Skip to content

Commit

Permalink
完善chrony文档
Browse files Browse the repository at this point in the history
  • Loading branch information
@gjmzj
gjmzj committed Jan 26, 2019
1 parent 6ac413e commit 999afbb
Show file tree
Hide file tree
Showing 2 changed files with 142 additions and 30 deletions.
105 changes: 105 additions & 0 deletions docs/guide/chrony.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -39,3 +39,108 @@ server {{ groups.deploy[0] }} iburst

`ansible-playbook /etc/ansible/roles/chrony/chrony.yml `

## 验证配置

- 在 chrony server (deploy 节点)检查时间源信息，默认配置为`ntp1.aliyun.com`的地址：

```
$ chronyc sources -v
210 Number of sources = 5
.-- Source mode '^' = server, '=' = peer, '#' = local clock.
/ .- Source state '*' = current synced, '+' = combined , '-' = not combined,
| / '?' = unreachable, 'x' = time may be in error, '~' = time too variable.
|| .- xxxx [ yyyy ] +/- zzzz
|| Reachability register (octal) -. | xxxx = adjusted offset,
|| Log2(Polling interval) --. | | yyyy = measured offset,
|| \ | | zzzz = estimated error.
|| | | \
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
^* 120.25.115.20 2 9 377 55 +147us[ +250us] +/- 15ms
^- 85.199.214.100 1 10 377 182 -25ms[ -24ms] +/- 128ms
^- makaki.miuku.net 2 10 367 307 +61ms[ +61ms] +/- 127ms
^- static-5-103-139-163.ip.f 1 9 167 572 +532us[ +336us] +/- 117ms
^- 119.28.183.184 2 7 377 33 -130us[ -130us] +/- 47ms
```

- 在 chrony server (deploy 节点)检查时间源同步状态

```
chronyc sourcestats -v
210 Number of sources = 5
.- Number of sample points in measurement set.
/ .- Number of residual runs with same sign.
| / .- Length of measurement set (time).
| | / .- Est. clock freq error (ppm).
| | | / .- Est. error in freq.
| | | | / .- Est. offset.
| | | | | | On the -.
| | | | | | samples. \
| | | | | | |
Name/IP Address NP NR Span Frequency Freq Skew Offset Std Dev
==============================================================================
120.25.115.20 15 11 44m +0.011 0.909 +4097ns 758us
85.199.214.100 22 13 49m -3.588 5.097 -23ms 5709us
makaki.miuku.net 22 14 46m +2.455 6.225 +64ms 4945us
static-5-103-139-163.ip.f 20 13 42m -2.472 10.168 +3615us 6732us
119.28.183.184 16 9 19m +10.378 25.190 +3469us 6803us
```

- 在 chrony client 检查，可以看到时间源只有一个（deploy 节点地址）

```
$ chronyc sources
210 Number of sources = 1
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
^* 192.168.1.1 3 6 377 15 +4085ns[ -25us] +/- 15ms
$ chronyc sourcestats
210 Number of sources = 1
Name/IP Address NP NR Span Frequency Freq Skew Offset Std Dev
==============================================================================
192.168.1.1 5 4 323 -0.252 0.819 -3031ns 15us
```

## 验证时间同步状态完成

chrony 服务启动后，chrony server 会与配置的公网参考时间服务器进行同步；server 同步完成后，chrony client 会与 server 进行时间同步；一般来说整个集群达到时间同步需要几十分钟。可以用如下命令检查，初始时 **NTP synchronized: no**，同步完成后 **NTP synchronized: yes**

``` bash
$ ansible all -m shell -a 'timedatectl'
192.168.1.1 | SUCCESS | rc=0 >>
Local time: Sat 2019-01-26 11:51:51 HKT
Universal time: Sat 2019-01-26 03:51:51 UTC
RTC time: Sat 2019-01-26 03:51:52
Time zone: Asia/Hong_Kong (HKT, +0800)
Network time on: yes
NTP synchronized: yes
RTC in local TZ: no

192.168.1.4 | SUCCESS | rc=0 >>
Local time: Sat 2019-01-26 11:51:51 HKT
Universal time: Sat 2019-01-26 03:51:51 UTC
RTC time: Sat 2019-01-26 03:51:52
Time zone: Asia/Hong_Kong (HKT, +0800)
Network time on: yes
NTP synchronized: yes
RTC in local TZ: no

192.168.1.2 | SUCCESS | rc=0 >>
Local time: Sat 2019-01-26 11:51:51 HKT
Universal time: Sat 2019-01-26 03:51:51 UTC
RTC time: Sat 2019-01-26 03:51:52
Time zone: Asia/Hong_Kong (HKT, +0800)
Network time on: yes
NTP synchronized: yes
RTC in local TZ: no

192.168.1.3 | SUCCESS | rc=0 >>
Local time: Sat 2019-01-26 11:51:51 HKT
Universal time: Sat 2019-01-26 03:51:51 UTC
RTC time: Sat 2019-01-26 03:51:52
Time zone: Asia/Hong_Kong (HKT, +0800)
Network time on: yes
NTP synchronized: yes
RTC in local TZ: no
```
67 changes: 37 additions & 30 deletions docs/setup/00-planning_and_overall_intro.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2,15 +2,17 @@

多节点高可用集群部署步骤与[AllinOne部署](quickStart.md)基本一致，增加LB 负载均衡部署步骤。

**注意1：请确保各节点时区设置一致、时间同步。** 如果你的环境没有提供NTP 时间同步，推荐集成安装[chrony](../guide/chrony.md)。
**注意2：如果需要在公有云上创建多主多节点集群，请结合阅读[在公有云上部署 kubeasz](kubeasz_on_public_cloud.md)**
-注意1：请确保各节点时区设置一致、时间同步。 如果你的环境没有提供NTP 时间同步，推荐集成安装[chrony](../guide/chrony.md)
-注意2：如果需要在公有云上创建多主多节点集群，请结合阅读[在公有云上部署 kubeasz](kubeasz_on_public_cloud.md)

## 高可用集群所需节点配置如下：
+ 部署节点------x1 : 运行这份 ansible 脚本的节点
+ etcd节点------x3 : 注意etcd集群必须是1,3,5,7...奇数个节点
+ master节点----x2 : 根据实际集群规模可以增加节点数，需要额外规划一个master VIP(虚地址)
+ lb节点--------x2 : 负载均衡节点两个，安装 haproxy+keepalived
+ node节点------x3 : 真正应用负载的节点，根据需要提升机器配置和增加节点数
## 高可用集群所需节点配置如下

|角色|数量|描述|
|deploy节点|1|运行这份 ansible 脚本的节点|
|etcd节点|3|注意etcd集群必须是1,3,5,7...奇数个节点|
|master节点|2|需要额外规划一个master VIP(虚地址)，可根据需要提升机器配置或增加节点数|
|lb节点|2|负载均衡节点两个，安装 haproxy+keepalived|
|node节点|3|运行应用负载的节点，可根据需要提升机器配置或增加节点数|

项目预定义了4个例子，请修改后完成适合你的集群规划，生产环境建议一个节点只是一个角色。

Expand Down Expand Up @@ -53,6 +55,8 @@ yum install python -y
```
### 3.在deploy节点安装及准备ansible

- pip 安装 ansible

``` bash
# Ubuntu 16.04
apt-get install git python-pip -y
Expand All @@ -64,28 +68,7 @@ yum install git python-pip -y
pip install pip --upgrade -i http://mirrors.aliyun.com/pypi/simple/ --trusted-host mirrors.aliyun.com
pip install --no-cache-dir ansible -i http://mirrors.aliyun.com/pypi/simple/ --trusted-host mirrors.aliyun.com
```

在`Ubuntu 16.04`中，如果出现以下错误:

``` bash
Traceback (most recent call last):
File "/usr/bin/pip", line 9, in <module>
from pip import main
ImportError: cannot import name main
```
将`/usr/bin/pip`做以下修改：

``` bash
#原代码
from pip import main
if __name__ == '__main__':
sys.exit(main())

#修改后
from pip import __main__
if __name__ == '__main__':
sys.exit(__main__._main())
```
- 在`Ubuntu 16.04`中可能安装报错，请看[附录](00-planning_and_overall_intro.md#Appendix)

- 在deploy节点配置免密码登陆

Expand Down Expand Up @@ -140,5 +123,29 @@ ansible-playbook 07.cluster-addon.yml

+ [可选]对集群所有节点进行操作系统层面的安全加固 `ansible-playbook roles/os-harden/os-harden.yml`，详情请参考[os-harden项目](https://github.com/dev-sec/ansible-os-hardening)

## Appendix

- Ubuntu 1604 安装 ansible 如果出现以下错误

``` bash
Traceback (most recent call last):
File "/usr/bin/pip", line 9, in <module>
from pip import main
ImportError: cannot import name main
```
将`/usr/bin/pip`做以下修改即可

``` bash
#原代码
from pip import main
if __name__ == '__main__':
sys.exit(main())

#修改后
from pip import __main__
if __name__ == '__main__':
sys.exit(__main__._main())
```
[后一篇](01-CA_and_prerequisite.md)

0 comments on commit 999afbb

Please sign in to comment.