1. #! /bin/sh
    2. # 更新系统
    3. yum -y update
    5. # 安装基础软件
    6. yum -y install net-tools lrzsz wget vim
    8. # 关闭防火墙
    9. systemctl stop firewalld
    10. systemctl disable firewalld
    11. systemctl status firewalld
    13. # 关闭selinux,把selinux状态改为disabled
    14. getenforce
    15. setenforce 0 
    16. sed -i 's/^SELINUX=.*$/SELINUX=disabled/g' /etc/selinux/config
    17. getenforce
    19. # 把服务器的时间改成统一的时区
    20. timedatectl set-timezone Asia/Shanghai
    22. # 关闭swap
    23. swapoff -a
    24. yes | cp /etc/fstab /etc/fstab_bak
    25. cat /etc/fstab_bak |grep -v swap > /etc/fstab
    27. # 设置ntp时间同步
    28. yum install -y ntpdate
    29. ntpdate -u ntp.api.bz
    31. #set the file limit
    32. #步骤一
    33. #echo "ulimit -SHn 102400" >> /etc/rc.local
    34. STR_NAME="ulimit -SHn 102400"
    35. if grep -Fxq "$STR_NAME" /etc/rc.local
    36. then
    37.     echo "setting is exist"
    38. else
    39.     echo "$STR_NAME" >> /etc/rc.local
    40. fi
    41. chmod +x /etc/rc.d/rc.local
    42. grep "$STR_NAME" /etc/rc.local
    44. #步骤二
    45. #cat >> /etc/security/limits.conf << EOF
    46. #*           hard    nproc           10240
    47. #*           soft    nproc           10240
    48. #*           soft   nofile       65535
    49. #*           hard   nofile       65535
    50. #EOF
    51. STR_NAME1="*            hard    nproc           10240"
    52. STR_NAME2="*            soft    nproc           10240"
    53. STR_NAME3="*            soft    nofile          65535"
    54. STR_NAME4="*            hard    nofile          65535"
    55. for STR_NAME in "$STR_NAME1" "$STR_NAME2" "$STR_NAME3" "$STR_NAME4"
    56. do
    57. if grep -Fxq "$STR_NAME" /etc/security/limits.conf
    58. then
    59.     echo "setting is exist"
    60. else
    61.    echo "$STR_NAME" >> /etc/security/limits.conf
    62. fi
    63. done
    64. grep "$STR_NAME1" /etc/security/limits.conf
    65. grep "$STR_NAME2" /etc/security/limits.conf
    66. grep "$STR_NAME3" /etc/security/limits.conf
    67. grep "$STR_NAME4" /etc/security/limits.conf
    69. #tune kernel parametres
    70. cat > /etc/sysctl.d/99-sysctl.conf << EOF
    71. vm.swappiness = 0
    72. net.ipv4.ip_forward = 1
    73. net.ipv4.conf.all.rp_filter = 1
    74. net.bridge.bridge-nf-call-ip6tables = 1
    75. net.bridge.bridge-nf-call-iptables = 1
    76. net.ipv4.conf.default.rp_filter = 1
    77. net.ipv4.conf.default.accept_source_route = 0
    78. kernel.sysrq = 0
    79. kernel.core_uses_pid = 1
    80. net.ipv4.tcp_syncookies = 1
    81. kernel.msgmnb = 65536
    82. kernel.msgmax = 65536
    83. kernel.shmmax = 68719476736
    84. kernel.shmall = 4294967296
    85. net.ipv4.tcp_max_tw_buckets = 6000
    86. net.ipv4.tcp_sack = 1
    87. net.ipv4.tcp_window_scaling = 1
    88. net.ipv4.tcp_rmem = 4096 87380 4194304
    89. net.ipv4.tcp_wmem = 4096 16384 4194304
    90. net.core.wmem_default = 8388608
    91. net.core.rmem_default = 8388608
    92. net.core.rmem_max = 16777216
    93. net.core.wmem_max = 16777216
    94. net.core.netdev_max_backlog = 262144
    95. net.core.somaxconn = 262144
    96. net.ipv4.tcp_max_orphans = 3276800
    97. net.ipv4.tcp_max_syn_backlog = 262144
    98. net.ipv4.tcp_timestamps = 0
    99. net.ipv4.tcp_synack_retries = 1
    100. net.ipv4.tcp_syn_retries = 1
    101. net.ipv4.tcp_tw_recycle = 1
    102. net.ipv4.tcp_tw_reuse = 1
    103. net.ipv4.tcp_syncookies = 1
    104. net.ipv4.tcp_mem = 94500000 915000000 927000000
    105. net.ipv4.tcp_fin_timeout = 10
    106. net.ipv4.tcp_keepalive_time = 1200
    107. net.ipv4.ip_local_port_range = 5000 65000
    108. fs.file-max=65535
    109. net.ipv4.tcp_orphan_retries = 3
    110. net.ipv4.tcp_keepalive_intvl = 15
    111. kernel.sem = 250 32000 100 128
    112. EOF
    113. /sbin/sysctl -p
    115. #lock system user
    116. passwd -l dbus
    117. passwd -l games
    118. passwd -l ftp
    119. passwd -l mail
    120. passwd -l shutdown
    121. passwd -l halt
    122. passwd -l operator
    123. passwd -l sync
    124. passwd -l adm
    125. passwd -l lp
    127. # 添加ipvs的模块
    128. cat > /etc/sysconfig/modules/ipvs.modules <<EOF
    129. #!/bin/bash
    130. ipvs_modules="ip_vs ip_vs_lc ip_vs_wlc ip_vs_rr ip_vs_wrr ip_vs_lblc ip_vs_lblcr ip_vs_dh ip_vs_sh ip_vs_fo ip_vs_nq ip_vs_sed ip_vs_ftp nf_conntrack"
    131. for kernel_module in \${ipvs_modules}; do
    132. /sbin/modinfo -F filename \${kernel_module} > /dev/null 2>&1
    133. if [ $? -eq 0 ]; then
    134. /sbin/modprobe \${kernel_module}
    135. fi
    136. done
    137. EOF
    139. #查看
    140. chmod 755 /etc/sysconfig/modules/ipvs.modules && bash /etc/sysconfig/modules/ipvs.modules && lsmod | grep ip_vs
    142. # 安装contained
    143. yum install -y yum-utils device-mapper-persistent-data lvm2
    144. yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
    145. yum install containerd -y
    147. cat <<EOF | sudo tee /etc/modules-load.d/containerd.conf
    148. overlay
    149. br_netfilter
    150. EOF
    151. modprobe overlay
    152. modprobe br_netfilter
    154. containerd config default > /etc/containerd/config.toml
    155. sed -i 's#k8s.gcr.io#registry.aliyuncs.com/google_containers#g' /etc/containerd/config.toml
    156. sed -i '/containerd.runtimes.runc.options/a\ \ \ \ \ \ \ \ \ \ \ \ SystemdCgroup = true' /etc/containerd/config.toml
    158. crictl config runtime-endpoint /run/containerd/containerd.sock
    159. systemctl daemon-reload
    160. systemctl enable containerd
    161. systemctl restart containerd
    164. # 配置kubernetes源
    165. cat > /etc/yum.repos.d/kubernetes.repo << EOF 
    166. [kubernetes]
    167. name=Kubernetes Repo
    168. baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
    169. gpgcheck=0
    170. gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg
    171. enabled=1
    172. EOF
    174. #配置epel源
    175. #设置centos7的YUM源为国内阿里云源epel源
    176. cd /etc/yum.repos.d/
    177. if [ ! -f epel-7.repo ];then
    178. wget http://mirrors.aliyun.com/repo/epel-7.repo
    179. fi
    181. # 加载源配置
    182. yum clean all
    183. yum makecache
    187. # 设置hosts配置文件
    188. for STR_NAME in "192.168.117.121 k8s-master01" "192.168.117.122 k8s-master02" "192.168.117.123 k8s-master03" "192.168.117.124 k8s-node01" "192.168.117.125 k8s-node02"
    189. do
    190. if grep -Fxq "$STR_NAME" /etc/hosts
    191. then
    192.     echo "setting is exist"
    193. else
    194.     echo  "$STR_NAME" >> /etc/hosts
    195. fi
    196. done
    199. # 关闭UseDNS，加速ssh连接
    200. sed -i 's/#UseDNS yes/UseDNS no/g' /etc/ssh/sshd_config
    201. grep UseDNS /etc/ssh/sshd_config
    202. systemctl restart sshd