安装依赖包

cd /etc/yum.repos.d
sudo mkdir bak
sudo mv * bak
sudo wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
sudo wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
sudo sed -i 's\$releasever\7\g' CentOS-Base.repo
sudo yum clean all
sudo yum makecache
sudo yum install -y conntrack ntpdate ntp ipvsadm ipset jq iptables curl sysstat libseccomp wget vim net-toos git iptables-services yum-utils device-mapper-persistent-data lvm2 nfs-utils cri-tools socat systemd

安装依赖包（离线）

#依赖包收集
yum install yum-plugin-downloadonly
#下载需要安装的包和依赖，默认保存/var/cache/yum
yum install --downloadonly --downloaddir=/path XXX
#安装的时候要写包全名，并把所有依赖一起安装

关闭防火墙

sudo systemctl stop firewalld 
sudo systemctl disable firewalld

启动iptables服务

sudo systemctl status iptables
sudo systemctl start iptables 
sudo systemctl enable iptables
#确保安装iptables就行 没必要启动

关闭虚拟内存

sudo swapoff -a
sudo cp /etc/fstab /etc/fstab_bak
sudo sh -c "cat /etc/fstab_bak |grep -v swap > /etc/fstab"

关闭SELINUX

setenforce 0
sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config

调整内核参数—可选

sudo vim /etc/sysctl.conf
---
net.ipv4.ip_forward = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
---
sudo modprobe -- ip_vs
sudo modprobe -- ip_vs_rr
sudo modprobe -- ip_vs_wrr
sudo modprobe -- ip_vs_sh
sudo modprobe -- nf_conntrack_ipv4
sudo modprobe br_netfilter
sudo sysctl -p

调整系统时区-可选

#设置系统时区为 中国/上海
timedatectl set-timezone Asia/Shanghai
#将当前的UTC时间写入硬件时钟
timedatectl set-local-rtc 0
#重启依赖于系统时间的服务
systemctl restart syslog
systemctl restart crond

关闭系统不需要的服务—可选

sudo systemctl stop postfix 
sudo systemctl disable postfix

设置resyslogd和systemd journald–可选

mkdir /var/log/journal
mkdir /etc/systemd/journald.conf.d
cat > /etc/systemd/journald.conf.d/99-prophet.conf << EOF
[Journal]
# 持久化保存到磁盘
Storage=persistent

# 压缩历史日志
Compress=yes

SyncIntervalSec=5m
RatelimitInterval=30s
RatelimitBurst=1000

# 最大占用空间
SystemMaxUse=10G

# 单日志文件最大 200M
SystemMaxFileSize=200M

# 日志保存时间 2周
MaxRetentionSec=2week

# 不将日志转发到syslog
ForwardToSyslog=no
EOF
systemctl restart systemd-journald

升级系统内核（选做）

#据说3.10.X内核存在一些BUG
rpm -Uvh http://www.elrepo.org/elrepo-release-7.0-3.el7.elrepo.noarch.rpm
#完成后检查 /boot/grub2/grub.cfg 中对应内核 menuentry 中是否包含 initrd16配置，如果没有，再安装一次
yum --enablerepo=elrepo-kernel install -y kernel-lt
#设置开机从新内核启动
grub2-set-default "CENTOS Linux (4.4.182-1.el7.elrepo.x86_64) 7 (Core)"

ipvs依赖(kube-proxy新模式需要)

sudo modprobe -- ip_vs
sudo modprobe -- ip_vs_rr
sudo modprobe -- ip_vs_wrr
sudo modprobe -- ip_vs_sh
sudo modprobe -- nf_conntrack_ipv4
sudo modprobe br_netfilter