Running applications Red Hat build of MicroShift 4.18 Running applications in MicroShift Red Hat OpenShift Documentation Team

Commands:
manifests: kustomizePaths: - <location> 1
manifests: kustomizePaths: []
MANIFEST_DIR=/etc/microshift/manifests
sudo mkdir -p USD{MANIFEST_DIR}
sudo tee USD{MANIFEST_DIR}/busybox.yaml &>/dev/null <<EOF apiVersion: v1 kind: Namespace metadata: name: busybox --- apiVersion: apps/v1 kind: Deployment metadata: name: busybox namespace: busybox-deployment spec: selector: matchLabels: app: busybox template: metadata: labels: app: busybox spec: containers: - name: busybox image: BUSYBOX_IMAGE command: [ "/bin/sh", "-c", "while true ; do date; sleep 3600; done;" ] EOF
sudo tee USD{MANIFEST_DIR}/kustomization.yaml &>/dev/null <<EOF apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: busybox resources: - busybox.yaml images: - name: BUSYBOX_IMAGE newName: busybox:1.35 EOF
sudo systemctl restart microshift
oc get pods -n busybox
sudo mkdir -p <path_of_delete_directory> 1
[sudo] mv <path_of_manifests> <path_of_delete_directory>
sudo systemctl restart microshift
oc kustomize ~/manifests | grep "image:" | grep -oE '[^ ]+USD' | while read line; do echo -e "[[containers]]\nsource = \"USD{line}\"\n"; done >><my_blueprint>.toml
sudo composer-cli blueprints push <my_blueprint>.toml
[containers] auth_file_path = "/<path>/pull-secret.json" 1
sudo composer-cli compose start-ostree <my_blueprint> edge-commit
sudo dnf install rpmdevtools rpmlint yum-utils createrepo
rpmdev-setuptree
ls ~/rpmbuild/
BUILD RPMS SOURCES SPECS SRPMS
Name: <application_workload_manifests> Version: 0.0.1 Release: 1%{?dist} Summary: Adds workload manifests to microshift BuildArch: noarch License: GPL Source0: %{name}-%{version}.tar.gz #Requires: microshift %description Adds workload manifests to microshift %prep %autosetup %install 1 rm -rf USDRPM_BUILD_ROOT mkdir -p USDRPM_BUILD_ROOT/%{_prefix}/lib/microshift/manifests cp -pr ~/manifests USDRPM_BUILD_ROOT/%{_prefix}/lib/microshift/ %clean rm -rf USDRPM_BUILD_ROOT %files %{_prefix}/lib/microshift/manifests/** %changelog * <DDD MM DD YYYY username@domain - V major.minor.patch> - <your_change_log_comment>
rpmbuild -bb ~/rpmbuild/SPECS/<application_workload_manifests.spec>
createrepo ~/rpmbuild/RPMS/
sudo chmod a+rx ~
id = "local-rpm-build" name = "RPMs build locally" type = "yum-baseurl" url = "file://<path>/rpmbuild/RPMS" 1 check_gpg = false check_ssl = false system = false
sudo composer-cli sources add repo-local-rpmbuild.toml
... [[packages]] name = "<application_workload_manifests>" 1 version = "*" ...
sudo composer-cli blueprints push repo-local-rpmbuild.toml
sudo composer-cli compose start-ostree repo-local-rpmbuild edge-commit
#!/bin/bash set -e SCRIPT_NAME=USD(basename USD0) PODS_NS_LIST=(<user_workload_namespace1> <user_workload_namespace2>) PODS_CT_LIST=(<user_workload_namespace1_pod_count> <user_workload_namespace2_pod_count>) Update these two lines with at least one namespace and the pod counts that are specific to your workloads. Use the kubernetes <namespace> where your workload is deployed. Set greenboot to read and execute the workload health check functions library. source /usr/share/microshift/functions/greenboot.sh Set the exit handler to log the exit status. trap 'script_exit' EXIT Set the script exit handler to log a `FAILURE` or `FINISHED` message depending on the exit status of the last command. args: None return: None function script_exit() { [ "USD?" -ne 0 ] && status=FAILURE || status=FINISHED echo USDstatus } Set the system to automatically stop the script if the user running it is not 'root'. if [ USD(id -u) -ne 0 ] ; then echo "The 'USD{SCRIPT_NAME}' script must be run with the 'root' user privileges" exit 1 fi echo "STARTED" Set the script to stop without reporting an error if the MicroShift service is not running. if [ USD(systemctl is-enabled microshift.service 2>/dev/null) != "enabled" ] ; then echo "MicroShift service is not enabled. Exiting..." exit 0 fi Set the wait timeout for the current check based on the boot counter. WAIT_TIMEOUT_SECS=USD(get_wait_timeout) Set the script to wait for the pod images to be downloaded. for i in USD{!PODS_NS_LIST[@]}; do CHECK_PODS_NS=USD{PODS_NS_LIST[USDi]} echo "Waiting USD{WAIT_TIMEOUT_SECS}s for pod image(s) from the USD{CHECK_PODS_NS} namespace to be downloaded" wait_for USD{WAIT_TIMEOUT_SECS} namespace_images_downloaded done Set the script to wait for pods to enter ready state. for i in USD{!PODS_NS_LIST[@]}; do CHECK_PODS_NS=USD{PODS_NS_LIST[USDi]} CHECK_PODS_CT=USD{PODS_CT_LIST[USDi]} echo "Waiting USD{WAIT_TIMEOUT_SECS}s for USD{CHECK_PODS_CT} pod(s) from the USD{CHECK_PODS_NS} namespace to be in 'Ready' state" wait_for USD{WAIT_TIMEOUT_SECS} namespace_pods_ready done Verify that pods are not restarting by running, which could indicate a crash loop. for i in USD{!PODS_NS_LIST[@]}; do CHECK_PODS_NS=USD{PODS_NS_LIST[USDi]} echo "Checking pod restart count in the USD{CHECK_PODS_NS} namespace" namespace_pods_not_restarting USD{CHECK_PODS_NS} done
sudo reboot
sudo journalctl -o cat -u greenboot-healthcheck.service
GRUB boot variables: boot_success=0 boot_indeterminate=0 Greenboot variables: GREENBOOT_WATCHDOG_CHECK_ENABLED=true MICROSHIFT_WAIT_TIMEOUT_SEC=600 System installation type: ostree System installation status: * rhel 19619bd269094510180c845c44d0944fd9aa15925376f249c4d680a3355e51ae.0 Version: 9.4 origin refspec: edge:rhel-9.4-microshift-4.18
GRUB boot variables: boot_success=0 Greenboot variables: GREENBOOT_WATCHDOG_CHECK_ENABLED=true MICROSHIFT_WAIT_TIMEOUT_SEC=600 System installation type: bootc System installation status: bootcHost
GRUB boot variables: boot_success=1 boot_indeterminate=0 Greenboot variables: GREENBOOT_WATCHDOG_CHECK_ENABLED=true System installation type: RPM System installation status: Not an ostree / bootc system
kind: AppProject apiVersion: argoproj.io/v1alpha1 metadata: name: default namespace: openshift-gitops spec: clusterResourceWhitelist: - group: '*' kind: '*' destinations: - namespace: '*' server: '*' sourceRepos: - '*' --- kind: Application apiVersion: argoproj.io/v1alpha1 metadata: name: spring-petclinic namespace: openshift-gitops spec: destination: namespace: spring-petclinic server: https://kubernetes.default.svc project: default source: directory: recurse: true path: app repoURL: https://github.com/siamaksade/openshift-gitops-getting-started syncPolicy: automated: {} syncOptions: - CreateNamespace=true - ServerSideApply=true
oc apply -f <my_app.yaml> 1
oc get applications -A
NAMESPACE NAME SYNC STATUS HEALTH STATUS openshift-gitops spring-petclinic Synced Healthy
oc adm inspect ns/openshift-gitops
Gathering data for ns/openshift-gitops W0501 20:34:35.978508 57625 util.go:118] the server doesn't have a resource type egressfirewalls, skipping the inspection W0501 20:34:35.980881 57625 util.go:118] the server doesn't have a resource type egressqoses, skipping the inspection W0501 20:34:36.040664 57625 util.go:118] the server doesn't have a resource type servicemonitors, skipping the inspection Wrote inspect data to inspect.local.2673575938140296280.
get --show-labels namespace <namespace>
oc label namespace <namespace> security.openshift.io/scc.podSecurityLabelSync=true
oc -n openshift-operator-lifecycle-manager get pod -l app=olm-operator
NAME READY STATUS RESTARTS AGE olm-operator-85b5c6786-n6kbc 1/1 Running 0 2m24s
oc -n openshift-operator-lifecycle-manager get pod -l app=catalog-operator
NAME READY STATUS RESTARTS AGE catalog-operator-5fc7f857b6-tj8cf 1/1 Running 0 2m33s
apiVersion: operators.coreos.com/v1alpha1 kind: CatalogSource metadata: name: operatorhubio-catalog namespace: openshift-marketplace 1 spec: sourceType: grpc image: quay.io/operatorhubio/catalog:latest displayName: Community Operators 2 publisher: OperatorHub.io grpcPodConfig: securityContextConfig: restricted 3 updateStrategy: registryPoll: interval: 60m
oc apply -f <catalog_source.yaml> 1
catalogsource.operators.coreos.com/operatorhubio-catalog created
oc describe catalogsources.operators.coreos.com -n openshift-marketplace operatorhubio-catalog
Name: operatorhubio-catalog Namespace: openshift-marketplace Labels: <none> Annotations: <none> API Version: operators.coreos.com/v1alpha1 Kind: CatalogSource Metadata: Creation Timestamp: 2024-01-31T09:55:31Z Generation: 1 Resource Version: 1212 UID: 4edc1a96-83cd-4de9-ac8c-c269ca895f3e Spec: Display Name: Community Operators Grpc Pod Config: Security Context Config: restricted Image: quay.io/operatorhubio/catalog:latest Publisher: OperatorHub.io Source Type: grpc Update Strategy: Registry Poll: Interval: 60m Status: Connection State: Address: operatorhubio-catalog.openshift-marketplace.svc:50051 Last Connect: 2024-01-31T09:55:57Z Last Observed State: READY 1 Registry Service: Created At: 2024-01-31T09:55:31Z Port: 50051 Protocol: grpc Service Name: operatorhubio-catalog Service Namespace: openshift-marketplace Events: <none>
oc get pods -n openshift-marketplace -l olm.catalogSource=operatorhubio-catalog
NAME READY STATUS RESTARTS AGE operatorhubio-catalog-x24nh 1/1 Running 0 59s
apiVersion: operators.coreos.com/v1alpha1 kind: Subscription metadata: name: my-cert-manager namespace: openshift-operators spec: channel: stable name: cert-manager source: operatorhubio-catalog sourceNamespace: openshift-marketplace 1
oc apply -f <subscription_cr.yaml> 1
subscription.operators.coreos.com/my-cert-manager created
oc get pods -n openshift-operators 1
NAME READY STATUS RESTARTS AGE cert-manager-7df8994ddb-4vrkr 1/1 Running 0 19s cert-manager-cainjector-5746db8fd7-69442 1/1 Running 0 18s cert-manager-webhook-f858bf58b-748nt 1/1 Running 0 18s
oc -n openshift-operator-lifecycle-manager get pod -l app=olm-operator
NAME READY STATUS RESTARTS AGE olm-operator-85b5c6786-n6kbc 1/1 Running 0 16m
oc -n openshift-operator-lifecycle-manager get pod -l app=catalog-operator
NAME READY STATUS RESTARTS AGE catalog-operator-5fc7f857b6-tj8cf 1/1 Running 0 16m
apiVersion: v1 kind: Namespace metadata: name: olm-microshift
oc apply -f <ns.yaml> 1
namespace/olm-microshift created
kind: OperatorGroup apiVersion: operators.coreos.com/v1 metadata: name: og namespace: olm-microshift spec: 1 targetNamespaces: - olm-microshift
oc apply -f <og.yaml> 1
operatorgroup.operators.coreos.com/og created
apiVersion: operators.coreos.com/v1alpha1 kind: CatalogSource metadata: name: operatorhubio-catalog namespace: openshift-marketplace 1 spec: sourceType: grpc image: quay.io/operatorhubio/catalog:latest displayName: Community Operators 2 publisher: OperatorHub.io grpcPodConfig: securityContextConfig: restricted 3 updateStrategy: registryPoll: interval: 60m
oc apply -f <catalog_source.yaml> 1
oc describe catalogsources.operators.coreos.com -n openshift-marketplace operatorhubio-catalog
Name: operatorhubio-catalog Namespace: openshift-marketplace Labels: <none> Annotations: <none> API Version: operators.coreos.com/v1alpha1 Kind: CatalogSource Metadata: Creation Timestamp: 2024-01-31T10:09:46Z Generation: 1 Resource Version: 2811 UID: 60ce4a36-86d3-4921-b9fc-84d67c28df48 Spec: Display Name: Community Operators Grpc Pod Config: Security Context Config: restricted Image: quay.io/operatorhubio/catalog:latest Publisher: OperatorHub.io Source Type: grpc Update Strategy: Registry Poll: Interval: 60m Status: Connection State: Address: operatorhubio-catalog.openshift-marketplace.svc:50051 Last Connect: 2024-01-31T10:10:04Z Last Observed State: READY 1 Registry Service: Created At: 2024-01-31T10:09:46Z Port: 50051 Protocol: grpc Service Name: operatorhubio-catalog Service Namespace: openshift-marketplace Events: <none>
oc get pods -n openshift-marketplace -l olm.catalogSource=operatorhubio-catalog
NAME READY STATUS RESTARTS AGE operatorhubio-catalog-j7sc8 1/1 Running 0 43s
apiVersion: operators.coreos.com/v1alpha1 kind: Subscription metadata: name: my-gitlab-operator-kubernetes namespace: olm-microshift 1 spec: channel: stable name: gitlab-operator-kubernetes source: operatorhubio-catalog sourceNamespace: openshift-marketplace 2
oc apply -f <subscription_cr.yaml> 1
subscription.operators.coreos.com/my-gitlab-operator-kubernetes
oc get pods -n olm-microshift 1
NAME READY STATUS RESTARTS AGE gitlab-controller-manager-69bb6df7d6-g7ntx 2/2 Running 0 3m24s
oc mirror list operators --version 4.18 --catalogs
oc mirror list operators <--catalog=<catalog_source>> 1
oc mirror list operators --catalog=registry.redhat.io/redhat/redhat-operator-index:v4.17 --package=amq-broker-rhel8
oc mirror list operators --catalog=registry.redhat.io/redhat/redhat-operator-index:v4.17 --package=amq-broker-rhel8 --channel=7.11.x
oc mirror init --registry <storage_backend> > imageset-config.yaml 1
kind: ImageSetConfiguration apiVersion: mirror.openshift.io/v1alpha2 storageConfig: registry: imageURL: registry.example.com/oc-mirror skipTLS: false mirror: platform: 1 channels: - name: stable-4.18 type: ocp operators: - catalog: registry.redhat.io/redhat/redhat-operator-index:v4.18 packages: - name: serverless-operator channels: - name: stable additionalImages: 2 - name: registry.redhat.io/ubi8/ubi:latest helm: {} 3
kind: ImageSetConfiguration apiVersion: mirror.openshift.io/v1alpha2 storageConfig: 1 registry: imageURL: <storage_backend> 2 skipTLS: false mirror: operators: - catalog: registry.redhat.io/redhat/redhat-operator-index:v4.18 3 packages: - name: amq-broker-rhel8 4 channels: - name: 7.11.x 5
additionalImages: - name: registry.redhat.io/ubi8/ubi:latest
operators: - catalog: registry.redhat.io/redhat/redhat-operator-index:v4.18 packages: - name: elasticsearch-operator minVersion: '2.4.0'
operators: - catalog: registry.redhat.io/redhat/redhat-operator-index:v4.18 packages: - name: elasticsearch-operator minVersion: '5.2.3-31'
oc mirror --config=./<imageset-config.yaml> \ 1 docker://registry.example:5000 2
Rendering catalog image "registry.example.com/redhat/redhat-operator-index:v{ocp-version}" with file-based catalog
cat oc-mirror-workspace/<results-directory>/imageContentSourcePolicy.yaml 1
apiVersion: operator.openshift.io/v1alpha1 kind: ImageContentSourcePolicy metadata: labels: operators.openshift.org/catalog: "true" name: operator-0 spec: repositoryDigestMirrors: - mirrors: - registry.<example.com>/amq7 source: registry.redhat.io/amq7
yq '.spec.repositoryDigestMirrors[] as USDitem ireduce([]; . + [{"mirror": USDitem.mirrors[], "source": (USDitem | .source)}]) | .[] | "[[registry]] prefix = \"" + .source + "\" location = \"" + .mirror + "\" mirror-by-digest-only = true insecure = true "' ./icsp.yaml
[[registry]] prefix = "registry.redhat.io/amq7" location = "registry.example.com/amq7" mirror-by-digest-only = true insecure = true
[[registry]] prefix = "registry.redhat.io/amq7" location = "registry.example.com/amq7" mirror-by-digest-only = true insecure = true [[registry]] prefix = "" location = "quay.io" mirror-by-digest-only = true [[registry.mirror]] location = "<registry_host>:<port>" 1 insecure = false
sudo systemctl restart crio
oc apply -f ./oc-mirror-workspace/results-1708508014/catalogSource-cs-redhat-operator-index.yaml
apiVersion: operators.coreos.com/v1alpha1 kind: CatalogSource metadata: name: redhat-catalog namespace: openshift-marketplace 1 spec: sourceType: grpc image: registry.example.com/redhat/redhat-operator-index:v4.17 updateStrategy: registryPoll: interval: 60m
catalogsource.operators.coreos.com/cs-redhat-operator-index created
oc get catalogsource --all-namespaces
oc get pods -n openshift-marketplace
NAME READY STATUS RESTARTS AGE cs-redhat-operator-index-4227b 2/2 Running 0 2m5s
apiVersion: operators.coreos.com/v1alpha1 kind: Subscription metadata: name: amq-broker namespace: openshift-operators spec: channel: 7.11.x name: amq-broker-rhel8 source: cs-redhat-operator-index sourceNamespace: openshift-marketplace
oc apply -f ./<my-subscription-cr.yaml> 1
subscription.operators.coreos.com/amq-broker created
oc mirror --config=./imageset-config.yaml \ 1 docker://registry.example:5000 \ 2 --dry-run 3
Checking push permissions for registry.example:5000 Creating directory: oc-mirror-workspace/src/publish Creating directory: oc-mirror-workspace/src/v2 Creating directory: oc-mirror-workspace/src/charts Creating directory: oc-mirror-workspace/src/release-signatures No metadata detected, creating new workspace wrote mirroring manifests to oc-mirror-workspace/operators.1658342351/manifests-redhat-operator-index info: Planning completed in 31.48s info: Dry run complete Writing image mapping to oc-mirror-workspace/mapping.txt
cd oc-mirror-workspace/
jq -r --slurp '.[] | select(.relatedImages != null) | "[[containers]]\nsource = \"" + .relatedImages[].image + "\"\n"' ./oc-mirror-workspace/src/catalogs/registry.redhat.io/redhat/redhat-operator-index/v4.17/index/index.json
jq -r --slurp '.[] | select(.relatedImages != null) | .relatedImages[] | select(.name | contains("ppc") or contains("s390x") | not) | "[[containers]]\\nsource = \\"" + .image + "\\"\\n"' ./oc-mirror-workspace/src/catalogs/registry.redhat.io/redhat/redhat-operator-index/v4.17/index/index.json
[[containers]] source = "registry.redhat.io/amq7/amq-broker-init-rhel8@sha256:0b2126cfb6054fdf428c1f43b69e36e93a09a49ce15350e9273c98cc08c6598b" [[containers]] source = "registry.redhat.io/amq7/amq-broker-init-rhel8@sha256:0dde839c2dce7cb684094bf26523c8e16677de03149a0fff468b8c3f106e1f4f" [[containers]] source = "registry.redhat.io/amq7/amq-broker-rhel8@sha256:e8fa2a00e576ecb95561ffbdbf87b1c82d479c8791ab2c6ce741dd0d0b496d15" [[containers]] source = "registry.redhat.io/amq7/amq-broker-rhel8@sha256:ff6fefad518a6c997d4c5a6e475ba89640260167f0bc27715daf3cc30116fad1" ... EOF
cat imageset-config.yaml
kind: ImageSetConfiguration apiVersion: mirror.openshift.io/v1alpha2 storageConfig: registry: imageURL: registry.example.com/microshift-mirror mirror: operators: - catalog: registry.redhat.io/redhat/redhat-operator-index:v4.17 1 packages: - name: amq-broker-rhel8 channels: - name: 7.11.x
skopeo inspect docker://<registry.redhat.io/redhat/redhat-operator-index:v4.17> | jq `.Digest` 1
"sha256:7a76c0880a839035eb6e896d54ebd63668bb37b82040692141ba39ab4c539bc6"
[[containers]] source = "registry.redhat.io/redhat/redhat-operator-index@sha256:7a76c0880a839035eb6e896d54ebd63668bb37b82040692141ba39ab4c539bc6"
name = "microshift_blueprint" description = "MicroShift 4.17.1 on x86_64 platform" version = "0.0.1" modules = [] groups = [] [[packages]] 1 name = "microshift" version = "4.17.1" [customizations.services] 2 enabled = ["microshift"] [customizations.firewall] ports = ["22:tcp", "80:tcp", "443:tcp", "5353:udp", "6443:tcp", "30000-32767:tcp", "30000-32767:udp"] [[containers]] 3 source = "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:f41e79c17e8b41f1b0a5a32c3e2dd7cd15b8274554d3f1ba12b2598a347475f4" [[containers]] source = "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:dbc65f1fba7d92b36cf7514cd130fe83a9bd211005ddb23a8dc479e0eea645fd" [[containers]] 4 source = "registry.redhat.io/redhat/redhat-operator-index@sha256:7a76c0880a839035eb6e896d54ebd63668bb37b82040692141ba39ab4c539bc6" [[containers]] source = "registry.redhat.io/amq7/amq-broker-init-rhel8@sha256:0dde839c2dce7cb684094bf26523c8e16677de03149a0fff468b8c3f106e1f4f" [[containers]] source = "registry.redhat.io/amq7/amq-broker-rhel8@sha256:e8fa2a00e576ecb95561ffbdbf87b1c82d479c8791ab2c6ce741dd0d0b496d15" [[containers]] source = "registry.redhat.io/amq7/amq-broker-rhel8@sha256:ff6fefad518a6c997d4c5a6e475ba89640260167f0bc27715daf3cc30116fad1" ... EOF
apiVersion: operators.coreos.com/v1alpha1 kind: CatalogSource metadata: name: cs-redhat-operator-index namespace: openshift-marketplace 1 spec: image: registry.example.com/redhat/redhat-operator-index:v4.17 sourceType: grpc displayName: publisher: updateStrategy: registryPoll: interval: 60m
apiVersion: operators.coreos.com/v1alpha1 kind: CatalogSource metadata: name: cs-redhat-operator-index namespace: openshift-marketplace spec: image: registry.example.com/redhat/redhat-operator-index@sha256:7a76c0880a839035eb6e896d54ebd63668bb37b82040692141ba39ab4c539bc6 1 sourceType: grpc displayName: publisher: updateStrategy: registryPoll: interval: 60m
oc apply -f ./oc-mirror-workspace/results-1708508014/catalogSource-cs-redhat-operator-index.yaml
catalogsource.operators.coreos.com/cs-redhat-operator-index created
oc get catalogsource --all-namespaces
oc get pods -n openshift-marketplace
NAME READY STATUS RESTARTS AGE cs-redhat-operator-index-4227b 2/2 Running 0 2m5s
apiVersion: operators.coreos.com/v1alpha1 kind: Subscription metadata: name: amq-broker namespace: openshift-operators spec: channel: 7.11.x name: amq-broker-rhel8 source: cs-redhat-operator-index sourceNamespace: openshift-marketplace
oc apply -f ./<my-subscription-cr.yaml> 1
subscription.operators.coreos.com/amq-broker created