《OpenShift 4.x HOL教程汇总》
本文在 OpenShift 4.11+ACS 3.71.0 环境中进行验证。
安装客户端环境
安装客户端工具
以下命令是针对 RHEL 8.4 的客户端环境。
$ sudo dnf install podman podman-docker git procps-ng jq
$ curl -OL https://github.com/mikefarah/yq/releases/download/2.4.1/yq_linux_amd64
$ chmod +x yq_linux_amd64 && sudo mv yq_linux_amd64 /usr/bin/yq
安装 Ansible 环境和模块
$ sudo dnf install ansible python3
$ pip3 install kubernetes jmespath openshift pyyaml --user
$ ansible-galaxy collection install cloud.common kubernetes.core
Process install dependency map
Starting collection install process
Installing 'cloud.common:2.1.2' to '/home/lab-user/.ansible/collections/ansible_collections/cloud/common'
Installing 'kubernetes.core:2.3.2' to '/home/lab-user/.ansible/collections/ansible_collections/kubernetes/core'
安装 RHACS 功能演示应用
- 下载 Ansible 脚本
$ git clone https://github.com/liuxiaoyu-git/rhacs-demo && cd rhacs-demo
- 根据 Ansible Role 部署 OpenShift 演示应用。
$ ACS_PASSWORD=$(oc -n stackrox get secret acs-password -o go-template='{{index .data "password" | base64decode}}')
$ ansible-playbook rhacs-demo.yaml -e stackrox_central_admin_password=${ACS_PASSWORD}
。。。
TASK [ocp4_deploy_acs_demo_apps : Get deployment details] **********************************************************************************************************
ok: [localhost] => (item=70e9cf6f-e91a-4c96-a59e-2774aa2f1ac8)
ok: [localhost] => (item=cc00d2b0-424e-42df-a6b0-69d764de06cb)
ok: [localhost] => (item=df2a898d-3038-42bd-83b9-5cf22fa81742)
TASK [ocp4_deploy_acs_demo_apps : Update baselines] ****************************************************************************************************************
ok: [localhost] => (item=visa-processor)
ok: [localhost] => (item=backend-atlas)
ok: [localhost] => (item=asset-cache)
TASK [ocp4_deploy_acs_demo_apps : Lock baselines] ******************************************************************************************************************
ok: [localhost] => (item=visa-processor)
ok: [localhost] => (item=backend-atlas)
ok: [localhost] => (item=asset-cache)
TASK [ocp4_workload_stackrox_demo_apps : Running Workload removal Tasks] *******************************************************************************************
skipping: [localhost]
PLAY RECAP *********************************************************************************************************************************************************
localhost : ok=35 changed=3 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
- 运行完后可在 OpenShift 看到以下项目和部署资源。
- 运行容器应用（可选）。
$ oc new-project test
$ oc run shell --labels=app=shellshock,team=test-team --image=vulnerables/cve-2014-6271 -n test
pod/shell created
$ oc run samba --labels=app=rce --image=vulnerables/cve-2017-7494 -n test
pod/samba created