一、TiDB制作离线镜像
1、找个能连上外网，执行下面的命令

# curl --proto '=https' --tlsv1.2 -sSf https://tiup-mirrors.pingcap.com/install.sh | sh

2、重新声明全局环境变量，确认TiUP工具是否安装

# source /root/.bash_profile
# which tiup

3、拉取我们需要的组件来打包，这里我用的6.2版本，然后压缩打包成离线包。

# tiup mirror clone sfs-tidb-x86 --pd v6.2.0 --tikv v6.2.0 --tidb v6.2.0 --cluster v1.9.0 --blackbox_exporter v0.12.0 --node_exporter v0.17.0 --arch amd64 --os linux

# tar -zcvf sfs-tidb-x86.tar.gz sfs-tidb-x86
其中--cluster、--blackbox_exporter、--node_exporter是必备的，且这三个是早期版本后就没更新过，所以这里安装的已经是对应的最高版本

4、其它与打包相关命令

# tiup list --all  显示所有相关组件
# tiup mirror clone --help  显示制作离线包各项指标

二、离线环境安装
1、配置部署节点到各节点互信（例如用secure用户，如果存在secure则用其它用户）

# sudo useradd -d /home/secure -m secure   创建时指定用户目录和登录名
# passwd secure    设置该用户的密码（密码必须满足安全需求）

# visudo 直接操作sudoers文件，使用户具有sudo免密权限
在文件末尾增加
User_Alias SYSADMINS = secure
SYSADMINS       ALL=(ALL)       NOPASSWD:ALL
其中User_Alias表示设置用户组SYSADMINS ，这个用户组里面有secure，也可以再添加其它用户并用逗号隔开。然后这个用户组拥有哪些权限就是ALL=(ALL)所有权限，且NOPASSWD:ALL表示不需要密码。（注：tidb安装完成后需要将此权限回退）

# su secure    切到用户secure
# cd          换到用户secure目录
# ssh-keygen -t rsa   创建密钥，一直按空格键就行
# ssh-copy-id secure@ip  后面填写对应用户和ip即可
注：如果部署数据库节点也是安装节点，那么部署节点还需要配置到自身节点的免密。
tidb数据库安装完成后，需要将新增的用户（例如secure）的sudo权限关闭。

2、上传离线镜像包并解压安装

# 将离线镜像包放入一处目录并解压
tar -zxvf sfs-tidb-x86.tar.gz
# 执行tiup部署初始化
sh sfs-tidb-x86/local_install.sh
# 执行环境变量初始化
source /root/.bash_profile
# 修改配置模板，根据实际环境填入配置参数，配置见3节点模板
vi  topology.yaml
# 执行部署命令，如果配置的是其它用户互信和sudo权限，那么secure和密钥替换则可
tiup cluster deploy sfs-tidb v6.2.0 topology.yaml --user secure -i /home/secure/.ssh/id_rsa
# 启动数据库
tiup cluster start sfs-tidb
# 为数据库root用户设置密码（密码必须满足安全需求）
mysql -u root -h 地址 -P 4000 -se "set password for 'root'@'%' = '满足安全要求密码';"

3节点配置topology.yaml模板，下图标红处根据实际环境填写。

# # Global variables are applied to all deployments and used as the default value of
# # the deployments if a specific deployment value is missing.
global:
  # # The user who runs the tidb cluster.默认用户tidb, ssh端口11111
  user: "sfs_tidb_user"
  ssh_port: sfs_ssh_port
  # # Storage directory for cluster deployment files, startup scripts, and configuration files.
  # 默认/tidb-deploy与/tidb-data
  deploy_dir: "sfs_deploy_dir"
  # # TiDB Cluster data storage directory
  data_dir: "sfs_data_dir"
  # # Supported values: "amd64", "arm64" (default: "amd64")
  arch: "sfs_arch"

# # Monitored variables are applied to all the machines.
#monitored:
  # # The communication port for reporting system information of each node in the TiDB cluster.
  #  node_exporter_port: 9100
  # # Blackbox_exporter communication port, used for TiDB cluster port monitoring.
  # blackbox_exporter_port: 9115

# # Server configs are used to specify the configuration of PD Servers.
pd_servers:
  # # The ip address of the PD Server.
  - host: sfs_tidb_host1_ip
    ssh_port: sfs_ssh_port
    # name: "pd-1"
    # client_port: 2379
    # peer_port: 2380
    # deploy_dir: "/tidb-deploy/pd-2379"
    # data_dir: "/tidb-data/pd-2379"
    # log_dir: "/tidb-deploy/pd-2379/log"
    # numa_node: "0,1"
    # config:
    #   schedule.max-merge-region-size: 20
    #   schedule.max-merge-region-keys: 200000
  - host: sfs_tidb_host2_ip
    ssh_port: sfs_ssh_port
    # name: "pd-1"
    # client_port: 2379
    # peer_port: 2380
    # deploy_dir: "/tidb-deploy/pd-2379"
    # data_dir: "/tidb-data/pd-2379"
    # log_dir: "/tidb-deploy/pd-2379/log"
    # numa_node: "0,1"
    # config:
    #   schedule.max-merge-region-size: 20
    #   schedule.max-merge-region-keys: 200000
  - host: sfs_tidb_host3_ip
    ssh_port: sfs_ssh_port
    # name: "pd-1"
    # client_port: 2379
    # peer_port: 2380
    # deploy_dir: "/tidb-deploy/pd-2379"
    # data_dir: "/tidb-data/pd-2379"
    # log_dir: "/tidb-deploy/pd-2379/log"
    # numa_node: "0,1"
    # config:
    #   schedule.max-merge-region-size: 20
    #   schedule.max-merge-region-keys: 200000

# # Server configs are used to specify the configuration of TiDB Servers.
tidb_servers:
  # # The ip address of the TiDB Server.
  - host: sfs_tidb_host1_ip
    ssh_port: sfs_ssh_port
    # port: 4000
    # status_port: 10080
    # deploy_dir: "/tidb-deploy/tidb-4000"
    # log_dir: "/tidb-deploy/tidb-4000/log"
  - host: sfs_tidb_host2_ip
    ssh_port: sfs_ssh_port
    # port: 4000
    # status_port: 10080
    # deploy_dir: "/tidb-deploy/tidb-4000"
    # log_dir: "/tidb-deploy/tidb-4000/log"
  - host: sfs_tidb_host3_ip
    ssh_port: sfs_ssh_port
    # port: 4000
    # status_port: 10080
    # deploy_dir: "/tidb-deploy/tidb-4000"
    # log_dir: "/tidb-deploy/tidb-4000/log"

# # Server configs are used to specify the configuration of TiKV Servers.
tikv_servers:
  # # The ip address of the TiKV Server.
  - host: sfs_tidb_host1_ip
    ssh_port: sfs_ssh_port
    # port: 20160
    # status_port: 20180
    # deploy_dir: "/tidb-deploy/tikv-20160"
    # data_dir: "/tidb-data/tikv-20160"
    # log_dir: "/tidb-deploy/tikv-20160/log"
    # config:
    #   log.level: warn
  - host: sfs_tidb_host2_ip
    ssh_port: sfs_ssh_port
    # port: 20160
    # status_port: 20180
    # deploy_dir: "/tidb-deploy/tikv-20160"
    # data_dir: "/tidb-data/tikv-20160"
    # log_dir: "/tidb-deploy/tikv-20160/log"
    # config:
    #   log.level: warn
  - host: sfs_tidb_host3_ip
    ssh_port: sfs_ssh_port
    # port: 20160
    # status_port: 20180
    # deploy_dir: "/tidb-deploy/tikv-20160"
    # data_dir: "/tidb-data/tikv-20160"
    # log_dir: "/tidb-deploy/tikv-20160/log"
    # config:
    #   log.level: warn


# # Server configs are used to specify the configuration of Prometheus Server.  
#monitoring_servers:
  # # The ip address of the Monitoring Server.
  #- host: ip