OpenShift Container Platform 3.9 Cluster Administration

304 Pages·2017·2.65 MB·English

OpenShift Container Platform 3.9
Cluster Administration
OpenShift Container Platform 3.9 Cluster Administration
Last Updated: 2019-11-21

OpenShift Container Platform 3.9 Cluster Administration
OpenShift Container Platform 3.9 Cluster Administration
Legal Notice
Copyright © 2019 Red Hat, Inc.
The text of and illustrations in this document are licensed by Red Hat under a Creative Commons
Attribution–Share Alike 3.0 Unported license ("CC-BY-SA"). An explanation of CC-BY-SA is
available at
http://creativecommons.org/licenses/by-sa/3.0/
. In accordance with CC-BY-SA, if you distribute this document or an adaptation of it, you must
provide the URL for the original version.
Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert,
Section 4d of CC-BY-SA to the fullest extent permitted by applicable law.
Red Hat, Red Hat Enterprise Linux, the Shadowman logo, the Red Hat logo, JBoss, OpenShift,
Fedora, the Infinity logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States
and other countries.
Linux ® is the registered trademark of Linus Torvalds in the United States and other countries.
Java ® is a registered trademark of Oracle and/or its affiliates.
XFS ® is a trademark of Silicon Graphics International Corp. or its subsidiaries in the United States
and/or other countries.
MySQL ® is a registered trademark of MySQL AB in the United States, the European Union and
other countries.
Node.js ® is an official trademark of Joyent. Red Hat is not formally related to or endorsed by the
official Joyent Node.js open source or commercial project.
The OpenStack ® Word Mark and OpenStack logo are either registered trademarks/service marks
or trademarks/service marks of the OpenStack Foundation, in the United States and other
countries and are used with the OpenStack Foundation's permission. We are not affiliated with,
endorsed or sponsored by the OpenStack Foundation, or the OpenStack community.
All other trademarks are the property of their respective owners.
Abstract
OpenShift Cluster Administration topics cover the day to day tasks for managing your OpenShift
cluster and other advanced configuration topics.
Table of Contents
Table of Contents
.C . H. .A . P. .T .E . R. . 1.. .O . .V . E. .R .V . I. E. W. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1. 3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
.C . H. .A . P. .T .E . R. . 2. .. M. . A. .N . A. .G . .I N. .G . . N. .O . D. .E . S. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.1. OVERVIEW 14
2.2. LISTING NODES 14
2.3. VIEWING NODES 16
2.4. ADDING NODES 17
2.5. DELETING NODES 17
2.6. UPDATING LABELS ON NODES 17
2.7. LISTING PODS ON NODES 18
2.8. MARKING NODES AS UNSCHEDULABLE OR SCHEDULABLE 18
2.9. EVACUATING PODS ON NODES 18
2.10. REBOOTING NODES 19
2.10.1. Infrastructure nodes 19
2.10.2. Using pod anti-affinity 20
2.10.3. Handling nodes running routers 21
2.11. CONFIGURING NODE RESOURCES 21
2.11.1. Setting maximum pods per node 22
2.12. RESETTING DOCKER STORAGE 23
2.13. CHANGING NODE TRAFFIC INTERFACE 24
.C . H. .A . P. .T .E . R. . 3. .. R. .E . S. .T .O . .R . I.N . G. . .O . P. .E . N. .S . H. .I F. .T . C. .O . .N . T. .A . I.N . E. .R . .P . L. A. .T . F. .O . R. .M . . C. .O . M. . P. .O . .N . E. .N . T. .S . . . . . . . . . . . . . . . . . . . . . . . . . . . .2 . 6. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.1. OVERVIEW 26
3.2. RESTORING A CLUSTER 26
Procedure 26
3.3. RESTORING A MASTER HOST BACKUP 26
Procedure 26
3.4. RESTORING A NODE HOST BACKUP 27
Procedure 28
3.5. RESTORING ETCD 29
3.5.1. Restoring etcd v2 & v3 data 29
Procedure 29
3.5.1.1. Fix the peerURLS parameter 30
3.5.1.1.1. Procedure 31
3.5.2. Restoring etcd for v3 31
Procedure 31
3.6. ADDING AN ETCD NODE 32
3.6.1. Adding a new etcd host using Ansible 32
Procedure 32
3.6.2. Manually adding a new etcd host 33
Procedure 33
Modify the current etcd cluster 33
Modify the new etcd host 36
Modify each OpenShift Container Platform master 38
3.7. BRINGING OPENSHIFT CONTAINER PLATFORM SERVICES BACK ONLINE 39
Procedure 39
3.8. RESTORING A PROJECT 40
Procedure 40
3.9. RESTORING APPLICATION DATA 40
Procedure 41
3.10. RESTORING PERSISTENT VOLUME CLAIMS 41
1
OpenShift Container Platform 3.9 Cluster Administration
3.10.1. Restoring files to an existing PVC 41
Procedure 41
3.10.2. Restoring data to a new PVC 42
Procedure 42
.C . H. .A . P. .T .E . R. . 4. .. .R . E. P. .L . A. .C . I.N . G. . .A . .M . A. .S . T. .E . R. .H . .O . S. .T . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4 .4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.1. DEPRECATING A MASTER HOST 44
Procedure 44
4.2. ADDING HOSTS 45
Procedure 46
4.3. SCALING ETCD 47
Prerequisites 48
4.3.1. Adding a new etcd host using Ansible 49
Procedure 49
4.3.2. Manually adding a new etcd host 50
Procedure 50
Modify the current etcd cluster 50
Modify the new etcd host 53
Modify each OpenShift Container Platform master 55
.C . H. .A . P. .T .E . R. . 5. .. M. . A. .N . A. .G . .I N. .G . . U. .S .E . R. .S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5 . 7. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5.1. OVERVIEW 57
5.2. CREATING A USER 57
5.3. VIEWING USER AND IDENTITY LISTS 57
5.4. CREATING GROUPS 58
5.5. MANAGING USER AND GROUP LABELS 58
5.6. DELETING A USER 59
.C . H. .A . P. .T .E . R. . 6. .. .M . A. .N . .A . G. .I N. .G . . P. .R . O. .J . E. C. . T. S. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6 .0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
6.1. OVERVIEW 60
6.2. SELF-PROVISIONING PROJECTS 60
6.2.1. Modifying the Template for New Projects 60
6.2.2. Disabling Self-provisioning 61
6.3. USING NODE SELECTORS 62
6.3.1. Setting the Cluster-wide Default Node Selector 62
6.3.2. Setting the Project-wide Node Selector 63
6.3.3. Developer-specified Node Selectors 63
6.4. LIMITING NUMBER OF SELF-PROVISIONED PROJECTS PER USER 64
.C . H. .A . P. .T .E . R. . 7. .. M. . A. .N . A. .G . .I N. .G . . P. .O . D. .S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6 .6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
7.1. OVERVIEW 66
7.2. VIEWING PODS 66
7.3. LIMITING RUN-ONCE POD DURATION 66
7.3.1. Configuring the RunOnceDuration Plug-in 66
7.3.2. Specifying a Custom Duration per Project 67
7.3.2.1. Deploying an Egress Router Pod 67
7.3.2.2. Deploying an Egress Router Service 68
7.3.3. Limiting Pod Access with Egress Firewall 69
7.3.3.1. Configuring Pod Access Limits 69
7.4. LIMITING THE BANDWIDTH AVAILABLE TO PODS 70
7.5. SETTING POD DISRUPTION BUDGETS 71
7.6. INJECTING INFORMATION INTO PODS USING POD PRESETS 72
.C . H. .A . P. .T .E . R. . 8. .. .M . A. .N . .A . G. .I N. .G . . N. .E . T. W. . O. . R. .K . I.N . G. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7 . 4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2
Table of Contents
8.1. OVERVIEW 74
8.2. MANAGING POD NETWORKS 74
8.2.1. Joining Project Networks 74
8.3. ISOLATING PROJECT NETWORKS 74
8.3.1. Making Project Networks Global 74
8.4. DISABLING HOST NAME COLLISION PREVENTION FOR ROUTES AND INGRESS OBJECTS 75
8.5. CONTROLLING EGRESS TRAFFIC 76
8.6. USING AN EGRESS FIREWALL TO LIMIT ACCESS TO EXTERNAL RESOURCES 76
8.6.1. Using an Egress Router to Allow External Resources to Recognize Pod Traffic 78
8.6.1.1. Deploying an Egress Router Pod in Redirect Mode 80
8.6.1.2. Redirecting to Multiple Destinations 81
8.6.1.3. Using a ConfigMap to specify EGRESS_DESTINATION 83
8.6.1.4. Deploying an Egress Router HTTP Proxy Pod 84
8.6.1.5. Enabling Failover for Egress Router Pods 86
8.6.2. Using iptables Rules to Limit Access to External Resources 87
8.7. ENABLING STATIC IPS FOR EXTERNAL PROJECT TRAFFIC 87
8.8. ENABLING MULTICAST 88
8.9. ENABLING NETWORKPOLICY 89
8.9.1. Using NetworkPolicy Efficiently 91
8.9.2. NetworkPolicy and Routers 91
8.9.3. Setting a Default NetworkPolicy for New Projects 92
8.10. ENABLING HTTP STRICT TRANSPORT SECURITY 93
8.11. TROUBLESHOOTING THROUGHPUT ISSUES 94
.C . H. .A . P. .T .E . R. . 9. .. .C . O. .N . F. .I G. . U. .R . I.N . G. . S. .E . R. .V . I.C . E. . A. .C . C. .O . U. .N . .T .S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9 .6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
9.1. OVERVIEW 96
9.2. USER NAMES AND GROUPS 96
9.3. MANAGING SERVICE ACCOUNTS 97
9.4. ENABLING SERVICE ACCOUNT AUTHENTICATION 97
9.5. MANAGED SERVICE ACCOUNTS 98
9.6. INFRASTRUCTURE SERVICE ACCOUNTS 98
9.7. SERVICE ACCOUNTS AND SECRETS 99
.C . H. .A . P. .T .E . R. . 1.0 . .. M. . A. .N . A. .G . .I N. .G . .R . O. . L. E. .- .B . A. .S . E. .D . .A . C. .C . E. .S .S . .C . O. .N . .T .R . O. . L. .( .R . B. .A . C. .) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1 0. .0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
10.1. OVERVIEW 100
10.2. VIEWING ROLES AND BINDINGS 100
10.2.1. Viewing cluster roles 100
10.2.2. Viewing cluster role bindings 104
10.2.3. Viewing local roles and bindings 108
10.3. MANAGING ROLE BINDINGS 109
10.4. CREATING A LOCAL ROLE 111
10.5. CREATING A CLUSTER ROLE 112
10.6. CLUSTER AND LOCAL ROLE BINDINGS 112
.C . H. .A . P. .T .E . R. . 1.1 .. .I M. . A. .G . E. . P. .O . L. .I C. .Y . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1 1. 3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
11.1. OVERVIEW 113
11.2. CONFIGURING REGISTRIES ALLOWED FOR IMPORT 113
11.3. CONFIGURING THE IMAGEPOLICY ADMISSION PLUG-IN 114
11.4. USING AN ADMISSION CONTROLLER TO ALWAYS PULL IMAGES 116
11.5. TESTING THE IMAGEPOLICY ADMISSION PLUG-IN 117
.C . H. .A . P. .T .E . R. . 1.2 . .. I.M . .A . G. .E . .S . I.G . N. .A . T. .U . R. .E . S. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1 1. 9. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
12.1. OVERVIEW 119
12.2. SIGNING IMAGES USING ATOMIC CLI 119
3
OpenShift Container Platform 3.9 Cluster Administration
12.3. VERIFYING IMAGE SIGNATURES USING OPENSHIFT CLI 120
12.4. ACCESSING IMAGE SIGNATURES USING REGISTRY API 121
12.4.1. Writing Image Signatures via API 121
12.4.2. Reading Image Signatures via API 121
12.4.3. Importing Image Signatures Automatically from Signature Stores 122
.C . H. .A . P. .T .E . R. . 1.3 . .. S. .C . O. .P . E. .D . .T . O. .K . E. .N . S. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1 .2 .4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
13.1. OVERVIEW 124
13.2. EVALUATION 124
13.3. USER SCOPES 124
13.4. ROLE SCOPE 124
.C . H. .A . P. .T .E . R. . 1.4 . .. M. . O. .N . .I T. .O . R. .I N. .G . . I.M . .A . G. .E . S. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2 . 5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
14.1. OVERVIEW 125
14.2. VIEWING IMAGES STATISTICS 125
14.3. VIEWING IMAGESTREAMS STATISTICS 125
14.4. PRUNING IMAGES 126
.C . H. .A . P. .T .E . R. . 1.5 . .. M. . A. .N . A. .G . I.N . .G . .S . E. .C . U. .R . I.T .Y . .C . O. . N. .T . E. .X . T. .C . O. . N. .S . T. .R .A . I.N . .T .S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2 . 7. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
15.1. OVERVIEW 127
15.2. LISTING SECURITY CONTEXT CONSTRAINTS 127
15.3. EXAMINING A SECURITY CONTEXT CONSTRAINTS OBJECT 127
15.4. CREATING NEW SECURITY CONTEXT CONSTRAINTS 128
15.5. DELETING SECURITY CONTEXT CONSTRAINTS 129
15.6. UPDATING SECURITY CONTEXT CONSTRAINTS 130
15.6.1. Example Security Context Constraints Settings 130
15.7. UPDATING THE DEFAULT SECURITY CONTEXT CONSTRAINTS 131
15.8. HOW DO I? 131
15.8.1. Grant Access to the Privileged SCC 131
15.8.2. Grant a Service Account Access to the Privileged SCC 132
15.8.3. Enable Images to Run with USER in the Dockerfile 132
15.8.4. Enable Container Images that Require Root 132
15.8.5. Use --mount-host on the Registry 133
15.8.6. Provide Additional Capabilities 133
15.8.7. Modify Cluster Default Behavior 133
15.8.8. Use the hostPath Volume Plug-in 134
15.8.9. Ensure That Admission Attempts to Use a Specific SCC First 134
15.8.10. Add an SCC to a User, Group, or Project 134
.C . H. .A . P. .T .E . R. . 1.6 . .. S. .C . H. .E . D. .U . L. .I N. .G . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1 .3 .6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
16.1. OVERVIEW 136
16.1.1. Overview 136
16.1.2. Default scheduling 136
16.1.3. Advanced scheduling 136
16.1.4. Custom scheduling 136
16.2. DEFAULT SCHEDULING 136
16.2.1. Overview 136
16.2.2. Generic Scheduler 136
16.2.3. Filter the Nodes 137
16.2.3.1. Prioritize the Filtered List of Nodes 137
16.2.3.2. Select the Best Fit Node 137
16.2.4. Scheduler Policy 137
16.2.4.1. Modifying Scheduler Policy 139
16.2.5. Available Predicates 140
4
Table of Contents
16.2.5.1. Static Predicates 140
16.2.5.1.1. Default Predicates 140
16.2.5.1.2. Other Static Predicates 141
16.2.5.2. General Predicates 142
Non-critical general predicates 142
Essential general predicates 142
16.2.5.3. Configurable Predicates 142
16.2.6. Available Priorities 144
16.2.6.1. Static Priorities 144
16.2.6.1.1. Default Priorities 145
16.2.6.1.2. Other Static Priorities 145
16.2.6.2. Configurable Priorities 146
16.2.7. Use Cases 147
16.2.7.1. Infrastructure Topological Levels 147
16.2.7.2. Affinity 148
16.2.7.3. Anti Affinity 148
16.2.8. Sample Policy Configurations 148
16.3. CUSTOM SCHEDULING 151
16.3.1. Overview 151
16.3.2. Deploying the Scheduler 151
16.4. CONTROLLING POD PLACEMENT 152
16.4.1. Overview 152
16.4.2. Constraining Pod Placement Using Node Name 153
16.4.3. Constraining Pod Placement Using a Node Selector 153
16.4.4. Control Pod Placement to Projects 154
16.5. ADVANCED SCHEDULING 157
16.5.1. Overview 157
16.5.2. Using Advanced Scheduling 158
16.6. ADVANCED SCHEDULING AND NODE AFFINITY 158
16.6.1. Overview 158
16.6.2. Configuring Node Affinity 159
16.6.2.1. Configuring a Required Node Affinity Rule 161
16.6.2.2. Configuring a Preferred Node Affinity Rule 161
16.6.3. Examples 162
16.6.3.1. Node Affinity with Matching Labels 162
16.6.3.2. Node Affinity with No Matching Labels 163
16.7. ADVANCED SCHEDULING AND POD AFFINITY AND ANTI-AFFINITY 164
16.7.1. Overview 164
16.7.2. Configuring Pod Affinity and Anti-affinity 164
16.7.2.1. Configuring an Affinity Rule 166
16.7.2.2. Configuring an Anti-affinity Rule 167
16.7.3. Examples 168
16.7.3.1. Pod Affinity 168
16.7.3.2. Pod Anti-affinity 169
16.7.3.3. Pod Affinity with no Matching Labels 169
16.8. ADVANCED SCHEDULING AND NODE SELECTORS 170
16.8.1. Overview 170
16.8.2. Configuring Node Selectors 170
16.9. ADVANCED SCHEDULING AND TAINTS AND TOLERATIONS 171
16.9.1. Overview 171
16.9.2. Taints and Tolerations 172
16.9.2.1. Using Multiple Taints 173
16.9.3. Adding a Taint to an Existing Node 174
5
OpenShift Container Platform 3.9 Cluster Administration
16.9.4. Adding a Toleration to a Pod 174
16.9.4.1. Using Toleration Seconds to Delay Pod Evictions 175
16.9.4.1.1. Setting a Default Value for Toleration Seconds 175
16.9.5. Preventing Pod Eviction for Node Problems 176
16.9.6. Daemonsets and Tolerations 177
16.9.7. Examples 177
16.9.7.1. Dedicating a Node for a User 177
16.9.7.2. Binding a User to a Node 177
16.9.7.3. Nodes with Special Hardware 178
.C . H. .A . P. .T .E . R. . 1.7 . .. S. .E .T . T. .I N. .G . . Q. .U . O. . T. A. .S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1 .7 .9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
17.1. OVERVIEW 179
17.2. RESOURCES MANAGED BY QUOTA 179
17.3. QUOTA SCOPES 181
17.4. QUOTA ENFORCEMENT 181
17.5. REQUESTS VERSUS LIMITS 182
17.6. SAMPLE RESOURCE QUOTA DEFINITIONS 182
17.7. CREATING A QUOTA 185
17.7.1. Creating Object Count Quotas 185
17.8. VIEWING A QUOTA 186
17.9. CONFIGURING QUOTA SYNCHRONIZATION PERIOD 186
17.10. ACCOUNTING FOR QUOTA IN DEPLOYMENT CONFIGURATIONS 187
17.11. REQUIRE EXPLICIT QUOTA TO CONSUME A RESOURCE 187
17.12. KNOWN ISSUES 188
.C . H. .A . P. .T .E . R. . 1.8 . .. S. .E .T . T. .I N. .G . . M. .U . .L .T . I.- .P . R. .O . J. .E . C. .T . .Q . U. .O . .T .A . S. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1 .8 .9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
18.1. OVERVIEW 189
18.2. SELECTING PROJECTS 189
18.3. VIEWING APPLICABLE CLUSTERRESOURCEQUOTAS 190
18.4. SELECTION GRANULARITY 191
.C . H. .A . P. .T .E . R. . 1.9 . .. S. .E .T . T. .I N. .G . . L. I. M. .I .T . R. .A . N. .G . .E .S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.9 . 2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
19.1. OVERVIEW 192
19.1.1. Container Limits 193
19.1.2. Pod Limits 194
19.1.3. Image Limits 195
19.1.4. Image Stream Limits 196
19.1.4.1. Counting of Image References 196
19.1.5. PersistentVolumeClaim Limits 197
19.2. CREATING A LIMIT RANGE 197
19.3. VIEWING LIMITS 198
19.4. DELETING LIMITS 198
.C . H. .A . P. .T .E . R. . 2. 0. .. .P . R. .U . N. .I .N . G. . O. . B. .J .E . C. .T . S. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1 .9 . 9. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
20.1. OVERVIEW 199
20.2. BASIC PRUNE OPERATIONS 199
20.3. PRUNING DEPLOYMENTS 199
20.4. PRUNING BUILDS 200
20.5. PRUNING IMAGES 201
20.5.1. Image Prune Conditions 202
20.5.2. Using Secure or Insecure Connections 204
20.5.3. Image Pruning Problems 205
Images Not Being Pruned 205
Using a Secure Connection Against Insecure Registry 205
6