Getting began with an area OKD cluster on Linux

rgerardi

6 years ago

OKD is the open supply upstream group version of Red Hat’s OpenShift container platform. OKD is a container administration and orchestration platform based mostly on Docker and Kubernetes.

OKD is an entire answer to handle, deploy, and function containerized purposes that (along with the options supplied by Kubernetes) contains an easy-to-use internet interface, automated construct instruments, routing capabilities, and monitoring and logging aggregation options.

OKD supplies a number of deployment choices geared toward completely different necessities with single or a number of grasp nodes, high-availability capabilities, logging, monitoring, and extra. You can create OKD clusters as small or as massive as you want.

In addition to those deployment choices, OKD supplies a method to create an area, all-in-one cluster by yourself machine utilizing the oc command-line instrument. This is a good choice if you wish to strive OKD domestically with out committing the sources to create a bigger multi-node cluster, or if you wish to have an area cluster in your machine as a part of your workflow or growth course of. In this case, you may create and deploy the purposes domestically utilizing the identical APIs and interfaces required to deploy the appliance on a bigger scale. This course of ensures a seamless integration that forestalls points with purposes that work within the developer’s setting however not in manufacturing.

This tutorial will present you the right way to create an OKD cluster utilizing oc cluster up in a Linux field.

1. Install Docker

The oc cluster up command creates an area OKD cluster in your machine utilizing Docker containers. In order to make use of this command, you want Docker put in in your machine. For OKD model three.9 and later, Docker 1.13 is the minimal beneficial model. If Docker just isn’t put in in your system, set up it through the use of your distribution package deal supervisor. For instance, on CentOS or RHEL, set up Docker with this command:

$ sudo yum set up -y docker

On Fedora, use dnf:

$ sudo dnf set up -y docker

This installs Docker and all required dependencies.

2. Configure Docker insecure registry

Once you have got Docker put in, you have to configure it to permit the communication with an insecure registry on tackle 172.30.Zero.Zero/16. This insecure registry shall be deployed together with your native OKD cluster later.

On CentOS or RHEL, edit the file /and so on/docker/daemon.json by including these strains:

On Fedora, edit the file /and so on/containers/registries.conf by including these strains:

[registries.insecure]
registries = ['172.30.0.0/16']

three. Start Docker

Before beginning Docker, create a system group named docker and assign this group to your person so you may run Docker instructions with your personal person, with out requiring root or sudo entry. This permits you to create your OKD cluster utilizing your personal person.

For instance, these are the instructions to create the group and assign it to my native person, ricardo:

$ sudo groupadd docker
$ sudo usermod -a -G docker ricardo

You have to sign off and log again in to see the brand new group affiliation. After logging again in, run the id command and make sure you’re a member of the docker group:

$ id
uid=1000(ricardo) gid=1000(ricardo) teams=1000(ricardo),10(wheel),1001(docker) 
context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

Now, begin and allow the Docker daemon like this:

$ sudo systemctl begin docker
$ sudo systemctl allow docker
Created symlink from /and so on/systemd/system/multi-user.goal.needs/docker.service to /usr/lib/systemd/system/docker.service.

Verify that Docker is operating:

$ docker model

Client:

 Version:         1.13.1

 API model:     1.26

 Package model: docker-1.13.1-75.git8633870.el7.centos.x86_64

 Go model:      go1.9.four

 Git commit:      8633870/1.13.1

 Built:           Fri Sep 28 19:45:08 2018

 OS/Arch:         linux/amd64Server:
 Version:         1.13.1
 API model:     1.26 (minimal model 1.12)
 Package model: docker-1.13.1-75.git8633870.el7.centos.x86_64
 Go model:      go1.9.four
 Git commit:      8633870/1.13.1
 Built:           Fri Sep 28 19:45:08 2018
 OS/Arch:         linux/amd64
 Experimental:    false

Ensure that the insecure registry choice has been enabled by operating docker information and in search of these strains:

$ docker information
... Skipping lengthy output ...
Insecure Registries:
 172.30.Zero.Zero/16
 127.Zero.Zero.Zero/eight

four. Open firewall ports

Next, open firewall ports to make sure your OKD containers can talk with the grasp API. By default, some distributions have the firewall enabled, which blocks required connectivity from the OKD containers to the grasp API. If your system has the firewall enabled, you have to add guidelines to permit communication on ports 8443/tcp for the grasp API and 53/udp for DNS decision on the Docker bridge subnet.

For CentOS, RHEL, and Fedora, you should use the firewall-cmd command-line instrument so as to add the principles. For different distributions, you should use the supplied firewall supervisor, equivalent to UFW or iptables.

Before including the firewall guidelines, acquire the Docker bridge community subnet’s tackle, like this:

$ docker community examine bridge | grep Subnet
                    "Subnet": "172.17.0.0/16",

Enable the firewall guidelines utilizing this subnet. For CentOS, RHEL, and Fedora, use firewall-cmd so as to add a brand new zone:

$ sudo firewall-cmd --permanent --new-zone okdlocal
success

Include the subnet tackle you obtained earlier than as a supply to the brand new zone:

$ sudo firewall-cmd --permanent --zone okdlocal --add-source 172.17.Zero.Zero/16
success

Next, add the required guidelines to the okdlocal zone:

$ sudo firewall-cmd --permanent --zone okdlocal --add-port 8443/tcp
success
$ sudo firewall-cmd --permanent --zone okdlocal --add-port 53/udp
success
$ sudo firewall-cmd --permanent --zone okdlocal --add-port 8053/udp
success

Finally, reload the firewall to allow the brand new guidelines:

$ sudo firewall-cmd --reload
success

Ensure that the brand new zone and guidelines are in place:

$ sudo firewall-cmd --zone okdlocal --list-sources
172.17.Zero.Zero/16
$ sudo firewall-cmd --zone okdlocal --list-ports
8443/tcp 53/udp 8053/udp

Your system is able to begin the cluster. It’s time to obtain the OKD consumer instruments.

To deploy an area OKD cluster utilizing oc, you have to obtain the OKD consumer instruments package deal. For some distributions, like CentOS and Fedora, this package deal may be downloaded as an RPM from the official repositories. Please word that these packages might comply with the distribution replace cycle and normally usually are not the newest model obtainable.

For this tutorial, obtain the OKD consumer package deal instantly from the official GitHub repository so you may get the newest model obtainable. At the time of writing, this was OKD v3.11.

Go to the OKD downloads page to get the hyperlink to the OKD instruments for Linux, then obtain it with wget:

$ cd ~/Downloads/
$ wget https://github.com/openshift/origin/releases/obtain/v3.11.Zero/openshift-origin-client-tools-v3.11.Zero-0cbc58b-linux-64bit.tar.gz

Uncompress the downloaded package deal:

$ tar -xzvf openshift-origin-client-tools-v3.11.Zero-0cbc58b-linux-64bit.tar.gz

Finally, to make it simpler to make use of the oc command systemwide, transfer it to a listing included in your $PATH variable. location is /usr/native/bin:

$ sudo cp openshift-origin-client-tools-v3.11.Zero-0cbc58b-linux-64bit/oc /usr/native/bin/

One of the nicest options of the oc command is that it is a static single binary. You needn’t set up it to make use of it.

Check that the oc command is working:

$ oc model
oc v3.11.Zero+0cbc58b
kubernetes v1.11.Zero+d4cacc0
options: Basic-Auth GSSAPI Kerberos SPNEGO

6. Start your OKD cluster

Once you have got all of the conditions in place, begin your native OKD cluster by operating this command:

$ oc cluster up

This command connects to your native Docker daemon, downloads all required photographs from Docker Hub, and begins the containers. The first time you run it, it takes a couple of minutes to finish. When it is completed, you will notice this message:

... Skipping lengthy output ...OpenShift server began.
The server is accessible through internet console at:
    https://127.0.0.1:8443
You are logged in as:
    User:     developer
    Password: <any worth>
To login as administrator:
    oc login -u system:admin

Access the OKD internet console through the use of the browser and navigating to https://127.0.0.1:8443:

From the command line, you may examine if the cluster is operating by coming into this command:

$ oc cluster standing

Web console URL: https://127.Zero.Zero.1:8443/console/Config is at host listing 
Volumes are at host listing 
Persistent volumes are at host listing /dwelling/ricardo/openshift.native.clusterup/openshift.native.pv
Data shall be discarded when cluster is destroyed

You can even confirm your cluster is working by logging in because the system:admin person and checking obtainable nodes utilizing the oc command-line instrument:

$ oc login -u system:admin

Logged into "https://127.0.0.1:8443" as "system:admin" utilizing current credentials.You have entry to the next initiatives and may change between them with 'oc venture <projectname>':
    default
    kube-dns
    kube-proxy
    kube-public
    kube-system
  * myproject
    openshift
    openshift-apiserver
    openshift-controller-manager
    openshift-core-operators
    openshift-infra
    openshift-node
    openshift-service-cert-signer
    openshift-web-console
Using venture "myproject".
$ oc get nodes
NAME        STATUS    ROLES     AGE       VERSION
localhost   Ready     <none>    52m       v1.11.Zero+d4cacc0

Since it is a native, all-in-one cluster, you see solely localhost within the nodes checklist.

7. Smoke-test your cluster

Now that your native OKD cluster is operating, create a check app to smoke-test it. Use OKD to construct and begin the pattern utility so you may make sure the completely different parts are working.

Start by logging in because the developer person:

$ oc login -u developer

Logged into "https://127.0.0.1:8443" as "developer" utilizing current credentials.You have one venture on this server: "myproject"
Using venture "myproject".

You’re mechanically assigned to a brand new, empty venture named myproject. Create a pattern PHP utility based mostly on an current GitHub repository, like this:

$ oc new-app php:5.6~https://github.com/rgerardi/ocp-smoke-test.git 

--> Found picture 92ed8b3 (5 months previous) in picture stream "openshift/php" underneath tag "5.6" for "php:5.6"    Apache 2.four with PHP 5.6 
    ----------------------- 
    PHP 5.6 obtainable as container is a base platform for constructing and operating numerous PHP 5.6 purposes and frameworks. PHP is an HTML-embedded scripting language. PHP makes an attempt to make it straightforward for builders to write dynamically generated internet pages. PHP additionally presents built-in database integration for a number of industrial and non-commercial database administration methods, so writing a database-enabled webpage with PHP is pretty easy. The most typical use of PHP coding might be as a alternative for CGI scripts.
    Tags: builder, php, php56, rh-php56
    * A supply construct utilizing supply code from https://github.com/rgerardi/ocp-smoke-test.git shall be created
      * The ensuing picture shall be pushed to picture stream tag "ocp-smoke-test:latest"
      * Use 'start-build' to set off a brand new construct
    * This picture shall be deployed in deployment config "ocp-smoke-test"
    * Ports 8080/tcp, 8443/tcp shall be load balanced by service "ocp-smoke-test"
      * Other containers can entry this service via the hostname "ocp-smoke-test"
--> Creating sources ...
    imagestream.picture.openshift.io "ocp-smoke-test" created
    buildconfig.construct.openshift.io "ocp-smoke-test" created
    deploymentconfig.apps.openshift.io "ocp-smoke-test" created
    service "ocp-smoke-test" created
--> Success
    Build scheduled, use 'oc logs -f bc/ocp-smoke-test' to trace its progress.
    Application just isn't uncovered. You can expose companies to the skin world by executing one or extra of the instructions beneath:
     'oc expose svc/ocp-smoke-test' 
    Run 'oc standing' to view your app.

OKD begins the construct course of, which clones the supplied GitHub repository, compiles the appliance (if required), and creates the required photographs. You can comply with the construct course of by tailing its log with this command:

$ oc logs -f bc/ocp-smoke-test
Cloning "https://github.com/rgerardi/ocp-smoke-test.git" ...
        Commit: 391a475713d01ab0afab700bab8a3d7549c5cc27 (Create index.php)
        Author: Ricardo Gerardi <ricardo.gerardi@gmail.com>
        Date:   Tue Oct 2 13:47:25 2018 -0400
Using 172.30.1.1:5000/openshift/php@sha256:f3c95020fa870fcefa7d1440d07a2b947834b87bdaf000588e84ef4a599c7546 as the s2i builder picture
---> Installing utility supply...
=> sourcing 20-copy-config.sh ...
---> 04:53:28     Processing extra arbitrary httpd configuration supplied by s2i ...
=> sourcing 00-documentroot.conf ...
=> sourcing 50-mpm-tuning.conf ...
=> sourcing 40-ssl-certs.sh ...
Pushing picture 172.30.1.1:5000/myproject/ocp-smoke-test:newest ...
Pushed 1/10 layers, 10% full
Push profitable

After the construct course of completes, OKD begins the appliance mechanically by operating a brand new pod based mostly on the created picture. You can see this new pod with this command:

$ oc get pods
NAME                     READY     STATUS      RESTARTS   AGE
ocp-smoke-test-1-build   Zero/1       Completed   Zero          1m
ocp-smoke-test-1-d8h76   1/1       Running     Zero          7s

You can see two pods are created; the primary one (with the standing Completed) is the pod used to construct the appliance. The second one (with the standing Running) is the appliance itself.

In addition, OKD creates a service for this utility. Verify it through the use of this command:

$ oc get service
NAME             TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)             AGE
ocp-smoke-test   ClusterIP   172.30.232.241   <none>        8080/TCP,8443/TCP   1m

Finally, expose this service externally utilizing OKD routes so you may entry the appliance from an area browser:

$ oc expose svc ocp-smoke-test

route.route.openshift.io/ocp-smoke-test uncovered$ oc get route
NAME             HOST/PORT                                   PATH      SERVICES         PORT       TERMINATION   WILDCARD
ocp-smoke-test   ocp-smoke-test-myproject.127.Zero.Zero.1.nip.io             ocp-smoke-test   8080-tcp                 None

Verify that your new utility is operating by navigating to http://ocp-smoke-test-myproject.127.0.0.1.nip.io in an internet browser:

You can even see the standing of your utility by logging into the OKD internet console:

Learn extra

You can discover extra details about OKD on the official site, which features a hyperlink to the OKD documentation.

If that is your first time working with OKD/OpenShift, you may be taught the fundamentals of the platform, together with the right way to construct and deploy containerized purposes, via the Interactive Learning Portal. Another good useful resource is the official OpenShift YouTube channel.