二进制部署K8S集群(六)Master节点之etcd集群部署

目录

1.集群规划

主机 IP 角色
hdss7-12.host.com 10.4.7.12 etcd-server
hdss7-21.host.com 10.4.7.21 etcd-server
hdss7-22.host.com 10.4.7.22 etcd-server

2.创建基于根证书的config配置文件

在hdss7-200主机上执行:

cat > /opt/certs/ca-config.json <<'eof'
{
    "signing": {
        "default": {
            "expiry": "175200h"
        },
        "profiles": {
            "server": {
                "expiry": "175200h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "server auth"
                ]
            },
            "client": {
                "expiry": "175200h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "client auth"
                ]
            },
            "peer": {
                "expiry": "175200h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "server auth",
                    "client auth"
                ]
            }
        }
    }
} 
eof
  • peer:相互通信,服务端找客户端需要证书,客户端找服务端也需要证书。
  • client:客户端跟服务器端需要证书,服务器端找客户端不需要证书。
  • server:服务端启动的时候需要证书。

3.创建生成etcd自签证书peer的csr的json配置文件

cat > /opt/certs/etcd-peer-csr.json <<'eof'
{
    "CN": "k8s-etcd",
    "hosts": [
        "10.4.7.11",
        "10.4.7.12",
        "10.4.7.21",
        "10.4.7.22"
    ],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "ST": "GuangZhou",
            "L": "GuangZhou",
            "O": "k8s",
            "OU": "yw"
        }
    ]
}
eof

hosts字段表示可能安装etcd的服务器主机ip。

4.生成etcd证书文件

cd /opt/certs/
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=peer etcd-peer-csr.json |cfssl-json -bare etcd-peer
[root@hdss7-200 certs]# ll
etcd-peer.csr
etcd-peer-csr.json
etcd-peer-key.pem
etcd-peer.pem

5.创建etcd用户

以下在hdss7-12,hdss7-21,hdss7-22操作
以hdss7-12部署为例:

useradd -s /sbin/nologin -M etcd

6.软件下载解压

下载链接:https://github.com/etcd-io/etcd/releases/tag/v3.1.20

mkdir /opt/src
cd /opt/src
rz ==> etcd-v3.1.20-linux-amd64.tar.gz
tar xf etcd-v3.1.20-linux-amd64.tar.gz -C /opt/
cd /opt
mv etcd-v3.1.20-linux-amd64/ etcd-v3.1.20
ln -s /opt/etcd-v3.1.20/ /opt/etcd

7.拷贝证书

mkdir -p /opt/etcd/certs /data/etcd /data/logs/etcd-server
scp hdss7-200:/opt/certs/ca.pem  /opt/etcd/certs/
scp hdss7-200:/opt/certs/etcd-peer.pem /opt/etcd/certs/
scp hdss7-200:/opt/certs/etcd-peer-key.pem /opt/etcd/certs/

8.创建etcd服务启动脚本(注意每台etcd服务器个别配置不一样)

cat > /opt/etcd/etcd-server-startup.sh <<'eof'
#!/bin/sh
./etcd --name etcd-server-7-12 \
       --data-dir /data/etcd/etcd-server \
       --listen-peer-urls https://10.4.7.12:2380 \
       --listen-client-urls https://10.4.7.12:2379,http://127.0.0.1:2379 \
       --quota-backend-bytes 8589934592 \
       --initial-advertise-peer-urls https://10.4.7.12:2380 \
       --advertise-client-urls https://10.4.7.12:2379,http://127.0.0.1:2379 \
       --initial-cluster  etcd-server-7-12=https://10.4.7.12:2380,etcd-server-7-21=https://10.4.7.21:2380,etcd-server-7-22=https://10.4.7.22:2380 \
       --ca-file ./certs/ca.pem \
       --cert-file ./certs/etcd-peer.pem \
       --key-file ./certs/etcd-peer-key.pem \
       --client-cert-auth  \
       --trusted-ca-file ./certs/ca.pem \
       --peer-ca-file ./certs/ca.pem \
       --peer-cert-file ./certs/etcd-peer.pem \
       --peer-key-file ./certs/etcd-peer-key.pem \
       --peer-client-cert-auth \
       --peer-trusted-ca-file ./certs/ca.pem \
       --log-output stdout
eof

9.授权

chmod +x /opt/etcd/etcd-server-startup.sh
chown -R etcd: /opt/etcd-v3.1.20/ /data/etcd/ /data/logs/etcd-server/

10.安装supervisor软件

yum install supervisor -y
systemctl start supervisord
systemctl enable supervisord

11.配置supervisor(注意每台etcd服务器个别配置不一样)

cat > /etc/supervisord.d/etcd-server.ini <<'eof'
[program:etcd-server-7-12]
command=/opt/etcd/etcd-server-startup.sh                        ; the program (relative uses PATH, can take args)
numprocs=1                                                      ; number of processes copies to start (def 1)
directory=/opt/etcd                                             ; directory to cwd to before exec (def no cwd)
autostart=true                                                  ; start at supervisord start (default: true)
autorestart=true                                                ; retstart at unexpected quit (default: true)
startsecs=30                                                    ; number of secs prog must stay running (def. 1)
startretries=3                                                  ; max # of serial start failures (default 3)
exitcodes=0,2                                                   ; 'expected' exit codes for process (default 0,2)
stopsignal=QUIT                                                 ; signal used to kill process (default TERM)
stopwaitsecs=10                                                 ; max num secs to wait b4 SIGKILL (default 10)
user=etcd                                                       ; setuid to this UNIX account to run the program
redirect_stderr=true                                            ; redirect proc stderr to stdout (default false)
stdout_logfile=/data/logs/etcd-server/etcd.stdout.log           ; stdout log path, NONE for none; default AUTO
stdout_logfile_maxbytes=64MB                                    ; max # logfile bytes b4 rotation (default 50MB)
stdout_logfile_backups=4                                        ; # of stdout logfile backups (default 10)
stdout_capture_maxbytes=1MB                                     ; number of bytes in 'capturemode' (default 0)
stdout_events_enabled=false                                     ; emit events on stdout writes (default false)
eof

12.启动etcd服务并检查

supervisorctl update
supervisorctl status
netstat -lntup|grep etcd                      
tcp        0      0 10.4.7.12:2379          0.0.0.0:*               LISTEN      11225/./etcd        
tcp        0      0 127.0.0.1:2379          0.0.0.0:*               LISTEN      11225/./etcd        
tcp        0      0 10.4.7.12:2380          0.0.0.0:*               LISTEN      11225/./etcd 

13.检查集群状态

[root@hdss7-21 etcd]# /opt/etcd/etcdctl cluster-health
member 988139385f78284 is healthy: got healthy result from http://127.0.0.1:2379
member 5a0ef2a004fc4349 is healthy: got healthy result from http://127.0.0.1:2379
member f4a0cb0a765574a8 is healthy: got healthy result from http://127.0.0.1:2379
cluster is healthy

[root@hdss7-21 etcd]# /opt/etcd/etcdctl member list
988139385f78284: name=etcd-server-7-22 peerURLs=https://10.4.7.22:2380 clientURLs=http://127.0.0.1:2379,https://10.4.7.22:2379 isLeader=false
5a0ef2a004fc4349: name=etcd-server-7-21 peerURLs=https://10.4.7.21:2380 clientURLs=http://127.0.0.1:2379,https://10.4.7.21:2379 isLeader=false
f4a0cb0a765574a8: name=etcd-server-7-12 peerURLs=https://10.4.7.12:2380 clientURLs=http://127.0.0.1:23
上一篇:Linux监控端口发送邮件


下一篇:ElasticSearch集群配置密码认证