OpenShift应用镜像构建(1) S2I tomcat 镜像定制

参考并感谢https://www.jianshu.com/p/fd3e62263046

在对接项目制作应用镜像的过程中，经常发现避免不了的是需要写Dockerfile,（当然另外一种方式是直接run一个基础镜像，改完commit,这个就完全不建议了),这需要对Dockerfile以及镜像有一定的了解，但在项目中发现学习Dockerfile还是有学习成本的，虽然Dockerfile已经足够简单，但仍然还是有不少图形化的需求。Dockerfile的图像化一方面不好设计，另外看市面上也没有类似产品，而这个做应用镜像的工作在项目对接过程中耗费不少的时间。总结下来的问题是:

制作应用镜像的问题

• Dockerfile有学习成本
• 熟悉部署的成本，并不是每个人都熟悉应用的部署。

S2I模式的价值

• 避免了从无到有写一个Dockerfile,项目成员只需要关注代码上（如何构建的过程，都可以通过S2I的镜像完成，自动生成一个应用镜像)
• 如果应用配置不愿意和代码放在一起，支持将配置放在独立目录下
• S2I完整的覆盖了容器CICD的全过程(Assembe如何装配镜像，Run是如何运行镜像)
• 需要针对某个特定的项目做好S2I镜像。

s2i镜像定制流程图如下

看上去很复杂，其实只要import-images后，当前项目的所有服务都可以重用这套imagestream了。

1.下载source-to-image 最新版解压配置到path

https://github.com/openshift/source-to-image/releases

2.创建 S2I Builder镜像

s2i create s2i-tomcat s2i-tomcat

3.修改文件，编辑Dockerfile，加入maven需要的setting以及修改assemble脚本

ericdeMacBook-Pro:s2i-tomcat ericnie$ cat Dockerfile
FROM openshift/base-centos7

EXPOSE 

ENV TOMCAT_VERSION=8.5. \
    MAVEN_VERSION=3.5. \
    STI_SCRIPTS_PATH=/usr/libexec/s2i/

LABEL io.k8s.description="Platform for building and running JEE applications on Tomcat" \
      io.k8s.display-name="Tomcat Builder" \
      io.openshift.expose-services="8080:http" \
      io.openshift.tags="builder,tomcat" \
      io.openshift.s2i.destination="/opt/s2i/destination"

COPY apache-maven-3.5.-bin.tar /
COPY apache-tomcat-8.5..tar /

# Install Maven, Tomcat 8.5.
RUN INSTALL_PKGS="tar java-1.8.0-openjdk java-1.8.0-openjdk-devel" && \
    yum install -y --enablerepo=centosplus $INSTALL_PKGS && \
    rpm -V $INSTALL_PKGS && \
    yum clean all -y && \
    tar -xvf /apache-maven-3.5.-bin.tar    -C /usr/local && \
    ln -sf /usr/local/apache-maven-$MAVEN_VERSION/bin/mvn /usr/local/bin/mvn && \
    mkdir -p $HOME/.m2 && \
    mkdir -p /tomcat && \
    tar -xvf /apache-tomcat-8.5..tar --strip-components= -C /tomcat && \
    rm -rf /tomcat/webapps/* && \
    mkdir -p /opt/s2i/destination && \
    mkdir /tmp/src && \
    mkdir -p /opt/maven/repository/ && \
    chmod 777 /opt/maven/repository

# Add s2i customizations
ADD ./settings.xml $HOME/.m2/

# Copy the S2I scripts from the specific language image to $STI_SCRIPTS_PATH
#COPY ./s2i/bin/ $STI_SCRIPTS_PATH
COPY ./s2i/bin/ /usr/libexec/s2i

RUN chmod -R a+rw /tomcat && \
    chmod a+rwx /tomcat/* && \
    chmod +x /tomcat/bin/*.sh && \
    chmod -R a+rw $HOME && \
    chmod -R +x $STI_SCRIPTS_PATH && \
    chmod -R g+rw /opt/s2i/destination

USER 1001

CMD $STI_SCRIPTS_PATH/usage

需要说明的是这不是一个一般的Dockerfile镜像构建文件，而是S2I的构建镜像，除了包含运行所需要的jdk,tomcat外，还包含如下内容

• 一系列说明镜像的openshift元数据的label
• maven构建包，用户编译打包源代码，形成war,jar等编译后工件
• s2i的工具，包括用于编译的命令assemble和运行的命令run

所以这是一个针对特定环境的流水线构建的镜像。

需要注意的是maven配置的settings.xml, 主要指定了repository存放的路径，以及jdk的版本

ericdeMacBook-Pro:s2i-tomcat ericnie$ cat settings.xml
<?xml version="1.0" encoding="UTF-8"?>
<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 http://maven.apache.org/xsd/settings-1.0.0.xsd">

  <localRepository>/opt/maven/repository</localRepository>
  <interactiveMode>true</interactiveMode>
  <offline>false</offline>
  <pluginGroups>

  </pluginGroups>

  <servers>
    <server>
      <id>deploymentRepo</id>
      <username>repouser</username>
      <password>repopwd</password>
    </server>
  </servers>

  <mirrors>
    <mirror>
      <id>mirrorId</id>
      <mirrorOf>repositoryId</mirrorOf>
      <name>Human Readable Name for this Mirror.</name>
      <url>http://my.repository.com/repo/path</url>
    </mirror>
  </mirrors>

  <profiles>
    <profile>
      <id>jdk-1.8</id>
      <activation>
        <activeByDefault>true</activeByDefault>
        <jdk>1.8</jdk>
      </activation>
      <properties>
          <maven.compiler.source>1.8</maven.compiler.source>
          <maven.compiler.target>1.8</maven.compiler.target>
          <maven.compiler.compilerVersion>1.8</maven.compiler.compilerVersion>
     </properties>
    </profile>
  </profiles>
  <activeProfiles>
    <activeProfile>jdk-1.8</activeProfile>
  </activeProfiles>
</settings>

assemble主要负责把源代码拷贝入镜像，然后编译打包的过程，这里可以参考

https://github.com/openshift/source-to-image/blob/master/docs/builder_image.md

这里明确说明了这句

s2i untars that file and places its contents into the destination specified with either the --destination flag or the value of the io.openshift.s2i.destination label set in the builder image (the default destination is /tmp). 

也就是如果没有设定io.openshift.s2i.destination的label，系统默认会把代码放到/tmp下，但如果设定了，就会放到label指定的路径，这个问题搞得我build了好多遍的镜像。而Dockerfile中明确设定的label是

io.openshift.s2i.destination="/opt/s2i/destination

最后的assemble

ericdeMacBook-Pro:bin ericnie$ cat assemble
#!/bin/bash -e
#
# S2I assemble script for the 's2i-tomcat' image.
# The 'assemble' script builds your application source so that it is ready to run.
#
# For more information refer to the documentation:
#    https://github.com/openshift/source-to-image/blob/master/docs/builder_image.md
#

# If the 's2i-tomcat' assemble script is executed with the '-h' flag, print the usage.
if [[ "$1" == "-h" ]]; then
    exec /usr/libexec/s2i/usage
fi

# Restore artifacts from the previous build (if they exist).
#
if [ "$(ls /tmp/artifacts/ 2>/dev/null)" ]; then
  echo "---> Restoring build artifacts..."
  mv /tmp/artifacts/. ./
fi

echo "---> Installing application source..."
#cp -Rf /tmp/src/. ./
a=`ls /tmp/`
echo $a
echo "**********"
b=`ls /opt/s2i/destination/`
echo $b
echo "------***"
c=`ls /opt/s2i/destination/src`
echo $c

cp -R /opt/s2i/destination/src/.  ./

echo "---> Building application from source..."
# TODO: Add build steps for your application, eg npm install, bundle install, pip install, etc.

mvn -Dmaven.test.skip=true clean package
mv ./target/*.war /tomcat/webapps/

run命令

ericdeMacBook-Pro:bin ericnie$ cat run
#!/bin/bash -e
#
# S2I run script for the 's2i-tomcat' image.
# The run script executes the server that runs your application.
#
# For more information see the documentation:
#    https://github.com/openshift/source-to-image/blob/master/docs/builder_image.md
#

#exec asdf -p
echo "==========now running==========="
bash -c "/tomcat/bin/catalina.sh run"

4.把文件传入github代码库

现在本地运行git init,git add .和git commit 命令

ericdeMacBook-Pro:minishift ericnie$ cd s2i-tomcat
ericdeMacBook-Pro:s2i-tomcat ericnie$ ls
Dockerfile          Dockerfile.original Makefile            README.md           s2i                 test
ericdeMacBook-Pro:s2i-tomcat ericnie$ git init
Initialized empty Git repository in /Users/ericnie/minishift/s2i-tomcat/.git/
ericdeMacBook-Pro:s2i-tomcat ericnie$ git add .
ericdeMacBook-Pro:s2i-tomcat ericnie$ git commit -m "first commit"
[master (root-commit) 21abd16] first commit
 Committer: eric nie <ericnie@ericdeMacBook-Pro.local>
Your name and email address were configured automatically based
on your username and hostname. Please check that they are accurate.
You can suppress this message by setting them explicitly. Run the
following command and follow the instructions in your editor to edit
your configuration file:

    git config --global --edit

After doing this, you may fix the identity used for this commit with:

    git commit --amend --reset-author

  files changed,  insertions(+)
 create mode  Dockerfile
 create mode  Dockerfile.original
 create mode  Makefile
 create mode  README.md
 create mode  s2i/bin/assemble
 create mode  s2i/bin/run
 create mode  s2i/bin/save-artifacts
 create mode  s2i/bin/usage
 create mode  test/run
 create mode  test/test-app/index.html

在远程生成repository.

然后运行git remote add origin和push命令

ericdeMacBook-Pro:s2i-tomcat ericnie$ git remote add origin https://github.com/ericnie2015/s2i-tomcat.git
ericdeMacBook-Pro:s2i-tomcat ericnie$ git push -u origin master
Enumerating objects: , done.
Counting objects: % (/), done.
Delta compression using up to  threads.
Compressing objects: % (/), done.
Writing objects: % (/), 6.30 KiB | 3.15 MiB/s, done.
Total  (delta ), reused  (delta )
remote:
remote: Create a pull request for 'master' on GitHub by visiting:
remote:      https://github.com/ericnie2015/s2i-tomcat/pull/new/master
remote:
To https://github.com/ericnie2015/s2i-tomcat.git
 * [new branch]      master -> master
Branch 'master' set up to track remote branch 'master' from 'origin'.
ericdeMacBook-Pro:s2i-tomcat ericnie$ git push origin master
Everything up-to-date
ericdeMacBook-Pro:s2i-tomcat ericnie$

最后看到本地的文件推送到远端

5.在cloud.docker.com中关联这个项目，然后build镜像

6.把镜像加入openshift image stream

先在openshift中切换成system:admin用户(注意,system用户和system:admin不一样，system仍然没有访问openshift 命名空间权限)

ericdeMacBook-Pro:s2i-tomcat ericnie$ oc login -u system:admin
Logged into "https://192.168.99.100:8443" as "system:admin" using existing credentials.

You have access to the following projects and can switch between them with 'oc project <projectname>':

  * default
    kube-dns
    kube-proxy
    kube-public
    kube-system
    myproject
    openshift
    openshift-apiserver
    openshift-controller-manager
    openshift-core-operators
    openshift-infra
    openshift-node
    openshift-web-console
    test

Using project "default".

然后运行import-image（如果虚拟机无法访问外网，请先docker login到openshift的registry,然后先手工pull一下镜像到本地)

ricdeMacBook-Pro:s2i-tomcat ericnie$ oc import-image ericnie2017/s2i-tomcat:latest -n openshift --confirm --insecure
The import completed successfully.

Name:            s2i-tomcat
Namespace:        openshift
Created:         seconds ago
Labels:            <none>
Annotations:        openshift.io/image.dockerRepositoryCheck=--19T15::19Z
Docker Pull Spec:    172.30.1.1:/openshift/s2i-tomcat
Image Lookup:        local=false
Unique Images:
Tags:            

latest
  tagged from ericnie2017/s2i-tomcat:latest
    will use insecure HTTPS or HTTP connections

  * ericnie2017/s2i-tomcat@sha256:3a82fea61a9d2c665f522d656d6112b78d744645c38d096971460b9380b5f933
       seconds ago

Image Name:    s2i-tomcat:latest
Docker Image:    ericnie2017/s2i-tomcat@sha256:3a82fea61a9d2c665f522d656d6112b78d744645c38d096971460b9380b5f933
Name:        sha256:3a82fea61a9d2c665f522d656d6112b78d744645c38d096971460b9380b5f933
Created:     seconds ago
Annotations:    image.openshift.io/dockerLayersOrder=ascending
Image Size:    .7MB (first layer .39MB, last binary layer .177MB)
Image Created:     minutes ago
Author:        <none>
Arch:        amd64
Entrypoint:    container-entrypoint
Command:    /bin/sh -c $STI_SCRIPTS_PATH/usage
Working Dir:    /opt/app-root/src
User:
Exposes Ports:    /tcp
Docker Labels:    build-date=
        io.k8s.description=Platform for building and running JEE applications on Tomcat
        io.k8s.display-name=Tomcat Builder
        io.openshift.builder-base-version=bfd4736
        io.openshift.expose-services=:http
        io.openshift.s2i.destination=/opt/s2i/destination
        io.openshift.s2i.scripts-url=image:///usr/libexec/s2i
        io.openshift.tags=builder,tomcat
        io.s2i.scripts-url=image:///usr/libexec/s2i
        license=GPLv2
        name=CentOS Base Image
        vendor=CentOS
Environment:    PATH=/opt/app-root/src/bin:/opt/app-root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
        STI_SCRIPTS_URL=image:///usr/libexec/s2i
        STI_SCRIPTS_PATH=/opt/s2i/
        HOME=/opt/app-root/src
        BASH_ENV=/opt/app-root/etc/scl_enable
        ENV=/opt/app-root/etc/scl_enable
        PROMPT_COMMAND=. /opt/app-root/etc/scl_enable
        TOMCAT_VERSION=8.5.
        MAVEN_VERSION=3.5.

通过命令修改镜像的annotation

oc edit is/s2i-tomcat -n openshift

主要加入和修改了下面标黑体的部分,如果没有，请注意iconClass,找一个现在有的图标的iconClass.

 name: s2i-tomcat
  namespace: openshift
  resourceVersion: ""
  selfLink: /apis/image.openshift.io/v1/namespaces/openshift/imagestreams/s2i-tomcat
  uid: 19d2fb2d-bc1f-11e8-a40a-0800276bcf3b
spec:
  lookupPolicy:
    local: false
  tags:
  - annotations:
      description: Build and run Tomcat applications on CentOS . For more information
        about using this builder image, including OpenShift considerations, see https://github.com/silentwu/s2i-tomcat.git.
      iconClass: icon-wildfly
      openshift.io/display-name: Tomcat 8.5.
      openshift.io/provider-display-name: Rabbit blog, http://blog.xianshiyue.com
      sampleRepo: https://github.com/ericnie2015/openshift-tomcat.git
      supports: tomcat:8.5.,jee,java
      tags: builder,tomcat,java
      version: 8.5.
    from:
      kind: DockerImage
      name: ericnie2017/s2i-tomcat:latest
    generation: 

7.建立openshift project,然后构建

用developer登录，如果没有看见新的is,请登出重新登录

在image Stream中可以看到构建的镜像。

注意： 这里又想半天，折腾啊。。。

build过程只是建立镜像和push镜像，但并不会部署deployment和services,因此需要deploy一下应用

应用访问

8.客户化标准镜像

针对应用需要修改配置，放入第三方jar包以及和应用相关的配置，可以放在源代码库中，比如

ericdeMacBook-Pro:minishift ericnie$ tree openshift-tomcat
openshift-tomcat
├── README.md
├── config
│   └── catalina.sh
├── pom.xml
└── src
    └── main
        └── webapp
            ├── WEB-INF
            │   └── web.xml
            └── index.jsp

修改的catalina.sh以及第三方的jar包和配置文件可以放在这个目录下

然后修改assemble文件,加入覆盖语句即可

cp /opt/s2i/destination/src/config/catalina.sh /tomcat/bin/catalina.sh