内网离线安装 Rancher 过程记录

内网离线安装 Rancher 过程记录

1. 环境配置

---

• 关闭防火墙

  systemctl stop firewalld
  systemctl disable firewalld
  

• 关闭 SELinux

  sed -i 's#SELINUX=enforcing#SELINUX=disabled#g' /etc/selinux/config
  grep "SELINUX=disabled" /etc/selinux/config
  setenforce 0
  

• 关闭 swap 分区

  swapoff -a
  echo "vm.swappiness=0" >> /etc/sysctl.conf
  sysctl -p /etc/sysctl.conf
  sed -i 's$/dev/mapper/centos-swap$#/dev/mapper/centos-swap$g' /etc/fstab
  

2. 设置主机名称（可选）

---

使用域名作为 rancher server 地址可以便于后续更改集群 ip 等操作，只需要修改对应 hosts 解析即可。

• 使用 hostnamectl 设置主机名

  hostnamectl set-hostname server149115
  

• 编辑 /etc/hostname 修改主机名

  $ cat /etc/hostname
  server149115
  

• 退出重新登录终端即可

  logout
  

• 配置 /etc/hosts 域名解析

  $ cat /etc/hosts
  127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
  ::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
  
  192.168.149.115 server149115
  192.168.149.116 server149116
  192.168.149.117 server149117
  

3. 安装 Docker

---

• 拷贝离线安装包及依赖至主机任意目录
  docker rpm 全套离线安装包 下载链接

• 安装 rpm 包

  rpm -ivh *.rpm --nodeps --force
  

• 启动 docker 并设置开机启动

  systemctl start docker
  systemctl enable docker
  

• 查看 docker 启动状态

  $ systemctl status docker
  
  ● docker.service - Docker Application Container Engine
     Loaded: loaded (/usr/lib/systemd/system/docker.service; enabled; vendor preset: disabled)
     Active: active (running) since Fri 2022-06-24 01:49:42 EDT; 24min ago
       Docs: https://docs.docker.com
   Main PID: 9949 (dockerd)
     CGroup: /system.slice/docker.service
             └─9949 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock
  

• 查看 docker 版本号

  $ docker -v
  
  Docker version 20.10.17, build 100c701
  

4. 配置私有 Harbor 仓库

---

需要提前部署好内网环境私有镜像仓库服务 Harbor

• 配置 docker 私有仓库地址

  tee /etc/docker/daemon.json << EOF
  {
    "insecure-registries": ["192.168.149.191:10080"]
  }
  EOF
  

• 重启 docker 使生效

  systemctl daemon-reload
  systemctl restart docker
  

• 登录私有仓库

  $ docker login 192.168.149.191:10080
  
  Username: yfxt
  Password:
  WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
  Configure a credential helper to remove this warning. See
  https://docs.docker.com/engine/reference/commandline/login/#credentials-store
  
  Login Succeeded
  

5. 安装 Rancher

---

• 拷贝离线安装包至任意目录

• 修改 tag 标签

• 推送到私有镜像仓库

• 安装 rancher

  docker run -d --privileged --restart=unless-stopped \
    -p 18080:80 -p 18443:443 \
    -v /home/rancher:/var/lib/rancher \
    -e CATTLE_SYSTEM_DEFAULT_REGISTRY=192.168.149.191:10080 \
    -e CATTLE_SYSTEM_CATALOG=bundled \
    192.168.149.191:10080/rancher/rancher:v2.5.14
  

6. 配置 Rancher

---

• 访问 UI 界面

  http://192.168.149.115:18080
  https://192.168.149.115:18443
  

• 配置初始密码

  xxx
  

• 添加集群

  在 Rancher UI 中创建集群，填写相关信息，根据实际情况分配节点角色，将生成的命令在对应节点运行即可。

    192.168.149.115 - 控制节点 control, 集群数据库 etcd
    192.168.149.116 - 工作节点 worker
    192.168.149.117 - 工作节点 worker
  

7. 配置防火墙（可选）

---

公司研发有安全要求，会经常扫描端口和服务，所以需要开启防火墙，对特定 ip 段、特定端口放行。

• 开启防火墙

  systemctl start firewalld
  systemctl enable firewalld
  

• 配置规则为全部拦截

  firewall-cmd --permanent --zone=public --set-target=DROP
  

• 放行 rancher 集群节点之间全部端口

  firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.168.149.115 accept'
  firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.168.149.116 accept'
  firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.168.149.117 accept'
  

• 放行研发 149/150 网段 rancher ui 服务端口

  # 149 网段
  firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.168.149.0/24 port protocol=tcp port=18080 accept'
  firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.168.149.0/24 port protocol=tcp port=18443 accept'
  # 150 网段
  firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.168.150.0/24 port protocol=tcp port=18080 accept'
  firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.168.150.0/24 port protocol=tcp port=18443 accept'
  

• 放行服务器管理人员 SSH 端口

  firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.168.150.116 port protocol=tcp port=22 accept'
  

• 使配置生效

  firewall-cmd --reload
  

8. 运维 Rancher

---

8.1 创建项目

8.2 创建用户

8.3 为项目添加人员