使用rancher快速建立一套生产可用的k8s集群

一、目的

本文档用于介绍，如何快速在生产环境安装一个稳定运行的kubernetes集群，用于运行项目微服务。

二、主机规划

主机名称	角色	IP地址	基础软件
rancher	管理k8s集群	192.168.130.5	docker-ce
k8s-master01	k8s集群主节点	192.168.130.6	docker-ce
k8s-worker01	k8s集群从节点	192.168.130.7	docker-ce

以下均以「主机名称」说明在哪台主机上操作。所有节点均为Centos 7。

三、节点 OS 调优

3.1 内核调优

echo "
net.bridge.bridge-nf-call-ip6tables=1
net.bridge.bridge-nf-call-iptables=1
net.ipv4.ip_forward=1
net.ipv4.conf.all.forwarding=1
net.ipv4.neigh.default.gc_thresh1=4096
net.ipv4.neigh.default.gc_thresh2=6144
net.ipv4.neigh.default.gc_thresh3=8192
net.ipv4.neigh.default.gc_interval=60
net.ipv4.neigh.default.gc_stale_time=120

# 参考 https://github.com/prometheus/node_exporter#disabled-by-default
kernel.perf_event_paranoid=-1

#sysctls for k8s node config
net.ipv4.tcp_slow_start_after_idle=0
net.core.rmem_max=16777216
fs.inotify.max_user_watches=524288
kernel.softlockup_all_cpu_backtrace=1

kernel.softlockup_panic=0

kernel.watchdog_thresh=30
fs.file-max=2097152
fs.inotify.max_user_instances=8192
fs.inotify.max_queued_events=16384
vm.max_map_count=262144
fs.may_detach_mounts=1
net.core.netdev_max_backlog=16384
net.ipv4.tcp_wmem=4096 12582912 16777216
net.core.wmem_max=16777216
net.core.somaxconn=32768
net.ipv4.ip_forward=1
net.ipv4.tcp_max_syn_backlog=8096
net.ipv4.tcp_rmem=4096 12582912 16777216

net.ipv6.conf.all.disable_ipv6=1
net.ipv6.conf.default.disable_ipv6=1
net.ipv6.conf.lo.disable_ipv6=1

kernel.yama.ptrace_scope=0
vm.swappiness=0

# 可以控制core文件的文件名中是否添加pid作为扩展。
kernel.core_uses_pid=1

# Do not accept source routing
net.ipv4.conf.default.accept_source_route=0
net.ipv4.conf.all.accept_source_route=0

# Promote secondary addresses when the primary address is removed
net.ipv4.conf.default.promote_secondaries=1
net.ipv4.conf.all.promote_secondaries=1

# Enable hard and soft link protection
fs.protected_hardlinks=1
fs.protected_symlinks=1

# 源路由验证
# see details in https://help.aliyun.com/knowledge_detail/39428.html
net.ipv4.conf.all.rp_filter=0
net.ipv4.conf.default.rp_filter=0
net.ipv4.conf.default.arp_announce = 2
net.ipv4.conf.lo.arp_announce=2
net.ipv4.conf.all.arp_announce=2

# see details in https://help.aliyun.com/knowledge_detail/41334.html
net.ipv4.tcp_max_tw_buckets=5000
net.ipv4.tcp_syncookies=1
net.ipv4.tcp_fin_timeout=30
net.ipv4.tcp_synack_retries=2
kernel.sysrq=1
" >> /etc/sysctl.conf

接着执行 sysctl -p命令。

3.2 nofile

cat >> /etc/security/limits.conf <<EOF
* soft nofile 65535
* hard nofile 65536
EOF

3.3 关闭防火墙

systemctl disable firewalld.service

3.4 关闭selinux

sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config

四、Docker安装

每台主机均使用 root 用户登录，每台均安装 docker-ce，安装命令为。

mkdir -p /etc/docker
tee /etc/docker/daemon.json <<-'EOF'
{
    "oom-score-adjust": -1000,
    "data-root":"/var/lib/docker",
    "log-driver":"json-file",
    "log-opts":{
        "max-size":"100m",
        "max-file":"3"
    },
    "default-address-pools":[
        {
            "base":"10.168.0.0/16",
            "size":24
        }
    ],
    "max-concurrent-downloads":50,
    "max-concurrent-uploads":50,
    "registry-mirrors":[
        "https://x6kx40rp.mirror.aliyuncs.com",
        "https://hub-mirror.c.163.com",
        "https://docker.mirrors.ustc.edu.cn",
        "https://registry.docker-cn.com"
    ],
    "storage-driver": "overlay2",
    "storage-opts": [
    "overlay2.override_kernel_check=true"
    ]
}
EOF
yum install -y yum-utils device-mapper-persistent-data lvm2

yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo

yum makecache fast

yum -y install docker-ce

systemctl enable docker
systemctl daemon-reload
systemctl restart docker

对于 CentOS 系统，docker.service 默认位于/usr/lib/systemd/system/docker.service，编辑docker.service，添加以下参数。

防止 docker 服务 OOM： OOMScoreAdjust=-1000
开启 iptables 转发链：

ExecStartPost=/usr/sbin/iptables -P FORWARD ACCEPT

配置完成后重启服务器。

五、Rancher安装

在主机 rancher 上，执行如下命令。

docker run -d \
--name rancher \
--restart=unless-stopped \
--privileged \
  -p 80:80 -p 443:443 \
  -v /data/rancher:/var/lib/rancher \
  registry.cn-hangzhou.aliyuncs.com/rancher/rancher:v2.5.16

待容器拉取完毕后1分钟后进入页面，首次进入需要设置新密码。