cloud-config

說明：<XXX> 需要根據實際情況配置

hostname: <主機名>

core用戶ssh登陸公鑰

ssh_authorized_keys:

• 'ssh-rsa <AAAA...>'

coreos:
units:
- name: systemd-networkd.service
command: stop

- name: down-interfaces.service
  command: start
  content: |
    [Service]
    Type=oneshot
    ExecStart=/usr/bin/ip link set ens192 down dynamic off
    ExecStart=/usr/bin/ip addr flush dev ens192

- name: ens192.network
  runtime: true
  content: |
    [Match]
    Name=ens192
    [Network]
    Address=<節點IP>/24
    Gateway=<網關IP>
    DNS=<DNS IP>
    DNS=<DNS IP>

- name: systemd-networkd.service
  command: start

# 參考 /usr/lib/systemd/system/clean-ca-certificates.service
- name: update-self-ca-certificate.service
  content: |
    [Unit]
    Description=Update self CA certificate /etc/ssl/certs/XXXSecureInternetProxyCA.pem
    DefaultDependencies=no
    Wants=clean-ca-certificates.service
    After=clean-ca-certificates.service
    Before=sysinit.target
    ConditionPathIsReadWrite=/etc/ssl/certs
    [Service]
    Type=oneshot
    ExecStart=/usr/sbin/update-ca-certificates
  command: start

- name: etcd2.service
  command: start

- name: fleet.service
  command: start

- name: docker.service
  drop-ins:
    - name: proxy.conf
      content: |
        [Service]
        # 只能用小寫http_proxy和https_proxy，二選一即可？
        Environment="http_proxy=<代理IP和端口>"
        Environment="https_proxy=<代理IP和端口>"
    - name: registry.conf
      content: |
        [Service]
        # 1. 加速images下載的registry mirror，這里添加daocloud的mirror
        # 2. 不安全（比如自己架設的）registry，這里添加希云、靈雀云的registry
        Environment="DOCKER_OPTS=--registry-mirror=http://XXX.m.daocloud.io --insecure-registry=index.csphere.cn --insecure-registry=index.alauda.cn"
  command: restart

# proxy環境下，update服務可能需要添加代理服務的CA證書才能使用（通過本配置文件的update-self-ca-certificate.service服務）
- name: update-engine.service
  drop-ins:
    - name: proxy.conf
      content: |
        [Service]
        Environment="ALL_PROXY=<代理IP和端口>"
  command: restart

etcd2:
# 參考https://coreos.com/os/docs/latest/cluster-architectures.html
# proxy場景下，可能需要添加代理服務的CA證書（通過本配置文件的update-self-ca-certificate.service服務），才能使用https
# 通過 curl https://discovery.etcd.io/new?size=<N> 生成，<N>根據實際集群節點個數配置
discovery: https://discovery.etcd.io/<XXX>
discovery-proxy: <代理IP和端口>
advertise-client-urls: http://<節點IP>:2379
initial-advertise-peer-urls: http://<節點IP>:2380
listen-client-urls: http://0.0.0.0:2379
listen-peer-urls: http://<節點IP>:2380

users:

• name: root
  ssh-authorized-keys:

  • 'ssh-rsa <AAAA...>'

  python -c "import crypt, getpass, pwd; print crypt.crypt('<口令>', '$6$SALT$')" 生成

  passwd: '<口令生成的hash值>'

• name: core

  python -c "import crypt, getpass, pwd; print crypt.crypt('<口令>', '$6$SALT$')" 生成

  passwd: '<口令生成的hash值>'

write_files:

• path: /etc/profile.d/custom.sh
  content: |
  unset PROMPT_COMMAND

• path: /etc/profile.d/custom.sh
  content: |
  export GIT_SSL_NO_VERIFY=true

• path: /etc/profile.d/proxy.sh
  content: |
  export ALL_PROXY=<代理IP和端口>

Docker configurtion file

- path: /run/flannel_docker_opts.env

content: |

• path: /etc/systemd/timesyncd.conf
  content: |
  [Time]
  NTP=<NTP IP>

• path: /etc/ssh/sshd_config
  permissions: 0600
  owner: root:root
  content: |

  原有默認內容

  Use most defaults for sshd configuration.

  UsePrivilegeSeparation sandbox
  Subsystem sftp internal-sftp
  ClientAliveInterval 180
  UseDNS no

  XXX版本開始，需要添加以下配置，允許root口令登陸

  PermitRootLogin yes
  PasswordAuthentication yes

添加代理服務器的CA根證書，內容通過chrome瀏覽器導出獲得，必須以pem后綴保存

• path: /etc/ssl/certs/XXXSecureInternetProxyCA.pem
  permissions: 0644
  owner: root:root
  content: |
  -----BEGIN CERTIFICATE-----
  ...
  -----END CERTIFICATE-----