OpenShift CLI Cheatsheet OpenShift命令行速查表

爱被打了一巴掌 2022-09-04 03:45 207阅读 0赞

### 文章目录 ###

*  OpenShift CLI Cheatsheet
 *   *  前言
     *  OpenShift CLI Cheatsheet
     *   *  普通命令
         *   *  登录
             *   *  oc login
                 *  oc logout
                 *  oc whoami
             *  项目管理
             *   *  oc project
                 *  oc projects
                 *  oc status
                 *  oc new-project
             *  应用构建和部署
             *   *  oc new-app
                 *  oc process
                 *  oc new-build
                 *  oc start-build
                 *  oc cancel-build
                 *  oc rollout
                 *  oc expose
                 *  oc set env
                 *  oc set triggers
                 *  oc set probe
                 *  oc set volumes
                 *  oc set image
                 *  oc scale
                 *  oc autoscale
                 *  oc set route-backends
                 *  oc set resources
             *  资源管理
             *   *  oc get
                 *  oc describe
                 *  oc explain
                 *  oc patch
                 *  oc edit
                 *  oc delete
                 *  oc create
                 *  oc apply
                 *  oc label
                 *  oc annotate
             *  应用运维
             *   *  oc logs
                 *  oc exec
                 *  oc rsh
                 *  oc rsync
                 *  oc run
                 *  oc idle
             *  其它命令
             *   *  oc version
                 *  oc cluster-info
                 *  oc completion
                 *  oc api-versions
                 *  oc api-resources
                 *  oc config set-cluster
                 *  oc auth can-i
         *  管理命令
         *   *  Manage Group and Members
             *   *  oc adm groups new
             *  Assign Roles to Users and Groups
             *   *  oc adm policy add-role-to-user
                 *  oc adm policy add-role-to-group
             *  Assign Cluster Roles to Users and Groups
             *   *  oc adm policy add-cluster-role-to-user
                 *  oc adm policy add-cluster-role-to-group
             *  Manage Policy
             *   *  oc adm policy add-scc-to-user
                 *  oc adm policy add-scc-to-group
             *  节点管理
             *   *  oc adm cordon
                 *  oc adm drain
                 *  oc adm taint
             *  资源配额管理
             *   *  cc adm create-bootstrap-project-template
     *  参考文档
     *  扩展阅读

# OpenShift CLI Cheatsheet #

## 前言 ##

本文列出了常用的OpenShift命令行速查表。  
Kubernetes的`kubectl` 命令与OpenShift的`oc`命令类似，也可以作为参考。

## OpenShift CLI Cheatsheet ##

下面按照使用OpenShift的过程来排序，只列出常使用的oc命令和例子。

### 普通命令 ###

#### 登录 ####

##### oc login #####

# login by username and passowrd
    oc login -u admin -p 'r3dh4t1!' --server=https://api.cluster-8xkj9.8xkj9.sandbox545.opentlc.com:6443 
    
    # login by token
    oc login --token=$(oc whoami --show-token) --server=$(oc whoami --show-server)
    
    # login as system admin
    oc login -u system:admin

# Log in interactively
    oc login --username=myuser
    
    # Log in to the given server with the given certificate authority file
    oc login localhost:8443 --certificate-authority=/path/to/cert.crt
    
    # Log in to the given server with the given credentials (will not prompt interactively)
    oc login localhost:8443 --username=myuser --password=mypass

##### oc logout #####

End the current server session

# Log out
    oc logout

##### oc whoami #####

Return information about the current session

# web console
    oc whoami --show-console
    # api server
    oc whoami --show-server
    # token
    oc whoami --show-token

# Display the currently authenticated user
    oc whoami

#### 项目管理 ####

##### oc project #####

Switch to another project

# Switch to the 'myapp' project
    oc project myapp
    
    # Display the project currently in use
    oc project

##### oc projects #####

Display existing projects.

# List all projects
    oc projects

##### oc status #####

Show an overview of the current project

# See an overview of the current project
    oc status
    
    # Export the overview of the current project in an svg file
    oc status -o dot | dot -T svg -o project.svg
    
    # See an overview of the current project including details for any identified issues
    oc status --suggest

##### oc new-project #####

Create a new project

# Create a new project with minimal information
    oc new-project web-team-dev
    
    # Create a new project with a display name and description
    oc new-project web-team-dev --display-name="Web Team Development" --description="Development project for the web team."

#### 应用构建和部署 ####

##### oc new-app #####

Create a enw application via:

*  OpenShift Template
 *  Dockerfile
 *  Docker Image
 *  Binary
 *  S2I: Source Code + Builder Image (specific)
 *  S2I: Source Code + Builder Image (autodetected)

# create application via docker image
    oc new-app --docker-image=quay.io/gpte-devops-automation/ocp-probe:v0.4 --name=green
    oc new-app --docker-image=quay.io/gpte-devops-automation/ocp-probe:v0.5 --name=blue
    
    # Deploy the little sample application and scale it to 40 replicas.
    oc new-app openshift/hello-openshift:v3.10 --name=nottainted -n taints
    
    # Set up one cotd application serving cats (the blue application)
    oc new-app --name='blue' --labels=name="blue" \
      php~https://github.com/redhat-gpte-devopsautomation/cotd.git \
      --env=SELECTOR=cats --as-deployment-config=true
    
    # Set up another cotd application serving cities (the green application)
    oc new-app --name='green' --labels=name="green" php~https://github.com/redhat-gpte-devopsautomation/cotd.git --env=SELECTOR=cities --as-deployment-config=true
    
    
    oc new-app docker.io/rocketchat/rocket.chat:0.63.3 \
      -e MONGO_URL="mongodb://mongodb_user:mongodb_password@mongodb:27017/mongodb?replicaSet=rs0" \
      --as-deployment-config=true
    
    # secarh template
    oc new-app --list | grep -i postgresql | grep -i persistent
    
    oc new-app jenkins-persistent \
      --param=ENABLE_OAUTH=true \
      --param=VOLUME_CAPACITY=4Gi \
      --param=MEMORY_LIMIT=2Gi \
      --param=DISABLE_ADMINISTRATIVE_MONITORS=true \
      --as-deployment-config=true

# List all local templates and image streams that can be used to create an app
    oc new-app --list
    
    # Create an application based on the source code in the current git repository (with a public remote) and a Docker image
    oc new-app . --docker-image=registry/repo/langimage
    
    # Create an application myapp with Docker based build strategy expecting binary input
    oc new-app  --strategy=docker --binary --name myapp
    
    # Create a Ruby application based on the provided [image]~[source code] combination
    oc new-app centos/ruby-25-centos7~https://github.com/sclorg/ruby-ex.git
    
    # Use the public Docker Hub MySQL image to create an app. Generated artifacts will be labeled with db=mysql
    oc new-app mysql MYSQL_USER=user MYSQL_PASSWORD=pass MYSQL_DATABASE=testdb -l db=mysql
    
    # Use a MySQL image in a private registry to create an app and override application artifacts' names
    oc new-app --docker-image=myregistry.com/mycompany/mysql --name=private
    
    # Create an application from a remote repository using its beta4 branch
    oc new-app https://github.com/openshift/ruby-hello-world#beta4
    
    # Create an application based on a stored template, explicitly setting a parameter value
    oc new-app --template=ruby-helloworld-sample --param=MYSQL_USER=admin
    
    # Create an application from a remote repository and specify a context directory
    oc new-app https://github.com/youruser/yourgitrepo --context-dir=src/build
    
    # Create an application from a remote private repository and specify which existing secret to use
    oc new-app https://github.com/youruser/yourgitrepo --source-secret=yoursecret
    
    # Create an application based on a template file, explicitly setting a parameter value
    oc new-app --file=./example/myapp/template.json --param=MYSQL_USER=admin
    
    # Search all templates, image streams, and Docker images for the ones that match "ruby"
    oc new-app --search ruby
    
    # Search for "ruby", but only in stored templates (--template, --image-stream and --docker-image
    # can be used to filter search results)
    oc new-app --search --template=ruby
    
    # Search for "ruby" in stored templates and print the output as YAML
    oc new-app --search --template=ruby --output=yaml

##### oc process #####

Process a template into list of resources.

# Configure and trigger the application build as version "0.1"
    oc process --local \
       --param=VERSION=0.1 \
       --param-file=openshift/multi-project-templates/parameters.yml \
       --ignore-unknown-parameters \
       -f openshift/multi-project-templates/cakephp-build.yml \
    | oc apply -f -

# Convert the template.json file into a resource list and pass to create
    oc process -f template.json | oc create -f -
    
    # Process a file locally instead of contacting the server
    oc process -f template.json --local -o yaml
    
    # Process template while passing a user-defined label
    oc process -f template.json -l name=mytemplate
    
    # Convert a stored template into a resource list
    oc process foo
    
    # Convert a stored template into a resource list by setting/overriding parameter values
    oc process foo PARM1=VALUE1 PARM2=VALUE2
    
    # Convert a template stored in different namespace into a resource list
    oc process openshift//foo
    
    # Convert template.json into a resource list
    cat template.json | oc process -f -

##### oc new-build #####

Create a new BuildConfig via:

*  Dockerfile
 *  S2I: Source Code + Builder Image (specific)
 *  S2I: Source Code + Builder Image (autodetected)

# Create an application BuildConfig and ImageStream, both with name node-ssh. 
    # Use the ubi8 ImageStream from the openshift namespace as the base image and use a docker strategy build to install the openssh-clients package.
    oc new-build openshift/ubi8:latest --name=node-ssh --dockerfile - <<EOF FROM unused RUN dnf install -y openssh-clients CMD ["sleep", "infinity"] EOF
    
    
    # create a build config
    # build from Dockerfile content (can provide Dockerfile path in command line ?)
    oc new-build --strategy=docker -D $'FROM registry.access.redhat.com/ubi8/go-toolset:latest as builder\n ENV SKOPEO_VERSION=v1.0.0\n RUN git clone -b $SKOPEO_VERSION https://github.com/containers/skopeo.git && cd skopeo/ && make binary-local DISABLE_CGO=1\n FROM image-registry.openshift-image-registry.svc:5000/openshift/jenkins-agent-maven:v4.0 as final\n USER root\n RUN mkdir /etc/containers\n COPY --from=builder /opt/app-root/src/skopeo/default-policy.json /etc/containers/policy.json\n COPY --from=builder /opt/app-root/src/skopeo/skopeo /usr/bin\n USER 1001' --name=jenkins-agent-appdev -n ${GUID}-jenkins

# Create a build config based on the source code in the current git repository (with a public
    # remote) and a Docker image
    oc new-build . --docker-image=repo/langimage
    
    # Create a NodeJS build config based on the provided [image]~[source code] combination
    oc new-build centos/nodejs-8-centos7~https://github.com/sclorg/nodejs-ex.git
    
    # Create a build config from a remote repository using its beta2 branch
    oc new-build https://github.com/openshift/ruby-hello-world#beta2
    
    # Create a build config using a Dockerfile specified as an argument
    oc new-build -D $'FROM centos:7\nRUN yum install -y httpd'
    
    # Create a build config from a remote repository and add custom environment variables
    oc new-build https://github.com/openshift/ruby-hello-world -e RACK_ENV=development
    
    # Create a build config from a remote private repository and specify which existing secret to use
    oc new-build https://github.com/youruser/yourgitrepo --source-secret=yoursecret
    
    # Create a build config from a remote repository and inject the npmrc into a build
    oc new-build https://github.com/openshift/ruby-hello-world --build-secret npmrc:.npmrc
    
    # Create a build config from a remote repository and inject environment data into a build
    oc new-build https://github.com/openshift/ruby-hello-world --build-config-map env:config
    
    # Create a build config that gets its input from a remote repository and another Docker image
    oc new-build https://github.com/openshift/ruby-hello-world --source-image=openshift/jenkins-1-centos7 --source-image-path=/var/lib/jenkins:tmp

##### oc start-build #####

Start a new build

# Starts build from build config "hello-world"
    oc start-build hello-world
    
    # Starts build from a previous build "hello-world-1"
    oc start-build --from-build=hello-world-1
    
    # Use the contents of a directory as build input
    oc start-build hello-world --from-dir=src/
    
    # Send the contents of a Git repository to the server from tag 'v2'
    oc start-build hello-world --from-repo=../hello-world --commit=v2
    
    # Start a new build for build config "hello-world" and watch the logs until the build
    # completes or fails
    oc start-build hello-world --follow
    
    # Start a new build for build config "hello-world" and wait until the build completes. It
    # exits with a non-zero return code if the build fails
    oc start-build hello-world --wait

##### oc cancel-build #####

Cancel running, pending, or new builds

# Cancel the build with the given name
    oc cancel-build ruby-build-2
    
    # Cancel the named build and print the build logs
    oc cancel-build ruby-build-2 --dump-logs
    
    # Cancel the named build and create a new one with the same parameters
    oc cancel-build ruby-build-2 --restart
    
    # Cancel multiple builds
    oc cancel-build ruby-build-1 ruby-build-2 ruby-build-3
    
    # Cancel all builds created from the 'ruby-build' build config that are in the 'new' state
    oc cancel-build bc/ruby-build --state=new

##### oc rollout #####

`oc rollout` 有以下命令：

*  `oc rollout latest` \- 开始一个新的部署
 *  `oc rollout status` \- 查看部署状态
 *  `oc rollout pause` \- 中止一个部署
 *  `oc rollout resume` \- 恢复一个被中止（paused）的部署
 *  `oc rollout cancel` \- 取消一个部署
 *  `oc rollout restart` \- 重新开始一个部署
 *  `oc rollout retry` \- 重试一个失败的部署
 *  `oc rollout undo` \- 撤销上一个部署
 *  `oc rollout history` \- 查看部署历史

# Start a new rollout based on the latest images defined in the image change triggers
    oc rollout latest dc/nginx
    
    # Print the rolled out deployment config
    oc rollout latest dc/nginx -o json
    
    # Watch the status of the latest rollout
    oc rollout status dc/nginx
    
    # Mark the nginx deployment as paused. Any current state of
    # the deployment will continue its function, new updates to the deployment will not
    # have an effect as long as the deployment is paused
    oc rollout pause dc/nginx
    
    # Resume an already paused deployment
    oc rollout resume dc/nginx
    
    # Cancel the in-progress deployment based on 'nginx'
    oc rollout cancel dc/nginx
    
    # Restart a deployment
    oc rollout restart deployment/nginx
    
    # Restart a daemonset
    oc rollout restart daemonset/abc
    
    # Retry the latest failed deployment based on 'frontend'
    # The deployer pod and any hook pods are deleted for the latest failed deployment
    oc rollout retry dc/frontend
    
    # Roll back to the previous deployment
    oc rollout undo dc/nginx
    
    # Roll back to deployment revision 3. The replication controller for that version must exist
    oc rollout undo dc/nginx --to-revision=3
    
    # View the rollout history of a deployment
    oc rollout history dc/nginx
    
    # View the details of deployment revision 3
    oc rollout history dc/nginx --revision=3

##### oc expose #####

Expose a replicated application as a service or route

# expose as route
    oc expose svc green --name=bluegreen

# Create a route based on service nginx. The new route will reuse nginx's labels
    oc expose service nginx
    
    # Create a route and specify your own label and route name
    oc expose service nginx -l name=myroute --name=fromdowntown
    
    # Create a route and specify a host name
    oc expose service nginx --hostname=www.example.com
    
    # Create a route with a wildcard
    oc expose service nginx --hostname=x.example.com --wildcard-policy=Subdomain
    # This would be equivalent to *.example.com. NOTE: only hosts are matched by the wildcard; subdomains would not be included
    
    # Expose a deployment configuration as a service and use the specified port
    oc expose dc ruby-hello-world --port=8080
    
    # Expose a service as a route in the specified path
    oc expose service nginx --path=/nginx
    
    # Expose a service using different generators
    oc expose service nginx --name=exposed-svc --port=12201 --protocol="TCP" --generator="service/v2"
    oc expose service nginx --name=my-route --port=12201 --generator="route/v1"
    
    # Exposing a service using the "route/v1" generator (default) will create a new exposed route with the "--name" provided
    # (or the name of the service otherwise). You may not specify a "--protocol" or "--target-port" option when using this generator

##### oc set env #####

Update environment variables on a pod template

# Update deployment config 'myapp' with a new environment variable
    oc set env dc/myapp STORAGE_DIR=/local
    
    # List the environment variables defined on a build config 'sample-build'
    oc set env bc/sample-build --list
    
    # List the environment variables defined on all pods
    oc set env pods --all --list
    
    # Output modified build config in YAML
    oc set env bc/sample-build STORAGE_DIR=/data -o yaml
    
    # Update all containers in all replication controllers in the project to have ENV=prod
    oc set env rc --all ENV=prod
    
    # Import environment from a secret
    oc set env --from=secret/mysecret dc/myapp
    
    # Import environment from a config map with a prefix
    oc set env --from=configmap/myconfigmap --prefix=MYSQL_ dc/myapp
    
    # Remove the environment variable ENV from container 'c1' in all deployment configs
    oc set env dc --all --containers="c1" ENV-
    
    # Remove the environment variable ENV from a deployment config definition on disk and
    # update the deployment config on the server
    oc set env -f dc.json ENV-
    
    # Set some of the local shell environment into a deployment config on the server
    oc set env | grep RAILS_ | oc env -e - dc/myapp
    
    # remove an env var
    oc set env deployment spring-petclinic \
      MYSQL_DATABASE_ROOT_PASSWORD-

##### oc set triggers #####

Update the triggers on one or more object.

# Print the triggers on the deployment config 'myapp'
    oc set triggers dc/myapp
    
    # Set all triggers to manual
    oc set triggers dc/myapp --manual
    
    # Enable all automatic triggers
    oc set triggers dc/myapp --auto
    
    # Reset the GitHub webhook on a build to a new, generated secret
    oc set triggers bc/webapp --from-github
    oc set triggers bc/webapp --from-webhook
    
    # Remove all triggers
    oc set triggers bc/webapp --remove-all
    
    # Stop triggering on config change
    oc set triggers dc/myapp --from-config --remove
    
    # Add an image trigger to a build config
    oc set triggers bc/webapp --from-image=namespace1/image:latest
    
    # Add an image trigger to a stateful set on the main container
    oc set triggers statefulset/db --from-image=namespace1/image:latest -c main

##### oc set probe #####

Update a probe （健康检查探针）on a pod template.

# Clear both readiness and liveness probes off all containers
      oc set probe dc/myapp --remove --readiness --liveness
    
      # Set an exec action as a liveness probe to run 'echo ok'
      oc set probe dc/myapp --liveness -- echo ok
    
      # Set a readiness probe to try to open a TCP socket on 3306
      oc set probe rc/mysql --readiness --open-tcp=3306
    
      # Set an HTTP startup probe for port 8080 and path /healthz over HTTP on the pod IP
      oc probe dc/webapp --startup --get-url=http://:8080/healthz
    
      # Set an HTTP readiness probe for port 8080 and path /healthz over HTTP on the pod IP
      oc probe dc/webapp --readiness --get-url=http://:8080/healthz
    
      # Set an HTTP readiness probe over HTTPS on 127.0.0.1 for a hostNetwork pod
      oc set probe dc/router --readiness --get-url=https://127.0.0.1:1936/stats
    
      # Set only the initial-delay-seconds field on all deployments
      oc set probe dc --all --readiness --initial-delay-seconds=30

##### oc set volumes #####

Update volumes on a pod template.

# List volumes defined on all deployment configs in the current project
    oc set volume dc --all
    
    # Add a new empty dir volume to deployment config (dc) 'myapp' mounted under
    # /var/lib/myapp
    oc set volume dc/myapp --add --mount-path=/var/lib/myapp
    
    # Use an existing persistent volume claim (pvc) to overwrite an existing volume 'v1'
    oc set volume dc/myapp --add --name=v1 -t pvc --claim-name=pvc1 --overwrite
    
    # Remove volume 'v1' from deployment config 'myapp'
    oc set volume dc/myapp --remove --name=v1
    
    # Create a new persistent volume claim that overwrites an existing volume 'v1'
    oc set volume dc/myapp --add --name=v1 -t pvc --claim-size=1G --overwrite
    
    # Change the mount point for volume 'v1' to /data
    oc set volume dc/myapp --add --name=v1 -m /data --overwrite
    
    # Modify the deployment config by removing volume mount "v1" from container "c1"
    # (and by removing the volume "v1" if no other containers have volume mounts that reference it)
    oc set volume dc/myapp --remove --name=v1 --containers=c1
    
    # Add new volume based on a more complex volume source (AWS EBS, GCE PD,
    # Ceph, Gluster, NFS, ISCSI, ...)
    oc set volume dc/myapp --add -m /data --source=<json-string>

##### oc set image #####

Updat eimage of a pod template.

# Set a deployment configs's nginx container image to 'nginx:1.9.1', and its busybox container image to 'busybox'.
    oc set image dc/nginx busybox=busybox nginx=nginx:1.9.1
    
    # Set a deployment configs's app container image to the image referenced by the imagestream tag 'openshift/ruby:2.3'.
    oc set image dc/myapp app=openshift/ruby:2.3 --source=imagestreamtag
    
    # Update all deployments' and rc's nginx container's image to 'nginx:1.9.1'
    oc set image deployments,rc nginx=nginx:1.9.1 --all
    
    # Update image of all containers of daemonset abc to 'nginx:1.9.1'
    oc set image daemonset abc *=nginx:1.9.1
    
    # Print result (in yaml format) of updating nginx container image from local file, without hitting the server
    oc set image -f path/to/file.yaml nginx=nginx:1.9.1 --local -o yaml

##### oc scale #####

Set a new size (scale up or scale down) for a Deployment, ReplicaSet or ReplicationController.

# Scale a replicaset named 'foo' to 3.
    oc scale --replicas=3 rs/foo
    
    # Scale a resource identified by type and name specified in "foo.yaml" to 3.
    oc scale --replicas=3 -f foo.yaml
    
    # If the deployment named mysql's current size is 2, scale mysql to 3.
    oc scale --current-replicas=2 --replicas=3 deployment/mysql
    
    # Scale multiple replication controllers.
    oc scale --replicas=5 rc/foo rc/bar rc/baz
    
    # Scale statefulset named 'web' to 3.
    oc scale --replicas=3 statefulset/web

##### oc autoscale #####

Autoscale a deployment config, deployment, replica set, stateful set, or replication controller

# Auto scale a deployment "foo", with the number of pods between 2 and 10, no target CPU utilization specified so a default autoscaling policy will be used:
    oc autoscale deployment foo --min=2 --max=10
    
    # Auto scale a replication controller "foo", with the number of pods between 1 and 5, target CPU utilization at 80%:
    oc autoscale rc foo --max=5 --cpu-percent=80
    
    # Create a resource HPA for the pod-autoscale deployment to scale between one and five replicas and set it to scale up when the CPU utilization reaches 60%.
    
    oc autoscale deployment.apps/pod-autoscale --min 1 --max 5 --cpu-percent=60

##### oc set route-backends #####

Update the backends for a route.

Split route traffic for blue/green deployment or canary deployment.

oc set route-backends bluegreen blue=80 green=20

# Print the backends on the route 'web'
    oc set route-backends web
    
    # Set two backend services on route 'web' with 2/3rds of traffic going to 'a'
    oc set route-backends web a=2 b=1
    
    # Increase the traffic percentage going to b by 10%% relative to a
    oc set route-backends web --adjust b=+10%%
    
    # Set traffic percentage going to b to 10%% of the traffic going to a
    oc set route-backends web --adjust b=10%%
    
    # Set weight of b to 10
    oc set route-backends web --adjust b=10
    
    # Set the weight to all backends to zero
    oc set route-backends web --zero

##### oc set resources #####

Update resource requests/limits on objects with pod templates

oc set resources dc cakephp-mysql-example --limits=memory=1Gi
    
    # set resources quota
    oc set resources dc/jenkins --requests=cpu=500m,memory=1Gi --limits=cpu=2,memory=2Gi

# Set a deployments nginx container CPU limits to "200m and memory to 512Mi"
    oc set resources deployment nginx -c=nginx --limits=cpu=200m,memory=512Mi
    
    # Set the resource request and limits for all containers in nginx
    oc set resources deployment nginx --limits=cpu=200m,memory=512Mi --requests=cpu=100m,memory=256Mi
    
    # Remove the resource requests for resources on containers in nginx
    oc set resources deployment nginx --limits=cpu=0,memory=0 --requests=cpu=0,memory=0
    
    # Print the result (in YAML format) of updating nginx container limits locally, without hitting the server
    oc set resources -f path/to/file.yaml --limits=cpu=200m,memory=512Mi --local -o yaml

#### 资源管理 ####

##### oc get #####

Display one or many resources.

# check pod labels
    oc get pods --show-labels
    
    # check csv under `openshift-operators` namespace
    oc get csv -n openshift-operators
    
    # The application that you previously deployed is exposing the metric http_request_total on its /metrics endpoint.
    curl http://$(oc get route pod-autoscale -n my-hpa --template='{ { .spec.host }}')/metrics
    
    # sort pods by node name
    oc get pod -n openshift-monitoring -o wide --sort-by=".spec.nodeName"
    
    # check template
    oc get templates -n openshift | grep -i jenkins
    
    # get pod name
    oc logs $(oc get pod -l app=kafka-producer -o=jsonpath='{.items[0].metadata.name}') -f

# List all pods in ps output format.
    oc get pods
    
    # List all pods in ps output format with more information (such as node name).
    oc get pods -o wide
    
    # List a single replication controller with specified NAME in ps output format.
    oc get replicationcontroller web
    
    # List deployments in JSON output format, in the "v1" version of the "apps" API group:
    oc get deployments.v1.apps -o json
    
    # List a single pod in JSON output format.
    oc get -o json pod web-pod-13je7
    
    # List a pod identified by type and name specified in "pod.yaml" in JSON output format.
    oc get -f pod.yaml -o json
    
    # List resources from a directory with kustomization.yaml - e.g. dir/kustomization.yaml.
    oc get -k dir/
    
    # Return only the phase value of the specified pod.
    oc get -o template pod/web-pod-13je7 --template={ { .status.phase}}
    
    # List resource information in custom columns.
    oc get pod test-pod -o custom-columns=CONTAINER:.spec.containers[0].name,IMAGE:.spec.containers[0].image
    
    # List all replication controllers and services together in ps output format.
    oc get rc,services
    
    # List one or more resources by their type and names.
    oc get rc/web service/frontend pods/web-pod-13je7

##### oc describe #####

Show details of a specific resource or group of resuces.

# check detailed parameters of template
    oc describe template jenkins-persistent -n openshift

# Describe a node
    oc describe nodes kubernetes-node-emt8.c.myproject.internal
    
    # Describe a pod
    oc describe pods/nginx
    
    # Describe a pod identified by type and name in "pod.json"
    oc describe -f pod.json
    
    # Describe all pods
    oc describe pods
    
    # Describe pods by label name=myLabel
    oc describe po -l name=myLabel
    
    # Describe all pods managed by the 'frontend' replication controller (rc-created pods
    # get the name of the rc as a prefix in the pod the name).
    oc describe pods frontend

##### oc explain #####

Documentation of resources

oc explain pods --recursive | less

# Get the documentation of the resource and its fields
    oc explain pods
    
    # Get the documentation of a specific field of a resource
    oc explain pods.spec.containers

##### oc patch #####

Update field(s) of a resource.

# patch route for blue/green deployment
    oc patch route/bluegreen -p '{"spec":{"to":{"name":"blue"}}}'
    oc patch route/bluegreen -p '{"spec":{"to":{"name":"green"}}}'

# Partially update a node using a strategic merge patch. Specify the patch as JSON.
    oc patch node k8s-node-1 -p '{"spec":{"unschedulable":true}}'
    
    # Partially update a node using a strategic merge patch. Specify the patch as YAML.
    oc patch node k8s-node-1 -p $'spec:\n unschedulable: true'
    
    # Partially update a node identified by the type and name specified in "node.json" using strategic merge patch.
    oc patch -f node.json -p '{"spec":{"unschedulable":true}}'
    
    # Update a container's image; spec.containers[*].name is required because it's a merge key.
    oc patch pod valid-pod -p '{"spec":{"containers":[{"name":"kubernetes-serve-hostname","image":"new image"}]}}'
    
    # Update a container's image using a json patch with positional arrays.
    oc patch pod valid-pod --type='json' -p='[{"op": "replace", "path": "/spec/containers/0/image", "value":"new image"}]'

##### oc edit #####

Edit a resource on the server

# Edit the service named 'docker-registry':
    oc edit svc/docker-registry
    
    # Use an alternative editor
    KUBE_EDITOR="nano" oc edit svc/docker-registry
    
    # Edit the job 'myjob' in JSON using the v1 API format:
    oc edit job.v1.batch/myjob -o json
    
    # Edit the deployment 'mydeployment' in YAML and save the modified config in its annotation:
    oc edit deployment/mydeployment -o yaml --save-config

##### oc delete #####

Delete resources by filenames, stdin, resources and names, or by resources and label selector.

# Delete a pod using the type and name specified in pod.json.
    oc delete -f ./pod.json
    
    # Delete resources from a directory containing kustomization.yaml - e.g. dir/kustomization.yaml.
    oc delete -k dir
    
    # Delete a pod based on the type and name in the JSON passed into stdin.
    cat pod.json | oc delete -f -
    
    # Delete pods and services with same names "baz" and "foo"
    oc delete pod,service baz foo
    
    # Delete pods and services with label name=myLabel.
    oc delete pods,services -l name=myLabel
    
    # Delete a pod with minimal delay
    oc delete pod foo --now
    
    # Force delete a pod on a dead node
    oc delete pod foo --force
    
    # Delete all pods
    oc delete pods --all

##### oc create #####

Create a resource from a file (yaml or json) of from stdin.

# Create a pod using the data in pod.json.
    oc create -f ./pod.json
    
    # Create a pod based on the JSON passed into stdin.
    cat pod.json | oc create -f -
    
    # Edit the data in docker-registry.yaml in JSON then create the resource using the edited data.
    oc create -f docker-registry.yaml --edit -o json

另外OpenShift还提供了以下创建资源的快捷方式：

*  `oc create build` \- Create a new build
 *  `oc create clusterresourcequota` \- Create a cluster resource quota
 *  `oc create clusterrole` \- Create a ClusterRole
 *  `oc create clusterrolebinding` \- Create a ClusterRoleBinding for a particular ClusterRole
 *  `oc create configmap` \- Create a configmap from a local file, directory or literal value
 *  `oc create cronjob` \- Create a cronjob with the specified name
 *  `oc create deployment` \- Create a deployment with the specified name
 *  `oc create deploymentconfig` \- Create a deployment config with default options that uses a given image
 *  `oc create identity` \- Manually create an identity (only needed if automatic creation is disabled)
 *  `oc create imagestream` \- Create a new empty image stream
 *  `oc create imagestreamtag` \- Create a new image stream tag
 *  `oc create ingress` \- Create an ingress with the specified name
 *  `oc create job` \- Create a job with the specified name
 *  `oc create namespace` \- Create a namespace with the specified name
 *  `oc create poddisruptionbudget` \- Create a pod disruption budget with the specified name
 *  `oc create priorityclass` \- Create a priorityclass with the specified name
 *  `oc create quota` \- Create a quota with the specified name
 *  `oc create role` \- Create a role with single rule
 *  `oc create rolebinding` \- Create a RoleBinding for a particular Role or ClusterRole
 *  `oc create route edge` \- Create a route that uses edge TLS termination
 *  `oc create route passthrough` \- Create a route that uses passthrough TLS termination
 *  `oc create route reencrypt` \- Create a route that uses reencrypt TLS termination
 *  `oc create secret docker-registry` \- Create a secret for use with a Docker registry
 *  `oc create secret generic` \- Create a secret from a local file, directory or literal value
 *  `oc create secret tls` \- Create a TLS secret
 *  `oc create service clusterip` \- Create a ClusterIP service
 *  `oc create service externalname` \- Create an ExternalName service
 *  `oc create service loadbalancer` \- Create a LoadBalancer service
 *  `oc create service nodeport` \- Create a NodePort service
 *  `oc create serviceaccount` \- Create a service account with the specified name
 *  `oc create user` \- Manually create a user (only needed if automatic creation is disabled)
 *  `oc create useridentitymapping` \- Manually map an identity to a user

# Create a secret, cluster-apiserver-tls in the openshift-config namespace
    oc create secret tls cluster-apiserver-tls \
      --cert=$HOME/certificates/cert.pem \
      --key=$HOME/certificates/privkey.pem \
      -n openshift-config
      
    # Create the htpasswd secret from the htpasswd file in the openshift-config namespace.
    oc create secret generic htpasswd --from-file=$HOME/htpasswd -n openshift-config
    
    
    # Example
    oc create route edge --service=frontend --cert=tls.crt --key=tls.key --ca-cert=ca.crt --hostname=www.example.com
    
    # 有默认的证书？
    oc create route edge nexus-registry --service=nexus-registry --port=5000
    
    # redirect http to https
    oc create route edge --service=spring-petclinic --insecure-policy='Redirect'
    
    # create config map
    oc create configmap maven-skopeo-agent --from-file=./podTemplate.xml -n ${GUID}-jenkins

##### oc apply #####

Apply a configuration to a resource by filename or stdin.

# Apply the configuration in pod.json to a pod.
    oc apply -f ./pod.json
    
    # Apply resources from a directory containing kustomization.yaml - e.g. dir/kustomization.yaml.
    oc apply -k dir/
    
    # Apply the JSON passed into stdin to a pod.
    cat pod.json | oc apply -f -
    
    # Note: --prune is still in Alpha
    # Apply the configuration in manifest.yaml that matches label app=nginx and delete all the other resources that are not in the file and match label app=nginx.
    oc apply --prune -f manifest.yaml -l app=nginx
    
    # Apply the configuration in manifest.yaml and delete all the other configmaps that are not in the file.
    oc apply --prune -f manifest.yaml --all --prune-whitelist=core/v1/ConfigMap

##### oc label #####

Update the labels on a resource

# label
    oc label configmap maven-skopeo-agent role=jenkins-slave

# Update pod 'foo' with the label 'unhealthy' and the value 'true'.
    oc label pods foo unhealthy=true
    
    # Update pod 'foo' with the label 'status' and the value 'unhealthy', overwriting any existing value.
    oc label --overwrite pods foo status=unhealthy
    
    # Update all pods in the namespace
    oc label pods --all status=unhealthy
    
    # Update a pod identified by the type and name in "pod.json"
    oc label -f pod.json status=unhealthy
    
    # Update pod 'foo' only if the resource is unchanged from version 1.
    oc label pods foo status=unhealthy --resource-version=1
    
    # Update pod 'foo' by removing a label named 'bar' if it exists.
    # Does not require the --overwrite flag.
    oc label pods foo bar-

##### oc annotate #####

Update the annoatations on a resource.

# Update pod 'foo' with the annotation 'description' and the value 'my frontend'.
    # If the same annotation is set multiple times, only the last value will be applied
    oc annotate pods foo description='my frontend'
    
    # Update a pod identified by type and name in "pod.json"
    oc annotate -f pod.json description='my frontend'
    
    # Update pod 'foo' with the annotation 'description' and the value 'my frontend running nginx', overwriting any existing value.
    oc annotate --overwrite pods foo description='my frontend running nginx'
    
    # Update all pods in the namespace
    oc annotate pods --all description='my frontend running nginx'
    
    # Update pod 'foo' only if the resource is unchanged from version 1.
    oc annotate pods foo description='my frontend running nginx' --resource-version=1
    
    # Update pod 'foo' by removing an annotation named 'description' if it exists.
    # Does not require the --overwrite flag.
    oc annotate pods foo description-

#### 应用运维 ####

##### oc logs #####

Print the logs for a container in a pod

# Start streaming the logs of the most recent build of the openldap build config
    oc logs -f bc/openldap
    
    # Start streaming the logs of the latest deployment of the mysql deployment config
    oc logs -f dc/mysql
    
    # Get the logs of the first deployment for the mysql deployment config. Note that logs
    # from older deployments may not exist either because the deployment was successful
    # or due to deployment pruning or manual deletion of the deployment
    oc logs --version=1 dc/mysql
    
    # Return a snapshot of ruby-container logs from pod backend
    oc logs backend -c ruby-container
    
    # Start streaming of ruby-container logs from pod backend
    oc logs -f pod/backend -c ruby-container

##### oc exec #####

Execute a command in a container

# Get output from running 'date' command from pod mypod, using the first container by default
    oc exec mypod -- date
    
    # Get output from running 'date' command in ruby-container from pod mypod
    oc exec mypod -c ruby-container -- date
    
    # Switch to raw terminal mode, sends stdin to 'bash' in ruby-container from pod mypod
    # and sends stdout/stderr from 'bash' back to the client
    oc exec mypod -c ruby-container -i -t -- bash -il
    
    # List contents of /usr from the first container of pod mypod and sort by modification time.
    # If the command you want to execute in the pod has any flags in common (e.g. -i),
    # you must use two dashes (--) to separate your command's flags/arguments.
    # Also note, do not surround your command and its flags/arguments with quotes
    # unless that is how you would execute it normally (i.e., do ls -t /usr, not "ls -t /usr").
    oc exec mypod -i -t -- ls -t /usr
    
    # Get output from running 'date' command from the first pod of the deployment mydeployment, using the first container by default
    oc exec deploy/mydeployment -- date
    
    # Get output from running 'date' command from the first pod of the service myservice, using the first container by default
    oc exec svc/myservice -- date

##### oc rsh #####

Start a shell session in a container

oc rsh nexus-5-sw29d cat /nexus-data/admin.password

# Open a shell session on the first container in pod 'foo'
    oc rsh foo
    
    # Open a shell session on the first container in pod 'foo' and namespace 'bar'
    # (Note that oc client specific arguments must come before the resource name and its arguments)
    oc rsh -n bar foo
    
    # Run the command 'cat /etc/resolv.conf' inside pod 'foo'
    oc rsh foo cat /etc/resolv.conf
    
    # See the configuration of your internal registry
    oc rsh dc/docker-registry cat config.yml
    
    # Open a shell session on the container named 'index' inside a pod of your job
    oc rsh -c index job/sheduled

##### oc rsync #####

Copy files between a local file system and a pod

# Synchronize a local directory with a pod directory
    oc rsync ./local/dir/ POD:/remote/dir
    
    # Synchronize a pod directory with a local directory
    oc rsync POD:/remote/dir/ ./local/dir

##### oc run #####

Run a particular image on the cluster

# Start a nginx pod.
    oc run nginx --image=nginx
    
    # Start a hazelcast pod and let the container expose port 5701.
    oc run hazelcast --image=hazelcast/hazelcast --port=5701
    
    # Start a hazelcast pod and set environment variables "DNS_DOMAIN=cluster" and "POD_NAMESPACE=default" in the container.
    oc run hazelcast --image=hazelcast/hazelcast --env="DNS_DOMAIN=cluster" --env="POD_NAMESPACE=default"
    
    # Start a hazelcast pod and set labels "app=hazelcast" and "env=prod" in the container.
    oc run hazelcast --image=hazelcast/hazelcast --labels="app=hazelcast,env=prod"
    
    # Dry run. Print the corresponding API objects without creating them.
    oc run nginx --image=nginx --dry-run=client
    
    # Start a nginx pod, but overload the spec with a partial set of values parsed from JSON.
    oc run nginx --image=nginx --overrides='{ "apiVersion": "v1", "spec": { ... } }'
    
    # Start a busybox pod and keep it in the foreground, don't restart it if it exits.
    oc run -i -t busybox --image=busybox --restart=Never
    
    # Start the nginx pod using the default command, but use custom arguments (arg1 .. argN) for that command.
    oc run nginx --image=nginx -- <arg1> <arg2> ... <argN>
    
    # Start the nginx pod using a different command and custom arguments.
    oc run nginx --image=nginx --command -- <cmd> <arg1> ... <argN>

##### oc idle #####

Idle scalable resources.

Idle后pod副本数降为0以降低资源使用率，当service要访问pod时再重新拉起pod。

# Idle the scalable controllers associated with the services listed in to-idle.txt
    oc idle --resource-names-file to-idle.txt

#### 其它命令 ####

##### oc version #####

Print the client and server version information.

# Print the OpenShift client, kube-apiserver, and openshift-apiserver version information for the current context
      oc version
    
      # Print the OpenShift client, kube-apiserver, and openshift-apiserver version numbers for the current context
      oc version --short
    
      # Print the OpenShift client version information for the current context
      oc version --client

##### oc cluster-info #####

Display cluster info

# Print the address of the control plane and cluster services
    oc cluster-info

##### oc completion #####

Output shell completion code for the specified shell (bash or zsh)

# Installing bash completion on macOS using homebrew
      ## If running Bash 3.2 included with macOS
      brew install bash-completion
      ## or, if running Bash 4.1+
      brew install bash-completion@2
      ## If oc is installed via homebrew, this should start working immediately.
      ## If you've installed via other means, you may need add the completion to your completion directory
      oc completion bash > $(brew --prefix)/etc/bash_completion.d/oc
    
    
      # Installing bash completion on Linux
      ## If bash-completion is not installed on Linux, please install the 'bash-completion' package
      ## via your distribution's package manager.
      ## Load the oc completion code for bash into the current shell
      source <(oc completion bash)
      ## Write bash completion code to a file and source it from .bash_profile
      oc completion bash > ~/.kube/completion.bash.inc
      printf " # Kubectl shell completion source '$HOME/.kube/completion.bash.inc' " >> $HOME/.bash_profile
      source $HOME/.bash_profile
    
      # Load the oc completion code for zsh[1] into the current shell
      source <(oc completion zsh)
      # Set the oc completion code for zsh[1] to autoload on startup
      oc completion zsh > "${fpath[1]}/_oc"

##### oc api-versions #####

Print the supported API versions on the server, in the form of “group/version”

oc api-versions | grep rbac | grep k8s
    
    # rbac.authorization.k8s.io/v1
    # rbac.authorization.k8s.io/v1beta1

# Print the supported API versions
    oc api-versions

##### oc api-resources #####

Print the supported API resources on the server

oc api-resources | grep rbac | grep k8s
    
    # clusterrolebindings rbac.authorization.k8s.io false ClusterRoleBinding
    # clusterroles rbac.authorization.k8s.io false ClusterRole
    # rolebindings rbac.authorization.k8s.io true RoleBinding
    # roles rbac.authorization.k8s.io true Role

# Print the supported API Resources
    oc api-resources
    
    # Print the supported API Resources with more information
    oc api-resources -o wide
    
    # Print the supported API Resources sorted by a column
    oc api-resources --sort-by=name
    
    # Print the supported namespaced resources
    oc api-resources --namespaced=true
    
    # Print the supported non-namespaced resources
    oc api-resources --namespaced=false
    
    # Print the supported API Resources with specific APIGroup
    oc api-resources --api-group=extensions

##### oc config set-cluster #####

Sets a cluster entry in kubeconfig

# You can update your client kubeconfig with the Let’s Encrypt CA by running the following command.
    oc config set-cluster $CLUSTER_NAME --certificate-authority=$HOME/certificates/chain.pem

# Set only the server field on the e2e cluster entry without touching other values.
    oc config set-cluster e2e --server=https://1.2.3.4
    
    # Embed certificate authority data for the e2e cluster entry
    oc config set-cluster e2e --embed-certs --certificate-authority=~/.kube/e2e/kubernetes.ca.crt
    
    # Disable cert checking for the dev cluster entry
    oc config set-cluster e2e --insecure-skip-tls-verify=true
    
    # Set custom TLS server name to use for validation for the e2e cluster entry
    oc config set-cluster e2e --tls-server-name=my-cluster-name

##### oc auth can-i #####

Check whether an action is allowed.

# verify permissions
    oc auth can-i get node
    oc auth can-i delete node

# Check to see if I can create pods in any namespace
    oc auth can-i create pods --all-namespaces
    
    # Check to see if I can list deployments in my current namespace
    oc auth can-i list deployments.apps
    
    # Check to see if I can do everything in my current namespace ("*" means all)
    oc auth can-i '*' '*'
    
    # Check to see if I can get the job named "bar" in namespace "foo"
    oc auth can-i list jobs.batch/bar -n foo
    
    # Check to see if I can read pod logs
    oc auth can-i get pods --subresource=log
    
    # Check to see if I can access the URL /logs/
    oc auth can-i get /logs/
    
    # List all allowed actions in namespace "foo"
    oc auth can-i --list --namespace=foo

### 管理命令 ###

#### Manage Group and Members ####

##### oc adm groups new #####

Create a new group

# Create a group named lab-cluster-admins with members david and karla.
    oc adm groups new lab-cluster-admins david karla

#### Assign Roles to Users and Groups ####

##### oc adm policy add-role-to-user #####

Add a role to users or service accounts for the current project

# Add the 'view' role to user1 for the current project
    oc policy add-role-to-user view user1
    
    # Add the 'edit' role to serviceaccount1 for the current project
    oc policy add-role-to-user edit -z serviceaccount1

##### oc adm policy add-role-to-group #####

Add a role to groups.

#### Assign Cluster Roles to Users and Groups ####

##### oc adm policy add-cluster-role-to-user #####

# Grant the registry-admin cluster role to the registry-admin service account. 
    # clusterrole: registry-admin
    # service account (full name): ystem:serviceaccount:openshift-config:registry-admin
    oc adm policy add-cluster-role-to-user registry-admin system:serviceaccount:openshift-config:registry-admin

##### oc adm policy add-cluster-role-to-group #####

# Grant the cluster-admin cluster role to the lab-cluster-admins group.
    # Do this by creating a clusterrolebinding and associating the cluster role with the group. 
    # While providing the rolebinding-name is optional, setting it makes it easier to validate cluster access.
    oc adm policy add-cluster-role-to-group cluster-admin lab-cluster-admins --rolebinding-name=lab-cluster-admins

#### Manage Policy ####

##### oc adm policy add-scc-to-user #####

Add a security context constraint to users or a service account

# Add the 'restricted' security context constraint to user1 and user2
    oc adm policy add-scc-to-user restricted user1 user2
    
    # Add the 'privileged' security context constraint to serviceaccount1 in the current namespace
    oc adm policy add-scc-to-user privileged -z serviceaccount1

##### oc adm policy add-scc-to-group #####

Add a security context constraint to groups

# Add the 'restricted' security context constraint to group1 and group2
    oc adm policy add-scc-to-group restricted group1 group2

#### 节点管理 ####

##### oc adm cordon #####

Mark node as unschedulable

# Cordon one of your manual workers to ensure no new Pods are scheduled to it.
    # 封节点，禁止新的Pods被调度到该节点
    oc adm cordon ip-10-0-61-193.us-east-2.compute.internal

# Mark node "foo" as unschedulable.
    oc adm cordon foo

##### oc adm drain #####

Drain node in preparation for maintenance

# evict, or drain, all of the existing Pods
    # The oc adm drain command will cordon a node for you first, if you have not already done so, before it proceeds with evicting the Pods.
    # 驱逐该节点上已有的Pods
    # The `--ignore-daemonsets` option will ensure that `Pods` backed by a `DaemonSet`, which cannot be evicted, don’t prevent the drain activity on the node from being successful.
    # The `--delete-local-data` option will ensure that `Pods` using local storage are evicted with their storage cleaned up.
    # The `--force` option will ensure that any `Pods` not backed by a replication controller - called *bare Pods* - are properly evicted as well.
    oc adm drain node/ip-10-0-61-193.us-east-2.compute.internal --ignore-daemonsets --delete-local-data --force

# Drain node "foo", even if there are pods not managed by a ReplicationController, ReplicaSet, Job, DaemonSet or StatefulSet on it.
    oc adm drain foo --force
    
    # As above, but abort if there are pods not managed by a ReplicationController, ReplicaSet, Job, DaemonSet or StatefulSet, and use a grace period of 15 minutes.
    oc adm drain foo --grace-period=900

##### oc adm taint #####

Update the taints on one or more ndoes.

这个Node是有污点（taints）的，只有能够接受（toleration）这些污点（taints）的Pod或者接受任意污点（taints）才会被调度到这个Node。

# add two taints for each infra node
    oc adm taint node ip-10-0-48-51.us-east-2.compute.internal infra=reserved:NoSchedule
    oc adm taint node ip-10-0-48-51.us-east-2.compute.internal infra=reserved:NoExecute
    
    oc adm taint node ip-10-0-54-210.us-east-2.compute.internal infra=reserved:NoSchedule
    oc adm taint node ip-10-0-54-210.us-east-2.compute.internal infra=reserved:NoExecute

# Update node 'foo' with a taint with key 'dedicated' and value 'special-user' and effect 'NoSchedule'.
      # If a taint with that key and effect already exists, its value is replaced as specified.
      oc adm taint nodes foo dedicated=special-user:NoSchedule
    
      # Remove from node 'foo' the taint with key 'dedicated' and effect 'NoSchedule' if one exists.
      oc adm taint nodes foo dedicated:NoSchedule-
    
      # Remove from node 'foo' all the taints with key 'dedicated'
      oc adm taint nodes foo dedicated-
    
      # Add a taint with key 'dedicated' on nodes having label mylabel=X
      oc adm taint node -l myLabel=X  dedicated=foo:PreferNoSchedule
    
      # Add to node 'foo' a taint with key 'bar' and no value
      oc adm taint nodes foo bar:NoSchedule

#### 资源配额管理 ####

##### cc adm create-bootstrap-project-template #####

# bootstrap project template
    oc adm create-bootstrap-project-template -o yaml > $HOME/project_request_template.yaml

References:

\- [https://docs.openshift.com/container-platform/4.6/applications/projects/configuring-project-creation.html][https_docs.openshift.com_container-platform_4.6_applications_projects_configuring-project-creation.html]

\- [https://docs.openshift.com/container-platform/4.6/nodes/clusters/nodes-cluster-limit-ranges.html][https_docs.openshift.com_container-platform_4.6_nodes_clusters_nodes-cluster-limit-ranges.html]

\- [https://docs.openshift.com/container-platform/4.6/applications/quotas/quotas-setting-per-project.html][https_docs.openshift.com_container-platform_4.6_applications_quotas_quotas-setting-per-project.html]

Add LimitRange and ResoureQuota into `objects` of `project_request_template.yaml`:

- apiVersion: "v1"
      kind: "LimitRange"
      metadata:
        name: "project-limits"
      spec:
        limits:
          - type: "Container"
            defaultRequest:
              cpu: "500m"
              memory: "500Mi"
            default:
              cpu: "1"
              memory: "1Gi"
    - apiVersion: v1
      kind: ResourceQuota
      metadata:
        name: project-quota
      spec:
        hard:
          pods: "10"
          requests.cpu: "4"
          requests.memory: "8Gi"
          limits.cpu: "6"
          limits.memory: "16Gi"
          requests.storage: "20G"

Create project request template:

# Create the new project-request template in the openshift-config namespace
    oc create -f $HOME/project_request_template.yaml -n openshift-config
    
    # verify project request template
    oc get template -n openshift-config | grep project
    oc edit template project-request -n openshift-config

Apply project request template in cluster settings:

# check projectRequestTemplate
    oc get projects.config.openshift.io -o yaml
    
    # modify project object to link a project request template
    oc patch projects.config.openshift.io cluster -p '{"spec": {"projectRequestTemplate": {"name": "project-request"}}}' --type=merge
    
    # check projectRequestTemplate again
    oc get projects.config.openshift.io -o yaml

Create a new project to verify LimitRange and Resource Quota:

oc new-project demo-limits
    
    oc describe project demo-limits
    
    oc get limits -n demo-limits
    oc get quota -n demo-limits
    
    # clean up project
    oc delete project demo-limits

## 参考文档 ##

*  [OpenShift Cheat Sheet][]
 *  [MasterTheBoss | OpenShift Cheat Sheet][MasterTheBoss _ OpenShift Cheat Sheet]
 *  [OpenShift CLI developer command reference][]
 *  [OpenShift CLI administrator command reference][]

## 扩展阅读 ##

*  [Kubernetes kubectl cheatsheet][]

[https_docs.openshift.com_container-platform_4.6_applications_projects_configuring-project-creation.html]: https://docs.openshift.com/container-platform/4.6/applications/projects/configuring-project-creation.html
[https_docs.openshift.com_container-platform_4.6_nodes_clusters_nodes-cluster-limit-ranges.html]: https://docs.openshift.com/container-platform/4.6/nodes/clusters/nodes-cluster-limit-ranges.html
[https_docs.openshift.com_container-platform_4.6_applications_quotas_quotas-setting-per-project.html]: https://docs.openshift.com/container-platform/4.6/applications/quotas/quotas-setting-per-project.html
[OpenShift Cheat Sheet]: https://design.jboss.org/redhatdeveloper/marketing/openshift_cheatsheet/cheatsheet/images/openshift_cheat_sheet_r3v1.pdf
[MasterTheBoss _ OpenShift Cheat Sheet]: http://www.mastertheboss.com/soa-cloud/openshift/openshift-cheatsheet/
[OpenShift CLI developer command reference]: https://docs.openshift.com/container-platform/4.8/cli_reference/openshift_cli/developer-cli-commands.html
[OpenShift CLI administrator command reference]: https://docs.openshift.com/container-platform/4.8/cli_reference/openshift_cli/administrator-cli-commands.html
[Kubernetes kubectl cheatsheet]: https://kubernetes.io/docs/reference/kubectl/cheatsheet/