腾讯蓝鲸智云平台搭建

准备环境，至少准备三台

主机名称	角色	操作环境
192.168.110.10	运维中控机	Centos 7
192.168.110.20	/	Centos 7
192.168.110.30	/	Centos 7

1. 安装开发者工具

[root@localhost ~]# yum -y groupinstall "Development Tools"
[root@localhost ~]# yum -y install net-tools

2. 关闭selinux和防火墙

[root@localhost ~]# cat /etc/selinux/config 
[root@localhost ~]# sed -i 's/\$releasever/7/g' /etc/yum.repos.d/CentOS7-Base-163.repo
[root@localhost ~]# systemctl stop firewalld       //停止firewalld
[root@localhost ~]# systemctl disable firewalld    //禁用firewall开机启动
Removed symlink /etc/systemd/system/multi-user.target.wants/firewalld.service.
Removed symlink /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.

3. 停止并禁用 NetWorkManager

[root@localhost ~]# systemctl stop NetworkManager
[root@localhost ~]# systemctl disable NetworkManager
Removed symlink /etc/systemd/system/multi-user.target.wants/NetworkManager.service.
Removed symlink /etc/systemd/system/dbus-org.freedesktop.NetworkManager.service.
Removed symlink /etc/systemd/system/dbus-org.freedesktop.nm-dispatcher.service.
Removed symlink /etc/systemd/system/network-online.target.wants/NetworkManager-wait-online.service.

4. 增加127.0.0.1的nameserver

[root@localhost ~]# chmod +x /etc/rc.d/rc.local 
[root@localhost ~]# echo "nameserver 127.0.0.1" >>/etc/resolv.conf
[root@localhost ~]# echo "nameserver 127.0.0.1" >>/etc/rc.d/rc.local
[root@localhost ~]# cat /etc/resolv.conf
nameserver 127.0.0.1      //127.0.0.1要放在首行
nameserver 192.168.110.2

5. 安装 rsync 命令

[root@localhost ~]# yum -y install rsync

6. 调整最大文件打开数

如果为默认的 1024，建议通过修改配置文件调整为 102400 或更大。
注意： limits.conf 初始文件的备份。

//检查当前root账号下的max open files值
[root@localhost ~]# ulimit -n
1024
[root@localhost ~]# ulimit -n 102400
[root@localhost ~]# ulimit -n
102400

[root@localhost ~]# cat < /etc/security/limits.d/99-nofile.conf
> root soft nofile 102400
> root hard nofile 102400
> EOF
[root@localhost ~]# cat /etc/security/limits.d/99-nofile.conf
 root soft nofile 102400
 root hard nofile 102400

7. 确认服务器时间同步

服务器后台时间不同步会对时间敏感的服务带来不可预见的后果。务必在安装和使用蓝鲸时保证时间同步。

//检查每台机器当前时间和时区是否一致，若相互之间差别大于3s(考虑批量执行时的时差)，建议校时。
[root@localhost ~]# date -R
Mon, 16 Nov 2020 11:10:39 +0800

//查看和ntp server的时间差异(需要外网访问，如果内网有ntpd服务器，自行替换域名为该服务的地址)
[root@localhost ~]# yum -y install ntpdate
[root@localhost ~]# ntpdate -d cn.pool.ntp.org     //没有安装ntpdate，先安装
注：如果输出的最后一行 offset 大于 1s 建议校时。

//和 ntp 服务器同步时间
[root@localhost ~]# ntpdate cn.pool.ntp.org
16 Nov 11:13:46 ntpdate[23493]: step time server 84.16.73.33 offset 1.434140 sec

8. 检查是否存在全局HTTP代理

//检查 http_proxy https_proxy 变量是否设置，若为空可以跳过后面的操作。
[root@localhost ~]# echo "$http_proxy" "$https_proxy"

注明：三台都需要操作以上步骤，原理如上

//在192.168.110.10中控机上操作如下：

9. 安装mysql

//安装系统环境python，默认安装2.7版本
[root@localhost src]# yum install python

//安装mysql
[root@localhost src]# cd /usr/local/src/
[root@localhost src]# wget http://repo.mysql.com/mysql57-community-release-el7-8.noarch.rpm
[root@localhost src]# rpm -ivh mysql57-community-release-el7-8.noarch.rpm

//重启mysql
[root@localhost src]# service mysqld restart
Redirecting to /bin/systemctl restart mysqld.service

//获取mysql创建的随机密码
[root@localhost ~]# grep "password" /var/log/mysqld.log
2020-11-16T02:27:18.557687Z 1 [Note] A temporary password is generated for root@localhost: na-=dib!h0sL

//通过随机密码登录
[root@localhost ~]# mysql -uroot -p'na-=dib!h0sL'
mysql: [Warning] Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 2
Server version: 5.7.32

Copyright (c) 2000, 2020, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> 

//使用命令重置密码
mysql> alter user 'root'@'localhost' identified by 'Passwd123!';
Query OK, 0 rows affected (0.00 sec)

mysql> exit
Bye

//退出验证
[root@localhost ~]# mysql -uroot -p'Passwd123!'
mysql: [Warning] Using a password on the command line interface can be insecure.
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 3
Server version: 5.7.32 MySQL Community Server (GPL)

Copyright (c) 2000, 2020, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> 

//修改my.cnf这个配置文件
[root@localhost ~]# vim /etc/my.cnf
[root@localhost ~]# tail -2 /etc/my.cnf
pid-file=/var/run/mysqld/mysqld.pid
skip-grant-tables   #添加这一行

10. 安装pip

[root@localhost ~]# yum -y install epel-release
[root@localhost ~]# yum -y install python-pip
//在线安装时，依赖 pip，需要配置可用的 pip 源。
[root@localhost ~]# vim /data/src/.pip/pip.conf
[global]
index-url = https://mirrors.cloud.tencent.com/pypi/simple
trusted-host = mirrors.cloud.tencent.com

声明：选择任意一台机器作为蓝鲸的运维中控机。之后的安装命令执行，如果没有特别说明，均在这台中控机上执行。

//将下载的蓝鲸社区版完整包上传到中控机，并解压到 同级 目录下。下载如下：https://bk.tencent.com/download/，以解压到 /data 目录为例：

11. 上传bkce包并解压到/data目录下

[root@localhost ~]# mkdir /data
[root@localhost ~]# ls
anaconda-ks.cfg  bkce_src-5.1.29.tar.gz
[root@localhost ~]# tar xf bkce_src-5.1.29.tar.gz -C /data/

//将 install.config.3ip.sample 复制为 install.config
[root@localhost ~]# cd /data/install/
[root@localhost install]# cp install.config.3ip.sample install.config

//修改install.config配置文件
[root@localhost install]# vim install.config
[bkce-basic]
192.168.110.10 nginx,rabbitmq,kafka(config),zk(config),es,appt,fta,consul,bkdata(databus)
192.168.110.20 mongodb,appo,kafka(config),zk(config),es,mysql,consul,bkdata(dataapi),beanstalk
192.168.110.30 paas,cmdb,job,gse,license,kafka(config),zk(config),es,redis,influxdb,consul,bkdata(monitor)

12. 配置ssl证书

访问http://bk.tencent.com/download/#ssl

//填入192.168.110.20和192.168.110.30的mac地址，将生成的ssl_certificates.tar.gz上传到192.168.110.10的/data下，登录192.168.110.10，执行如下操作
[root@localhost ~]# tar xf ssl_certificates.tar.gz -C /data/src/cert/

13. 配置 SSH 免密登陆

[root@localhost ~]# cd /data/install/
[root@localhost install]# bash configure_ssh_without_pass 

14. 安装前校验环境是否满足

[root@localhost ~]# cd /data/install/
[root@localhost install]# bash precheck.sh -r
start <> ... [OK]
start <> ... [OK]
start <> ... [OK]
start <> ... [OK]
start <> ... [OK]
start <> ... [OK]
start <> ... [OK]
start <> ... [OK]
start <> ... [OK]
start <> ... [OK]
start <> ... [OK]
start <> ... [OK]
start <> ... [OK]
start <> ... [OK]
start <> ... [OK]

15. 标准部署

cd /data/install

#该步骤后,可以打开 paas 平台
./bk_install paas  #安装paas平台及其依赖服务

#该步骤完成后, 可以打开 cmdb, 看到蓝鲸业务及示例业务
./bk_install cmdb  # 安装cmdb及其依赖服务

#该步骤完成后, 可以打开作业平台, 并执行作业
#同时在配置平台中可以看到蓝鲸的模块下加入了主机
./bk_install job # 安装作业平台及其依赖组件,并在安装蓝鲸的服务器上装好 gse_agent 供验证