-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathfeed.xml
2632 lines (2138 loc) · 232 KB
/
feed.xml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<?xml version="1.0" encoding="utf-8"?><feed xmlns="http://www.w3.org/2005/Atom" ><generator uri="https://jekyllrb.com/" version="3.7.4">Jekyll</generator><link href="https://kago.site/feed.xml" rel="self" type="application/atom+xml" /><link href="https://kago.site/" rel="alternate" type="text/html" /><updated>2018-12-10T18:01:42+08:00</updated><id>https://kago.site/feed.xml</id><title type="html">阅后即忘 | 牛昌平的个人博客</title><subtitle>点滴积累，聚沙成塔</subtitle><author><name>Barry New</name></author><entry><title type="html">Rancher高可用部署</title><link href="https://kago.site/2018/12/10/rancher-HA/" rel="alternate" type="text/html" title="Rancher高可用部署" /><published>2018-12-10T00:00:00+08:00</published><updated>2018-12-10T00:00:00+08:00</updated><id>https://kago.site/2018/12/10/rancher-HA</id><content type="html" xml:base="https://kago.site/2018/12/10/rancher-HA/"><blockquote>
<p>前一篇博客<a href="https://kago.site/2018/11/26/install-rancher/"> “CentOS7安装Rancher2.x” </a>分享可如何部署单节点的 Rancher-Server。在生产环境部署时，需要考虑到 Rancher-Server 的可用性，单实例部署时，当 Rancher-Server 节点出现故障导致服务不可用时（ rancher-server 故障不会影响运行的 k8s 集群及其业务容器），将不能通过 web-ui 进行操作。本文通过参考<a href="https://www.cnrancher.com/docs/rancher/v2.x/cn/installation/server-installation/ha-install/helm-rancher/">官方文档</a>分享搭建高可用 Rancher-Server 的过程。</p>
</blockquote>
<h2 id="1说明">1、说明</h2>
<h3 id="11架构说明">1.1、架构说明</h3>
<p>Rancher-Server 的高可用部署，实则是利用 kubernetes 的 deployment 实现，利用 rke 工具，部署三节点 kubernetes 集群（每个节点都运行 etcd、kube-master、kube-worker），使用helm 安装 Rancher-Server，Rancher-Server 即为 kubernetes 中的应用服务，由集群提供高可用实现。前端可配置负载均衡器或软件负载均衡如 nginx 或 ingress，安装完成后 Rancher-Server 会自动纳管 rke 安装的本地 kubernetes 集群。</p>
<p><img src="/images/posts/rancher-ha/2018-12-10_111310.png" alt="rancher-ha架构" /></p>
<h3 id="12环境说明">1.2、环境说明</h3>
<ul>
<li>操作系统：CentOS7.2</li>
<li>OS内核：3.10.0 (使用Overlay2需要升级内核至4.x）</li>
<li>Rancher:2.1.3</li>
<li>Docker: 17.03</li>
<li>集群IP地址划分：</li>
</ul>
<table>
<thead>
<tr>
<th>role</th>
<th>hostname</th>
<th>IP</th>
</tr>
</thead>
<tbody>
<tr>
<td>rancher-server</td>
<td>server1</td>
<td>192.168.31.10</td>
</tr>
<tr>
<td>rancher-server</td>
<td>server2</td>
<td>192.168.31.11</td>
</tr>
<tr>
<td>rancher-server</td>
<td>server3</td>
<td>192.168.31.12</td>
</tr>
<tr>
<td>worker</td>
<td>node1</td>
<td>192.168.31.20</td>
</tr>
<tr>
<td>worker</td>
<td>node2</td>
<td>192.168.31.21</td>
</tr>
<tr>
<td>worker</td>
<td>node3</td>
<td>192.168.31.22</td>
</tr>
<tr>
<td>registry</td>
<td>harbor.kago.site</td>
<td>192.168.31.65</td>
</tr>
</tbody>
</table>
<p>参考<a href="https://kago.site/2018/11/26/install-rancher/"> “CentOS7安装Rancher2.x” </a>要求各个服务器满足如下要求：</p>
<ol>
<li>harbor镜像库：
<ul>
<li>安装完成</li>
<li>上传 rancher 所需镜像</li>
</ul>
</li>
<li>Rancher-Server节点：
<ul>
<li>各节点安装 docker</li>
<li>信任 harbor 镜像库，并完成登录</li>
<li>新建 rancher 用户</li>
<li>各节点 rancher 用户可 ssh 免密钥登录</li>
<li>openssh 版本在 6.7 以上</li>
</ul>
</li>
<li>worker节点：
<ul>
<li>各节点安装 docker</li>
<li>信任 harbor 镜像库，并完成登录</li>
</ul>
</li>
</ol>
<h3 id="13软件准备">1.3、软件准备</h3>
<ul>
<li>rke</li>
</ul>
<ol>
<li>
<p>点击<a href="https://www.cnrancher.com/download/rke/rke_linux-amd64">下载rke-linux-amd64</a></p>
</li>
<li>
<p>复制命令到PATH</p>
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@server1 ~]# chmod +x rke_linux_amd64
<span class="o">[</span>root@server1 ~]# cp rke_linux_amd64 /usr/local/bin/
<span class="o">[</span>root@server1 ~]# ln <span class="nt">-s</span> /usr/local/bin/rke_linux_amd64 /usr/bin/rke
</code></pre></div> </div>
</li>
</ol>
<ul>
<li>helm</li>
</ul>
<ol>
<li>
<p>点击<a href="https://www.cnrancher.com/download/helm/helm-linux.tar.gz">下载helm-linux.tar.gz</a></p>
</li>
<li>解压文件并复制到PATH
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@server1 ~]# <span class="nb">tar</span> <span class="nt">-zxf</span> helm-linux.tar.gz
<span class="o">[</span>root@server1 ~]# chmod +x linux-amd64/helm
<span class="o">[</span>root@server1 ~]# cp linux-amd64/helm /usr/bin
</code></pre></div> </div>
</li>
<li>获取tiller镜像
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@server1 ~]# docker pull registry.cn-hangzhou.aliyuncs.com/google_containers/tiller:v2.12
<span class="o">[</span>root@server1 ~]# docker tag registry.cn-hangzhou.aliyuncs.com/google_containers/tiller:v2.12 harbor.kago.site/google_containers/tiller:v2.12
<span class="o">[</span>root@server1 ~]# docker push harbor.kago.site/google_containers/tiller:v2.12
</code></pre></div> </div>
</li>
</ol>
<ul>
<li>kubectl</li>
</ul>
<ol>
<li>
<p>点击<a href="https://www.cnrancher.com/download/kubectl/kubectl_amd64-linux">下载kubectl</a></p>
</li>
<li>
<p>复制到PATH</p>
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@server1 ~]# cp kubectl_amd64-linux /usr/local/bin
<span class="o">[</span>root@server1 ~]# chmod +x /usr/local/bin/kubectl_amd64-linux
<span class="o">[</span>root@server1 ~]# ln <span class="nt">-s</span> /usr/local/bin/kubectl_amd64-linux /usr/bin/kubectl
</code></pre></div> </div>
</li>
</ol>
<h2 id="2rke安装-k8s-集群">2、RKE安装 K8S 集群</h2>
<blockquote>
<p>该集群仅用于运行 Rancher-Server，CentOS 环境下使用非 root 用户安装（本案例使用 rancher 用户）。</p>
</blockquote>
<h3 id="21创建配置文件rancher-clusteryml">2.1、创建配置文件rancher-cluster.yml</h3>
<div class="language-yml highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="na">nodes</span><span class="pi">:</span>
<span class="pi">-</span> <span class="na">address</span><span class="pi">:</span> <span class="s">192.168.31.10</span>
<span class="na">user</span><span class="pi">:</span> <span class="s">rancher</span>
<span class="na">role</span><span class="pi">:</span> <span class="pi">[</span><span class="nv">controlplane</span><span class="pi">,</span><span class="nv">worker</span><span class="pi">,</span><span class="nv">etcd</span><span class="pi">]</span>
<span class="pi">-</span> <span class="na">address</span><span class="pi">:</span> <span class="s">192.168.31.11</span>
<span class="na">user</span><span class="pi">:</span> <span class="s">rancher</span>
<span class="na">role</span><span class="pi">:</span> <span class="pi">[</span><span class="nv">controlplane</span><span class="pi">,</span><span class="nv">worker</span><span class="pi">,</span><span class="nv">etcd</span><span class="pi">]</span>
<span class="pi">-</span> <span class="na">address</span><span class="pi">:</span> <span class="s">192.168.31.12</span>
<span class="na">user</span><span class="pi">:</span> <span class="s">rancher</span>
<span class="na">role</span><span class="pi">:</span> <span class="pi">[</span><span class="nv">controlplane</span><span class="pi">,</span><span class="nv">worker</span><span class="pi">,</span><span class="nv">etcd</span><span class="pi">]</span>
<span class="na">private_registries</span><span class="pi">:</span>
<span class="pi">-</span> <span class="na">url</span><span class="pi">:</span> <span class="s">harbor.kago.site</span>
<span class="na">user</span><span class="pi">:</span> <span class="s">admin</span>
<span class="na">password</span><span class="pi">:</span> <span class="s2">"</span><span class="s">xxxxxxxxx"</span>
<span class="na">is_default</span><span class="pi">:</span> <span class="no">true</span>
<span class="na">services</span><span class="pi">:</span>
<span class="na">etcd</span><span class="pi">:</span>
<span class="na">snapshot</span><span class="pi">:</span> <span class="no">true</span>
<span class="na">creation</span><span class="pi">:</span> <span class="s">6h</span>
<span class="na">retention</span><span class="pi">:</span> <span class="s">24h</span>
</code></pre></div></div>
<h3 id="22执行安装">2.2、执行安装</h3>
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>rancher@server1 ~]<span class="nv">$ </span><span class="nb">sudo </span>rke up <span class="nt">--config</span> ./rancher-cluster.yml
</code></pre></div></div>
<p>当提示“Finished builled Kubernetes cluster successfully”说明安装成功,并生当前目录生成 kube_config_rancher-cluster.yml 文件。</p>
<h3 id="23查看集群状态">2.3、查看集群状态</h3>
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@server1 ~]# mkdir ~/.kube
<span class="o">[</span>root@server1 ~]# cp kube_config_rancher-cluster.yml ~/.kube/config
<span class="o">[</span>root@server1 ~]# kubectl get node
</code></pre></div></div>
<h2 id="3安装helm-server">3、安装helm server</h2>
<h3 id="31配置-helm-客户端访问权限">3.1、配置 helm 客户端访问权限</h3>
<p>Helm在集群上安装tiller服务以管理charts. 由于RKE默认启用RBAC, 因此我们需要使用kubectl来创建一个serviceaccount，clusterrolebinding才能让tiller具有部署到集群的权限。</p>
<ul>
<li>在kube-system命名空间中创建ServiceAccount；</li>
<li>创建ClusterRoleBinding以授予tiller帐户对集群的访问权限</li>
<li>helm初始化tiller服务</li>
</ul>
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@server1 ~]# kubectl <span class="nt">-n</span> kube-system create serviceaccount tiller
<span class="o">[</span>root@server1 ~]# kubectl create clusterrolebinding tiller <span class="nt">--clusterrole</span> cluster-admin <span class="nt">--serviceaccount</span><span class="o">=</span>kube-system:tiller
</code></pre></div></div>
<h3 id="32添加镜像仓库密钥">3.2、添加镜像仓库密钥</h3>
<ol>
<li>生成密钥
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@server1 ~]# kubectl <span class="nt">-n</span> kube-system create secret docker-registry regSecret <span class="nt">--docker-server</span><span class="o">=</span><span class="s2">"harbor.kago.site"</span> <span class="nt">--docker-username</span><span class="o">=</span>admin <span class="nt">--docker-password</span><span class="o">=</span>xxxxxxxx <span class="nt">--docker-email</span><span class="o">=</span>[email protected]
</code></pre></div> </div>
</li>
<li>打patch
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@server1 ~]# kubectl <span class="nt">-n</span> kube-system patch serviceaccounts tiller <span class="nt">-p</span> <span class="s1">'{"imagePullSecrets": [{"name": "regSecret"}]}'</span>
</code></pre></div> </div>
</li>
</ol>
<h3 id="33安装helm-server">3.3、安装helm server</h3>
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@server1 ~]# helm init <span class="nt">--service-account</span> tiller <span class="nt">--tiller-image</span> harbor.kago.site/google_containers/tiller:v2.12 <span class="nt">--stable-repo-url</span> https://kubernetes.oss-cn-hangzhou.aliyuncs.com/charts
</code></pre></div></div>
<h3 id="34添加chart仓库">3.4、添加chart仓库</h3>
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@server1 ~]# helm repo add rancher-stable https://releases.rancher.com/server-charts/stable
</code></pre></div></div>
<h2 id="4安装-rancher-server">4、安装 Rancher Server</h2>
<h3 id="41安装cert-manager">4.1、安装cert-manager</h3>
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@server1 ~]# helm install stable/cert-manager <span class="nt">--name</span> cert-manager <span class="nt">--namespace</span> kube-system
</code></pre></div></div>
<ul>
<li>离线环境：</li>
</ul>
<ol>
<li>在能联网的机器上获取chart
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@server1 ~]# helm fetch stable/cert-manager
</code></pre></div> </div>
</li>
<li>上传chart后修改配置
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@server1 ~]# helm template ./cert-manager-v0.8.0.tgz <span class="nt">--output-dir</span> <span class="nb">.</span> <span class="nt">--name</span> cert-manager <span class="nt">--namespace</span> kube-system <span class="nt">--set</span> image.repository<span class="o">=</span>harbor.kago.site.com/jetstack/cert-manager-controller
</code></pre></div> </div>
</li>
<li>运行
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@server1 ~]# kubectl apply <span class="nt">-n</span> kube-system - R <span class="nt">-f</span> ./cert-manager
</code></pre></div> </div>
</li>
</ol>
<h3 id="42安装rancher-server">4.2、安装rancher server</h3>
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@server1 ~]# helm install rancher-stable/rancher <span class="nt">--name</span> rancher <span class="nt">--namespace</span> cattle-system <span class="nt">--set</span> <span class="nv">hostname</span><span class="o">=</span>rancher.kago.site
</code></pre></div></div>
<blockquote>
<p>默认情况下，Rancher会自动生成CA根证书并使用cert-manager颁发证书，因此，这里设置了 hostname=rancher.kago.site，后续只能通过域名访问UI</p>
</blockquote>
<ul>
<li>离线环境：</li>
</ul>
<ol>
<li>在能联网的机器上获取chart
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@server1 ~]# helm fetch rancher-stable/rancher
</code></pre></div> </div>
</li>
<li>上传chart后修改配置
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@server1 ~]# helm template ./rancher-2018.10.2.tgz <span class="nt">--output-dir</span> <span class="nb">.</span> <span class="nt">--name</span> rancher <span class="nt">--namespace</span> cattle-system <span class="nt">--set</span> <span class="nv">hostname</span><span class="o">=</span>rancher.kago.site <span class="nt">--set</span> <span class="nv">rancherImage</span><span class="o">=</span>harbor.kago.site/rancher/rancher
</code></pre></div> </div>
</li>
<li>运行
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@server1 ~]# kubectl create namespace cattle-system
<span class="o">[</span>root@server1 ~]# kubectl apply <span class="nt">-n</span> cattle-system <span class="nt">-R</span> <span class="nt">-f</span> ./rancher
</code></pre></div> </div>
</li>
</ol>
<h2 id="5为agent-pod添加主机别名">5、为Agent Pod添加主机别名</h2>
<p>如果你没有内部DNS服务器而是通过添加/etc/hosts主机别名的方式指定的Rancher server域名，那么不管通过哪种方式(自定义、导入、Host驱动等)创建K8S集群，K8S集群运行起来之后，因为cattle-cluster-agent Pod和cattle-node-agent无法通过DNS记录找到Rancher server,最终导致无法通信。</p>
<p>可以通过给cattle-cluster-agent Pod和cattle-node-agent添加主机别名(/etc/hosts)，让其可以正常通信(前提是IP地址可以互通)。</p>
<blockquote>
<p>注意：替换以下命令中的域名和IP</p>
</blockquote>
<h3 id="51cattle-cluster-agent-pod">5.1、cattle-cluster-agent pod</h3>
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@server1 ~]# kubectl <span class="nt">-n</span> cattle-system patch deployments cattle-cluster-agent <span class="nt">--patch</span> <span class="s1">'{
"spec": {
"template": {
"spec": {
"hostAliases": [
{
"hostnames":
[
"rancher.kago.site"
],
"ip": "192.168.31.10"
}
]
}
}
}
}'</span>
</code></pre></div></div>
<h3 id="52cattle-node-agent-pod">5.2、cattle-node-agent pod</h3>
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@server1 ~]# kubectl <span class="nt">-n</span> cattle-system patch daemonsets cattle-node-agent <span class="nt">--patch</span> <span class="s1">'{
"spec": {
"template": {
"spec": {
"hostAliases": [
{
"hostnames":
[
"rancher.kago.site"
],
"ip": "192.168.31.10"
}
]
}
}
}
}'</span>
</code></pre></div></div></content><author><name>Barry New</name></author><summary type="html">前一篇博客 “CentOS7安装Rancher2.x” 分享可如何部署单节点的 Rancher-Server。在生产环境部署时，需要考虑到 Rancher-Server 的可用性，单实例部署时，当 Rancher-Server 节点出现故障导致服务不可用时（ rancher-server 故障不会影响运行的 k8s 集群及其业务容器），将不能通过 web-ui 进行操作。本文通过参考官方文档分享搭建高可用 Rancher-Server 的过程。</summary></entry><entry><title type="html">CentOS7安装rancher2.x</title><link href="https://kago.site/2018/11/26/install-rancher/" rel="alternate" type="text/html" title="CentOS7安装rancher2.x" /><published>2018-11-26T00:00:00+08:00</published><updated>2018-11-26T00:00:00+08:00</updated><id>https://kago.site/2018/11/26/install-rancher</id><content type="html" xml:base="https://kago.site/2018/11/26/install-rancher/"><h1 id="centos7安装rancher2x">CentOS7安装Rancher2.x</h1>
<p>容器已然成为IT建设的潮流，目前最流行的容器管理、编排方案莫过于Kubernetes（简称K8S)，但是使用过K8S的小伙伴肯定和我一样爬坑无数。我曾经写过一套安装脚本用于公司内部环境部署，虽所简化了安装过程，但在管理多个K8S环境时（项目多数以整个集群为交付成果，开发测试时也划分了多个集群）仍然很犯难，Rancher对我而言最大的吸引点可能就在于此吧，参考官方文档实验后简单记录如下，便于日后回顾。</p>
<h2 id="1rancher简介">1、Rancher简介</h2>
<p>Rancher是一套容器管理平台，它可以帮助组织在生产环境中轻松快捷的部署和管理容器。 Rancher可以轻松地管理各种环境的Kubernetes，满足IT需求并为DevOps团队提供支持。</p>
<p>Kubernetes不仅已经成为的容器编排标准，它也正在迅速成为各类云和虚拟化厂商提供的标准基础架构。Rancher用户可以选择使用Rancher Kubernetes Engine(RKE)创建Kubernetes集群，也可以使用GKE，AKS和EKS等云Kubernetes服务。 Rancher用户还可以导入和管理现有的Kubernetes集群。</p>
<p>Rancher支持各类集中式身份验证系统来管理Kubernetes集群。例如，大型企业的员工可以使用其公司Active Directory凭证访问GKE中的Kubernetes集群。IT管理员可以在用户，组，项目，集群和云中设置访问控制和安全策略。 IT管理员可以在单个页面对所有Kubernetes集群的健康状况和容量进行监控。</p>
<p>(引自<a href="https://www.cnrancher.com/docs/rancher/v2.x/cn/overview/">Rancher Labs</a>)</p>
<p><img src="/images/posts/rancher/rancher-architecture.png" alt="" /></p>
<h2 id="2组件版本">2、组件版本</h2>
<ul>
<li>操作系统：CentOS7.2</li>
<li>OS内核：3.10.0 (使用Overlay2需要升级内核至4.x）</li>
<li>Rancher:2.1.1</li>
<li>Docker: 17.03</li>
<li>集群IP地址划分：</li>
</ul>
<table>
<thead>
<tr>
<th>role</th>
<th>hostname</th>
<th>IP</th>
</tr>
</thead>
<tbody>
<tr>
<td>rancher-server</td>
<td>server</td>
<td>192.168.31.10</td>
</tr>
<tr>
<td>worker</td>
<td>node1</td>
<td>192.168.31.11</td>
</tr>
<tr>
<td>worker</td>
<td>node2</td>
<td>192.168.31.12</td>
</tr>
<tr>
<td>worker</td>
<td>node3</td>
<td>192.168.31.13</td>
</tr>
<tr>
<td>registry</td>
<td>harbor.kago.site</td>
<td>192.168.31.65</td>
</tr>
</tbody>
</table>
<h2 id="3基础环境安装">3、基础环境安装</h2>
<p><strong>1. 操作系统安装</strong></p>
<p>推荐使用“minimal install”最小安装模式，安装完毕后再按需安装“vim、ip-utils、net-tools”等工具。</p>
<p><strong>2. 配置主机名</strong></p>
<p>命令：hostnamectl set-hostname &lt;hostname&gt;</p>
<blockquote>
<p>因为K8S的规定，主机名只支持包含 - 和 .(中横线和点)两种特殊符号，并且主机名不能出现重复。</p>
</blockquote>
<p><strong>3. 关闭防火墙、selinux</strong></p>
<p><strong>4. kernel性能优化</strong></p>
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nb">cat</span> <span class="o">&gt;&gt;</span> /etc/sysctl.conf<span class="o">&lt;&lt;</span><span class="no">EOF</span><span class="sh">
net.ipv4.ip_forward=1
net.bridge.bridge-nf-call-iptables=1
net.ipv4.neigh.default.gc_thresh1=4096
net.ipv4.neigh.default.gc_thresh2=6144
net.ipv4.neigh.default.gc_thresh3=8192
</span><span class="no">EOF
</span></code></pre></div></div>
<h2 id="4安装docker">4、安装docker</h2>
<p><strong>1. 修改YUM源</strong></p>
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nb">sudo </span>cp /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.bak
<span class="nb">cat</span> <span class="o">&gt;</span> /etc/yum.repos.d/CentOS-Base.repo <span class="o">&lt;&lt;</span> <span class="no">EOF</span><span class="sh">
[base]
name=CentOS-</span><span class="nv">$releasever</span><span class="sh"> - Base - mirrors.aliyun.com
failovermethod=priority
baseurl=http://mirrors.aliyun.com/centos/</span><span class="nv">$releasever</span><span class="sh">/os/</span><span class="nv">$basearch</span><span class="sh">/
http://mirrors.aliyuncs.com/centos/</span><span class="nv">$releasever</span><span class="sh">/os/</span><span class="nv">$basearch</span><span class="sh">/
http://mirrors.cloud.aliyuncs.com/centos/</span><span class="nv">$releasever</span><span class="sh">/os/</span><span class="nv">$basearch</span><span class="sh">/
gpgcheck=1
gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-7
#released updates
[updates]
name=CentOS-</span><span class="nv">$releasever</span><span class="sh"> - Updates - mirrors.aliyun.com
failovermethod=priority
baseurl=http://mirrors.aliyun.com/centos/</span><span class="nv">$releasever</span><span class="sh">/updates/</span><span class="nv">$basearch</span><span class="sh">/
http://mirrors.aliyuncs.com/centos/</span><span class="nv">$releasever</span><span class="sh">/updates/</span><span class="nv">$basearch</span><span class="sh">/
http://mirrors.cloud.aliyuncs.com/centos/</span><span class="nv">$releasever</span><span class="sh">/updates/</span><span class="nv">$basearch</span><span class="sh">/
gpgcheck=1
gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-7
#additional packages that may be useful
[extras]
name=CentOS-</span><span class="nv">$releasever</span><span class="sh"> - Extras - mirrors.aliyun.com
failovermethod=priority
baseurl=http://mirrors.aliyun.com/centos/</span><span class="nv">$releasever</span><span class="sh">/extras/</span><span class="nv">$basearch</span><span class="sh">/
http://mirrors.aliyuncs.com/centos/</span><span class="nv">$releasever</span><span class="sh">/extras/</span><span class="nv">$basearch</span><span class="sh">/
http://mirrors.cloud.aliyuncs.com/centos/</span><span class="nv">$releasever</span><span class="sh">/extras/</span><span class="nv">$basearch</span><span class="sh">/
gpgcheck=1
gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-7
#additional packages that extend functionality of existing packages
[centosplus]
name=CentOS-</span><span class="nv">$releasever</span><span class="sh"> - Plus - mirrors.aliyun.com
failovermethod=priority
baseurl=http://mirrors.aliyun.com/centos/</span><span class="nv">$releasever</span><span class="sh">/centosplus/</span><span class="nv">$basearch</span><span class="sh">/
http://mirrors.aliyuncs.com/centos/</span><span class="nv">$releasever</span><span class="sh">/centosplus/</span><span class="nv">$basearch</span><span class="sh">/
http://mirrors.cloud.aliyuncs.com/centos/</span><span class="nv">$releasever</span><span class="sh">/centosplus/</span><span class="nv">$basearch</span><span class="sh">/
gpgcheck=1
enabled=0
gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-7
#contrib - packages by Centos Users
[contrib]
name=CentOS-</span><span class="nv">$releasever</span><span class="sh"> - Contrib - mirrors.aliyun.com
failovermethod=priority
baseurl=http://mirrors.aliyun.com/centos/</span><span class="nv">$releasever</span><span class="sh">/contrib/</span><span class="nv">$basearch</span><span class="sh">/
http://mirrors.aliyuncs.com/centos/</span><span class="nv">$releasever</span><span class="sh">/contrib/</span><span class="nv">$basearch</span><span class="sh">/
http://mirrors.cloud.aliyuncs.com/centos/</span><span class="nv">$releasever</span><span class="sh">/contrib/</span><span class="nv">$basearch</span><span class="sh">/
gpgcheck=1
enabled=0
gpgkey=http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-7
</span><span class="no">
EOF
</span></code></pre></div></div>
<p><strong>2. 安装Docker-ce</strong></p>
<blockquote>
<p>因为CentOS的安全限制，通过RKE安装K8S集群时候无法使用root账户。所以，建议CentOS用户使用非root用户来运行docker,不管是RKE还是custom安装k8s。</p>
</blockquote>
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c"># 添加用户（可选）</span>
<span class="nb">sudo </span>adduser <span class="sb">`</span>&lt;new_user&gt;<span class="sb">`</span>
<span class="c"># 为新用户设置密码</span>
<span class="nb">sudo </span>passwd <span class="sb">`</span>&lt;new_user&gt;<span class="sb">`</span>
<span class="c"># 为新用户添加sudo权限</span>
<span class="nb">sudo echo</span> <span class="s1">'&lt;new_user&gt; ALL=(ALL) ALL'</span> <span class="o">&gt;&gt;</span> /etc/sudoers
<span class="c"># 卸载旧版本Docker软件</span>
<span class="nb">sudo </span>yum remove docker <span class="se">\</span>
docker-client <span class="se">\</span>
docker-client-latest <span class="se">\</span>
docker-common <span class="se">\</span>
docker-latest <span class="se">\</span>
docker-latest-logrotate <span class="se">\</span>
docker-logrotate <span class="se">\</span>
docker-selinux <span class="se">\</span>
docker-engine-selinux <span class="se">\</span>
docker-engine <span class="se">\</span>
container<span class="k">*</span>
<span class="c"># 定义安装版本</span>
<span class="nb">export </span><span class="nv">docker_version</span><span class="o">=</span>17.03.2
<span class="c"># step 1: 安装必要的一些系统工具</span>
<span class="nb">sudo </span>yum update <span class="nt">-y</span>
<span class="nb">sudo </span>yum install <span class="nt">-y</span> yum-utils device-mapper-persistent-data lvm2 bash-completion
<span class="c"># Step 2: 添加软件源信息</span>
<span class="nb">sudo </span>yum-config-manager <span class="nt">--add-repo</span> http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
<span class="c"># Step 3: 更新并安装 Docker-CE</span>
<span class="nb">sudo </span>yum makecache all
<span class="nv">version</span><span class="o">=</span><span class="k">$(</span>yum list docker-ce.x86_64 <span class="nt">--showduplicates</span> | sort <span class="nt">-r</span>|grep <span class="k">${</span><span class="nv">docker_version</span><span class="k">}</span>|awk <span class="s1">'{print $2}'</span><span class="k">)</span>
<span class="nb">sudo </span>yum <span class="nt">-y</span> install <span class="nt">--setopt</span><span class="o">=</span><span class="nv">obsoletes</span><span class="o">=</span>0 docker-ce-<span class="k">${</span><span class="nv">version</span><span class="k">}</span> docker-ce-selinux-<span class="k">${</span><span class="nv">version</span><span class="k">}</span>
<span class="c"># 如果已经安装高版本Docker,可进行降级安装(可选)</span>
yum downgrade <span class="nt">--setopt</span><span class="o">=</span><span class="nv">obsoletes</span><span class="o">=</span>0 <span class="nt">-y</span> docker-ce-<span class="k">${</span><span class="nv">version</span><span class="k">}</span> docker-ce-selinux-<span class="k">${</span><span class="nv">version</span><span class="k">}</span>
<span class="c"># 把当前用户加入docker组</span>
<span class="nb">sudo </span>usermod <span class="nt">-aG</span> docker <span class="sb">`</span>&lt;new_user&gt;<span class="sb">`</span>
<span class="c"># 设置开机启动</span>
<span class="nb">sudo </span>systemctl <span class="nb">enable </span>docker
</code></pre></div></div>
<blockquote>
<p>Docker-Engine Docker官方已经不推荐使用，请安装Docker-CE。</p>
</blockquote>
<p><strong>3. 配置Docker</strong>
daemon.json默认位于/etc/docker/daemon.json，如果没有可手动创建，基于systemd管理的系统都是相同的路径。通过修改daemon.json来改过Docker配置，也是Docker官方推荐的方法。</p>
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@server ~]# <span class="nb">cat</span> /etc/docker/daemon.json
<span class="o">{</span>
<span class="s2">"registry-mirrors"</span>: <span class="o">[</span><span class="s2">"https://8m0vweth.mirror.aliyuncs.com"</span><span class="o">]</span>,
<span class="s2">"insecure-registries"</span>: <span class="o">[</span><span class="s2">"0.0.0.0/0"</span><span class="o">]</span>
<span class="o">}</span>
</code></pre></div></div>
<p><strong>4. 配置Docker存储驱动</strong></p>
<blockquote>
<p>本次实验跳过此步骤</p>
</blockquote>
<p>OverlayFS是一个新一代的联合文件系统，类似于AUFS，但速度更快，实现更简单。Docker为OverlayFS提供了两个存储驱动程序:旧版的overlay，新版的overlay2(更稳定)。</p>
<p>先决条件：</p>
<ul>
<li>overlay2: Linux内核版本4.0或更高版本，或使用内核版本3.10.0-514+的RHEL或CentOS。</li>
<li>overlay: 主机Linux内核版本3.18+</li>
<li>支持的磁盘文件系统
<ul>
<li>ext4(仅限RHEL 7.1)</li>
<li>xfs(RHEL7.2及更高版本)，需要启用d_type=true。 &gt;具体详情参考 Docker Use the OverlayFS storage driver</li>
</ul>
</li>
</ul>
<p>编辑/etc/docker/daemon.json加入以下内容</p>
<div class="language-json highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="p">{</span><span class="w">
</span><span class="s2">"storage-driver"</span><span class="p">:</span><span class="w"> </span><span class="s2">"overlay2"</span><span class="p">,</span><span class="w">
</span><span class="s2">"storage-opts"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span><span class="s2">"overlay2.override_kernel_check=true"</span><span class="p">]</span><span class="w">
</span><span class="p">}</span><span class="w">
</span></code></pre></div></div>
<p><strong>5. 配置日志驱动</strong></p>
<p>容器在运行时会产生大量日志文件，很容易占满磁盘空间。通过配置日志驱动来限制文件大小与文件的数量。 &gt;限制单个日志文件为100M,最多产生3个日志文件</p>
<div class="language-json highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="p">{</span><span class="w">
</span><span class="s2">"log-driver"</span><span class="p">:</span><span class="w"> </span><span class="s2">"json-file"</span><span class="p">,</span><span class="w">
</span><span class="s2">"log-opts"</span><span class="p">:</span><span class="w"> </span><span class="p">{</span><span class="w">
</span><span class="s2">"max-size"</span><span class="p">:</span><span class="w"> </span><span class="s2">"100m"</span><span class="p">,</span><span class="w">
</span><span class="s2">"max-file"</span><span class="p">:</span><span class="w"> </span><span class="s2">"3"</span><span class="w">
</span><span class="p">}</span><span class="w">
</span><span class="p">}</span><span class="w">
</span></code></pre></div></div>
<h2 id="5harbor镜像库安装">5、harbor镜像库安装</h2>
<blockquote>
<p>安装harbor是用于离线安装rancher组件、K8S组件时的镜像拉取，也可以用于应用部署时自定义镜像存储</p>
</blockquote>
<p>Harbor 是一个企业级的 Docker Registry，可以实现images的私有存储和日志统计权限控制等功能，并支持创建多项目(Harbor 提出的概念)，基于官方Registry实现。 通过地址:<a href="https://github.com/goharbor/harbor/releases/">https://github.com/goharbor/harbor/releases/</a>可以下载最新的版本。官方提供了三种版本:在线版、离线版、OVA虚拟镜像版。</p>
<p>在线安装:安装程序从Docker镜像仓库下载Harbour相关映像。因此，安装程序的尺寸非常小。
离线安装:主机没有Internet连接时使用此安装程序镜像安装。安装程序包含所有镜像，因此压缩包较大。
详细过程参考<a href="https://github.com/goharbor/harbor/blob/master/docs/installation_guide.md">harbor安装</a></p>
<p><strong>1. 配置https</strong></p>
<p>1.1 生成自建ca 证书
默认在/data/cert/</p>
<div class="highlighter-rouge"><div class="highlight"><pre class="highlight"><code>[root@harbor ~]#cd /data/cert/
[root@harbor cert]#openssl req -newkey rsa:4096 -nodes -sha256 -keyout ca.key -x509 -days 365 -out ca.crt -subj "/CN=kago.site"
</code></pre></div></div>
<p>1.2 生成请求</p>
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@harbor cert]#openssl req <span class="nt">-newkey</span> rsa:4096 <span class="nt">-nodes</span> <span class="nt">-sha256</span> <span class="nt">-keyout</span> harbor.kago.site.key <span class="nt">-out</span> harbor.kago.site.csr <span class="nt">-subj</span> <span class="s2">"/CN=harbor.kago.site"</span>
</code></pre></div></div>
<p>1.3 证书签署</p>
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@harbor cert]#openssl x509 <span class="nt">-req</span> <span class="nt">-days</span> 365 <span class="nt">-in</span> harbor.kago.site.csr <span class="nt">-CA</span> ca.crt <span class="nt">-CAkey</span> ca.key <span class="nt">-CAcreateserial</span> <span class="nt">-out</span> harbor.kago.site.crt
</code></pre></div></div>
<p>1.4 更改配置</p>
<div class="highlighter-rouge"><div class="highlight"><pre class="highlight"><code>[root@harbor harbor]#vim harbor.cfg
hostname = harbor.kago.site:443
ui_url_protocol = https
ssl_cert = /data/cert/harbor.kago.site.crt
ssl_cert_key = /data/cert/harbor.kago.site.key
</code></pre></div></div>
<p><strong>2. 执行安装</strong></p>
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@harbor cert]#cd /opt/harbor/
<span class="o">[</span>root@harbor harbor]#sh install.sh
</code></pre></div></div>
<h2 id="6离线环境镜像准备">6、离线环境镜像准备</h2>
<p>在线安装rancher虽然方便，但需要从互联网拉取诸多镜像，在独立内网环境下不适用，此处记录离线环境下安装rancher。
在联网环境下获取镜像后，以便离线使用</p>
<ol>
<li>所需镜像列表</li>
</ol>
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@harbor opt]#cat rancher-images.txt
busybox
minio/minio:RELEASE.2018-05-25T19-49-13Z
rancher/alertmanager-helper:v0.0.2
rancher/calico-cni:v3.1.1
rancher/calico-cni:v3.1.3
rancher/calico-ctl:v2.0.0
rancher/calico-node:v3.1.1
rancher/calico-node:v3.1.3
rancher/cluster-proportional-autoscaler-amd64:1.0.0
rancher/coreos-etcd:v3.1.12
rancher/coreos-etcd:v3.2.18
rancher/coreos-etcd:v3.2.24
rancher/coreos-flannel-cni:v0.2.0
rancher/coreos-flannel-cni:v0.3.0
rancher/coreos-flannel:v0.10.0
rancher/coreos-flannel:v0.9.1
rancher/docker-elasticsearch-kubernetes:5.6.2
rancher/fluentd-helper:v0.1.2
rancher/fluentd:v0.1.10
rancher/hyperkube:v1.10.5-rancher1
rancher/hyperkube:v1.11.3-rancher1
rancher/hyperkube:v1.12.0-rancher1
rancher/hyperkube:v1.9.7-rancher2
rancher/jenkins-jnlp-slave:3.10-1-alpine
rancher/jenkins-plugins-docker:17.12
rancher/k8s-dns-dnsmasq-nanny-amd64:1.14.10
rancher/k8s-dns-dnsmasq-nanny-amd64:1.14.13
rancher/k8s-dns-dnsmasq-nanny-amd64:1.14.7
rancher/k8s-dns-dnsmasq-nanny-amd64:1.14.8
rancher/k8s-dns-kube-dns-amd64:1.14.10
rancher/k8s-dns-kube-dns-amd64:1.14.13
rancher/k8s-dns-kube-dns-amd64:1.14.7
rancher/k8s-dns-kube-dns-amd64:1.14.8
rancher/k8s-dns-sidecar-amd64:1.14.10
rancher/k8s-dns-sidecar-amd64:1.14.13
rancher/k8s-dns-sidecar-amd64:1.14.7
rancher/k8s-dns-sidecar-amd64:1.14.8
rancher/kibana:5.6.4
rancher/log-aggregator:v0.1.3
rancher/metrics-server-amd64:v0.2.1
rancher/metrics-server-amd64:v0.3.1
rancher/nginx-ingress-controller-defaultbackend:1.4
rancher/nginx-ingress-controller:0.16.2-rancher1
rancher/pause-amd64:3.0
rancher/pause-amd64:3.1
rancher/pipeline-jenkins-server:v0.1.0
rancher/pipeline-tools:v0.1.0
rancher/prom-alertmanager:v0.15.2
rancher/rke-tools:v0.1.13
rancher/rke-tools:v0.1.15
registry:2
rancher/rancher:v2.1.1
rancher/rancher-agent:v2.1.1
</code></pre></div></div>
<ol>
<li>拉取保存脚本</li>
</ol>
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@harbor opt]#cat rancher-save-images.sh
<span class="c">#!/bin/bash</span>
<span class="nv">list</span><span class="o">=</span><span class="s2">"rancher-images.txt"</span>
<span class="nv">images</span><span class="o">=</span><span class="s2">"rancher-images.tar.gz"</span>
<span class="nv">POSITIONAL</span><span class="o">=()</span>
<span class="k">while</span> <span class="o">[[</span> <span class="nv">$# </span><span class="nt">-gt</span> 0 <span class="o">]]</span><span class="p">;</span> <span class="k">do
</span><span class="nv">key</span><span class="o">=</span><span class="s2">"</span><span class="nv">$1</span><span class="s2">"</span>
<span class="k">case</span> <span class="nv">$key</span> <span class="k">in</span>
<span class="nt">-i</span><span class="p">|</span><span class="nt">--images</span><span class="p">)</span>
<span class="nv">images</span><span class="o">=</span><span class="s2">"</span><span class="nv">$2</span><span class="s2">"</span>
<span class="nb">shift</span> <span class="c"># past argument</span>
<span class="nb">shift</span> <span class="c"># past value</span>
<span class="p">;;</span>
<span class="nt">-l</span><span class="p">|</span><span class="nt">--image-list</span><span class="p">)</span>
<span class="nv">list</span><span class="o">=</span><span class="s2">"</span><span class="nv">$2</span><span class="s2">"</span>
<span class="nb">shift</span> <span class="c"># past argument</span>
<span class="nb">shift</span> <span class="c"># past value</span>
<span class="p">;;</span>
<span class="nt">-h</span><span class="p">|</span><span class="nt">--help</span><span class="p">)</span>
<span class="nb">help</span><span class="o">=</span><span class="s2">"true"</span>
<span class="nb">shift</span>
<span class="p">;;</span>
<span class="k">esac</span>
<span class="k">done
</span>usage <span class="o">()</span> <span class="o">{</span>
<span class="nb">echo</span> <span class="s2">"USAGE: </span><span class="nv">$0</span><span class="s2"> [--image-list rancher-images.txt] [--images rancher-images.tar.gz]"</span>
<span class="nb">echo</span> <span class="s2">" [-l|--images-list path] text file with list of images. 1 per line."</span>
<span class="nb">echo</span> <span class="s2">" [-l|--images path] tar.gz generated by docker save."</span>
<span class="nb">echo</span> <span class="s2">" [-h|--help] Usage message"</span>
<span class="o">}</span>
<span class="k">if</span> <span class="o">[[</span> <span class="nv">$help</span> <span class="o">]]</span><span class="p">;</span> <span class="k">then
</span>usage
<span class="nb">exit </span>0
<span class="k">fi
</span><span class="nb">set</span> <span class="nt">-e</span> <span class="nt">-x</span>
<span class="k">for </span>i <span class="k">in</span> <span class="k">$(</span><span class="nb">cat</span> <span class="k">${</span><span class="nv">list</span><span class="k">})</span><span class="p">;</span> <span class="k">do
</span>docker pull <span class="k">${</span><span class="nv">i</span><span class="k">}</span>
<span class="k">done
</span>docker save <span class="k">$(</span><span class="nb">cat</span> <span class="k">${</span><span class="nv">list</span><span class="k">}</span> | tr <span class="s1">'\n'</span> <span class="s1">' '</span><span class="k">)</span> | gzip <span class="nt">-c</span> <span class="o">&gt;</span> <span class="k">${</span><span class="nv">images</span><span class="k">}</span>
</code></pre></div></div>
<ol>
<li>项目创建</li>
</ol>
<p>登录harbor.kago.site，创建公开项目rancher、minio</p>
<ol>
<li>镜像上传</li>
</ol>
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@harbor opt]#cat rancher-load-images.sh
<span class="c">#!/bin/bash</span>
<span class="nv">list</span><span class="o">=</span><span class="s2">"rancher-images.txt"</span>
<span class="nv">images</span><span class="o">=</span><span class="s2">"rancher-images.tar.gz"</span>
<span class="nv">POSITIONAL</span><span class="o">=()</span>
<span class="k">while</span> <span class="o">[[</span> <span class="nv">$# </span><span class="nt">-gt</span> 0 <span class="o">]]</span><span class="p">;</span> <span class="k">do
</span><span class="nv">key</span><span class="o">=</span><span class="s2">"</span><span class="nv">$1</span><span class="s2">"</span>
<span class="k">case</span> <span class="nv">$key</span> <span class="k">in</span>
<span class="nt">-r</span><span class="p">|</span><span class="nt">--registry</span><span class="p">)</span>
<span class="nv">reg</span><span class="o">=</span><span class="s2">"</span><span class="nv">$2</span><span class="s2">"</span>
<span class="nb">shift</span> <span class="c"># past argument</span>
<span class="nb">shift</span> <span class="c"># past value</span>
<span class="p">;;</span>
<span class="nt">-l</span><span class="p">|</span><span class="nt">--image-list</span><span class="p">)</span>
<span class="nv">list</span><span class="o">=</span><span class="s2">"</span><span class="nv">$2</span><span class="s2">"</span>
<span class="nb">shift</span> <span class="c"># past argument</span>
<span class="nb">shift</span> <span class="c"># past value</span>
<span class="p">;;</span>
<span class="nt">-i</span><span class="p">|</span><span class="nt">--images</span><span class="p">)</span>
<span class="nv">images</span><span class="o">=</span><span class="s2">"</span><span class="nv">$2</span><span class="s2">"</span>
<span class="nb">shift</span> <span class="c"># past argument</span>
<span class="nb">shift</span> <span class="c"># past value</span>
<span class="p">;;</span>
<span class="nt">-h</span><span class="p">|</span><span class="nt">--help</span><span class="p">)</span>
<span class="nb">help</span><span class="o">=</span><span class="s2">"true"</span>
<span class="nb">shift</span>
<span class="p">;;</span>
<span class="k">esac</span>
<span class="k">done
</span>usage <span class="o">()</span> <span class="o">{</span>
<span class="nb">echo</span> <span class="s2">"USAGE: </span><span class="nv">$0</span><span class="s2"> [--image-list rancher-images.txt] [--images rancher-images.tar.gz] --registry my.registry.com:5000"</span>
<span class="nb">echo</span> <span class="s2">" [-l|--images-list path] text file with list of images. 1 per line."</span>
<span class="nb">echo</span> <span class="s2">" [-l|--images path] tar.gz generated by docker save."</span>
<span class="nb">echo</span> <span class="s2">" [-r|--registry registry:port] target private registry:port."</span>
<span class="nb">echo</span> <span class="s2">" [-h|--help] Usage message"</span>
<span class="o">}</span>
<span class="k">if</span> <span class="o">[[</span> <span class="nt">-z</span> <span class="nv">$reg</span> <span class="o">]]</span><span class="p">;</span> <span class="k">then
</span>usage
<span class="nb">exit </span>1
<span class="k">fi
if</span> <span class="o">[[</span> <span class="nv">$help</span> <span class="o">]]</span><span class="p">;</span> <span class="k">then
</span>usage
<span class="nb">exit </span>0
<span class="k">fi
</span><span class="nb">set</span> <span class="nt">-e</span> <span class="nt">-x</span>
docker load <span class="nt">--input</span> <span class="k">${</span><span class="nv">images</span><span class="k">}</span>
<span class="k">for </span>i <span class="k">in</span> <span class="k">$(</span><span class="nb">cat</span> <span class="k">${</span><span class="nv">list</span><span class="k">})</span><span class="p">;</span> <span class="k">do
</span>docker tag <span class="k">${</span><span class="nv">i</span><span class="k">}</span> <span class="k">${</span><span class="nv">reg</span><span class="k">}</span>/<span class="k">${</span><span class="nv">i</span><span class="k">}</span>
docker push <span class="k">${</span><span class="nv">reg</span><span class="k">}</span>/<span class="k">${</span><span class="nv">i</span><span class="k">}</span>
<span class="k">done</span>
<span class="o">[</span>root@harbor opt]#docker login harbor.kago.site
<span class="o">[</span>root@harbor opt]#sh rancher-load-images.sh <span class="nt">-l</span> ./rancher-images.txt <span class="nt">-r</span> harbor.kago.site
</code></pre></div></div>
<h2 id="7安装rancher-server">7、安装rancher-server</h2>
<ol>
<li>启动rancher-server
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@server opt]#docker run <span class="nt">-d</span> <span class="nt">--restart</span><span class="o">=</span>unless-stopped <span class="nt">-p</span> 80:80 <span class="nt">-p</span> 443:443 <span class="nt">-v</span> /root/var/log/auditlog:/var/log/auditlog <span class="nt">-e</span> <span class="nv">AUDIT_LEVEL</span><span class="o">=</span>3 <span class="nt">-e</span> <span class="nv">AUDIT_LOG_PATH</span><span class="o">=</span>/var/log/auditlog/rancher-api-audit.log <span class="nt">-e</span> <span class="nv">AUDIT_LOG_MAXAGE</span><span class="o">=</span>20 <span class="nt">-e</span> <span class="nv">AUDIT_LOG_MAXBACKUP</span><span class="o">=</span>20 <span class="nt">-e</span> <span class="nv">AUDIT_LOG_MAXSIZE</span><span class="o">=</span>100 harbor.kago.site/rancher/rancher:v2.1.1
<span class="o">[</span>root@server ~]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
8dc861f595b4 5370bbde1a1b <span class="s2">"entrypoint.sh"</span> 7 hours ago Up 6 hours 0.0.0.0:80-&gt;80/tcp, 0.0.0.0:443-&gt;443/tcp stupefied_austin
</code></pre></div> </div>
</li>
<li>浏览器登录rancher-server
<ul>
<li>设置密码</li>
<li>设置url
<blockquote>
<p>重置管理员密码：docker exec -ti <container_id> reset-password</container_id></p>
</blockquote>
</li>
</ul>
</li>
</ol>
<h2 id="8k8s集群安装">8、K8S集群安装</h2>
<ol>
<li>修改系统镜像库地址</li>
</ol>
<p>使用浏览器登录rancher-server，点击“全局配置”–“系统设置”，找到“system-default-registry”，点击编辑，设置为harbor镜像库地址。</p>
<p><img src="/images/posts/rancher/2018-11-26_112843.png" alt="" /></p>
<p><img src="/images/posts/rancher/2018-11-26_112911.png" alt="" /></p>
<ol>
<li>
<p>添加集群 <br />
<img src="/images/posts/rancher/2018-11-26_112242.png" alt="" /></p>
</li>
<li>
<p>选择自定义 <br />
<img src="/images/posts/rancher/2018-11-26_112436.png" alt="" /></p>
</li>
<li>选择组件信息<br />
<img src="/images/posts/rancher/2018-11-26_112549.png" alt="" />
<blockquote>
<p>当有内外网时，点击“高级选型”添加主机内外网地址</p>
</blockquote>
</li>
<li>选择主机角色 <br />
<img src="/images/posts/rancher/2018-11-26_112702.png" alt="" />
<blockquote>
<p>主机角色中的etcd为k8s中数据库，controller包含k8s的master组件（apiserver、controller manager、schedule），worker包含kubelet、kube-proxy</p>
</blockquote>
</li>
<li>
<p>登录主机执行命令 <br />
拷贝给出的命令，登录目标主机执行命令，片刻后会自动注册至rancher-server</p>
</li>
<li>注册成功 <br />
<img src="/images/posts/rancher/2018-11-26_113449.png" alt="" /></li>
</ol>
<h2 id="9命令行工具">9、命令行工具</h2>
<ol>
<li>
<p>kubectl <br />
点击“集群”，点击“kubeconfig”复制文件到需要运行kubectl的主机~/.kube/config</p>
</li>
<li>
<p>rancher-cli <br />
登录rancher-server，点击用户头像，选择“api&amp;ksys”，点击添加key，填写描述信息，选择有效时长，保存key信息，复制token
在安装有rancher-cli的windows cmd中运行： <br />
rancher login https://rancher-server-ip –token &lt;token&gt;
<img src="/images/posts/rancher/2018-11-26_133849.png" alt="" /></p>
</li>
</ol></content><author><name>Barry New</name></author><summary type="html">CentOS7安装Rancher2.x</summary></entry><entry><title type="html">Linux下安装tomcat</title><link href="https://kago.site/2018/11/15/tomcat-install/" rel="alternate" type="text/html" title="Linux下安装tomcat" /><published>2018-11-15T00:00:00+08:00</published><updated>2018-11-15T00:00:00+08:00</updated><id>https://kago.site/2018/11/15/tomcat-install</id><content type="html" xml:base="https://kago.site/2018/11/15/tomcat-install/"><h1 id="前言">前言</h1>
<p>tomcat 是一款优秀的 web 应用服务器，可以用来运行 servlet。下文记录 tomcat 的安装以及使用 systemctl 命令进行控制的过程。</p>
<blockquote>
<p>systemctl命令是service和chkconfig命令的集合 service命令:用于启动、停止、重新启动和关闭系统服务，还可以显示所有系统服务的当前状态 chkconfig命令:用于更新（启动或停止）和查询系统服务的运行级信息</p>
</blockquote>
<h2 id="1安装tomcat">1、安装tomcat</h2>
<h3 id="11下载二进制文件">1.1、下载二进制文件</h3>
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@master ~]# wget http://mirrors.hust.edu.cn/apache/tomcat/tomcat-9/v9.0.13/bin/apache-tomcat-9.0.13.tar.gz
</code></pre></div></div>
<h3 id="12解压文件">1.2、解压文件</h3>
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@master ~]# <span class="nb">tar</span> <span class="nt">-zxf</span> apache-tomcat-9.0.13.tar.gz
</code></pre></div></div>
<h3 id="13移动文件到opt下">1.3、移动文件到/opt下</h3>
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@master ~]# mv apache-tomcat-9.0.13 /opt/apache-tomcat-9.0.13/
</code></pre></div></div>
<h3 id="14创建软链">1.4、创建软链</h3>
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@master opt]# ln <span class="nt">-s</span> /opt/apache-tomcat-9.0.13 /usr/local/tomcat
</code></pre></div></div>
<h3 id="15配置jdk环境变量">1.5、配置jdk环境变量</h3>
<p>添加：</p>
<div class="highlighter-rouge"><div class="highlight"><pre class="highlight"><code>JAVA_HOME=/usr/java/default
JRE_HOME=$JAVA_HOME/jre
PATH=$PATH:$JAVA_HOME/bin:$JRE_HOME/bin
CLASSPATH=.:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar:$JRE_HOME/lib
export JAVA_HOME PATH CLASSPATH
</code></pre></div></div>
<h3 id="16生效环境变量">1.6、生效环境变量</h3>
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@master opt]# <span class="nb">source</span> /etc/profile
</code></pre></div></div>
<h3 id="17配置tomcat端口默认8080">1.7、配置tomcat端口（默认8080）</h3>
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@master ~]# vim /usr/local/tomcat/conf/server.xml
<span class="c">#修改：</span>
&lt;Connector <span class="nv">port</span><span class="o">=</span><span class="s2">"8080"</span> <span class="nv">protocol</span><span class="o">=</span><span class="s2">"HTTP/1.1"</span>
</code></pre></div></div>
<h3 id="18启动tomcat">1.8、启动tomcat</h3>
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@master ~]# /usr/local/tomcat/bin/startup.sh
</code></pre></div></div>
<h3 id="19验证">1.9、验证</h3>
<p>浏览器输入：http://IP:PROT</p>
<h2 id="2配置systemctl">2、配置systemctl</h2>
<h3 id="21新建tomcatpid">2.1、新建tomcat.pid</h3>
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@master ~]# <span class="nb">cd</span> /usr/local/tomcat-9.0.13
<span class="o">[</span>root@master tomcat-9.0.13]# touch tomcat.pid
</code></pre></div></div>
<h3 id="22新建setenvshcatalinash调用">2.2、新建setenv.sh(catalina.sh调用）</h3>
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@master tomcat-9.0.13]# <span class="nb">cd </span>bin
<span class="o">[</span>root@master bin]# vim setenv.sh
<span class="c">#$CATALINA_BASE为tomcat安装的目录路径,将tomcat.pid指给了CATALINA_PID</span>
<span class="nv">CATALINA_PID</span><span class="o">=</span><span class="s2">"</span><span class="nv">$CATALINA_BASE</span><span class="s2">/tomcat.pid"</span>
<span class="c">#设置tomcat启动的java内存参数</span>
<span class="nv">JAVA_OPTS</span><span class="o">=</span><span class="s2">"-server -XX:PermSize=256M -XX:MaxPermSize=1024m -Xms512M -Xmx1024M -XX:MaxNewSize=256m"</span>
</code></pre></div></div>
<h3 id="23创建service文件">2.3、创建service文件</h3>
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@master bin]# vim /usr/lib/systemd/system/tomcat.service
<span class="o">[</span>Unit]
<span class="nv">Description</span><span class="o">=</span>Tomcat
<span class="nv">After</span><span class="o">=</span>syslog.target network.target remote-fs.target nss-lookup.target
<span class="o">[</span>Service]
<span class="nv">Type</span><span class="o">=</span>forking
<span class="nv">PIDFile</span><span class="o">=</span>/usr/local/tomcat-9.0.13/tomcat.pid
<span class="nv">ExecStart</span><span class="o">=</span>/usr/local/tomcat-9.0.13/bin/startup.sh
<span class="nv">ExecReload</span><span class="o">=</span>/bin/kill <span class="nt">-s</span> HUP <span class="nv">$MAINPID</span>
<span class="nv">ExecStop</span><span class="o">=</span>/bin/kill <span class="nt">-s</span> QUIT <span class="nv">$MAINPID</span>
<span class="nv">PrivateTmp</span><span class="o">=</span><span class="nb">true</span>
<span class="o">[</span>Install]
<span class="nv">WantedBy</span><span class="o">=</span>multi-user.target
</code></pre></div></div>
<h3 id="24测试">2.4、测试</h3>
<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">[</span>root@master bin]# systemctl start tomcat.service
<span class="o">[</span>root@master bin]# systemctl status tomcat.service
<span class="o">[</span>root@master bin]# systemctl stop tomcat.service
</code></pre></div></div></content><author><name>Barry New</name></author><summary type="html">前言</summary></entry><entry><title type="html">最美青海六日行</title><link href="https://kago.site/2018/05/08/%E9%9D%92%E6%B5%B76%E6%97%A5%E8%A1%8C/" rel="alternate" type="text/html" title="最美青海六日行" /><published>2018-05-08T00:00:00+08:00</published><updated>2018-05-08T00:00:00+08:00</updated><id>https://kago.site/2018/05/08/%E9%9D%92%E6%B5%B76%E6%97%A5%E8%A1%8C</id><content type="html" xml:base="https://kago.site/2018/05/08/%E9%9D%92%E6%B5%B76%E6%97%A5%E8%A1%8C/"><blockquote>
<center>
巍巍昆仑山脚下,
</center>
</blockquote>
<p>是我心中最美的家,</p>
<p>千山万水曾走过脚下,</p>
<p>始终眷恋深爱着她,</p>
<p>碧波荡漾的青海湖,</p>
<p>胜似一幅美丽的画,</p>
<p>香气怡人的郁金香,</p>
<p>朵朵绽放阳光下,</p>
<p>遥望山间的群群白羊,</p>
<p>像白云游走山脚下,</p>
<p>片片翠绿的青稞粮,</p>
<p>酿出美酒饮天下,</p>
<p>聆听嘹亮的青海花儿,</p>
<p>唱出心中幸福的话,</p>
<p>神圣庄严的塔尔寺,</p>
<p>播撒福祉传天下,</p>