准备工作

#更新系统组件
$yum upgrade -y

#安装工具
$yum install -y net-tools vim wget ntp ntpdate epel-release conntrack ipvsadm ipset jq sysstat curl iptables libseccomp

$vim /etc/hosts

127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.161.150     k8s-master1
192.168.161.151     k8s-master2
192.168.161.152     k8s-master3
192.168.161.170     k8s-node1
192.168.161.171     k8s-node2
192.168.161.172     k8s-node3

$ sudo systemctl stop firewalld
$ sudo systemctl disable firewalld
$ sudo iptables -F && sudo iptables -X && sudo iptables -F -t nat && sudo iptables -X -t nat
$ sudo sudo iptables -P FORWARD ACCEPT

sudo swapoff -a

为了防止开机自动挂载 swap 分区，可以注释 /etc/fstab 中相应的条目：
sudo sed -i ‘/ swap / s/^\(.*\)$/#\1/g‘ /etc/fstab

$sudo setenforce 0

$vim /etc/selinux/config

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=disabled
# SELINUXTYPE= can take one of three two values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes are protected. 
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted

$ cat > kubernetes.conf <<EOF
net.bridge.bridge-nf-call-iptables=1
net.bridge.bridge-nf-call-ip6tables=1
net.ipv4.ip_forward=1
net.ipv4.tcp_tw_recycle=0
vm.swappiness=0
vm.overcommit_memory=1
vm.panic_on_oom=0
fs.inotify.max_user_watches=89100
fs.file-max=52706963
fs.nr_open=52706963
net.ipv6.conf.all.disable_ipv6=1
net.netfilter.nf_conntrack_max=2310720
EOF
$ sudo cp kubernetes.conf  /etc/sysctl.d/kubernetes.conf
$ sudo sysctl -p /etc/sysctl.d/kubernetes.conf
$ sudo mount -t cgroup -o cpu,cpuacct none /sys/fs/cgroup/cpu,cpuacct

$ # 调整系统 TimeZone
$ sudo timedatectl set-timezone Asia/Shanghai

$ # 将当前的 UTC 时间写入硬件时钟
$ sudo timedatectl set-local-rtc 0

$ # 重启依赖于系统时间的服务
$ sudo systemctl restart rsyslog 
$ sudo systemctl restart crond

#更新系统时间
sudo ntpdate cn.pool.ntp.org

sudo useradd -m k8s
sudo sh -c ‘echo 123456 | passwd k8s --stdin‘ # 为 k8s 账户设置密码

sudo visudo
输入 /NOPASSWD 查找到  #%wheel ALL=(ALL)       NOPASSWD: ALL
然后删掉# 取消注释

sudo grep ‘%wheel.*NOPASSWD: ALL‘ /etc/sudoers
看到如下输出表示取消成功
%wheel    ALL=(ALL)    NOPASSWD: ALL

sudo gpasswd -a k8s wheel

$sudo useradd -m docker
$ sudo gpasswd -a k8s docker
$ sudo mkdir -p  /etc/docker/
$vim /etc/docker/daemon.json

输入以下内容并保存
{
    "registry-mirrors": ["https://hub-mirror.c.163.com", "https://docker.mirrors.ustc.edu.cn"],
    "max-concurrent-downloads": 20
}