一、环境
角色 | IP |
---|---|
etcd-1 | 192.168.10.10 (12379、12380) |
etcd-2 | 192.168.10.10 (22379、22380) |
etcd-3 | 192.168.10.10 (32379、32380) |
多服务器把ip和端口自行调整一下就行了
二、软件下载
mkdir /opt/etcd
mkdir /opt/etcd/{cfg,ssl,data,wal} –p
mkdir /opt/etcd2
mkdir /opt/etcd2/{cfg,ssl,data,wal} –p
mkdir /opt/etcd3
mkdir /opt/etcd3/{cfg,ssl,data,wal} –p
工具下载:
curl -L https://github.com/cloudflare/cfssl/releases/download/v1.5.0/cfssl_1.5.0_linux_amd64 -o cfssl
chmod +x cfssl
curl -L https://github.com/cloudflare/cfssl/releases/download/v1.5.0/cfssljson_1.5.0_linux_amd64 -o cfssljson
chmod +x cfssljson
curl -L https://github.com/cloudflare/cfssl/releases/download/v1.5.0/cfssl-certinfo_1.5.0_linux_amd64 -o cfssl-certinfo
chmod +x cfssl-certinfo
mv {cfssl,cfssljson,cfssl-certinfo} /usr/local/bin
etcd软件下载:
wget -c https://github.com/etcd-io/etcd/releases/download/v3.5.0/etcd-v3.5.0-linux-amd64.tar.gz
tar -zxf etcd-v3.5.0-linux-amd64.tar.gz
cd etcd-v3.5.0-linux-amd64
mv {etcd,etcdctl,etcdutl} /usr/local/bin/
三、证书生成
(1)自签证书颁发机构(CA)
[root@localhost etcd]# cat > ca-config.json<< EOF
{
"signing":{
"default":{
"expiry":"87600h"
},
"profiles":{
"kubernetes":{
"expiry":"87600h",
"usages":[
"signing",
"key encipherment",
"server auth",
"client auth"
]
}
}
}
}
EOF
[root@localhost etcd]# cat > ca-csr.json<< EOF
{
"CN":"etcd CA",
"key":{
"algo":"rsa",
"size":2048
},
"names":[
{
"C":"CN",
"L":"Beijing",
"ST":"Beijing"
}
]
}
EOF
生成 CA 秘钥文件(
ca-key.pem
)和证书文件(ca.pem
) :
[root@localhost etcd]# cfssl gencert -ini