597
if [ -s /tmp/kk.26597 ]; then
 echo "OK /usr/libexec/olcne-agent running on `hostname`"
 if [ -n "" ]; then
 cat /tmp/kk.26597
 fi
else
 echo "FAIL /usr/libexec/olcne-agent NOT running on `hostname`"
fi

在操作員節點上建立 Oracle Cloud Native Environment

如果這不是全新配置的叢集，且先前已在操作員節點上建立 Oracle Cloud Native Environment ，請立即刪除該叢集。 

#optionally remove previous environment 
olcne --api-server 127.0.0.1:8091 environment delete --environment-name myenvironment
create environment 
sudo chown -R opc:opc /etc/olcne /configs
olcne --api-server 127.0.0.1:8091 environment create --environment-name myenvironment --update-config --secret-manager-type file --olcne-node-cert-path 
/etc/olcne/configs/certificates/production/node.cert --olcne-ca-path 
/etc/olcne/configs/certificates/production/ca.cert --olcne-node-key-path 
/etc/olcne/configs/certificates/production/node.key

建立 Kubernetes 模組

如果這不是全新配置的叢集，且先前已在操作員節點上建立 Oracle Cloud Native Environment Kubernetes 模組，請移除該模組。

舉例而言：

#optionally remove previous k8s module 
olcne module uninstall --environment-name myenvironment --module kubernetes --name mycluster

在操作員節點上建立 Kubernetes 模組。對於此指令，我們需要決定要使用的網路介面。在此範例程式碼中，我們執行 ifconfig 並挑選第一個非迴圈網路介面。因此，例如，如果 ifconfig 產生下列輸出： 

ifconfig output 
ens3: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 9000
 inet 172.16.8.117 netmask 255.255.252.0 broadcast 172.16.11.255
 inet6 fe80::213:97ff:fe3c:8b34 prefixlen 64 scopeid 0x20link
 ether 00:13:97:3c:8b:34 txqueuelen 1000 (Ethernet)
 RX packets 2284 bytes 392817 (383.6 KiB)
 RX errors 0 dropped 0 overruns 0 frame 0
 TX packets 1335 bytes 179539 (175.3 KiB)
 TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
 inet 127.0.0.1 netmask 255.0.0.0
 inet6 ::1 prefixlen 128 scopeid 0x10host
 loop txqueuelen 1000 (Local Loopback)
 RX packets 6 bytes 416 (416.0 B)
 RX errors 0 dropped 0 overruns 0 frame 0
 TX packets 6 bytes 416 (416.0 B)
 TX errors 0 dropped 0 overruns 0 carrier 0 collisions

然後下面第二行的 sed 表示式會結束將 iface 設定為 ens3。

舉例而言：

create k8 module 
sudo chown -R opc:opc /etc/olcne/configs/certificates/restrict_external_ip/production
iface=`ifconfig | sed -n -e '/^ /d' -e /LOOPBACK/d -e 's/:.*//p'```
# substitute the IP of your control node for CONTROL_NODE_IP below:
olcne module create --environment-name myenvironment --module kubernetes --name mycluster --container-registry container-registry.oracle.com/olcne --virtual-ip CONTROL_NODE_IP --master-nodes ocnecontrol.dm.com:8090 --worker-nodes ocneworker.dm.com:8090,ocneworker2.dm.com:8090,ocneworker3.dm.com:8090 --selinux enforcing --restrict-service-externalip-ca-cert 
/etc/olcne/configs/certificates/restrict_external_ip/production/production/ca.cert --restrict-service-externalip-tls-cert 
/etc/olcne/configs/certificates/restrict_external_ip/production/production/node.cert --restrict-service-externalip-tls-key 
/etc/olcne/configs/certificates/restrict_external_ip/production/production/node.key --pod-network-iface $iface

新增傳入規則至子網路

  1. 在 Private Cloud Appliance 介面中，瀏覽至 Dashboard/Virtual Cloud Networks/your_VCN/your_security_list。
  2. 新增類型為 TCP 之來源 0.0.0.0/0 的規則，允許目的地連接埠範圍為 2379-10255。

驗證操作員節點上的 Kubernetes 模組

validate k8 
olcne module validate --environment-name myenvironment --name mycluster

在操作員節點上安裝 Kubernetes 模組

install k8 
olcne module install --environment-name myenvironment --name mycluster

查看操作員節點上的 Kubernetes 模組報表

report on k8  OCNEctl module report --environment-name myenvironment --name mycluster

在操作員節點上顯示 Kubernetes 節點

Note: To use kubectl within your cluster,:
run kubectl 
kubectl get nodes -o wide