Centos7部署kubernetes-ETCD集群(三)

 
 1、下载etcd软件包 

  wget 
 https://github.com/coreos/etcd/releases/download/v3.2.18/etcd-v3.2.18-linux-amd64.tar.gz 

 
 [root@linux-node1 src]# tar -zxvf etcd-v3.2.18-linux-amd64.tar.gz  

 
 [root@linux-node1 src]# cd etcd-v3.2.18-linux-amd64 

 
 [root@linux-node1 etcd-v3.2.18-linux-amd64]# cp etcd etcdctl /opt/kubernetes/bin/ 

 
 [root@linux-node1 etcd-v3.2.18-linux-amd64]# scp etcd etcdctl 192.168.43.22:/opt/kubernetes/bin/ 

 
 [root@linux-node1 etcd-v3.2.18-linux-amd64]# scp etcd etcdctl 192.168.43.23:/opt/kubernetes/bin/ 

 
 2、创建etcd证书签名请求 

 
 [root@linux-node1 ~]# cd /usr/local/src/ssl/ 

 
 [root@linux-node1 ssl]# vim etcd-csr.json 

{

 
  "CN": "etcd", 

 
  "hosts": [ 

 
  "127.0.0.1", 

 
 "192.168.43.21", 

 
 "192.168.43.22", 

 
 "192.168.43.23" 

],

 
  "key": { 

 
  "algo": "rsa", 

 
  "size": 2048 

},

 
  "names": [ 

{

 
  "C": "CN", 

 
  "ST": "BeiJing", 

 
  "L": "BeiJing", 

 
  "O": "k8s", 

 
  "OU": "System" 

}

]

}

 
 3、生成etcd证书和私钥 

 
 [root@linux-node1 ssl]# cfssl gencert -ca=/opt/kubernetes/ssl/ca.pem \ 

 
 > -ca-key=/opt/kubernetes/ssl/ca-key.pem \ 

 
 > -config=/opt/kubernetes/ssl/ca-config.json \ 

 
 > -profile=kubernetes etcd-csr.json | cfssljson -bare etcd 

 
 [root@linux-node1 ssl]# ls -l etcd* 

 
 -rw-r--r-- 1 root root 1062 Jun 11 00:28 etcd.csr 

 
 -rw-r--r-- 1 root root 287 Jun 11 00:26 etcd-csr.json 

 
 -rw------- 1 root root 1679 Jun 11 00:28 etcd-key.pem 

 
 -rw-r--r-- 1 root root 1436 Jun 11 00:28 etcd.pem 

 
 4、将证书移动到opt/kubernetes/ssl目录下 

 
 [root@linux-node1 ssl]# cp etcd*.pem /opt/kubernetes/ssl 

 
 [root@linux-node1 ssl]# scp etcd*.pem 192.168.43.22:/opt/kubernetes/ssl  

 
 [root@linux-node1 ssl]# scp etcd*.pem 192.168.43.23:/opt/kubernetes/ssl 

 
 5、设置ETCD配置文件 

 
 [root@linux-node1 ssl]# vim /opt/kubernetes/cfg/etcd.conf 

 
 #[member] 

 
 ETCD_NAME="etcd-node1" 

 
 ETCD_DATA_DIR="/var/lib/etcd/default.etcd" 

 
 #ETCD_SNAPSHOT_COUNTER="10000" 

 
 #ETCD_HEARTBEAT_INTERVAL="100" 

 
 #ETCD_ELECTION_TIMEOUT="1000" 

 
 ETCD_LISTEN_PEER_URLS="https://192.168.43.21:2380" 

 
 ETCD_LISTEN_CLIENT_URLS="https://192.168.43.21:2379,https://127.0.0.1:2379" 

 
 #ETCD_MAX_SNAPSHOTS="5" 

 
 #ETCD_MAX_WALS="5" 

 
 #ETCD_CORS="" 

 
 #[cluster] 

 
 ETCD_INITIAL_ADVERTISE_PEER_URLS="https://192.168.43.21:2380" 

 
 # if you use different ETCD_NAME (e.g. test), 

 
 # set ETCD_INITIAL_CLUSTER value for this name, i.e. "test=http://..." 

 
 ETCD_INITIAL_CLUSTER="etcd-node1=https://192.168.43.21:2380,etcd-node2=https://192.168.43.22:2380,etcd-node3=https://192.168.43.23:2380" 

 
 ETCD_INITIAL_CLUSTER_STATE="new" 

 
 ETCD_INITIAL_CLUSTER_TOKEN="k8s-etcd-cluster" 

 
 ETCD_ADVERTISE_CLIENT_URLS="https://192.168.43.21:2379" 

 
 #[security] 

 
 CLIENT_CERT_AUTH="true" 

 
 ETCD_CA_FILE="/opt/kubernetes/ssl/ca.pem" 

 
 ETCD_CERT_FILE="/opt/kubernetes/ssl/etcd.pem" 

 
 ETCD_KEY_FILE="/opt/kubernetes/ssl/etcd-key.pem" 

 
 PEER_CLIENT_CERT_AUTH="true" 

 
 ETCD_PEER_CA_FILE="/opt/kubernetes/ssl/ca.pem" 

 
 ETCD_PEER_CERT_FILE="/opt/kubernetes/ssl/etcd.pem" 

 
 ETCD_PEER_KEY_FILE="/opt/kubernetes/ssl/etcd-key.pem" 

 
 6、创建ETCD系统服务 

  [root@linux-node1 ~]# vim /etc/systemd/system/etcd.service 

  [Unit] 

  Description=Etcd Server 

  After=network.target 

  [Service] 

  Type=simple 

  WorkingDirectory=/var/lib/etcd 

  EnvironmentFile=-/opt/kubernetes/cfg/etcd.conf 

  # set GOMAXPROCS to number of processors 

  ExecStart=/bin/bash -c "GOMAXPROCS=$(nproc) /opt/kubernetes/bin/etcd" 

  Type=notify 

  [Install] 

  WantedBy=multi-user.target 

 
 7、重新加载系统服务，并修改node1、node2节点的etcd.conf的配置文件为自己本机的主机名、IP 

  [root@linux-node1 ~]# systemctl daemon-reload 

  [root@linux-node1 ~]# systemctl enable etcd 

  [root@linux-node1 ssl]# scp /opt/kubernetes/cfg/etcd.conf 192.168.43.22:/opt/kubernetes/cfg/ 

  [root@linux-node1 ssl]# scp /etc/systemd/system/etcd.service 192.168.43.22:/etc/systemd/system/ 

  [root@linux-node1 ssl]# scp /opt/kubernetes/cfg/etcd.conf 192.168.43.23:/opt/kubernetes/cfg/ 

  [root@linux-node1 ssl]# scp /etc/systemd/system/etcd.service 192.168.43.23:/etc/systemd/system/ 

 
 [root@linux-node2 ~]# vim /opt/kubernetes/cfg/etcd.conf  

  #[member] 

  ETCD_NAME="etcd-node2" 

  ETCD_DATA_DIR="/var/lib/etcd/default.etcd" 

  #ETCD_SNAPSHOT_COUNTER="10000" 

  #ETCD_HEARTBEAT_INTERVAL="100" 

  #ETCD_ELECTION_TIMEOUT="1000" 

  ETCD_LISTEN_PEER_URLS="https://192.168.43.22:2380" 

  ETCD_LISTEN_CLIENT_URLS="https://192.168.43.22:2379,https://127.0.0.1:2379" 

  #ETCD_MAX_SNAPSHOTS="5" 

  #ETCD_MAX_WALS="5" 

  #ETCD_CORS="" 

  #[cluster] 

  ETCD_INITIAL_ADVERTISE_PEER_URLS="https://192.168.43.22:2380" 

  # if you use different ETCD_NAME (e.g. test), 

  # set ETCD_INITIAL_CLUSTER value for this name, i.e. "test=http://..." 

  ETCD_INITIAL_CLUSTER="etcd-node1=https://192.168.43.21:2380,etcd-node2=https://192.168.43.22:2380,etcd-node3=https://192.168.43.23:2380" 

  ETCD_INITIAL_CLUSTER_STATE="new" 

  ETCD_INITIAL_CLUSTER_TOKEN="k8s-etcd-cluster" 

  ETCD_ADVERTISE_CLIENT_URLS="https://192.168.43.22:2379" 

  #[security] 

  CLIENT_CERT_AUTH="true" 

  ETCD_CA_FILE="/opt/kubernetes/ssl/ca.pem" 

  ETCD_CERT_FILE="/opt/kubernetes/ssl/etcd.pem" 

 
 [root@linux-node3 ~]# vim /opt/kubernetes/cfg/etcd.conf  

  #[member] 

  ETCD_NAME="etcd-node3" 

  ETCD_DATA_DIR="/var/lib/etcd/default.etcd" 

  #ETCD_SNAPSHOT_COUNTER="10000" 

  #ETCD_HEARTBEAT_INTERVAL="100" 

  #ETCD_ELECTION_TIMEOUT="1000" 

  ETCD_LISTEN_PEER_URLS="https://192.168.43.23:2380" 

  ETCD_LISTEN_CLIENT_URLS="https://192.168.43.23:2379,https://127.0.0.1:2379" 

  #ETCD_MAX_SNAPSHOTS="5" 

  #ETCD_MAX_WALS="5" 

  #ETCD_CORS="" 

  #[cluster] 

  ETCD_INITIAL_ADVERTISE_PEER_URLS="https://192.168.43.23:2380" 

  # if you use different ETCD_NAME (e.g. test), 

  # set ETCD_INITIAL_CLUSTER value for this name, i.e. "test=http://..." 

  ETCD_INITIAL_CLUSTER="etcd-node1=https://192.168.43.21:2380,etcd-node2=https://192.168.43.22:2380,etcd-node3=https://192.168.43.23:2380" 

  ETCD_INITIAL_CLUSTER_STATE="new" 

  ETCD_INITIAL_CLUSTER_TOKEN="k8s-etcd-cluster" 

  ETCD_ADVERTISE_CLIENT_URLS="https://192.168.43.23:2379" 

  #[security] 

  CLIENT_CERT_AUTH="true" 

  ETCD_CA_FILE="/opt/kubernetes/ssl/ca.pem" 

  ETCD_CERT_FILE="/opt/kubernetes/ssl/etcd.pem" 

  在所有节点创建etcd存储目录并启动 
 etcd，默认是不会创建的。 

 
 [root@linux-node1 ~]# mkdir /var/lib/etcd 

 
 [root@linux-node2 ~]# mkdir /var/lib/etcd 

 
 [root@linux-node3 ~]# mkdir /var/lib/etcd 

 
 [root@linux-node1 ~]# systemctl daemon-reload 

 
 [root@linux-node1 ~]# systemctl enable etcd 

 
 [root@linux-node2 ~]# systemctl daemon-reload 

 
 [root@linux-node2 ~]# systemctl enable etcd 

 
 [root@linux-node3 ~]# systemctl daemon-reload 

 
 [root@linux-node3 ~]# systemctl enable etcd 

 
 [root@linux-node1 ~]# systemctl start etcd 

 
 [root@linux-node2 ~]# systemctl start etcd 

 
 [root@linux-node3 ~]# systemctl start etcd 

 
 8、验证集群 

 
 [root@linux-node1 ~]# etcdctl --endpoints=https://192.168.43.21:2379 \ 

 
 > --ca-file=/opt/kubernetes/ssl/ca.pem \ 

 
 > --cert-file=/opt/kubernetes/ssl/etcd.pem \ 

 
 > --key-file=/opt/kubernetes/ssl/etcd-key.pem cluster-health 

 
 member 6617b5aaafae24e4 is healthy: got healthy result from https://192.168.43.23:2379 

 
 member bb1998338f4e535e is healthy: got healthy result from https://192.168.43.21:2379 

 
 member dcf594c5976bb617 is healthy: got healthy result from https://192.168.43.22:2379 

 
 cluster is healthy 