etcd集群安装

原创已于 2022-06-06 10:16:50 修改 · 987 阅读
0 ·
CC 4.0 BY-SA版权
文章标签：
#etcd #kubernetes
于 2022-05-10 11:17:33 首次发布
k8s 专栏收录该内容
36 篇文章
订阅专栏
etcd版本
[root@localhost etcd]# ./etcdctl  version
etcdctl version: 3.5.1
API version: 3.5

系统版本
[root@localhost etcd]# cat /etc/redhat-release 
CentOS Linux release 7.4.1708 (Core) 

/data/etcd/etcd.conf
etced配置文件
 
ETCD_NAME="etcd01"
ETCD_DATA_DIR="/data/etcddata"
ETCD_LISTEN_PEER_URLS="https://192.168.73.130:2380"
ETCD_LISTEN_CLIENT_URLS="https://192.168.73.130:2379,https://127.0.0.1:2379"
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://192.168.73.130:2380"
ETCD_ADVERTISE_CLIENT_URLS="https://192.168.73.130:2379"
ETCD_INITIAL_CLUSTER="etcd01=https://192.168.73.130:2380,etcd02=https://192.168.73.131:2380,etcd03=https://192.168.73.132:2380"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
 
ETCD_NAME="etcd02"
ETCD_DATA_DIR="/data/etcddata"
ETCD_LISTEN_PEER_URLS="https://192.168.73.131:2380"
ETCD_LISTEN_CLIENT_URLS="https://192.168.73.131:2379,https://127.0.0.1:2379"
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://192.168.73.131:2380"
ETCD_ADVERTISE_CLIENT_URLS="https://192.168.73.131:2379"
ETCD_INITIAL_CLUSTER="etcd01=https://192.168.73.130:2380,etcd02=https://192.168.73.131:2380,etcd03=https://192.168.73.132:2380"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
 
 
ETCD_NAME="etcd03"
ETCD_DATA_DIR="/data/etcddata"
ETCD_LISTEN_PEER_URLS="https://192.168.73.132:2380"
ETCD_LISTEN_CLIENT_URLS="https://192.168.73.132:2379,https://127.0.0.1:2379"
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://192.168.73.132:2380"
ETCD_ADVERTISE_CLIENT_URLS="https://192.168.73.132:2379"
ETCD_INITIAL_CLUSTER="etcd01=https://192.168.73.130:2380,etcd02=https://192.168.73.131:2380,etcd03=https://192.168.73.132:2380"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
 
 
/usr/lib/systemd/system/etcd.service
etcd启动文件
 
[Unit]
Description=Etcd Server
After=network.target
After=network-online.target
Wants=network-online.target
 
[Service]
Type=notify
WorkingDirectory=/data/etcd/
EnvironmentFile=/data/etcd/etcd.conf
ExecStart=/data/etcd/etcd \
--initial-cluster-state=new \
--cert-file=/data/etcd/ssl/server.pem \
--key-file=/data/etcd/ssl/server-key.pem \
--peer-cert-file=/data/etcd/ssl/server.pem \
--peer-key-file=/data/etcd/ssl/server-key.pem \
--trusted-ca-file=/data/etcd/ssl/ca.pem \
--peer-trusted-ca-file=/data/etcd/ssl/ca.pem
Restart=on-failure
LimitNOFILE=65536
 
[Install]
WantedBy=multi-user.target
 
 
13、创建TLS证书
cd /data/
wget https://github.com/cloudflare/cfssl/releases/download/v1.6.1/cfssl-certinfo_1.6.1_linux_amd64
wget https://github.com/cloudflare/cfssl/releases/download/v1.6.1/cfssljson_1.6.1_linux_amd64
wget https://github.com/cloudflare/cfssl/releases/download/v1.6.1/cfssl_1.6.1_linux_amd64
mv cfssl-certinfo_1.6.1_linux_amd64 cfssl-certinfo
mv cfssl_1.6.1_linux_amd64 cfssl
mv cfssljson_1.6.1_linux_amd64 cfssljson
chmod +x cfssl*



tls.sh 文件内容如下全部内容(先修改其中的IP地址,其中hosts尽可能多加)
 
# etcd
# cat ca-config.json
cat > ca-config.json <<EOF
{
  "signing": {
    "default": {
      "expiry": "87600h"
    },
    "profiles": {
      "www": {
         "expiry": "87600h",
         "usages": [
            "signing",
            "key encipherment",
            "server auth",
            "client auth"
        ]
      }
    }
  }
}
EOF
 
# cat ca-csr.json
cat > ca-csr.json <<EOF
{
    "CN": "etcd CA",
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "Beijing",
            "ST": "Beijing"
        }
    ]
}
EOF
 
# cat server-csr.json
cat > server-csr.json <<EOF
{
    "CN": "etcd",
    "hosts": [
    "127.0.0.1",
    "192.168.73.130",
    "192.168.73.131",
    "192.168.73.132",
	"192.168.73.158",
	"192.168.73.157",
	"192.168.73.156"
    ],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "BeiJing",
            "ST": "BeiJing"
        }
    ]
}
EOF
 
执行如下命令
sh tls.sh
/data/cfssl gencert -initca ca-csr.json | /data/cfssljson -bare ca -
/data/cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=www server-csr.json | /data/cfssljson -bare server
ls *.pem
 
然后将生成的4个pem文件证书复制到各个机器的/data/etcd/ssl目录中
 
启动服务etcd
systemctl daemon-reload
systemctl enable etcd
systemctl start etcd
 
 
查看集群状态
集群状态主要是etcdctl endpoint status和etcdctl endpoint health两条命令
 
cd /data/etcd/ && ./etcdctl \
--endpoints="https://192.168.73.130:2379,https://192.168.73.131:2379,https://192.168.73.132:2379" \
--cacert=ssl/ca.pem \
--key=ssl/server-key.pem  \
--cert=ssl/server.pem  \
endpoint health 
 
https://192.168.73.130:2379 is healthy: successfully committed proposal: took = 41.287713ms
https://192.168.73.131:2379 is healthy: successfully committed proposal: took = 44.011272ms
https://192.168.73.132:2379 is healthy: successfully committed proposal: took = 45.182357ms
 
 
cd /data/etcd/ && ./etcdctl \
--endpoints="https://192.168.73.130:2379,https://192.168.73.131:2379,https://192.168.73.132:2379" \
--cacert=ssl/ca.pem \
--key=ssl/server-key.pem  \
--cert=ssl/server.pem  \
endpoint status
 
https://192.168.73.130:2379, c72a9875502ca9ec, 3.5.1, 20 kB, true, false, 2, 18, 18, 
https://192.168.73.131:2379, eae86f80f91acc92, 3.5.1, 20 kB, false, false, 2, 18, 18, 
https://192.168.73.132:2379, f4a2f8e0a48075dc, 3.5.1, 20 kB, false, false, 2, 18, 18, 
 
 
cd /data/etcd/ && ./etcdctl \
--endpoints="https://192.168.73.130:2379,https://192.168.73.131:2379,https://192.168.73.132:2379" \
--cacert=ssl/ca.pem \
--key=ssl/server-key.pem  \
--cert=ssl/server.pem  \
endpoint health endpoint health

https://192.168.73.130:2379 is healthy: successfully committed proposal: took = 21.621538ms
https://192.168.73.131:2379 is healthy: successfully committed proposal: took = 21.835347ms
https://192.168.73.132:2379 is healthy: successfully committed proposal: took = 30.630989ms