Rancher实践记录1-单机环境

1台Linux主机简易部署rancher环境

一、部署docker环境
使用离线安装包安装：

tar -zxvf docker-ce-19.03.15-3.tar.gz
cd docker-ce-19.03.15-3
yum localinstall -y ./docker-dependentPackages/*.rpm
yum localinstall -y  ./*.rpm

使用yum安装：

yum remove docker  docker-common docker-selinux docker-engine
yum install -y yum-utils device-mapper-persistent-data lvm2
yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
yum install docker-ce
systemctl start docker
systemctl enable docker

配置镜像加速器：

mkdir -p /etc/docker
tee /etc/docker/daemon.json <<-'EOF'
{
  "registry-mirrors": ["https://kf4xvs0s.mirror.aliyuncs.com"]
}
EOF
systemctl daemon-reload
systemctl restart docker

二、使用如下脚本创建自定义CA证书（可以不做这一步，则下一步不挂载自定义证书）

#!/bin/bash
DNS_NAME=rancher.server.com
mkdir -p /opt/rancher/CA
cd  /opt/rancher/CA
openssl genrsa -out ca.key 4096
openssl req -x509 -new -nodes -sha512 -days 7300 -subj "/C=CN/ST=GanSu/L=Lanzhou/O=Global/OU=ZYROX/CN=$DNS_NAME" -key ca.key -out ca.crt
openssl genrsa -out $DNS_NAME.key 4096
openssl req -sha512 -new -subj "/C=CN/ST=Gansu/L=Lanzhou/O=Global/OU=ZYROX/CN=$DNS_NAME" -key $DNS_NAME.key -out $DNS_NAME.csr
cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1=$DNS_NAME
EOF
openssl x509 -req -sha512 -days 7300 -extfile v3.ext -CA ca.crt -CAkey ca.key -CAcreateserial -in $DNS_NAME.csr -out $DNS_NAME.crt
openssl x509 -inform PEM -in $DNS_NAME.crt -out $DNS_NAME.cert
cp $DNS_NAME.crt /etc/pki/ca-trust/source/anchors/$DNS_NAME.crt
update-ca-trust

三、使用docker快速部署rancher服务（测试使用，使用了ssl证书文件）

docker run -d --restart=unless-stopped --privileged \
  -p 8080:80 -p 8443:443 \
  --memory 4g \
  --memory-swap -1 \
  -v /opt/rancher:/var/lib/rancher \
  -v /opt/rancher/ssl/cert.pem:/etc/rancher/ssl/cert.pem \
  -v /opt/rancher/ssl/key.pem:/etc/rancher/ssl/key.pem \
  --name rancher_server \
  rancher/rancher:v2.5.12 --no-cacerts

四、如果增加域名绑定修改hosts文件：使用https://hostname.证书的域名访问，就可以https安全访问
或使用IP访问https://IP:8443 创建自定义集群

之前忽视的证书的重要性，如果只是docker测试一下rancher，不需要证书使用local集群简单测试。
如果需要增加自定义集群，发现节点常常不能自动注册成功。分析docker日志，查阅官方文档，发现确实存在这个报错，基本定位是证书的原因。
所以还是建议根据官方文档实例挂载证书：

docker run -d --restart=unless-stopped --privileged \
  -p 8080:80 -p 8443:443 \
  -v /opt/rancher:/var/lib/rancher \
  -v /opt/rancher/CA:/container/certs \
  -e SSL_CERT_DIR="/container/certs" \
  --name rancher_server \
  rancher/rancher:latest

五、添加自定义集群内工作节点，将docker宿主机作为自定义集群工作节点，进行如下节点环境调优：

echo "********************操作系统内核调优************************"
echo "
net.bridge.bridge-nf-call-ip6tables=1
net.bridge.bridge-nf-call-iptables=1
net.ipv4.ip_forward=1
net.ipv4.conf.all.forwarding=1
net.ipv4.neigh.default.gc_thresh1=4096
net.ipv4.neigh.default.gc_thresh2=6144
net.ipv4.neigh.default.gc_thresh3=8192
net.ipv4.neigh.default.gc_interval=60
net.ipv4.neigh.default.gc_stale_time=120
kernel.perf_event_paranoid=-1
net.ipv4.tcp_slow_start_after_idle=0
net.core.rmem_max=16777216
fs.inotify.max_user_watches=524288
kernel.softlockup_all_cpu_backtrace=1
kernel.softlockup_panic=0
kernel.watchdog_thresh=30
fs.file-max=2097152
fs.inotify.max_user_instances=8192
fs.inotify.max_queued_events=16384
vm.max_map_count=262144
fs.may_detach_mounts=1
net.core.netdev_max_backlog=16384
net.ipv4.tcp_wmem=4096 12582912 16777216
net.core.wmem_max=16777216
net.core.somaxconn=32768
net.ipv4.tcp_max_syn_backlog=8096
net.ipv4.tcp_rmem=4096 12582912 16777216
net.ipv6.conf.all.disable_ipv6=1
net.ipv6.conf.default.disable_ipv6=1
net.ipv6.conf.lo.disable_ipv6=1
kernel.yama.ptrace_scope=0
vm.swappiness=0
kernel.core_uses_pid=1
# Do not accept source routing
net.ipv4.conf.default.accept_source_route=0
net.ipv4.conf.all.accept_source_route=0
# Promote secondary addresses when the primary address is removed
net.ipv4.conf.default.promote_secondaries=1
net.ipv4.conf.all.promote_secondaries=1
# Enable hard and soft link protection
fs.protected_hardlinks=1
fs.protected_symlinks=1
net.ipv4.conf.all.rp_filter=0
net.ipv4.conf.default.rp_filter=0
net.ipv4.conf.default.arp_announce = 2
net.ipv4.conf.lo.arp_announce=2
net.ipv4.conf.all.arp_announce=2
net.ipv4.tcp_max_tw_buckets=5000
net.ipv4.tcp_syncookies=1
net.ipv4.tcp_fin_timeout=30
net.ipv4.tcp_synack_retries=2
kernel.sysrq=1
" >> /etc/sysctl.d/rke.conf
sysctl -p /etc/sysctl.d/rke.conf

echo "*******************系统文件数限制设置***************"
cat >> /etc/security/limits.conf <<EOF
* soft nofile 65535
* hard nofile 65536
* hard nproc 51200
* soft nproc 4096
EOF

echo "********************内核升级************************"
rpm -ivh kernel-ml-5.5.11-1.el7.elrepo.x86_64.rpm
grub2-set-default 0

重启再检查内核升级完成

reboot
uname -a

六、使用rancher提供的主机添加命令，添加自定义集群内工作节点–etcd --controlplane --worker，等待片刻完成1个集群工作节点部署。
（若需要添加多个节点，需要考虑nfs共享存储卷和keepalive高可用等，此处暂不处理）