• 关闭防火墙

  systemctl stop firewalld
  systemctl disable firewalld
  

• 关闭 SELinux

  sed -i 's#SELINUX=enforcing#SELINUX=disabled#g' /etc/selinux/config
  grep "SELINUX=disabled" /etc/selinux/config
  setenforce 0
  

• 关闭 swap 分区

  swapoff -a
  echo "vm.swappiness=0" >> /etc/sysctl.conf
  sysctl -p /etc/sysctl.conf
  sed -i 's$/dev/mapper/centos-swap$#/dev/mapper/centos-swap$g' /etc/fstab
  

使用域名作为 rancher server 地址可以便于后续更改集群 ip 等操作，只需要修改对应 hosts 解析即可。

• 使用 hostnamectl 设置主机名

  hostnamectl set-hostname server149115
  

• 编辑 /etc/hostname 修改主机名

  $ cat /etc/hostname
  server149115
  

• 退出重新登录终端即可

• 配置 /etc/hosts 域名解析

  $ cat /etc/hosts
  127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
  ::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
  
  192.168.149.115 server149115
  192.168.149.116 server149116
  192.168.149.117 server149117
  

需要提前部署好内网环境私有镜像仓库服务 Harbor

• 配置 docker 私有仓库地址

  tee /etc/docker/daemon.json << EOF
  {
    "insecure-registries": ["192.168.149.191:10080"]
  }
  EOF
  

• 重启 docker 使生效

  systemctl daemon-reload
  systemctl restart docker
  

• 登录私有仓库

  $ docker login 192.168.149.191:10080
  
  Username: yfxt
  Password:
  WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
  Configure a credential helper to remove this warning. See
  https://docs.docker.com/engine/reference/commandline/login/#credentials-store
  
  Login Succeeded
  

• 拷贝离线安装包至任意目录

• 修改 tag 标签

• 推送到私有镜像仓库

• 安装 rancher

  docker run -d --privileged --restart=unless-stopped \
    -p 18080:80 -p 18443:443 \
    -v /home/rancher:/var/lib/rancher \
    -e CATTLE_SYSTEM_DEFAULT_REGISTRY=192.168.149.191:10080 \
    -e CATTLE_SYSTEM_CATALOG=bundled \
    192.168.149.191:10080/rancher/rancher:v2.5.14
  

• 访问 UI 界面

  http://192.168.149.115:18080
  https://192.168.149.115:18443
  

• 配置初始密码

  xxx
  

• 添加集群

  在 Rancher UI 中创建集群，填写相关信息，根据实际情况分配节点角色，将生成的命令在对应节点运行即可。

    192.168.149.115 - 控制节点 control, 集群数据库 etcd
    192.168.149.116 - 工作节点 worker
    192.168.149.117 - 工作节点 worker
  

公司研发有安全要求，会经常扫描端口和服务，所以需要开启防火墙，对特定 ip 段、特定端口放行。

• 开启防火墙

  systemctl start firewalld
  systemctl enable firewalld
  

• 配置规则为全部拦截

  firewall-cmd --permanent --zone=public --set-target=DROP
  

• 放行 rancher 集群节点之间全部端口

  firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.168.149.115 accept'
  firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.168.149.116 accept'
  firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.168.149.117 accept'
  

• 放行研发 149/150 网段 rancher ui 服务端口

  # 149 网段
  firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.168.149.0/24 port protocol=tcp port=18080 accept'
  firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.168.149.0/24 port protocol=tcp port=18443 accept'
  # 150 网段
  firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.168.150.0/24 port protocol=tcp port=18080 accept'
  firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.168.150.0/24 port protocol=tcp port=18443 accept'
  

• 放行服务器管理人员 SSH 端口

• 使配置生效

  firewall-cmd --reload