Before we begin: This is in no way production ready, as the title states. In a production setup you would put the internal registry on a persistent storage, you would probably have more than one master node and you would probably have more than on compute node. Security is not covered at all here. This post is intended to quickly bring up something you can play with, that’s it. In future posts will explore more details of OpenShift. So, lets start.
What I used as a starting point are three t2.xlarge instances:
One of them will be the master, there will be one infrastructure and one compute node. All of them are based on the Red Hat Enterprise Linux 7.5 (HVM) AMI:
Once these three instances are running the most important thing is that you set persistent hostnames (if you do not do this the OpenShift installation will fail):
[root@master ec2-user]$ hostnamectl set-hostname --static master.it.dbi-services.com [root@master ec2-user]$ echo "preserve_hostname: true" >> /etc/cloud/cloud.cfg
Of course you need to do that on all three hosts. Once that is done, because I have no DNS in my setup, /etc/hosts should be adjusted on all the machines, in my case:
[root@master ec2-user]$ cat /etc/hosts 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 10.0.1.167 master master.it.dbi-services.com 10.0.1.110 node1 node1.it.dbi-services.com 10.0.1.13 node2 node2.it.dbi-services.com
As everything is based on RedHat you need to register all the machines:
[root@master ec2-user]$ subscription-manager register Registering to: subscription.rhsm.redhat.com:443/subscription Username: xxxxxx Password: The system has been registered with ID: xxxxxxx The registered system name is: master
Once done, refresh and then list the available subscriptions. There should be at least one which is named like “Red Hat OpenShift”. Having identified the “Pool ID” for that one attach it (on all machines):
[root@master ec2-user]$ subscription-manager refresh [root@master ec2-user]$ subscription-manager list --available [root@master ec2-user]$ subscription-manager attach --pool=xxxxxxxxxxxxxxxxxxxxxxxxx
Now you are ready to enable the required repositories (on all machines):
[root@master ec2-user]$ subscription-manager repos --enable="rhel-7-server-rpms" \
--enable="rhel-7-server-extras-rpms" \
--enable="rhel-7-server-ose-3.11-rpms" \
--enable="rhel-7-server-ansible-2.6-rpms"
Repository 'rhel-7-server-rpms' is enabled for this system.
Repository 'rhel-7-server-extras-rpms' is enabled for this system.
Repository 'rhel-7-server-ansible-2.6-rpms' is enabled for this system.
Repository 'rhel-7-server-ose-3.11-rpms' is enabled for this system.
Having the repos enabled the required packages can be installed (on all machines):
[root@master ec2-user]$ yum -y install wget git net-tools bind-utils iptables-services bridge-utils bash-completion kexec-tools sos psacct
Updating all packages to the latest release and rebooting to the potentially new kernel is recommended. As we will be using Docker for this deployment we will install that as well (on all machines):
[root@master ec2-user]$ yum install -y docker [root@master ec2-user]$ yum update -y [root@master ec2-user]$ systemctl reboot
Now, that we are up to date and the prerequisites are met we create a new group and a new user. Why that? The complete OpenShift installation is driven by Ansible. You could run all of the installation directly as root, but a better way is to use a dedicated user that has sudo permissions to perform the tasks (on all machines):
[root@master ec2-user]$ useradd -g dbi dbi [root@master ec2-user]$ useradd -g dbi dbi
As Ansible needs to login to all the machines you will need to setup password-less ssh connections for the user. I am assuming that you know how to do that. If not, please check here.
Several tasks of the OpenShift Ansible playbooks need to be executed as root so the “dbi” user needs permissions to do that (on all machines):
[root@master ec2-user]$ cat /etc/sudoers | grep dbi dbi ALL=(ALL) NOPASSWD: ALL
There is one last preparation step to be executed on the master only: Installing the Ansible playbooks required to bring up OpenShift:
[root@master ec2-user]$ yum -y install openshift-ansible
That’s all the preparation required for this playground setup. As all the installation is Ansible based we need an inventory file on the master:
[dbi@master ~]$ id -a
uid=1001(dbi) gid=1001(dbi) groups=1001(dbi),994(dockerroot) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
[dbi@master ~]$ pwd
/home/dbi
[dbi@master ~]$ cat inventory
# Create an OSEv3 group that contains the masters, nodes, and etcd groups
[OSEv3:children]
masters
nodes
etcd
# Set variables common for all OSEv3 hosts
[OSEv3:vars]
# SSH user, this user should allow ssh based auth without requiring a password
ansible_ssh_user=dbi
# If ansible_ssh_user is not root, ansible_become must be set to true
ansible_become=true
become_method = sudo
openshift_deployment_type=openshift-enterprise
openshift_master_identity_providers=[{'name': 'htpasswd_auth', 'login': 'true', 'challenge': 'true', 'kind': 'HTPasswdPasswordIdentityProvider'}]
openshift_master_htpasswd_users={'admin': '$apr1$4ZbKL26l$3eKL/6AQM8O94lRwTAu611', 'developer': '$apr1$4ZbKL26l$3eKL/6AQM8O94lRwTAu611'}
# Registry settings
oreg_url=registry.redhat.io/openshift3/ose-${component}:${version}
oreg_auth_user=dbiservices2800
oreg_auth_password=eIJAy7LsyA
# disable checks
openshift_disable_check=disk_availability,docker_storage,memory_availability
openshift_master_default_subdomain=apps.it.dbi-services.com
# host group for masters
[masters]
master.it.dbi-services.com
# host group for etcd
[etcd]
master.it.dbi-services.com
# host group for nodes, includes region info
[nodes]
master.it.dbi-services.com openshift_node_group_name='node-config-master'
node1.it.dbi-services.com openshift_node_group_name='node-config-compute'
node2.it.dbi-services.com openshift_node_group_name='node-config-infra'
If you need more details about all the variables and host groups used here, please check the OpenShift documentation.
In any case pleas execute the prerequisites playbook before starting with the installation. When that does not run until the end or does show any “failed” tasks then you need to fix something before proceeding:
[dbi@master ~]$ ansible-playbook -i inventory /usr/share/ansible/openshift-ansible/playbooks/prerequisites.yml PLAY [Fail openshift_kubelet_name_override for new hosts] ********************************************** TASK [Gathering Facts] ********************************************************************************* ok: [master.it.dbi-services.com] ok: [node1.it.dbi-services.com] ... PLAY RECAP ********************************************************************************************* localhost : ok=11 changed=0 unreachable=0 failed=0 master.it.dbi-services.com : ok=80 changed=17 unreachable=0 failed=0 node1.it.dbi-services.com : ok=56 changed=16 unreachable=0 failed=0 INSTALLER STATUS *************************************************************************************** Initialization : Complete (0:01:40)
When it is fine, install OpenShift:
[dbi@master ~]$ ansible-playbook -i inventory /usr/share/ansible/openshift-ansible/playbooks/deploy_cluster.yml
That will take some time but at the end your OpenShift cluster should be up and running:
[dbi@master ~]$ oc login -u system:admin
Logged into "https://master:8443" as "system:admin" using existing credentials.
You have access to the following projects and can switch between them with 'oc project ':
* default
kube-public
kube-service-catalog
kube-system
management-infra
openshift
openshift-ansible-service-broker
openshift-console
openshift-infra
openshift-logging
openshift-monitoring
openshift-node
openshift-sdn
openshift-template-service-broker
openshift-web-console
Using project "default".
[dbi@master ~]$ oc get nodes
NAME STATUS ROLES AGE VERSION
master.it.dbi-services.com Ready master 1h v1.11.0+d4cacc0
node1.it.dbi-services.com Ready compute 1h v1.11.0+d4cacc0
node2.it.dbi-services.com Ready infra 1h v1.11.0+d4cacc0
As expected there is one master, one infratructure and one compute node. All the pods in the default namespace should be running fine:
[dbi@master ~]$ oc get pods -n default NAME READY STATUS RESTARTS AGE docker-registry-1-lmjzs 1/1 Running 0 1h registry-console-1-n4z5j 1/1 Running 0 1h router-1-5wl27 1/1 Running 0 1h
All the default Image Streams are there as well:
[dbi@master ~]$ oc get is -n openshift NAME DOCKER REPO TAGS UPDATED apicurito-ui docker-registry.default.svc:5000/openshift/apicurito-ui 1.2 2 hours ago dotnet docker-registry.default.svc:5000/openshift/dotnet latest,1.0,1.1 + 3 more... 2 hours ago dotnet-runtime docker-registry.default.svc:5000/openshift/dotnet-runtime 2.2,latest,2.0 + 1 more... 2 hours ago eap-cd-openshift docker-registry.default.svc:5000/openshift/eap-cd-openshift 14.0,15.0,13 + 6 more... 2 hours ago fis-java-openshift docker-registry.default.svc:5000/openshift/fis-java-openshift 1.0,2.0 2 hours ago fis-karaf-openshift docker-registry.default.svc:5000/openshift/fis-karaf-openshift 1.0,2.0 2 hours ago fuse-apicurito-generator docker-registry.default.svc:5000/openshift/fuse-apicurito-generator 1.2 2 hours ago fuse7-console docker-registry.default.svc:5000/openshift/fuse7-console 1.0,1.1,1.2 2 hours ago fuse7-eap-openshift docker-registry.default.svc:5000/openshift/fuse7-eap-openshift 1.0,1.1,1.2 2 hours ago fuse7-java-openshift docker-registry.default.svc:5000/openshift/fuse7-java-openshift 1.0,1.1,1.2 2 hours ago fuse7-karaf-openshift docker-registry.default.svc:5000/openshift/fuse7-karaf-openshift 1.0,1.1,1.2 2 hours ago httpd docker-registry.default.svc:5000/openshift/httpd 2.4,latest 2 hours ago java docker-registry.default.svc:5000/openshift/java 8,latest 2 hours ago jboss-amq-62 docker-registry.default.svc:5000/openshift/jboss-amq-62 1.3,1.4,1.5 + 4 more... 2 hours ago jboss-amq-63 docker-registry.default.svc:5000/openshift/jboss-amq-63 1.0,1.1,1.2 + 1 more... 2 hours ago jboss-datagrid73-openshift docker-registry.default.svc:5000/openshift/jboss-datagrid73-openshift 1.0 jboss-datavirt63-driver-openshift docker-registry.default.svc:5000/openshift/jboss-datavirt63-driver-openshift 1.0,1.1 2 hours ago jboss-datavirt63-openshift docker-registry.default.svc:5000/openshift/jboss-datavirt63-openshift 1.0,1.1,1.2 + 2 more... 2 hours ago jboss-decisionserver62-openshift docker-registry.default.svc:5000/openshift/jboss-decisionserver62-openshift 1.2 2 hours ago jboss-decisionserver63-openshift docker-registry.default.svc:5000/openshift/jboss-decisionserver63-openshift 1.3,1.4 2 hours ago jboss-decisionserver64-openshift docker-registry.default.svc:5000/openshift/jboss-decisionserver64-openshift 1.0,1.1,1.2 + 1 more... 2 hours ago jboss-eap64-openshift docker-registry.default.svc:5000/openshift/jboss-eap64-openshift 1.7,1.3,1.4 + 6 more... 2 hours ago jboss-eap70-openshift docker-registry.default.svc:5000/openshift/jboss-eap70-openshift 1.5,1.6,1.7 + 2 more... 2 hours ago jboss-eap71-openshift docker-registry.default.svc:5000/openshift/jboss-eap71-openshift 1.1,1.2,1.3 + 1 more... 2 hours ago jboss-eap72-openshift docker-registry.default.svc:5000/openshift/jboss-eap72-openshift 1.0,latest 2 hours ago jboss-fuse70-console docker-registry.default.svc:5000/openshift/jboss-fuse70-console 1.0 2 hours ago jboss-fuse70-eap-openshift docker-registry.default.svc:5000/openshift/jboss-fuse70-eap-openshift 1.0 jboss-fuse70-java-openshift docker-registry.default.svc:5000/openshift/jboss-fuse70-java-openshift 1.0 2 hours ago jboss-fuse70-karaf-openshift docker-registry.default.svc:5000/openshift/jboss-fuse70-karaf-openshift 1.0 2 hours ago jboss-processserver63-openshift docker-registry.default.svc:5000/openshift/jboss-processserver63-openshift 1.3,1.4 2 hours ago jboss-processserver64-openshift docker-registry.default.svc:5000/openshift/jboss-processserver64-openshift 1.2,1.3,1.0 + 1 more... 2 hours ago jboss-webserver30-tomcat7-openshift docker-registry.default.svc:5000/openshift/jboss-webserver30-tomcat7-openshift 1.1,1.2,1.3 2 hours ago jboss-webserver30-tomcat8-openshift docker-registry.default.svc:5000/openshift/jboss-webserver30-tomcat8-openshift 1.2,1.3,1.1 2 hours ago jboss-webserver31-tomcat7-openshift docker-registry.default.svc:5000/openshift/jboss-webserver31-tomcat7-openshift 1.0,1.1,1.2 2 hours ago jboss-webserver31-tomcat8-openshift docker-registry.default.svc:5000/openshift/jboss-webserver31-tomcat8-openshift 1.0,1.1,1.2 2 hours ago jenkins docker-registry.default.svc:5000/openshift/jenkins 2,latest,1 2 hours ago mariadb docker-registry.default.svc:5000/openshift/mariadb 10.1,10.2,latest 2 hours ago mongodb docker-registry.default.svc:5000/openshift/mongodb 2.4,3.2,3.6 + 3 more... 2 hours ago mysql docker-registry.default.svc:5000/openshift/mysql 5.7,latest,5.6 + 1 more... 2 hours ago nginx docker-registry.default.svc:5000/openshift/nginx 1.8,latest,1.10 + 1 more... 2 hours ago nodejs docker-registry.default.svc:5000/openshift/nodejs 8-RHOAR,0.10,6 + 3 more... 2 hours ago perl docker-registry.default.svc:5000/openshift/perl 5.20,5.24,5.16 + 1 more... 2 hours ago php docker-registry.default.svc:5000/openshift/php 5.6,5.5,7.0 + 1 more... 2 hours ago postgresql docker-registry.default.svc:5000/openshift/postgresql latest,10,9.2 + 3 more... 2 hours ago python docker-registry.default.svc:5000/openshift/python 2.7,3.3,3.4 + 3 more... 2 hours ago redhat-openjdk18-openshift docker-registry.default.svc:5000/openshift/redhat-openjdk18-openshift 1.0,1.1,1.2 + 2 more... 2 hours ago redhat-sso70-openshift docker-registry.default.svc:5000/openshift/redhat-sso70-openshift 1.3,1.4 2 hours ago redhat-sso71-openshift docker-registry.default.svc:5000/openshift/redhat-sso71-openshift 1.1,1.2,1.3 + 1 more... 2 hours ago redhat-sso72-openshift docker-registry.default.svc:5000/openshift/redhat-sso72-openshift 1.0,1.1,1.2 2 hours ago redis docker-registry.default.svc:5000/openshift/redis 3.2,latest 2 hours ago rhdm70-decisioncentral-openshift docker-registry.default.svc:5000/openshift/rhdm70-decisioncentral-openshift 1.0,1.1 2 hours ago rhdm70-kieserver-openshift docker-registry.default.svc:5000/openshift/rhdm70-kieserver-openshift 1.0,1.1 2 hours ago rhdm71-controller-openshift docker-registry.default.svc:5000/openshift/rhdm71-controller-openshift 1.0,1.1 2 hours ago rhdm71-decisioncentral-indexing-openshift docker-registry.default.svc:5000/openshift/rhdm71-decisioncentral-indexing-openshift 1.0,1.1 2 hours ago rhdm71-decisioncentral-openshift docker-registry.default.svc:5000/openshift/rhdm71-decisioncentral-openshift 1.1,1.0 2 hours ago rhdm71-kieserver-openshift docker-registry.default.svc:5000/openshift/rhdm71-kieserver-openshift 1.0,1.1 2 hours ago rhdm71-optaweb-employee-rostering-openshift docker-registry.default.svc:5000/openshift/rhdm71-optaweb-employee-rostering-openshift 1.0,1.1 2 hours ago rhdm72-controller-openshift docker-registry.default.svc:5000/openshift/rhdm72-controller-openshift 1.0,1.1 2 hours ago rhdm72-decisioncentral-indexing-openshift docker-registry.default.svc:5000/openshift/rhdm72-decisioncentral-indexing-openshift 1.0,1.1 2 hours ago rhdm72-decisioncentral-openshift docker-registry.default.svc:5000/openshift/rhdm72-decisioncentral-openshift 1.1,1.0 2 hours ago rhdm72-kieserver-openshift docker-registry.default.svc:5000/openshift/rhdm72-kieserver-openshift 1.0,1.1 2 hours ago rhdm72-optaweb-employee-rostering-openshift docker-registry.default.svc:5000/openshift/rhdm72-optaweb-employee-rostering-openshift 1.0,1.1 2 hours ago rhpam70-businesscentral-indexing-openshift docker-registry.default.svc:5000/openshift/rhpam70-businesscentral-indexing-openshift 1.0,1.1,1.2 2 hours ago rhpam70-businesscentral-monitoring-openshift docker-registry.default.svc:5000/openshift/rhpam70-businesscentral-monitoring-openshift 1.1,1.2,1.0 2 hours ago rhpam70-businesscentral-openshift docker-registry.default.svc:5000/openshift/rhpam70-businesscentral-openshift 1.0,1.1,1.2 2 hours ago rhpam70-controller-openshift docker-registry.default.svc:5000/openshift/rhpam70-controller-openshift 1.0,1.1,1.2 2 hours ago rhpam70-kieserver-openshift docker-registry.default.svc:5000/openshift/rhpam70-kieserver-openshift 1.0,1.1,1.2 2 hours ago rhpam70-smartrouter-openshift docker-registry.default.svc:5000/openshift/rhpam70-smartrouter-openshift 1.0,1.1,1.2 2 hours ago rhpam71-businesscentral-indexing-openshift docker-registry.default.svc:5000/openshift/rhpam71-businesscentral-indexing-openshift 1.0,1.1 2 hours ago rhpam71-businesscentral-monitoring-openshift docker-registry.default.svc:5000/openshift/rhpam71-businesscentral-monitoring-openshift 1.0,1.1 2 hours ago rhpam71-businesscentral-openshift docker-registry.default.svc:5000/openshift/rhpam71-businesscentral-openshift 1.0,1.1 2 hours ago rhpam71-controller-openshift docker-registry.default.svc:5000/openshift/rhpam71-controller-openshift 1.0,1.1 2 hours ago rhpam71-kieserver-openshift docker-registry.default.svc:5000/openshift/rhpam71-kieserver-openshift 1.0,1.1 2 hours ago rhpam71-smartrouter-openshift docker-registry.default.svc:5000/openshift/rhpam71-smartrouter-openshift 1.0,1.1 2 hours ago rhpam72-businesscentral-indexing-openshift docker-registry.default.svc:5000/openshift/rhpam72-businesscentral-indexing-openshift 1.1,1.0 2 hours ago rhpam72-businesscentral-monitoring-openshift docker-registry.default.svc:5000/openshift/rhpam72-businesscentral-monitoring-openshift 1.0,1.1 2 hours ago rhpam72-businesscentral-openshift docker-registry.default.svc:5000/openshift/rhpam72-businesscentral-openshift 1.0,1.1 2 hours ago rhpam72-controller-openshift docker-registry.default.svc:5000/openshift/rhpam72-controller-openshift 1.0,1.1 2 hours ago rhpam72-kieserver-openshift docker-registry.default.svc:5000/openshift/rhpam72-kieserver-openshift 1.0,1.1 2 hours ago rhpam72-smartrouter-openshift docker-registry.default.svc:5000/openshift/rhpam72-smartrouter-openshift 1.0,1.1 2 hours ago ruby docker-registry.default.svc:5000/openshift/ruby 2.2,2.3,2.4 + 3 more... 2 hours ago
Happy playing …
![Thumbnail [60x60]](https://www.dbi-services.com/blog/wp-content/uploads/2022/08/DWE_web-min-scaled.jpg)
![Thumbnail [90x90]](https://www.dbi-services.com/blog/wp-content/uploads/2022/09/DDI_web-min-scaled.jpg)
![Thumbnail [90x90]](https://www.dbi-services.com/blog/wp-content/uploads/2022/08/STH_web-min-scaled.jpg)