其他分享
首页 > 其他分享> > (二)kubernetes集群搭建(二进制方式)之--搭建etcd

(二)kubernetes集群搭建(二进制方式)之--搭建etcd

作者:互联网

kubernetes集群搭建(二进制方式)之--搭建etcd


Etcd是一个分布式键值存储系统,也是k8s使用的数据存储系统,所以先搭建etcd,为解决单点故障,采用集群方式部署,两台机器都部署etcd。

1.准备证书生成工具cfssl

cfssl是一个开源的证书管理工具,使用json文件生成证书,在master上操作生成证书,etcd的通信需要认证证书通信

#下载工具
wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64
#添加执行权限
chmod +x cfssl*
#放入可执行目录
mv cfssl_linux-amd64 /usr/local/bin/cfssl
mv cfssljson_linux-amd64 /usr/local/bin/cfssljson
mv cfssl-certinfo_linux-amd64 /usr/bin/cfssl-certinfo

2.生成Etcd证书

(1)自签证书办法机构

创建工作目录

mkdir -p ~/TLS/{etcd,k8s}
cd TLS/etcd

自签CA:

cat > ca-config.json<< EOF
{
  "signing": {
    "default": {
      "expiry": "87600h"
    },
    "profiles": {
      "www": {
        "expiry": "87600h",
        "usages": [
          "signing",
          "key encipherment",
          "server auth",
          "client auth"
        ]
      }
    }
  }
}
EOF
cat > ca-csr.json<< EOF
{
  "CN": "etcd CA",
  "key": {
  "algo": "rsa",
  "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "L": "Beijing",
      "ST": "Beijing"
    }
  ]
}
EOF

生成证书:

cfssl gencert -initca ca-csr.json | cfssljson -bare ca -

(2)使用自签CA签发Etcd HTTPS 证书

创建证书申请文件:

cat > server-csr.json<< EOF
{
    "CN": "etcd",
    "hosts": [
        "172.21.32.17",
        "172.21.32.15",
        "172.21.32.16",
        "172.21.32.18",
        "172.21.32.19"
    ],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [{
        "C": "CN",
        "L": "BeiJing",
        "ST": "BeiJing"
    }]
}
EOF

注:上述文件hosts字段中ip为所有etcd节点的集群内部通信ip,一个不能少,为了方便以后扩容,可以多写几个预留的ip
生成证书:

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=www server-csr.json | cfssljson -bare server

3.下载二进制文件

下载地址:https://github.com/etcd-io/etcd/releases/download/v3.4.9/etcd-v3.4.9-linux-amd64.tar.gz
以下在master节点操作,操作完事将生成文件拷贝到node节点
获取二进制文件:

#创建源文件目录用于存储
mkdir -p /data/src
cd /data/src
yum -y install wget
wget https://github.com/etcd-io/etcd/releases/download/v3.4.9/etcd-v3.4.9-linux-amd64.tar.gz

4.部署etcd集群

(1)创建工作目录并解压二进制包

mkdir /data/etcd/{bin,cfg,ssl} -p
tar fx etcd-v3.4.9-linux-amd64.tar.gz -C /data/etcd/
cd /data/etcd/etcd-v3.4.9-linux-amd64
mv ./{etcd,etcdctl} /data/etcd/bin/

(2)创建etcd配置文件

cat > /data/etcd/cfg/etcd.conf <<EOF
#[Member]
ETCD_NAME="etcd-1"
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
ETCD_LISTEN_PEER_URLS="https://172.21.32.17:2380"
ETCD_LISTEN_CLIENT_URLS="https://172.21.32.17:2379"
#[Clustering]
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://172.21.32.17:2380"
ETCD_ADVERTISE_CLIENT_URLS="https://172.21.32.17:2379"
ETCD_INITIAL_CLUSTER="etcd-1=https://172.21.32.17:2380,etcd-2=https://172.21.32.15:2380"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
ETCD_INITIAL_CLUSTER_STATE="new"
EOF

ETCD_NAME:节点名称,集群中唯一
ETCD_DATA_DIR:数据目录
ETCD_LISTEN_PEER_URLS:集群通信监听地址
ETCD_LISTEN_CLIENT_URLS:客户端访问监听地址
ETCD_INITIAL_ADVERTISE_PEER_URLS:集群通告地址
ETCD_ADVERTISE_CLIENT_URLS:客户端通告地址
ETCD_INITIAL_CLUSTER:集群节点地址
ETCD_INITIAL_CLUSTER_TOKEN:集群Token
ETCD_INITIAL_CLUSTER_STATE:加入集群的当前状态,new 是新集群,existing 表示加入已有集群

(3)systemd管理etcd

cat > /usr/lib/systemd/system/etcd.service <<EOF
[Unit]
Description=Etcd Server
After=network.target
After=network-online.target
Wants=network-online.target
[Service]
Type=notify
EnvironmentFile=/data/etcd/cfg/etcd.conf
ExecStart=/data/etcd/bin/etcd \
--cert-file=/data/etcd/ssl/server.pem \
--key-file=/data/etcd/ssl/server-key.pem \
--peer-cert-file=/data/etcd/ssl/server.pem \
--peer-key-file=/data/etcd/ssl/server-key.pem \
--trusted-ca-file=/data/etcd/ssl/ca.pem \
--peer-trusted-ca-file=/data/etcd/ssl/ca.pem \
--logger=zap
Restart=on-failure
LimitNOFILE=65536
[Install]
WantedBy=multi-user.target
EOF

(4)拷贝刚才生成的证书

cp ~/TLS/etcd/ca*pem ~/TLS/etcd/server*pem /data/etcd/ssl/

(5)将刚刚master上的所有生成的文件拷贝到node节点

scp -r /data root@172.21.32.15:/
scp /usr/lib/systemd/system/etcd.service root@172.21.32.15:/usr/lib/systemd/system/

(6)在node节点更改etcd的配置文件

#[Member]
ETCD_NAME="etcd-2"
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
ETCD_LISTEN_PEER_URLS="https://172.21.32.15:2380"
ETCD_LISTEN_CLIENT_URLS="https://172.21.32.15:2379"
#[Clustering]
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://172.21.32.15:2380"
ETCD_ADVERTISE_CLIENT_URLS="https://172.21.32.15:2379"
ETCD_INITIAL_CLUSTER="etcd-1=https://172.21.32.17:2380,etcd-2=https://172.21.32.15:2380"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
ETCD_INITIAL_CLUSTER_STATE="new"

(7)master和node同时操作

#加载启动文件
systemctl daemon-reload
#启动etcd
systemctl start etcd
#开机自启动
systemctl enable etcd
#查看进程状态
systemctl status etcd

(8)验证

/data/etcd/bin/etcdctl --cacert=/data/etcd/ssl/ca.pem --cert=/data/etcd/ssl/server.pem --key=/data/etcd/ssl/server-key.pem --endpoints="https://172.21.32.17:2379,https://172.21.32.15:2379" endpoint health

看到如下说明etcd集群搭建完成
https://172.21.32.17:2379 is healthy: successfully committed proposal: took = 9.011409ms
https://172.21.32.15:2379 is healthy: successfully committed proposal: took = 9.168965ms

标签:https,etcd,kubernetes,--,cfssl,ETCD,data,172.21,搭建
来源: https://blog.csdn.net/weixin_47402482/article/details/114383390