{"id":47938,"date":"2022-01-07T12:00:28","date_gmt":"2022-01-07T03:00:28","guid":{"rendered":"https:\/\/www.creationline.com\/?p=47938"},"modified":"2026-05-27T22:20:59","modified_gmt":"2026-05-27T13:20:59","slug":"miranits-secure-registry-3-msr%e3%82%92k0s%e3%81%a7%e5%8b%95%e3%81%8b%e3%81%9d%e3%81%86-k0s-msr-k8s-kubernetes-mirantis","status":"publish","type":"post","link":"https:\/\/www.creationline.com\/tech-blog\/cloudnative\/docker\/47938","title":{"rendered":"Mirantis Secure Registry 3 (MSR)\u3092k0s\u3067\u52d5\u304b\u305d\u3046 #k0s #msr #k8s #kubernetes #mirantis"},"content":{"rendered":"

Mirantis Secure Registry<\/a>\u3068\u306f\u3001Docker\u30b3\u30f3\u30c6\u30ca\u30a4\u30e1\u30fc\u30b8\u3084Helm Chart\u3092\u5b89\u5168\u306b\u4fdd\u7ba1\u30fb\u5171\u6709\u30fb\u7ba1\u7406\u3067\u304d\u308b\u30d7\u30e9\u30a4\u30d9\u30fc\u30c8\u30ec\u30b8\u30b9\u30c8\u30ea\u3067\u3059\u30022021\u5e74\u672b\u306b\u30ea\u30ea\u30fc\u30b9\u3055\u308c\u305f\u30d0\u30fc\u30b8\u30e7\u30f33.0.0<\/a>\u306b\u3066\u3001\u5f93\u6765\u3088\u308a\u7d71\u5408\u3055\u308c\u3066\u3044\u305fMirantis Kubernetes Engine<\/a>\u304b\u3089\u72ec\u7acb\u3057\u3001\u6a19\u6e96\u7684\u306aKubernetes\u4e0a\u3067\u52d5\u4f5c\u53ef\u80fd<\/a>\u3068\u306a\u308a\u307e\u3057\u305f\u3002
\n\u672c\u7a3f\u3067\u306fMirantis Secure Registry (\u4ee5\u4e0bMSR)\u30d0\u30fc\u30b8\u30e7\u30f33.0.0\u3092\u3001\u30ef\u30f3\u30d0\u30a4\u30ca\u30ea\u3067\u52d5\u4f5c\u3059\u308b\u8efd\u91cf\u306a\u30d5\u30eb\u6a5f\u80fdKubernetes\u30c7\u30a3\u30b9\u30c8\u30ea\u30d3\u30e5\u30fc\u30b7\u30e7\u30f3\u3067\u3042\u308bk0s<\/a>\u306b\u30c7\u30d7\u30ed\u30a4\u3057\u3066\u307f\u307e\u3059\u3002
\n\u306a\u304a\u3001\u672c\u7a3f\u3067\u306fMSR\u306e\u8a73\u7d30\u306a\u8a2d\u5b9a\u624b\u9806\u3084\u5229\u7528\u65b9\u6cd5\u306f\u7701\u7565\u3057\u307e\u3059\u3002\u516c\u5f0f\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8<\/a>\u3092\u53c2\u7167\u3044\u305f\u3060\u304f\u304b\u3001\u4eca\u5f8c\u4e88\u5b9a\u3055\u308c\u3066\u3044\u308bMirantis\u793e\u516c\u8a8d\u30c8\u30ec\u30fc\u30cb\u30f3\u30b0<\/a>\u306e\u958b\u50ac\u3092\u304a\u5f85\u3061\u304f\u3060\u3055\u3044\u3002<\/p>\n

Vagrantfile<\/h2>\n

Virtualbox\u3068Vagrant\u3067\u4eee\u60f3\u30de\u30b7\u30f3\u30921\u53f0\u4f5c\u6210\u3057\u3001\u305d\u3061\u3089\u306bk0s\u3068MSR\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u307e\u3059\u3002<\/p>\n

base_install =<<-SHELL\ntimedatectl set-timezone Asia\/Tokyo\nyum install -y ntp\nsystemctl enable ntpd\nsystemctl start ntpd\nSHELL\nVagrant.configure("2") do |config|\nconfig.vm.box = "centos\/7"\nconfig.vm.box_check_update = false\nconfig.vm.define "node1" do |cf|\ncf.vm.hostname = "node1"\ncf.vm.network "private_network", ip: "192.168.56.101"\ncf.vm.provision "shell", inline: base_install\ncf.vm.provider "virtualbox" do |vb|\nvb.memory = 12288\nvb.cpus = 4\nend\nend\nend<\/pre>\n
k0s\u81ea\u4f53\u306f\u8efd\u91cf\u3067\u3059\u304c\u3001MSR\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30b9\u30ad\u30e3\u30f3\u3092\u5229\u7528\u3059\u308b\u5834\u5408\u306f\u30d1\u30ef\u30d5\u30eb\u306a\u74b0\u5883\u304c\u5fc5\u8981\u3067\u3042\u308b\u305f\u3081\u30e1\u30e2\u30ea12GB\u30fb4vCPU\u3068\u8a2d\u5b9a\u3057\u3066\u3044\u307e\u3059\u3002\u5f53\u521d\u306f\u30e1\u30e2\u30ea4GB\u30fb1vCPU\u3067\u3057\u305f\u304c\u6b63\u5e38\u306b\u52d5\u4f5c\u305b\u305a\u3001\u6b21\u306b\u30e1\u30e2\u30ea8GB\u30fb2vCPU\u3068\u500d\u306b\u3057\u3066\u3082\u52d5\u4f5c\u306b\u652f\u969c\u304c\u898b\u3089\u308c\u305f\u305f\u3081\u3067\u3059\u3002\u8a73\u7d30\u306fSystem requirements<\/a>\u3092\u53c2\u7167\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n
k0s\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb<\/h2>\n
Virtualbox\/Vagrant\u3067\u306ek0s\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u306b\u3064\u3044\u3066\u306e\u8a73\u7d30\u306f\u904e\u53bb\u8a18\u4e8b\u300ck0s\u3067Kubernetes\u3092Virtualbox\/Vagrant\u306b\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u3066\u307f\u3088\u3046<\/a>\u300d\u3092\u3054\u89a7\u304f\u3060\u3055\u3044\u3002\u4ee5\u964d\u3067\u306f\u624b\u9806\u3092\u304b\u3044\u3064\u307e\u3093\u3067\u8a18\u8ff0\u3057\u307e\u3059\u3002<\/p>\n
k0s<\/a>\u306f\u672c\u7a3f\u57f7\u7b46\u6642\u70b9\u3067\u6700\u65b0\u306e v1.23.1+k0s.0 \u3092\u5229\u7528\u3057\u307e\u3059\u3002<\/p>\n
[vagrant@node1 ~]$ \/usr\/local\/bin\/k0s version\nv1.23.1+k0s.0<\/pre>\n
\u30c7\u30d5\u30a9\u30eb\u30c8\u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u306b\u3066\u3001IP\u30a2\u30c9\u30ec\u30b9\u3092\u5909\u66f4\u3057\u307e\u3059\u3002<\/p>\n
[vagrant@node1 ~]$ k0s config create > k0s.yaml.orig\n[vagrant@node1 ~]$ cp -a k0s.yaml.orig k0s.yaml\n[vagrant@node1 ~]$ vi k0s.yaml\n[vagrant@node1 ~]$ sudo mkdir \/etc\/k0s\n[vagrant@node1 ~]$ sudo mv k0s.yaml \/etc\/k0s\/<\/pre>\n
[vagrant@node1 ~]$ diff -u k0s.yaml.orig \/etc\/k0s\/k0s.yaml\n--- k0s.yaml.orig 2022-01-04 15:08:14.826736210 +0900\n+++ \/etc\/k0s\/k0s.yaml 2022-01-04 15:10:39.865766191 +0900\n@@ -5,11 +5,10 @@\nname: k0s\nspec:\napi:\n- address: 10.0.2.15\n+ address: 192.168.56.101\nk0sApiPort: 9443\nport: 6443\nsans:\n- - 10.0.2.15\n- 192.168.56.101\n- fe80::5054:ff:fe4d:77d3\n- fe80::a00:27ff:fefc:8421\n@@ -81,7 +80,7 @@\nscheduler: {}\nstorage:\netcd:\n- peerAddress: 10.0.2.15\n+ peerAddress: 192.168.56.101\ntype: etcd\ntelemetry:\nenabled: true<\/pre>\n
\u30b7\u30f3\u30b0\u30eb\u30ce\u30fc\u30c9<\/a>\u3067\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u307e\u3059\u3002k0s\u306f\u3001\u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u306f\u30b3\u30f3\u30c8\u30ed\u30fc\u30e9\u30ce\u30fc\u30c9\u3067\u30ef\u30fc\u30af\u30ed\u30fc\u30c9\u3092\u52d5\u4f5c\u3067\u304d\u306a\u3044\u3088\u3046\u306b\u306a\u3063\u3066\u3044\u307e\u3059\u304c\u3001 --single \u30aa\u30d7\u30b7\u30e7\u30f3\u3092\u4ed8\u4e0e\u3057\u3066\u30b7\u30f3\u30b0\u30eb\u30ce\u30fc\u30c9\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3092\u884c\u3046\u3068\u3001\u30b3\u30f3\u30c8\u30ed\u30fc\u30e9\u30ce\u30fc\u30c9\u304c\u30ef\u30fc\u30ab\u30fc\u30ce\u30fc\u30c9\u3092\u517c\u7528\u3057\u30011\u30ce\u30fc\u30c9\u3067Kubernetes\u3092\u8d77\u52d5\u3067\u304d\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n
[vagrant@node1 ~]$ sudo \/usr\/local\/bin\/k0s install controller -c \/etc\/k0s\/k0s.yaml --single --kubelet-extra-args "--node-ip=192.168.56.101"\n[vagrant@node1 ~]$ sudo \/usr\/local\/bin\/k0s start\n[vagrant@node1 ~]$ sudo \/usr\/local\/bin\/k0s status\nVersion: v1.23.1+k0s.0\nProcess ID: 3862\nRole: controller\nWorkloads: true\nSingleNode: true<\/pre>\n
Role\u304c\u300ccontroller\u300d\u3067\u3042\u308a\u3064\u3064\u3001Workloads\u3082\u300ctrue\u300d\u3068\u306a\u3063\u3066\u3044\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059\u3002kubectl get nodes\u3067\u3082\u898b\u3066\u307f\u307e\u3057\u3087\u3046\u3002<\/p>\n
[vagrant@node1 ~]$ mkdir .kube\n[vagrant@node1 ~]$ sudo cp \/var\/lib\/k0s\/pki\/admin.conf .kube\/config\n[vagrant@node1 ~]$ sudo chown $USER:$USER .kube\/config\n[vagrant@node1 ~]$ chmod 600 .kube\/config\n[vagrant@node1 ~]$ export KUBECONFIG=~\/.kube\/config\n[vagrant@node1 ~]$ k0s kubectl get nodes\nNAME STATUS ROLES AGE VERSION\nnode1 Ready control-plane 82s v1.23.1+k0s<\/pre>\n
\u30c7\u30d5\u30a9\u30eb\u30c8\u306ek0s\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u306a\u3089\u300cNo resources found\u300d\u3068\u306a\u3063\u3066\u3057\u307e\u3044\u307e\u3059\u304c\u3001\u30b7\u30f3\u30b0\u30eb\u30ce\u30fc\u30c9\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3067\u3042\u308c\u3070\u30b3\u30f3\u30c8\u30ed\u30fc\u30e9\u30ce\u30fc\u30c9\u3082\u30ef\u30fc\u30af\u30ed\u30fc\u30c9\u3092\u52d5\u4f5c\u53ef\u80fd\u3067\u3042\u308b\u305f\u3081\u3001\u3053\u306e\u3088\u3046\u306a\u7d50\u679c\u3068\u306a\u308a\u307e\u3059\u3002<\/p>\n
\u4ee5\u4e0a\u3067k0s\u306b\u3088\u308bKubernetes\u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u306f\u5b8c\u4e86\u3067\u3059\u3002<\/p>\n
Helm\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb<\/h2>\n
MSR\u30d0\u30fc\u30b8\u30e7\u30f33\u3068\u95a2\u9023\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u306fHelm<\/a>\u3067\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3059\u308b\u3088\u3046\u306b\u306a\u3063\u3066\u3044\u308b\u306e\u3067\u3001\u307e\u305aHelm\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u307e\u3057\u3087\u3046\u3002\u672c\u7a3f\u57f7\u7b46\u6642\u70b9\u3067\u6700\u65b0\u306ev3.7.2\u3092\u4f7f\u7528\u3057\u307e\u3059\u3002<\/p>\n
[vagrant@node1 ~]$ curl -LO https:\/\/get.helm.sh\/helm-v3.7.2-linux-amd64.tar.gz -LO https:\/\/get.helm.sh\/helm-v3.7.2-linux-amd64.tar.gz.sha256sum\n[vagrant@node1 ~]$ sha256sum -c helm-v3.7.2-linux-amd64.tar.gz.sha256sum\nhelm-v3.7.2-linux-amd64.tar.gz: OK\n[vagrant@node1 ~]$ tar xf helm-v3.7.2-linux-amd64.tar.gz\n[vagrant@node1 ~]$ sudo mv linux-amd64\/helm \/usr\/local\/bin\/\n[vagrant@node1 ~]$ helm version\nversion.BuildInfo{Version:"v3.7.2", GitCommit:"663a896f4a815053445eec4153677ddc24a0a361", GitTreeState:"clean", GoVersion:"go1.16.10"}<\/pre>\n
\u4ee5\u4e0a\u3067Helm\u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u306f\u5b8c\u4e86\u3067\u3059\u3002<\/p>\n
\u30dc\u30ea\u30e5\u30fc\u30e0\u306e\u6e96\u5099<\/h2>\n
MSR\u30d0\u30fc\u30b8\u30e7\u30f33\u3067\u306f\u6c38\u7d9a\u30c7\u30fc\u30bf\u306e\u683c\u7d0d\u7528\u306b\u30013\u3064\u306e\u30dc\u30ea\u30e5\u30fc\u30e0<\/a>\u3092\u4f7f\u7528\u3057\u307e\u3059\u3002Prerequisites<\/a>\u3067\u306fPersistent Volume (PV)\u306e\u52d5\u7684\u30d7\u30ed\u30d3\u30b8\u30e7\u30cb\u30f3\u30b0\u3092\u8981\u6c42\u3057\u3066\u3044\u307e\u3059\u304c\u3001\u672c\u7a3f\u306f1\u30ce\u30fc\u30c9\u3067\u3042\u308a\u5185\u5bb9\u3092\u5358\u7d14\u5316\u3059\u308b\u305f\u3081\u306b\u3001hostPath<\/a>\u306e\u9759\u7684PV\u3092\u6e96\u5099\u30fb\u5229\u7528\u3059\u308b\u3053\u3068\u3068\u3057\u307e\u3059\u3002<\/p>\n
\u307e\u305a\u3001\u8106\u5f31\u6027\u30b9\u30ad\u30e3\u30f3\u30c7\u30fc\u30bf\u7528\u30dc\u30ea\u30e5\u30fc\u30e0\u306e\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u3092\u4f5c\u6210\u3057\u3001\u6240\u6709\u8005\u30fb\u6240\u5c5e\u30b0\u30eb\u30fc\u30d7\u3092 101:103 \u3067\u8a2d\u5b9a\u3057\u3066\u304a\u304d\u307e\u3059\u3002\u30dc\u30ea\u30e5\u30fc\u30e0\u7528\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u306f\u5272\u308a\u5f53\u3066\u306e\u969b\u306b\u81ea\u52d5\u7684\u306b\u4f5c\u6210\u3055\u308c\u308b\u306e\u3067\u3059\u304c\u3001\u6240\u6709\u8005\u30fb\u6240\u5c5e\u30b0\u30eb\u30fc\u30d7\u304c root:root \u3068\u306a\u308a\u66f8\u304d\u8fbc\u307f\u3067\u304d\u305a\u30a8\u30e9\u30fc\u3068\u306a\u308b\u305f\u3081\u3001\u3042\u3089\u304b\u3058\u3081\u4f5c\u6210\u30fb\u8a2d\u5b9a\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u4ed6\u3001\u30a4\u30e1\u30fc\u30b8\u30c7\u30fc\u30bf\u7528\u30fb\u30ec\u30dd\u30b8\u30c8\u30ea\u30e1\u30bf\u30c7\u30fc\u30bf\u7528\u306e2\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u306f\u81ea\u52d5\u4f5c\u6210\u30fb\u8a2d\u5b9a\u3055\u308c\u308b root:root \u3067\u554f\u984c\u306a\u3044\u305f\u3081\u3001\u3053\u3053\u3067\u306f\u4f5c\u6210\u3057\u307e\u305b\u3093\u3002<\/p>\n
[vagrant@node1 ~]$ sudo mkdir -p \/vols\/msr-scanningstore\n[vagrant@node1 ~]$ sudo chown 101:103 \/vols\/msr-scanningstore\n[vagrant@node1 ~]$ ls -ld \/vols\/msr-scanningstore\ndrwxr-xr-x. 2 101 103 6 Jan 4 15:58 \/vols\/msr-scanningstore<\/pre>\n
\u6b21\u306eYAML\u30de\u30cb\u30d5\u30a7\u30b9\u30c8\u3067PV\u3092\u4f5c\u6210\u3057\u307e\u3059\u3002<\/p>\n
apiVersion: v1\nkind: PersistentVolume\nmetadata:\nname: msr-hostpath\nspec:\naccessModes:\n- ReadWriteMany\ncapacity:\nstorage: 20Gi\nhostPath:\npath: \/vols\/msr<\/pre>\n
apiVersion: v1\nkind: PersistentVolume\nmetadata:\nname: rethinkdb-cluster-hostpath\nspec:\naccessModes:\n- ReadWriteOnce\ncapacity:\nstorage: 1Gi\nhostPath:\npath: \/vols\/msr-rethinkdb-cluster<\/pre>\n
apiVersion: v1\nkind: PersistentVolume\nmetadata:\nname: scanningstore-hostpath\nspec:\naccessModes:\n- ReadWriteOnce\ncapacity:\nstorage: 24Gi\nhostPath:\npath: \/vols\/msr-scanningstore<\/pre>\n
\u5404PV\u306espec.accessModes\u3001access.capacity.storage\u306f\u3001MSR\u306eHelm Chart\u5185\u3067\u6307\u5b9a\u3055\u308c\u3066\u3044\u308b\u5024\u3092\u7528\u3044\u3066\u3044\u307e\u3059\u3002Recommended system requirements<\/a>\u306bImage data storage\u306f25\u301c100GB\u63a8\u5968\u3068\u3042\u308b\u306e\u3067 msr-hostpath\u306f20Gi\u3067\u306f\u8db3\u308a\u306a\u3044\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002\u5fc5\u8981\u3067\u3042\u308c\u3070\u9069\u5b9c\u5909\u66f4\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n
\u3067\u306f\u3001PV\u3092\u4f5c\u6210\u3057\u307e\u3059\u3002<\/p>\n
[vagrant@node1 ~]$ k0s kubectl apply -f static-pv.yaml\npersistentvolume\/msr-hostpath created\npersistentvolume\/rethinkdb-cluster-hostpath created\npersistentvolume\/scanningstore-hostpath created\n[vagrant@node1 ~]$ k0s kubectl get pv\nNAME CAPACITY ACCESS MODES RECLAIM POLICY STATUS CLAIM STORAGECLASS REASON AGE\nmsr-hostpath 20Gi RWX Retain Available 21s\nrethinkdb-cluster-hostpath 1Gi RWO Retain Available 21s\nscanningstore-hostpath 24Gi RWO Retain Available 21s<\/pre>\n
\u4f5c\u6210\u3067\u304d\u307e\u3057\u305f\u3002<\/p>\n
\u95a2\u9023\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb<\/h2>\n
Prerequisites<\/a>\u3067\u306f\u3001\u95a2\u9023\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u3068\u3057\u3066cert-manager<\/a>\u3068Postgres Operator<\/a>\u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u304c\u6c42\u3081\u3089\u308c\u3066\u3044\u308b\u306e\u3067\u3001\u624b\u9806\u306b\u5f93\u3063\u3066\u5b9f\u65bd\u3057\u307e\u3059\u3002<\/p>\n
cert-manager<\/h3>\n
[vagrant@node1 ~]$ k0s kubectl apply -f https:\/\/github.com\/jetstack\/cert-manager\/releases\/download\/v1.3.1\/cert-manager.yaml\ncustomresourcedefinition.apiextensions.k8s.io\/certificaterequests.cert-manager.io created\ncustomresourcedefinition.apiextensions.k8s.io\/certificates.cert-manager.io created\ncustomresourcedefinition.apiextensions.k8s.io\/challenges.acme.cert-manager.io created\ncustomresourcedefinition.apiextensions.k8s.io\/clusterissuers.cert-manager.io created\ncustomresourcedefinition.apiextensions.k8s.io\/issuers.cert-manager.io created\ncustomresourcedefinition.apiextensions.k8s.io\/orders.acme.cert-manager.io created\nnamespace\/cert-manager created\nserviceaccount\/cert-manager-cainjector created\nserviceaccount\/cert-manager created\nserviceaccount\/cert-manager-webhook created\nclusterrole.rbac.authorization.k8s.io\/cert-manager-cainjector created\nclusterrole.rbac.authorization.k8s.io\/cert-manager-controller-issuers created\nclusterrole.rbac.authorization.k8s.io\/cert-manager-controller-clusterissuers created\nclusterrole.rbac.authorization.k8s.io\/cert-manager-controller-certificates created\nclusterrole.rbac.authorization.k8s.io\/cert-manager-controller-orders created\nclusterrole.rbac.authorization.k8s.io\/cert-manager-controller-challenges created\nclusterrole.rbac.authorization.k8s.io\/cert-manager-controller-ingress-shim created\nclusterrole.rbac.authorization.k8s.io\/cert-manager-view created\nclusterrole.rbac.authorization.k8s.io\/cert-manager-edit created\nclusterrole.rbac.authorization.k8s.io\/cert-manager-controller-approve:cert-manager-io created\nclusterrole.rbac.authorization.k8s.io\/cert-manager-webhook:subjectaccessreviews created\nclusterrolebinding.rbac.authorization.k8s.io\/cert-manager-cainjector created\nclusterrolebinding.rbac.authorization.k8s.io\/cert-manager-controller-issuers created\nclusterrolebinding.rbac.authorization.k8s.io\/cert-manager-controller-clusterissuers created\nclusterrolebinding.rbac.authorization.k8s.io\/cert-manager-controller-certificates created\nclusterrolebinding.rbac.authorization.k8s.io\/cert-manager-controller-orders created\nclusterrolebinding.rbac.authorization.k8s.io\/cert-manager-controller-challenges created\nclusterrolebinding.rbac.authorization.k8s.io\/cert-manager-controller-ingress-shim created\nclusterrolebinding.rbac.authorization.k8s.io\/cert-manager-controller-approve:cert-manager-io created\nclusterrolebinding.rbac.authorization.k8s.io\/cert-manager-webhook:subjectaccessreviews created\nrole.rbac.authorization.k8s.io\/cert-manager-cainjector:leaderelection created\nrole.rbac.authorization.k8s.io\/cert-manager:leaderelection created\nrole.rbac.authorization.k8s.io\/cert-manager-webhook:dynamic-serving created\nrolebinding.rbac.authorization.k8s.io\/cert-manager-cainjector:leaderelection created\nrolebinding.rbac.authorization.k8s.io\/cert-manager:leaderelection created\nrolebinding.rbac.authorization.k8s.io\/cert-manager-webhook:dynamic-serving created\nservice\/cert-manager created\nservice\/cert-manager-webhook created\ndeployment.apps\/cert-manager-cainjector created\ndeployment.apps\/cert-manager created\ndeployment.apps\/cert-manager-webhook created\nmutatingwebhookconfiguration.admissionregistration.k8s.io\/cert-manager-webhook created\nvalidatingwebhookconfiguration.admissionregistration.k8s.io\/cert-manager-webhook created\n[vagrant@node1 ~]$ k0s kubectl apply -f https:\/\/github.com\/jetstack\/cert-manager\/releases\/download\/v1.3.1\/cert-manager.crds.yaml\ncustomresourcedefinition.apiextensions.k8s.io\/certificaterequests.cert-manager.io configured\ncustomresourcedefinition.apiextensions.k8s.io\/certificates.cert-manager.io configured\ncustomresourcedefinition.apiextensions.k8s.io\/challenges.acme.cert-manager.io configured\ncustomresourcedefinition.apiextensions.k8s.io\/clusterissuers.cert-manager.io configured\ncustomresourcedefinition.apiextensions.k8s.io\/issuers.cert-manager.io configured\ncustomresourcedefinition.apiextensions.k8s.io\/orders.acme.cert-manager.io configured<\/pre>\n
cert-manager\u30cd\u30fc\u30e0\u30b9\u30da\u30fc\u30b9\u3092\u78ba\u8a8d\u3057\u3001\u5404\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u304c\u554f\u984c\u306a\u3044\u3053\u3068\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/p>\n
[vagrant@node1 ~]$ k0s kubectl -n cert-manager get all\nNAME READY STATUS RESTARTS AGE\npod\/cert-manager-748f4d667d-7s7xk 1\/1 Running 0 79s\npod\/cert-manager-cainjector-6cd5988f45-n7f5d 1\/1 Running 0 79s\npod\/cert-manager-webhook-7498ddfd98-l78p2 1\/1 Running 0 79s\n\nNAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE\nservice\/cert-manager ClusterIP 10.107.197.71 9402\/TCP 79s\nservice\/cert-manager-webhook ClusterIP 10.105.218.129 443\/TCP 79s\n\nNAME READY UP-TO-DATE AVAILABLE AGE\ndeployment.apps\/cert-manager 1\/1 1 1 79s\ndeployment.apps\/cert-manager-cainjector 1\/1 1 1 79s\ndeployment.apps\/cert-manager-webhook 1\/1 1 1 79s\n\nNAME DESIRED CURRENT READY AGE\nreplicaset.apps\/cert-manager-748f4d667d 1 1 1 79s\nreplicaset.apps\/cert-manager-cainjector-6cd5988f45 1 1 1 79s\nreplicaset.apps\/cert-manager-webhook-7498ddfd98 1 1 1 79s<\/pre>\n
Postgres Operator<\/h3>\n
[vagrant@node1 ~]$ helm repo add postgres-operator https:\/\/opensource.zalando.com\/postgres-operator\/charts\/postgres-operator\/\n"postgres-operator" has been added to your repositories\n[vagrant@node1 ~]$ helm repo up\nHang tight while we grab the latest from your chart repositories...\n...Successfully got an update from the "postgres-operator" chart repository\nUpdate Complete. Happy Helming!\n[vagrant@node1 ~]$ helm install postgres-operator postgres-operator\/postgres-operator \\\n--set configKubernetes.spilo_runasuser=101 \\\n--set configKubernetes.spilo_runasgroup=103 \\\n--set configKubernetes.spilo_fsgroup=103\nmanifest_sorter.go:192: info: skipping unknown hook: "crd-install"\nmanifest_sorter.go:192: info: skipping unknown hook: "crd-install"\nmanifest_sorter.go:192: info: skipping unknown hook: "crd-install"\nNAME: postgres-operator\nLAST DEPLOYED: Tue Jan 4 16:07:15 2022\nNAMESPACE: default\nSTATUS: deployed\nREVISION: 1\nTEST SUITE: None\nNOTES:\nTo verify that postgres-operator has started, run:\n\nkubectl --namespace=default get pods -l "app.kubernetes.io\/name=postgres-operator"<\/pre>\n
\u6700\u5f8c\u306b\u8868\u793a\u3055\u308c\u305f\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3057\u3066\u3001\u554f\u984c\u304c\u306a\u3044\u3053\u3068\u3092\u78ba\u8a8d\u3057\u307e\u3059\u3002<\/p>\n
[vagrant@node1 ~]$ k0s kubectl --namespace=default get pods -l "app.kubernetes.io\/name=postgres-operator"\nNAME READY STATUS RESTARTS AGE\npostgres-operator-867bf8f978-tw4f9 1\/1 Running 0 35s<\/pre>\n
MSR\u30d0\u30fc\u30b8\u30e7\u30f33\u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb<\/h2>\n
\u3067\u306f\u3001MSR\u30d0\u30fc\u30b8\u30e7\u30f33\u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3092\u884c\u3044\u307e\u3057\u3087\u3046\u3002<\/p>\n
\u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u306fMSR\u306eWebUI\u304cClusterIP\u30b5\u30fc\u30d3\u30b9\u3067\u5185\u90e8\u516c\u958b\u3055\u308c\u308b\u3088\u3046\u306b\u306a\u3063\u3066\u3044\u308b\u306e\u3067\u3001NodePort\u30b5\u30fc\u30d3\u30b9\u3067\u5916\u90e8\u516c\u958b\u3059\u308b\u3088\u3046\u306b\u5909\u66f4\u3057\u307e\u3059\u3002
\n\u307e\u305f\u3001\u3053\u3053\u3067\u306f\u30e9\u30a4\u30bb\u30f3\u30b9\u30d5\u30a1\u30a4\u30eb\u300clicense.lic\u300d\u3092\u4e0e\u3048\u3066\u3044\u307e\u3059\u304c\u3001\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u5f8c\u306b\u30e9\u30a4\u30bb\u30f3\u30b9\u30d5\u30a1\u30a4\u30eb\u3092\u9069\u7528\u3059\u308b<\/a>\u3053\u3068\u3082\u3067\u304d\u307e\u3059\u3002\u306a\u304a\u3001\u4ee5\u524d\u306eMSR\u3068\u7570\u306a\u308a\u3001\u30e9\u30a4\u30bb\u30f3\u30b9\u30d5\u30a1\u30a4\u30eb\u3092WebUI\u304b\u3089\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u3059\u308b\u306e\u3067\u306f\u306a\u304f\u3001Helm\u30b3\u30de\u30f3\u30c9\u3067\u9069\u7528\u3059\u308b\u3088\u3046\u306b\u306a\u3063\u3066\u3044\u307e\u3059\u3002<\/p>\n
[vagrant@node1 ~]$ helm install msr msr \\\n--repo https:\/\/registry.mirantis.com\/charts\/msr\/msr \\\n--version 1.0.0 \\\n--set-file license=license.lic \\\n--set service.type=NodePort\nNAME: msr\nLAST DEPLOYED: Tue Jan 4 16:24:04 2022\nNAMESPACE: default\nSTATUS: deployed\nREVISION: 1\nTEST SUITE: None\nNOTES:\nRelease Notes: http:\/\/docs.mirantis.com\/msr-3.0-01\n\n1. Get the application URL by running these commands:\nexport NODE_PORT=$(kubectl get --namespace default -o jsonpath='{.spec.ports[?(@.name=="https")].nodePort}' services msr)\nexport NODE_IP=$(kubectl get nodes --namespace default -o jsonpath="{.items[0].status.addresses[0].address}")\necho https:\/\/$NODE_IP:$NODE_PORT\n\n2. Run MSR CLI commands as follows:\nkubectl -n default exec -it deploy\/msr-api -- msr <command>\n\n3. Modifying rethinkdb.cluster.replicaCount requires additional steps to scale\nthe MSR and eNZi databases (table replicas):\n\nAFTER increasing replicaCount, run the command:\nkubectl -n default exec -it deploy\/msr-api -- msr db scale\n\nBEFORE decreasing replicaCount:\n- Decommission RethinkDB servers from highest to lowest:\n- Get a list of servers to decommission:\nkubectl -n default exec -it deploy\/msr-api -- msr rethinkdb list\n- Decommission servers with:\nkubectl -n default exec -it deploy\/msr-api -- msr rethinkdb decommission\n- Scale the database:\nkubectl -n default exec -it deploy\/msr-api -- msr db scale<\/pre>\n
\u3082\u3057\u300ctimed out waiting for the condition\u300d\u30a8\u30e9\u30fc\u3068\u306a\u3063\u3066\u3057\u307e\u3063\u305f\u3089\u3001\u3057\u3070\u3089\u304f\u5f85\u3063\u3066\u304b\u3089\u300chelm status msr\u300d\u3092\u5b9f\u884c\u3057\u3066\u304f\u3060\u3055\u3044\u3002\u540c\u3058\u3088\u3046\u306a\u4f7f\u7528\u65b9\u6cd5\u306e\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u304c\u8868\u793a\u3055\u308c\u308b\u306f\u305a\u3067\u3059\u3002\u3055\u308c\u306a\u3044\u5834\u5408\u306f\u305d\u306e\u4ed6\u306e\u554f\u984c\u304c\u767a\u751f\u3057\u3066\u3044\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u306e\u3067\u3001Pod\u306e\u30ed\u30b0\u306a\u3069\u3092\u78ba\u8a8d\u3057\u3066\u307f\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n
\u3088\u304f\u3042\u308b\u30d1\u30bf\u30fc\u30f3\u3068\u3057\u3066\u306f\u5fc5\u8981\u306aPV\u304c\u3046\u307e\u304f\u6e96\u5099\u3067\u304d\u3066\u3044\u306a\u3044\u5834\u5408\u306a\u3069\u3067\u3059\u3002\u4f8b\u3048\u3070\u8106\u5f31\u6027\u30b9\u30ad\u30e3\u30f3\u30c7\u30fc\u30bf\u7528\u30dc\u30ea\u30e5\u30fc\u30e0\u306e\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u306e\u6240\u6709\u8005\u30fb\u6240\u5c5e\u30b0\u30eb\u30fc\u30d7\u304c root:root \u3068\u306a\u3063\u3066\u3044\u3066\u66f8\u304d\u8fbc\u307f\u304c\u3067\u304d\u306a\u3044\u3068\u3001msr-scanningstore-0 Pod\u306e\u30ed\u30b0\u304c\u6b21\u306e\u3088\u3046\u306b\u306a\u3063\u3066\u3044\u307e\u3059\u3002<\/p>\n
[vagrant@node1 ~]$ k0s kubectl logs msr-scanningstore-0\nmkdir: cannot create directory \u2018\/home\/postgres\/pgdata\/pgroot\u2019: Permission denied\nmkdir: cannot create directory \u2018\/home\/postgres\/pgdata\/pgroot\u2019: Permission denied\ntouch: cannot touch '\/home\/postgres\/pgdata\/pgroot\/pg_log\/postgresql-0.csv': No such file or directory\n(\u7565)<\/pre>\n
MSR\u306eWebUI\u3078\u306e\u30a2\u30af\u30bb\u30b9<\/h2>\n
MSR\u306eWebUI\u306b\u30a2\u30af\u30bb\u30b9\u3059\u308b\u305f\u3081\u306eURL\u306f\u3001\u30c7\u30d7\u30ed\u30a4\u6210\u529f\u6642\u306b\u8868\u793a\u3055\u308c\u305f\u30b3\u30de\u30f3\u30c9\u3067\u5f97\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002\u305f\u3060\u3057\u3001\u672c\u7a3f\u3067\u306f\u7d20\u306ekubectl\u3067\u306f\u306a\u304fk0s\u540c\u68b1\u306e\u3082\u306e\u3092\u4f7f\u3063\u3066\u3044\u308b\u305f\u3081\u3001kubectl\u306e\u524d\u306bk0s\u3092\u4ed8\u4e0e\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n
[vagrant@node1 ~]$ export NODE_PORT=$(k0s kubectl get --namespace default -o jsonpath='{.spec.ports[?(@.name=="https")].nodePort}' services msr)\n[vagrant@node1 ~]$ export NODE_IP=$(k0s kubectl get nodes --namespace default -o jsonpath="{.items[0].status.addresses[0].address}")\n[vagrant@node1 ~]$ echo https:\/\/$NODE_IP:$NODE_PORT\nhttps:\/\/192.168.56.101:30211<\/pre>\n
\u3053\u3061\u3089\u306b\u30a6\u30a7\u30d6\u30d6\u30e9\u30a6\u30b6\u3067\u30a2\u30af\u30bb\u30b9\u3057\u3066\u307f\u307e\u3057\u3087\u3046\u3002<\/p>\n
\"\"<\/p>\n
\u7ba1\u7406\u8005\u306eID\u306f\u300cadmin\u300d\u3001\u30d1\u30b9\u30ef\u30fc\u30c9\u306f\u300cpassword\u300d\u3068\u306a\u3063\u3066\u3044\u307e\u3059\u3002\u3053\u308c\u3089\u306fMSR\u306eHelm Chart\u5185\u3067\u6307\u5b9a\u3055\u308c\u3066\u3044\u308b\u306e\u3067\u3001\u8208\u5473\u306e\u3042\u308b\u65b9\u306fHelm Chart\u3092\u53d6\u5f97\u3057\u3066\u8abf\u3079\u3066\u307f\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n
\u8106\u5f31\u6027\u30b9\u30ad\u30e3\u30f3\u306e\u6709\u52b9\u5316<\/h2>\n
\u7ba1\u7406\u8005\u3068\u3057\u3066\u30ed\u30b0\u30a4\u30f3\u3067\u304d\u305f\u3089\u3001\u307e\u305a\u306f\u8106\u5f31\u6027\u30b9\u30ad\u30e3\u30f3<\/a>\u3092\u6709\u52b9\u306b\u3057\u3066\u307f\u307e\u3057\u3087\u3046\u3002\u5de6\u306e\u30b5\u30a4\u30c9\u30d0\u30fc\u304b\u3089 System \u3092\u958b\u304d\u3001\u4e0a\u306e Security \u30bf\u30d6\u3092\u958b\u304d\u307e\u3059\u3002Enable Scanning \u3092\u30c8\u30b0\u30eb\u3057\u3001Sync Database now \u30dc\u30bf\u30f3\u3092\u30af\u30ea\u30c3\u30af\u3057\u307e\u3059\u3002\u8106\u5f31\u6027\u30b9\u30ad\u30e3\u30f3\u7528\u306e\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u521d\u671f\u5316\u304c\u59cb\u307e\u308a\u307e\u3059\u3002\u30e1\u30e2\u30ea12GB\u30fb4vCPU\u3067\u3059\u304c\u300130\u5206\u4ee5\u4e0a\u304b\u304b\u308a\u307e\u3057\u305f\u306e\u3067\u6c17\u9577\u306b\u5f85\u3061\u307e\u3057\u3087\u3046\u3002<\/p>\n
\"\"<\/p>\n
\u30e6\u30fc\u30b6\u3001\u30aa\u30fc\u30ac\u30cb\u30bc\u30fc\u30b7\u30e7\u30f3\u3001\u30c1\u30fc\u30e0\u306e\u4f5c\u6210<\/h2>\n
MSR\u306b\u306f\u30e6\u30fc\u30b6\u3001\u30aa\u30fc\u30ac\u30cb\u30bc\u30fc\u30b7\u30e7\u30f3\u3001\u30c1\u30fc\u30e0<\/a>\u3068\u3044\u3046\u6982\u5ff5\u304c\u3042\u308a\u3001\u7d30\u304b\u306a\u6a29\u9650\u8a2d\u5b9a\u3084\u30e6\u30fc\u30b6\u306e\u30b0\u30eb\u30fc\u30d4\u30f3\u30b0\u3092\u884c\u3048\u308b\u3088\u3046\u306b\u306a\u3063\u3066\u3044\u307e\u3059\u3002
\n\u3053\u3053\u3067\u306f\u3059\u3079\u3066\u3092\u307e\u3068\u3081\u308b\u30aa\u30fc\u30ac\u30cb\u30bc\u30fc\u30b7\u30e7\u30f3\u3068\u3057\u3066\u300ccreationline\u300d\u304c\u3042\u308a\u3001\u300cdev\u300d\u3068\u300cops\u300d\u306e2\u30c1\u30fc\u30e0\u304c\u6240\u5c5e\u3057\u3066\u304a\u308a\u3001\u300cdev\u300d\u30c1\u30fc\u30e0\u306b\u306f\u300calice\u300d\u30e6\u30fc\u30b6\u304c\u3001\u300cops\u300d\u30c1\u30fc\u30e0\u306b\u306f\u300cbob\u300d\u30e6\u30fc\u30b6\u304c\u6240\u5c5e\u3057\u3066\u3044\u308b\u3068\u3057\u307e\u3059\u3002
\n\u3055\u3089\u306b\u300ccreationline\u300d\u30aa\u30fc\u30ac\u30cb\u30bc\u30fc\u30b7\u30e7\u30f3\u306f\u30d7\u30e9\u30a4\u30d9\u30fc\u30c8\u306a\u30b3\u30f3\u30c6\u30ca\u30a4\u30e1\u30fc\u30b8\u30ec\u30dd\u30b8\u30c8\u30ea\u3068\u3057\u3066\u300clogstash\u300d\u3092\u6301\u3063\u3066\u304a\u308a\u3001\u3053\u306e\u30ec\u30dd\u30b8\u30c8\u30ea\u306b\u5bfe\u3057\u3066\u300cdev\u300d\u30c1\u30fc\u30e0\u306f\u8aad\u307f\u66f8\u304d\u6a29\u9650\u3092\u6301\u3061\u3001\u300cops\u300d\u30c1\u30fc\u30e0\u306f\u8aad\u307f\u8fbc\u307f\u5c02\u7528\u6a29\u9650\u3092\u6301\u3063\u3066\u3044\u308b\u3068\u3057\u307e\u3059\u3002
\n\u7b87\u6761\u66f8\u304d\u3067\u307e\u3068\u3081\u308b\u3068\u6b21\u306e\u3088\u3046\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n