安装docker:https://www.cnblogs.com/cjsblogs/p/8717304.html
安装etcd集群:https://www.cnblogs.com/cjsblogs/p/8716976.html
先安装docker以及etcd集群
将etcd集群的/opt/ssl/*.pem全部拷贝到对应的docker宿主机的/opt/ssl下
daemon.json添加etcd相关配置
"cluster-store": "etcd://172.16.150.25:2379", "cluster-store-opts": { "kv.cacertfile": "/opt/ssl/ca.pem", "kv.certfile": "/opt/ssl/etcd.pem", "kv.keyfile": "/opt/ssl/etcd-key.pem" } }
重启docker
systemctl daemon-reload && systemctl restart docker
mkdir -p /opt/platform/calico/certs /opt/platform/calico/log
创建证书:由于搭建etcd集群中已经创建了etcd的证书，calico只需要复用即可
cp -a /opt/ssl/*.pem /opt/platform/calico/certs/
wget -O /opt/platform/calico/calicoctl https://github.com/projectcalico/calicoctl/releases/download/v1.6.2/calicoctl chmod +x /opt/platform/calico/calicoctl
下载calicoctl镜像,如果下载不了,需要FQ
docker pull quay.io/calico/node:v2.6.2
配置calico系统服务
vim /lib/systemd/system/calico-node.service [Unit] Description=calico-node After=docker.service Requires=docker.service [Service] EnvironmentFile=/opt/platform/calico/calico.env ExecStartPre=-/usr/bin/docker rm -f calico-node ExecStart=/usr/bin/docker run --net=host --privileged \ --name=calico-node \ -e NODENAME=${CALICO_NODENAME} \ -e IP=${CALICO_IP} \ -e IP6=${CALICO_IP6} \ -e CALICO_NETWORKING_BACKEND=${CALICO_NETWORKING_BACKEND} \ -e AS=${CALICO_AS} \ -e NO_DEFAULT_POOLS=${CALICO_NO_DEFAULT_POOLS} \ -e CALICO_LIBNETWORK_ENABLED=${CALICO_LIBNETWORK_ENABLED} \ -e ETCD_ENDPOINTS=${ETCD_ENDPOINTS} \ -e ETCD_CA_CERT_FILE=${ETCD_CA_CERT_FILE} \ -e ETCD_CERT_FILE=${ETCD_CERT_FILE} \ -e ETCD_KEY_FILE=${ETCD_KEY_FILE} \ -v /opt/platform/calico/certs:/etc/calico/certs \ -v /opt/platform/calico/log:/var/log/calico \ -v /run/docker/plugins:/run/docker/plugins \ -v /lib/modules:/lib/modules \ -v /var/run/calico:/var/run/calico \ -v /var/run/docker.sock:/var/run/docker.sock \ quay.io/calico/node:v2.6.2 ExecStop=-/usr/bin/docker stop calico-node Restart=on-failure StartLimitBurst=3 StartLimitInterval=60s [Install] WantedBy=multi-user.target 这里需要注意的是，官方的service配置中没有certs及docker.sock的映射路径，会导致calico找不到证书及无法启动容器
配置环境变量
vim /opt/platform/calico/calico.env ETCD_ENDPOINTS="https://172.16.150.25:2379,https://172.16.150.26:2379,https://172.16.150.27:2379" ETCD_CA_CERT_FILE="/etc/calico/certs/ca.pem" ETCD_CERT_FILE="/etc/calico/certs/etcd.pem" ETCD_KEY_FILE="/etc/calico/certs/etcd-key.pem" CALICO_NODENAME="" CALICO_NO_DEFAULT_POOLS="" CALICO_IP="" CALICO_IP6="" CALICO_AS="" CALICO_LIBNETWORK_ENABLED=true CALICO_NETWORKING_BACKEND=bird 这里需要注意的是，此配置为容器内部读取的变量，所以证书路径为容器路径，而不是宿主机路径。
配置calicoctl的etcd存储
mkdir -p /etc/calico/ vim /etc/calico/calicoctl.cfg apiVersion: v1 kind: calicoApiConfig metadata: spec: etcdEndpoints: https://172.16.150.25:2379,https://172.16.150.26:2379,https://172.16.150.27:2379 etcdKeyFile: /opt/platform/calico/certs/etcd-key.pem etcdCertFile: /opt/platform/calico/certs/etcd.pem etcdCACertFile: /opt/platform/calico/certs/ca.pem 这里需要注意的是，这是配置calicoctl调用etcd接口的环境变量，所以证书路径为宿主机路径。calicoctl 默认读/etc/calico/下的calicoctl.cfg
启动calico
systemctl daemon-reload && systemctl enable calico-node && systemctl start calico-node
以上配置均需要在每个node节点上操作
创建calico网络
docker network create --driver calico --ipam-driver calico-ipam --subnet=10.233.0.0/16 calico docker network ls #查看docker所有网络
创建calico网络IP池
calicoctl apply -f ipPool.yaml apiVersion: v1 kind: ipPool metadata: cidr: 10.233.0.0/16 spec: ipip: enabled: true mode: always nat-outgoing: true disabled: false
查看calico IPAM配置
ln -s /opt/platform/calico/calicoctl /usr/local/sbin/calicoctl #创建命令快捷方式calicoctl get ipPool
网络验证:
分别在node1和node2创建job
node1 docker run --net calico --name workload-a -tid busybox docker run --net calico --name workload-b -tid busybox node2 docker run --net calico --name workload-c -tid busybox docker run --net calico --name workload-d -tid busybox
ping测试
docker exec workload-a ping -c 4 workload-b docker exec workload-a ping -c 4 workload-c docker exec workload-c ping -c 4 workload-d
相关参考命令
查看网络
docker network ls
查看具体信息
docker network inspect b69fb4a79dfb 查看workloadEndpoint
calicoctl get workloadEndpoint
删除workloadEndpoint容器在calico服务停止的情况下被删除了，calico服务再次启动的时候注册到etcd里的数据并没会刷新掉被删除容器的信息，如果你启动的是固定IP的容器，则会提示workloadEndpoint信息冲突，需要手动去删除
calicoctl delete workloadEndpoint 8173e77ea4b8dd69f68d21d846e99b27e57140dfdca28346ceeea50d4abc7e84 --node=W708- ATMQZLPR-1 --orchestrator=libnetwork --workload=libnetwork
转载于:https://www.cnblogs.com/cjsblogs/p/9154709.html
发布者：全栈程序员-站长，转载请注明出处：https://javaforall.net/227579.html原文链接：https://javaforall.net
