kubernetes笔记（一）：安装与部署etcd

最新推荐文章于 2025-05-30 21:45:00 发布

原创最新推荐文章于 2025-05-30 21:45:00 发布 · 246 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#kubernetes #etcd

k8s 专栏收录该内容

5 篇文章

订阅专栏

本文介绍两种Etcd的安装配置方法：通过yum包管理和二进制文件安装，并详细阐述了如何进行节点分配、证书生成及服务配置。

yum安装etcd

1、下载

yum install -y etcd

2、节点分配

master：10.0.0.11
node：10.0.0.14,10.0.0.15,10.0.0.16,10.0.0.17,10.0.0.18

3、修改配置文件

#以10.0.0.11为例，其他节点需要修改ETCD_LISTEN_PEER_URLS、ETCD_LISTEN_CLIENT_URLS、ETCD_INITIAL_ADVERTISE_PEER_URLS、ETCD_ADVERTISE_CLIENT_URLS的IP
cp /etc/etcd/etcd.conf /etc/etcd/etcd.conf.bak.`date +%Y%m%d%H%M%S`
vim /etc/etcd/etcd.conf
#[Member]
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
ETCD_LISTEN_PEER_URLS="http://10.0.0.11:2380"
ETCD_LISTEN_CLIENT_URLS="http://10.0.0.11:2379,http://127.0.0.1:2379"
ETCD_NAME="etcd1"
ETCD_INITIAL_ADVERTISE_PEER_URLS="http://10.0.0.11:2380"
ETCD_ADVERTISE_CLIENT_URLS="http://10.0.0.11:2379"
ETCD_INITIAL_CLUSTER="etcd1=http://10.0.0.11:2380,etcd2=http://10.0.0.14:2380,etcd3=http://10.0.0.15:2380,etcd4=http://10.0.0.16:2380,etcd5=http://10.0.0.17:2380,etcd6=http://10.0.0.18:2380"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"

4、启动etcd服务

#如果不删除成员目录的话是无法启动的
rm -rf /var/lib/etcd/default.etcd
systemctl disable etcd
systemctl enable etcd
systemctl stop etcd
systemctl start etcd
systemctl status etcd
systemctl restart etcd

5、检查与常用配置

#检查是否监控
etcdctl cluster-health

#查看节点
etcdctl member list

#新增节点
etcdctl member add etcd3 http://10.0.0.14:2380 clientURLs=http://10.0.0.14:2379 isLeader=false

#删除节点
etcdctl member remove bc721669bdca5256

二进制安装etcd+证书

节点分配
etcd-1 10.0.8.4
etcd-2 10.0.8.5
etcd-3 10.0.8.6

1、部署cfssl证书

cd /public_data/source
wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64
chmod +x cfssl_linux-amd64 cfssljson_linux-amd64 cfssl-certinfo_linux-amd64
cp /public_data/source/k8s-cfssl/cfssl_linux-amd64 /usr/local/bin/cfssl
cp /public_data/source/k8s-cfssl/cfssljson_linux-amd64 /usr/local/bin/cfssljson
cp /public_data/source/k8s-cfssl/cfssl-certinfo_linux-amd64 /usr/bin/cfssl-certinfo
chmod +x /usr/local/bin/cfssl /usr/local/bin/cfssljson /usr/bin/cfssl-certinfo

2、生成etcd证书

#自签证书颁发机构
mkdir -p ~/TLS/{etcd,k8s}
cd ~/TLS/etcd

#自签CA：
cat > ca-config.json<< EOF
{
    "signing": {
        "default": {
            "expiry": "87600h"
        },
        "profiles": {
            "www": {
                "expiry": "87600h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "server auth",
                    "client auth"
                ]
            }
        }
    }
}
EOF

cat > ca-csr.json<< EOF
    {
        "CN": "etcd CA",
        "key": {
            "algo": "rsa",
            "size": 2048
        },
    "names": [
        {
            "C": "CN",
            "L": "Beijing",
            "ST": "Beijing"
        }
    ]
}
EOF

#生成证书
cfssl gencert -initca ca-csr.json | cfssljson -bare ca -
ls *pem
ca-key.pem ca.pem

3、使用自签 CA 签发 Etcd HTTPS 证书

#创建证书申请文件，注意里面的IP要对应ETCD节点
cat > server-csr.json<< EOF
{
    "CN": "etcd",
    "hosts": [
        "10.0.8.4",
        "10.0.8.5",
        "10.0.8.6"
    ],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "BeiJing",
            "ST": "BeiJing"
        }
    ]
}
EOF
#生成证书
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=www server-csr.json | cfssljson -bare server
ls server*pem
server-key.pem server.pem

4、下载etcd

wget https://github.com/etcd-io/etcd/releases/download/v3.4.9/etcd-v3.4.9-linux-amd64.tar.gz

5、部署etcd节点

mkdir -p /opt/module/etcd/
mkdir /opt/module/etcd/{bin,cfg,ssl} 
tar zxvf /public_data/source/etcd-v3.4.9-linux-amd64.tar.gz -C /opt/module
mv /opt/module/etcd-v3.4.9-linux-amd64/{etcd,etcdctl} /opt/module/etcd/bin/

6、同步证书

cp ~/TLS/etcd/ca*pem ~/TLS/etcd/server*pem /opt/module/etcd/ssl/

7、配置etcd文件

vim /opt/module/etcd/cfg/etcd.conf
#[Member]
ETCD_NAME="etcd-1"
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
ETCD_LISTEN_PEER_URLS="https://10.0.8.4:2380"
ETCD_LISTEN_CLIENT_URLS="https://10.0.8.4:2379"
#[Clustering]
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://10.0.8.4:2380"
ETCD_ADVERTISE_CLIENT_URLS="https://10.0.8.4:2379"
ETCD_INITIAL_CLUSTER="etcd-1=https://10.0.8.4:2380,etcd-2=https://10.0.8.5:2380,etcd-3=https://10.0.8.6:2380"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
ETCD_INITIAL_CLUSTER_STATE="new"

8、开机启动

vim /usr/lib/systemd/system/etcd.service
[Unit]
Description=Etcd Server
After=network.target
After=network-online.target
Wants=network-online.target
[Service]
Type=notify
EnvironmentFile=/opt/module/etcd/cfg/etcd.conf
ExecStart=/opt/module/etcd/bin/etcd \
--cert-file=/opt/module/etcd/ssl/server.pem \
--key-file=/opt/module/etcd/ssl/server-key.pem \
--peer-cert-file=/opt/module/etcd/ssl/server.pem \
--peer-key-file=/opt/module/etcd/ssl/server-key.pem \
--trusted-ca-file=/opt/module/etcd/ssl/ca.pem \
--peer-trusted-ca-file=/opt/module/etcd/ssl/ca.pem \
--logger=zap
Restart=on-failure
LimitNOFILE=65536
[Install]
WantedBy=multi-user.target

9、同步到其他节点

scp -r /opt/module/etcd root@10.0.8.5:/opt/module/
scp /usr/lib/systemd/system/etcd.service root@10.0.8.5:/usr/lib/systemd/system/
scp -r /opt/module/etcd root@10.0.8.6:/opt/module/
scp /usr/lib/systemd/system/etcd.service root@10.0.8.5:/usr/lib/systemd/system/

#修改其他节点配置文件
ETCD_NAME
ETCD_LISTEN_PEER_URLS
ETCD_LISTEN_CLIENT_URLS
ETCD_INITIAL_ADVERTISE_PEER_URLS
ETCD_ADVERTISE_CLIENT_URLS

10、启动+检查

systemctl daemon-reload
systemctl start etcd
systemctl restart etcd
systemctl enable etcd

#检查健康状态
ETCDCTL_API=3 /opt/module/etcd/bin/etcdctl --cacert=/opt/module/etcd/ssl/ca.pem --cert=/opt/module/etcd/ssl/server.pem --key=/opt/module/etcd/ssl/server-key.pem --endpoints="https://10.0.8.4:2379,https://10.0.8.5:2379,https://10.0.8.6:2379" endpoint health