kubernetes集群安装指南：docker-ce部署

原创

清白之年 2019-07-04 18:12:55 博主文章分类：Cloud Native 云原生实践 ©著作权

文章标签 kubernetes docker docker-ce 文章分类 Docker 云计算

©著作权归作者所有：来自51CTO博客作者清白之年的原创作品，请联系作者获取转载授权，否则将追究法律责任

docker是POD基本运行环境，kubernetes默认以dockerd作为runtime运行引擎，在安装docker-ce前必须先升级内核到最新lts版，这是因为为了让docker-ce支持数据存储类型overlay2，这里将会以二进制文件方式部署在所有的worker节点上部署docker-ce。

1. 准备工作

#################### Variable parameter setting ######################
DOCKER_INSTALL_PATH=/data/apps/k8s/docker
SOFTWARE=/root/software
VERSION=18.09.6
PACKAGE=docker-${VERSION}.tgz
DOWNLOAD_URL=https://download.docker.com/linux/static/stable/x86_64/$PACKAGE
MIRRORS1=https://docker.mirrors.ustc.edu.cn
MIRRORS2=https://registry-mirrors.mo9.com
USER=docker

2. 安装docker

准备docker-ce安装环境

# 1.Uninstall the original docker installation package
sudo yum -y remove docker docker-client \
  docker-client-latest  docker-common docker-latest \
  docker-latest-logrotate docker-selinux docker-engine-selinux docker-engine 
### 2 Setting firewall rules for docker
/sbin/iptables -P FORWARD ACCEPT
sudo sed -i '/iptables -P FORWARD ACCEPT/d' /etc/rc.local
echo -e "/sbin/iptables -P FORWARD ACCEPT"  >> /etc/rc.local


### 3.Install docker-ce package with yum.
sudo yum install -y yum-utils device-mapper-persistent-data lvm2 bridge-utils 
sudo yum-config-manager \
  --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo

创建docker安装相关安装目录以及dockers用户组

### 4.Install docker-ce package with source.
# Check if the install directory exists and Check if the docker group exists .
if [ ! -d $DOCKER_INSTALL_PATH/bin ]; then
     mkdir -p $DOCKER_INSTALL_PATH/bin
fi

egrep "^$USER" /etc/group-
if [ $? -ne 0 ]; then
     groupadd $USER
fi


### 5.Download source package of docker-ce
if [ ! -f "$SOFTWARE/docker-${VERSION}.tgz" ]; then
     wget $DOWNLOAD_URL -P $SOFTWARE >>/dev/null 2>&1
fi
cd $SOFTWARE && tar -zxf $SOFTWARE/docker-${VERSION}.tgz -C ./
sudo cp -fp $SOFTWARE/docker/* $DOCKER_INSTALL_PATH/bin
cd $DOCKER_INSTALL_PATH/bin/
ln -sf docker,dockerd,containerd,containerd-shim,runc,ctr /usr/local/bin


### 6.Create daemon.json file for docker
# Create daemon.json file  path
if [ ! -d "/etc/docker" ]; then
     mkdir /etc/docker/
fi

docker默认以root用户运行，为了安全起见，方便其他用户调用docker api，需要创建一个docker组用户

创建docker配置文件

cat >/etc/docker/daemon.json <<EOF
{
	"authorization-plugins": [],
	"dns": ["223.5.5.5","223.4.4.4"],
	"dns-opts": [],
	"dns-search": [],
	"exec-opts": [],
	"data-root": "$DOCKER_INSTALL_PATH/data",
        "exec-root": "$DOCKER_INSTALL_PATH/exec",
	"experimental": false,
	"storage-driver": "overlay2",
        "storage-opts": ["overlay2.override_kernel_check=true"  ],
	"labels": [],
	"live-restore": true,
	"log-driver": "syslog",
	"log-opts": {},
	"pidfile": "/var/run/docker/docker.pid",
	"cluster-store": "",
	"cluster-store-opts": {},
	"cluster-advertise": "",
	"max-concurrent-downloads": 20,
	"max-concurrent-uploads": 5,
	"shutdown-timeout": 15,
	"debug": true,
	"default-ulimit": ["65535:65535"],
	"hosts": ["tcp://127.0.0.1:2376","unix:///var/run/docker.sock"],
	"log-level": "INFO",
	"swarm-default-advertise-addr": "",
	"api-cors-header": "",
	"selinux-enabled": false,
	"userns-remap": "",
	"group": "docker",
	"cgroup-parent": "",
	"init": false,
	"init-path": "/usr/libexec/docker-init",
	"ipv6": false,
	"iptables": true,
	"ip-forward": false,
	"userland-proxy": false,
	"userland-proxy-path": "/usr/libexec/docker-proxy",
	"ip": "0.0.0.0",
	"bridge": "",
	"fixed-cidr": "",
	"default-gateway": "",
	"icc": false,
	"raw-logs": false,
	"registry-mirrors": ["$MIRRORS1", "$MIRRORS2"],
	"seccomp-profile": "",
	"insecure-registries": [],
	"runtimes": {
		"cc-runtime": {
			"path": "/usr/bin/cc-runtime"
		},
		"custom": {
			"path": "/usr/local/bin/my-runc-replacement",
			"runtimeArgs": [
				"--debug"
			]
		}
	}
}
EOF

这里使用overlay2作为docker数据存储引擎
关于docker demon.json参数请参考docker官方文档

创建docker服务启动文件

cat >/usr/lib/systemd/system/docker.service <<"EOF"
[Unit]
Description=Docker Application Container Engine
Documentation=https://docs.docker.com
After=network-online.target firewalld.service
Wants=network-online.target
[Service]
Type=notify
# the default is not to use systemd for cgroups because the delegate issues still
# exists and systemd currently does not support the cgroup feature set required
# for containers run by docker
EnvironmentFile=-/run/flannel/docker
ExecStart=/usr/local/bin/dockerd  $DOCKER_NETWORK_OPTIONS
ExecReload=/bin/kill -s HUP $MAINPID
# Having non-zero Limit*s causes performance problems due to accounting overhead
# in the kernel. We recommend using cgroups to do container-local accounting.
LimitNOFILE=infinity
LimitNPROC=infinity
LimitCORE=infinity
# Uncomment TasksMax if your systemd version supports it.
# Only systemd 226 and above support this version.
#TasksMax=infinity
TimeoutStartSec=0
# set delegate yes so that systemd does not reset the cgroups of docker containers
Delegate=yes
# kill only the docker process, not all processes in the cgroup
KillMode=process
# restart the docker process if it exits prematurely
Restart=on-failure
StartLimitBurst=3
StartLimitInterval=60s
[Install]
WantedBy=multi-user.target
EOF