服务器环境
服务器版本:CentOS Linux release 7.2.1511 (Core)
内核版本:3.10.0-327.el7.x86_64
1、搭建docker
(1)编辑/etc/sysctl.conf,添加如下内容
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.ipv4.ip_forward = 1
执行下面命令
modprobe br_netfilter
sysctl -p
(2)安装docker的yum源
yum install -y yum-utils device-mapper-persistent-data lvm2
yum-config-manager \
--add-repo \
https://download.docker.com/linux/centos/docker-ce.repo
(3)查看docker的版本
yum list docker-ce.x86_64 --showduplicates |sort -r
* updates: mirrors.aliyun.com
Loading mirror speeds from cached hostfile
Loaded plugins: fastestmirror
Installed Packages
* extras: mirrors.aliyun.com
* epel: mirrors.aliyun.com
docker-ce.x86_64 3:18.09.0-3.el7 docker-ce-stable
docker-ce.x86_64 18.06.1.ce-3.el7 docker-ce-stable
docker-ce.x86_64 18.06.1.ce-3.el7 @docker-ce-stable
docker-ce.x86_64 18.06.0.ce-3.el7 docker-ce-stable
docker-ce.x86_64 18.03.1.ce-1.el7.centos docker-ce-stable
docker-ce.x86_64 18.03.0.ce-1.el7.centos docker-ce-stable
docker-ce.x86_64 17.12.1.ce-1.el7.centos docker-ce-stable
docker-ce.x86_64 17.12.0.ce-1.el7.centos docker-ce-stable
docker-ce.x86_64 17.09.1.ce-1.el7.centos docker-ce-stable
docker-ce.x86_64 17.09.0.ce-1.el7.centos docker-ce-stable
docker-ce.x86_64 17.06.2.ce-1.el7.centos docker-ce-stable
docker-ce.x86_64 17.06.1.ce-1.el7.centos docker-ce-stable
docker-ce.x86_64 17.06.0.ce-1.el7.centos docker-ce-stable
docker-ce.x86_64 17.03.3.ce-1.el7 docker-ce-stable
docker-ce.x86_64 17.03.2.ce-1.el7.centos docker-ce-stable
docker-ce.x86_64 17.03.1.ce-1.el7.centos docker-ce-stable
docker-ce.x86_64 17.03.0.ce-1.el7.centos docker-ce-stable
* base: mirrors.aliyun.com
Available Packages
(4)安装最新版本docker
yum makecache fast
yum install -y --setopt=obsoletes=0 \
docker-ce-18.06.1.ce-3.el7
systemctl start docker
systemctl enable docker
(5)确认下iptables filter表中FOWARD链的默认策略(pllicy)为ACCEPT
iptables -nvL
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
255K 14M CATTLE_NETWORK_POLICY all -- * * 10.42.0.0/16 10.42.0.0/16
1300K 1914M CATTLE_FORWARD all -- * * 0.0.0.0/0 0.0.0.0/0
786K 406M DOCKER-USER all -- * * 0.0.0.0/0 0.0.0.0/0
786K 406M DOCKER-ISOLATION-STAGE-1 all -- * * 0.0.0.0/0 0.0.0.0/0
433K 109M ACCEPT all -- * docker0 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
2130 113K DOCKER all -- * docker0 0.0.0.0/0 0.0.0.0/0
351K 296M ACCEPT all -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0
716 37220 ACCEPT all -- docker0 docker0 0.0.0.0/0 0.0.0.0/0
2、搭建rancher的server端
(1)用docker搭建rancher
docker run -d --restart=always -p 8080:8080 rancher/server
(2)出现下面的错误,下面为docker错误日志
Dec 10 15:42:31 iZbp10cnscbfblnh5buomfZ dockerd: time="2018-12-10T15:42:31.530843247+08:00" level=error msg="Handler for POST /v1.38/containers/create returned error: mkdir /var/lib/docker/overlay2/6f1ba4b09228e52acc14d12f40f9af6754781f6b253a878d9e98e292c6fc41fb-init/merged/dev/shm: invalid argument"
查了很多资料,确认原因为存储驱动的问题,改为devicemapper就搞定了
修改文件/etc/docker/daemon.json
cat /etc/docker/daemon.json
{
"registry-mirrors": ["https://quv6i4g3.mirror.aliyuncs.com"],
"storage-driver": "devicemapper"
}
去掉启动选择存储驱动的启动参数,修改完成如下
cat /usr/lib/systemd/system/docker.service
[Unit]
Description=Docker Application Container Engine
Documentation=https://docs.docker.com
After=network-online.target firewalld.service
Wants=network-online.target
[Service]
Type=notify
# the default is not to use systemd for cgroups because the delegate issues still
# exists and systemd currently does not support the cgroup feature set required
# for containers run by docker
ExecStart=/usr/bin/dockerd -H tcp://0.0.0.0:2375 -H unix:///var/run/docker.sock
ExecReload=/bin/kill -s HUP $MAINPID
# Having non-zero Limit*s causes performance problems due to accounting overhead
# in the kernel. We recommend using cgroups to do container-local accounting.
LimitNOFILE=infinity
LimitNPROC=infinity
LimitCORE=infinity
# Uncomment TasksMax if your systemd version supports it.
# Only systemd 226 and above support this version.
#TasksMax=infinity
TimeoutStartSec=0
# set delegate yes so that systemd does not reset the cgroups of docker containers
Delegate=yes
# kill only the docker process, not all processes in the cgroup
KillMode=process
# restart the docker process if it exits prematurely
Restart=on-failure
StartLimitBurst=3
StartLimitInterval=60s
[Install]
WantedBy=multi-user.target
(3)重新启动docker,就可以了
systemctl restart docker
(4)server端搭建完成,用ip+端口直接可以访问rancher
(5)自己配置下用户权限
3、配置rancher的client端
(1)基础架构->主机->添加主机
(2)复制上面的命令在要添加client端的服务器运行,出现如下的错误:
INFO: Running Agent Registration Process, CATTLE_URL=http://xx.xx.xx.xx:8080/v1
INFO: Attempting to connect to: http://xx.xx.xx.xx:8080/v1
ERROR: http://xx.xx.xx.xx:8080/v1 is not accessible (Failed to connect to xx.xx.xx.xx port 8080: Connection timed out)
curl地址看下:
curl -k -i http://xx.xx.xx.xx:8080/v1
HTTP/1.1 401 Unauthorized
Content-Type: application/json; charset=utf-8
Date: Tue, 11 Dec 2018 02:47:40 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: PL=rancher;Path=/
Www-Authenticate: Basic realm="Enter API access key and secret key as username and password"
X-Api-Schemas: http://xx.xx.xx.xx:8080/v1/schemas
X-Rancher-Version: v1.6.25
Content-Length: 177
{"id":"6df18d62-d509-499c-8805-bdbf0b4e5783","type":"error","links":{},"actions":{},"status":401,"code":"Unauthorized","message":"Unauthorized","detail":null,"baseType":"error"}
curl -k -i http://xx.xx.xx.xx:8080/v1/scripts/2ACEE7A659A39604D5B0:1514678400000:rnrITfbHWobU2tjD3SNfleY8ePQ
HTTP/1.1 200 OK
Content-Type: text/plain
Date: Tue, 11 Dec 2018 02:48:09 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: PL=rancher;Path=/
Vary: Accept-Encoding, User-Agent
Www-Authenticate: Basic realm="Enter API access key and secret key as username and password"
X-Api-Schemas: http://xx.xx.xx.xx:8080/v1/schemas
X-Rancher-Version: v1.6.25
Content-Length: 268
#!/bin/sh
export CATTLE_REGISTRATION_ACCESS_KEY="registrationToken"
export CATTLE_REGISTRATION_SECRET_KEY="2ACEE7A659A39604D5B0:1514678400000:rnrITfbHWobU2tjD3SNfleY8ePQ"
export CATTLE_URL="http://xx.xx.xx.xx:8080/v1"
export DETECTED_CATTLE_AGENT_IP="192.168.0.1"
查了大量资料,开放与其他所有主机之间的 UDP
端口 500
和 4500,也尝试关闭了防火墙还是不行
最后找到了原因,进入rancher的server的容器内,发现容器的网络不通
docker exec -it cca2d5cea45c /bin/bash
ping百度ping不通
重启server端和client端的docker,就可以了
systemctl restart docker
OK!rancher简单的搭建完成,这些在本地虚拟机搭建完全没有问题,到线上环境还是出现不少的坑@=@