一、环境介绍：
1、操作系统：CentOS 7
2、主机结点：node1（192.168.5.251） node2（192.168.5.252） node3（192.168.5.253）
3、软件版本：calicoctl（version v1.6.1） etcdctl（version: 3.2.15） docker（version：17.12.0-ce）
192.168.5.251 node1 安装docker+etcd+calicoctl 192.168.5.252 node2 安装docker+etcd+calicoctl 192.168.5.253 node3 安装docker+etcd+calicoctl [root@node1 ~]# cat /etc/redhat-release CentOS Linux release 7.5.1804 (Core) 修改三个节点的主机名 (主机名最好和后面ETCD_NAME和calico的NODENAME名称起一样的名,否则最后可能会出现容器之间ping不通的现象) [root@node1 ~]# hostnamectl --static set-hostname node1 [root@node1 ~]# echo "node1" > /etc/hostname [root@node2 ~]# hostnamectl --static set-hostname node2 [root@node2 ~]# echo "node2" > /etc/hostname [root@node3 ~]# hostnamectl --static set-hostname node3 [root@node3 ~]# echo "node3" > /etc/hostname 关闭三台主机的防火墙。若开启iptables防火墙，则需要打开2380端口通信。 [root@node1 ~]# systemctl disable firewalld.service [root@node1 ~]# systemctl stop firewalld.service [root@node1 ~]# iptables -F [root@node1 ~]# firewall-cmd --state not running 在三台机器上都要设置hosts，均执行如下命令： [root@node1 ~]# vim /etc/hosts 192.168.5.251 node1 192.168.5.252 node2 192.168.5.253 node3 三台集机器上的ip转发功能打开 [root@node1 ~]# echo 1 > /proc/sys/net/ipv4/ip_forward [root@node1 ~]# cat /etc/sysctl.conf ...... net.ipv4.conf.all.rp_filter=1 net.ipv4.ip_forward=1 [root@node1 ~]# sysctl -p
二、配置ETCD集群
1、安装EPEL源 http://fedoraproject.org/wiki/EPEL 2、三台结点安装Etcd软件包 [root@node1 ~]# yum install etcd -y 3、三台结点配置ETCD集群模式 [root@node1 ~]# cat /etc/etcd/etcd.conf ETCD_DATA_DIR="/var/lib/etcd/default.etcd" ETCD_LISTEN_PEER_URLS="http://0.0.0.0:2380" ETCD_LISTEN_CLIENT_URLS="http://0.0.0.0:2379" # 根据不同主机进行相应修改，分别为node1 node2 node3 ETCD_NAME="node1" # 根据不同主机进行相应修改，分别为192.168.5.251 192.168.5.252 192.168.5.253 ETCD_INITIAL_ADVERTISE_PEER_URLS="http://192.168.5.251:2380" ETCD_ADVERTISE_CLIENT_URLS="http://192.168.5.251:2379" ETCD_INITIAL_CLUSTER="node1=http://192.168.5.251:2380,node2=http://192.168.5.252:2380,node3=http://192.168.5.253:2380" 3、启用Etcd服务，并测试是集群是否配置正确 [root@node1 ~]# systemctl start etcd [root@node1 ~]# export ETCDCTL_API=3 [root@node1 ~]# etcdctl member list 24535a04231931b0, started, node3, http://192.168.5.253:2380, http://192.168.5.253:2379 762f75df97deec48, started, node1, http://192.168.5.251:2380, http://192.168.5.251:2379 7d53f37d27d9c631, started, node2, http://192.168.5.252:2380, http://192.168.5.252:2379
二、 安装Docker，配置使用集群存储
1、安装 Docker https://yq.aliyun.com/articles/110806 2、配置Docker守护程序使用有群集存储 [root@node1 ~]# cat /etc/docker/daemon.json { "registry-mirrors": ["https://7i5u59ls.mirror.aliyuncs.com"], "cluster-store": "etcd://192.168.5.251:2379" } 3、重启Docker进程，并检查配置是否正确 [root@node1 ~]# systemctl restart docker [root@node1 ~]# docker info | grep "Cluster Store" Cluster Store: etcd://192.168.5.251:2379
三、配置calico基于sysinit方式启动
1、三台主机分别添加calico-node配置文件 [root@node1 calico]# cat /etc/calico/calico.env ETCD_ENDPOINTS="http://192.168.5.251:2379,http://192.168.5.252:2379,http://192.168.5.253:2379" ETCD_CA_FILE="" ETCD_CERT_FILE="" ETCD_KEY_FILE="" # 根据不同主机进行配置，分别为node1 node2 node3 CALICO_NODENAME="node1" CALICO_NO_DEFAULT_POOLS="" CALICO_IP="192.168.5.251" CALICO_IP6="" CALICO_AS="" CALICO_LIBNETWORK_ENABLED=true CALICO_NETWORKING_BACKEND=bird 2、三台主机分别添加calico-node sysinit配置文件 [root@node1 calico]# cat /etc/systemd/system/calico-node.service [Unit] Description=calico-node After=docker.service Requires=docker.service [Service] EnvironmentFile=/etc/calico/calico.env ExecStartPre=-/usr/bin/docker rm -f calico-node ExecStart=/usr/bin/docker run --net=host --privileged --name=calico-node -e NODENAME=${CALICO_NODENAME} -e IP=${CALICO_IP} -e IP6=${CALICO_IP6} -e CALICO_NETWORKING_BACKEND=${CALICO_NETWORKING_BACKEND} -e AS=${CALICO_AS} -e NO_DEFAULT_POOLS=${CALICO_NO_DEFAULT_POOLS} -e CALICO_LIBNETWORK_ENABLED=${CALICO_LIBNETWORK_ENABLED} -e ETCD_ENDPOINTS=${ETCD_ENDPOINTS} -e ETCD_CA_CERT_FILE=${ETCD_CA_CERT_FILE} -e ETCD_CERT_FILE=${ETCD_CERT_FILE} -e ETCD_KEY_FILE=${ETCD_KEY_FILE} -v /var/run/docker.sock:/var/run/docker.sock -v /var/log/calico:/var/log/calico -v /run/docker/plugins:/run/docker/plugins -v /lib/modules:/lib/modules -v /var/run/calico:/var/run/calico calico/node:v2.6.1 ExecStop=-/usr/bin/docker stop calico-node Restart=on-failure StartLimitBurst=3 StartLimitInterval=60s [Install] WantedBy=multi-user.target 3、三台主机分别启动calico-node服务 [root@node1 calico]# systemctl daemon-reload [root@node1 calico]# systemctl start calico-node [root@node1 calico]# tail -f /var/log/messages ... Mar 11 12:23:46 node1 docker: Starting libnetwork service Mar 11 12:23:46 node1 docker: Calico node started successfully 4、下载calicoctl二进制文件，并添加执行权限 [root@node1 calico]# wget -O /usr/local/bin/calicoctl https://github.com/projectcalico/calicoctl/releases/download/v1.6.1/calicoctl [root@node1 calico]# chmod +x /usr/local/bin/calicoctl 5、检查calico-node是否正常 [root@node1 calico]# calicoctl node status Calico process is running. IPv4 BGP status +---------------+-------------------+-------+----------+-------------+ | PEER ADDRESS | PEER TYPE | STATE | SINCE | INFO | +---------------+-------------------+-------+----------+-------------+ | 192.168.5.252 | node-to-node mesh | up | 04:23:50 | Established | | 192.168.5.253 | node-to-node mesh | up | 04:23:50 | Established | +---------------+-------------------+-------+----------+-------------+ IPv6 BGP status No IPv6 peers found. [root@node1 calico]# calicoctl get node NAME node1 node2 node3
三、测试calico网络
1、创建网络 [root@node1 ~]# docker network create --driver calico --ipam-driver calico-ipam net1 #在任意一台主机，都可以看到新增的网络插件 [root@node1 ~]# docker network ls ... 9316f6603268 net1 calico global ... 2、在node1 node2 node3分别建立一个容器，查看IP地址 [root@node1 ~]# docker run --net net1 --name workload-A -tid busybox [root@node1 ~]# docker exec -it workload-A ip addr ... inet 192.168.166.136/32 brd 192.168.166.136 scope global cali0 ... [root@node2 ~]# docker run --net net1 --name workload-B -tid busybox [root@node1 ~]# docker exec -it workload-B ip addr ... inet 192.168.104.2/32 brd 192.168.104.2 scope global cali0 ... [root@node3 ~]# docker run --net net1 --name workload-C -tid busybox [root@node1 ~]# docker exec -it workload-C ip addr ... inet 192.168.135.7/32 brd 192.168.135.7 scope global cali0 ... 3、在node1的容器中(workload-A)，ping各结点的容器IP，测试网络是否正常 / # ping 192.168.135.7 PING 192.168.135.7 (192.168.135.7): 56 data bytes 64 bytes from 192.168.135.7: seq=77 ttl=62 time=0.797 ms / # ping 192.168.104.2 PING 192.168.104.2 (192.168.104.2): 56 data bytes 64 bytes from 192.168.104.2: seq=0 ttl=62 time=56.072 ms 4、查看各结点的路由表 [root@node1 ~]# route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 192.168.5.2 0.0.0.0 UG 100 0 0 ens33 172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0 192.168.5.0 0.0.0.0 255.255.255.0 U 100 0 0 ens33 192.168.104.0 192.168.5.252 255.255.255.192 UG 0 0 0 ens33 192.168.122.0 0.0.0.0 255.255.255.0 U 0 0 0 virbr0 192.168.135.0 192.168.5.253 255.255.255.192 UG 0 0 0 ens33 192.168.166.128 0.0.0.0 255.255.255.192 U 0 0 0 * 192.168.166.136 0.0.0.0 255.255.255.255 UH 0 0 0 calia42c5f1e64a [root@node2 ~]# route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 192.168.5.2 0.0.0.0 UG 100 0 0 ens33 172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0 192.168.5.0 0.0.0.0 255.255.255.0 U 100 0 0 ens33 192.168.104.0 0.0.0.0 255.255.255.192 U 0 0 0 * 192.168.104.2 0.0.0.0 255.255.255.255 UH 0 0 0 calic7493c5fa1e 192.168.122.0 0.0.0.0 255.255.255.0 U 0 0 0 virbr0 192.168.135.0 192.168.5.253 255.255.255.192 UG 0 0 0 ens33 192.168.166.128 192.168.5.251 255.255.255.192 UG 0 0 0 ens33 [root@node3 ~]# route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 192.168.5.2 0.0.0.0 UG 100 0 0 ens33 172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0 192.168.5.0 0.0.0.0 255.255.255.0 U 100 0 0 ens33 192.168.104.0 192.168.5.252 255.255.255.192 UG 0 0 0 ens33 192.168.122.0 0.0.0.0 255.255.255.0 U 0 0 0 virbr0 192.168.135.0 0.0.0.0 255.255.255.192 U 0 0 0 * 192.168.135.7 0.0.0.0 255.255.255.255 UH 0 0 0 cali4a45031fc02 192.168.166.128 192.168.5.251 255.255.255.192 UG 0 0 0 ens33
参考 https://www.cnblogs.com/kevingrace/p/6864804.html?utm_source=itdadao&utm_medium=referral
https://my.oschina.net/huangweibin/blog/1632932