OpenShift 4 - Fedora CoreOS (4) - 用 Ignition 定制 CoreOS 的网络/存储等配置

《OpenShift 4.x HOL教程汇总》

Fedora CoreOS是通过Ignition定制操作系统的配置的，而Ignition文件是从FCC文件转换的，FCC文件是一种特殊YAML格式的文件。
FCC文件格式可以参见官方文档说明：https://docs.fedoraproject.org/en-US/fedora-coreos/fcct-config/
Ignition 在系统首次启动期间（在 initramfs 中）仅运行一次。我们可以使用Ignition初始化CoreOS系统的组件包括：存储，文件系统，systemd 和用户。

设置 FCC 配置文件

以下是一些典型场景的FCC配置，说明可见注释。在创建完FCC文件后，我们可以使用《OpenShift 4 - Fedora CoreOS (1) - 最简安装》中的方法将FCC文件先转换成JSON格式的Ignition文件，然后再根据Ignition文件安装Fedora CoreOS镜像文件。安装后通过以下过程验证Ignition文件配置已经生效。

variant: fcos
version: 1.1.0
passwd:
  users:
    - name: core
      password_hash: "$1$yoursalt$7/tmQXmlhL0pYfN/fyBZS1"
      ssh_authorized_keys:
        - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDIBxVOCdtNHBgbEVQseDdRonC/OlP5qm7MoKeuwYFjvg6UKXl8MTplQ4ErV1r994XnkErRBzlxsPdn/s7/alJ8CJ3Po39QDMlJvvy/nG3Vak/naxc6hXwL4to1oJr
Mhyp7YsY2EzPke+b1FyWD6NZ27mhJnCmNhw4pND6QxfZulVCnlolg9BeTSuXaIRrgLnjdSU+9ojTz6BMVo5MWY+xXRNrydlI4rx19tnd0c62SwQnvjO8i+hCXzNAkwGb8J5KDLs7jYZhjOW4IyHa95NdgWlRDcVICQSbA0makjJyIF
K9KDzaTYM0MvCpSkMXo9uTFKwPiKfhBrKw9n8nBegXN root@ceph-node1"
storage:
  files:
    ## 设置主机名为mycoreos
    - path: /etc/hostname
      mode: 0644
      contents:
        inline: |
          mycoreos
    ## 为enp0s3网卡设置固定IP地址
    - path: /etc/NetworkManager/system-connections/enp0s3.nmconnection
      mode: 0600
      overwrite: true
      contents:
        inline: |
          [connection]
          type=ethernet
          id='Custom interface'
          interface-name=enp0s3   
          [ipv4]
          method=manual
          addresses=192.168.1.100/24
          gateway=192.168.1.1
          dns=192.168.1.1
    ## 允许直接使用username/password登录远程的CoreOS。缺省CoreOS只能用私钥证书登录远程的CoreOS
    - path: /etc/ssh/sshd_config.d/20-enable-passwords.conf
      mode: 0644
      contents:
        inline: |
          PasswordAuthentication yes
  disks:
  ## 在sda上设置一个分区，lable设为/var。
  - device: /dev/sda
    wipe_table: false
    partitions:
    - size_mib: 0
      start_mib: 5000
      label: var
  ## 将var分区挂到/var文件系统。
  filesystems:
    - path: /var
      device: /dev/disk/by-partlabel/var
      format: ext4
      with_mount_unit: true

systemd:
  ## 配置一个系统service，服务运行的是busybox容器。
  units:
    - name: hello.service
      enabled: true
      contents: |
        [Unit]
        Description=MyApp
        After=network-online.target
        Wants=network-online.target

        [Service]
        TimeoutStartSec=0
        ExecStartPre=-/bin/podman kill busybox1
        ExecStartPre=-/bin/podman rm busybox1
        ExecStartPre=/bin/podman pull busybox
        ExecStart=/bin/podman run --name busybox1 busybox /bin/sh -c "trap 'exit 0' INT TERM; while true; do echo Hello World; sleep 1; done"

        [Install]
        WantedBy=multi-user.target

验证 CoreOS 配置

1. 执行命令，使用core/password的用户名直接登录CoreOS。

$ ssh core@192.168.1.100

2. 查看主机名为mycoreos。

[core@tutorial ~]$ more /etc/hostname
mycoreos
[core@tutorial ~]$ hostnamectl
   Static hostname: mycoreos
         Icon name: computer-vm
           Chassis: vm
        Machine ID: 33cf0d0d9d70410785b03fbb651b132a
           Boot ID: c52435b931344a1c9f72da1023090de2
    Virtualization: oracle
  Operating System: Fedora CoreOS 32.20200907.3.0
       CPE OS Name: cpe:/o:fedoraproject:fedora:32
            Kernel: Linux 5.8.10-200.fc32.x86_64
      Architecture: x86-64

3. 查看网络配置和IP地址。

[core@tutorial ~]$ nmcli con show
NAME                UUID                                  TYPE      DEVICE
'Custom interface'  aa44c29f-33e8-358f-879b-e0b8efae27f3  ethernet  enp0s3
 
[core@tutorial ~]$ sudo more /etc/NetworkManager/system-connections/enp0s3.nmconnection
[connection]
type=ethernet
id='Custom interface'
interface-name=enp0s3
[ipv4]
method=manual
addresses=192.168.1.100/24
gateway=192.168.1.1
dns=192.168.1.1

4. 执行命令，查看“hello.service”和它的日志。

[core@tutorial ~]$ systemctl list-units --type=service | grep hello
  hello.service                                           loaded active running MyBusyBoxApp
[core@tutorial ~]$ journalctl -u hello.service
-- Logs begin at Fri 2020-10-09 09:12:52 UTC, end at Fri 2020-10-09 09:35:04 UTC. --
Oct 09 09:13:01 tutorial systemd[1]: Starting MyBusyBoxApp...
Oct 09 09:13:02 tutorial podman[929]: Error: no container with name or ID busybox1 found: no such container
Oct 09 09:13:02 tutorial podman[1066]: Error: no container with name or ID busybox1 found: no such container
Oct 09 09:13:02 tutorial podman[1115]: Trying to pull registry.fedoraproject.org/busybox...
Oct 09 09:13:04 tutorial podman[1115]:   manifest unknown: manifest unknown
Oct 09 09:13:04 tutorial podman[1115]: Trying to pull registry.access.redhat.com/busybox...
Oct 09 09:13:17 tutorial podman[1115]:   name unknown: Repo not found
Oct 09 09:13:17 tutorial podman[1115]: Trying to pull registry.centos.org/busybox...
Oct 09 09:13:21 tutorial podman[1115]:   manifest unknown: manifest unknown
Oct 09 09:13:21 tutorial podman[1115]: Trying to pull docker.io/library/busybox...
Oct 09 09:13:32 tutorial podman[1115]: Getting image source signatures
Oct 09 09:13:36 tutorial podman[1115]: Copying blob sha256:df8698476c65c2ee7ca0e9dbc2b1c8b1c91bce555819a9aaab724ac64241ba67
Oct 09 09:13:40 tutorial podman[1115]: Copying config sha256:6858809bf669cc5da7cb6af83d0fae838284d12e1be0182f92f6bd96559873e3
Oct 09 09:13:40 tutorial podman[1115]: Writing manifest to image destination
Oct 09 09:13:40 tutorial podman[1115]: Storing signatures
Oct 09 09:13:40 tutorial podman[1115]: 6858809bf669cc5da7cb6af83d0fae838284d12e1be0182f92f6bd96559873e3
Oct 09 09:13:40 tutorial systemd[1]: Started MyBusyBoxApp.
Oct 09 09:13:41 tutorial podman[2489]: Hello World
Oct 09 09:13:42 tutorial podman[2489]: Hello World
Oct 09 09:13:43 tutorial podman[2489]: Hello World
Oct 09 09:13:44 tutorial podman[2489]: Hello World
Oct 09 09:13:45 tutorial podman[2489]: Hello World
Oct 09 09:13:46 tutorial podman[2489]: Hello World
Oct 09 09:13:47 tutorial podman[2489]: Hello World

5. 查看磁盘分区，确认已经挂在了/var目录。

[core@tutorial ~]$ lsblk -f
NAME   FSTYPE  FSVER            LABEL                         UUID                                 FSAVAIL FSUSE% MOUNTPOINT
sda
|-sda1 ext4    1.0              boot                          bc707549-946b-41c0-a625-6b400d300304  172.6M    46% /boot
|-sda2 vfat    FAT16            EFI-SYSTEM                    801D-C508                             118.3M     7% /boot/efi
|-sda3
|-sda4 xfs                      root                          8f288986-4676-4ed1-ae66-f3cf4b8b80eb    2.5G    43% /sysroot
`-sda5 ext4    1.0                                            9764c24c-6d57-4fba-8c6d-c9687b924b6b    2.8G     3% /var
sr0    iso9660 Joliet Extension fedora-coreos-32.20200907.3.0 2020-09-23-08-39-52-00
 
[core@tutorial ~]$ sudo fdisk -l
Disk /dev/sda: 8 GiB, 8589934592 bytes, 16777216 sectors
Disk model: VBOX HARDDISK
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: C256EB3E-04C8-4214-BF21-B8BCF4D07756
 
Device        Start      End Sectors  Size Type
/dev/sda1      2048   788479  786432  384M Linux filesystem
/dev/sda2    788480  1048575  260096  127M EFI System
/dev/sda3   1048576  1050623    2048    1M BIOS boot
/dev/sda4   1050624 10239999 9189376  4.4G Linux filesystem
/dev/sda5  10240000 16777182 6537183  3.1G Linux filesystem

参考

https://developers.redhat.com/blog/2020/03/12/how-to-customize-fedora-coreos-for-dedicated-workloads-with-ostree/