K8s集群部署之一 ------安装TSL证书和部署etcd集群

版权声明：本文为博主原创文章，未经博主允许不得转载。 https://blog.csdn.net/qq_28883885/article/details/88055314

准备

三台centos7.4服务器，可以用VMware虚拟机创建生成。(01是master,02、03是node)

安装TSL证书

mkdir ssl
cd ssl
wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64

chmod +x cfssl_linux-amd64 cfssljson_linux-amd64 cfssl-certinfo_linux-amd64

mv cfssl_linux-amd64 /usr/local/bin/cfssl
mv cfssljson_linux-amd64 /usr/local/bin/cfssljson
mv cfssl-certinfo_linux-amd64 /usr/local/bin/cfssl-certinfo

##生成模板文件
cfssl print-defaults config > ca-config.json
cfssl print-defaults csr > ca-csr.json

修改ca-config.json,过期时间为5年

{
    "signing": {
        "default": {
            "expiry": "87600h"
        },
        "profiles": {
            "kubernetes": {
                "expiry": "87600h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "server auth",
                    "client auth"
                ]
            }
        }
    }
}

修改ca-csr.json 文件

{
    "CN": "kubernetes",
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "Beijing",
            "ST": "Beijing",
            "O":"k8s",
            "OU":"System"
        }
    ]
}

生成ca证书

cfssl gencert -initca ca-csr.json | cfssljson -bare ca -

#ca是前缀
#生成三个个文件ca-key.pem  ca.pem ca.pem

新建server-csr.json

{
    "CN": "kubernetes",
    "hosts": [
       "127.0.0.1",
       "10.186.104.103",
       "10.186.104.102",
       "10.186.104.90",
       "kubernetes",
       "kubernetes.default",
       "kubernetes.default.svc",
       "kubernetes.default.svc.cluster",
       "kubernetes.default.svc.cluster.local"
    ],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "Beijing",
            "ST": "Beijing",
            "O":"k8s",
            "OU":"System"
        }
    ]
}

#生成证书
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes server-csr.json | cfssljson -bare server

#生成两个文件server-key.pem server.pem

新增admin-csr.json

{
    "CN": "admin",
      "hosts": [],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "Beijing",
            "ST": "Beijing",
            "O":"system:masters",
            "OU":"System"
        }
    ]
}
#生成证书
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes admin-csr.json | cfssljson -bare admin

新建kube-proxy-csr.json

{
    "CN": "system:kube-proxy",
    "hosts": [],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "Beijing",
            "ST": "Beijing",
            "O":"k8s",
            "OU":"System"
        }
    ]
}

#生成证书
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kube-proxy-csr.json | cfssljson -bare kube-proxy

部署ETCD

下载etcd https://github.com/etcd-io/etcd/tags

#配置文件的位置
mkdir /opt/kubernetes
mkdir /opt/kubernetes/{bin,cfg,ssl}

tar -zxvf etcd-v3.3.12-linux-amd64.tar.gz 
mv etcd-v3.3.12-linux-amd64/etcd /opt/kubernetes/bin/

vim etcd 放在/cfg目录

ETCD_NAME="etcd01"
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
ETCD_LISTEN_PEER_URLS="https://10.186.104.103:2380"
ETCD_LISTEN_CLIENT_URLS="https://10.186.104.103:2379"

#[cluster]
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://10.186.104.103:2380"
ETCD_INITIAL_CLUSTER="etcd01=https://10.186.104.103:2380,etcd02=https://10.186.104.102:2380,etcd03=https://10.186.104.90:2380"
ETCD_INITIAL_CLUSTER_STATE="new"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
ETCD_ADVERTISE_CLIENT_URLS="https://10.186.104.103:2379"

vim /usr/lib/systemd/system/etcd.service

[UNIT]
Description=Etcd Server
After=network.target
After=network-online.target
Wants=network-online.target

[Service]
Type=notify
EnvironmentFile=-/opt/kubernetes/cfg/etcd
ExecStart=/opt/kubernetes/bin/etcd \
--name=${ETCD_NAME} \
--data-dir=${ETCD_DATA_DIR} \
--listen-peer-urls=${ETCD_LISTEN_PEER_URLS} \
--listen-client-urls=${ETCD_LISTEN_CLIENT_URLS},http://127.0.0.1:2379 \
--advertise-client-urls=${ETCD_ADVERTISE_CLIENT_URLS} \
--initial-advertise-peer-urls=${ETCD_INITIAL_ADVERTISE_PEER_URLS} \
--initial-cluster-token=${ETCD_INITIAL_CLUSTER_TOKEN} \
--initial-cluster=${ETCD_INITIAL_CLUSTER} \
--initial-cluster-state=new \
--cert-file=/opt/kubernetes/ssl/server.pem \
--key-file=/opt/kubernetes/ssl/server-key.pem \
--peer-cert-file=/opt/kubernetes/ssl/server.pem \
--peer-key-file=/opt/kubernetes/ssl/server-key.pem \
--trusted-ca-file=/opt/kubernetes/ssl/ca.pem \
--peer-trusted-ca-file=/opt/kubernetes/ssl/ca.pem
Restart=on-failure
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target

 cp /root/ssl/server*.pem /root/ssl/ca*.pem  /opt/kubernetes/ssl/
#启动
systemctl start etcd

配置启动另外两台etct

ssh-keygen
ls /root/.ssh/

ssh-copy-id [email protected]
ssh-copy-id [email protected]

#另外两台机器
mkdir -p /opt/kubernetes/{bin,cfg,ssl}

#传输 手动复制也是可以的
scp -r /opt/kubernetes/bin/ [email protected]:/opt/kubernetes/
scp -r /opt/kubernetes/bin/ [email protected]:/opt/kubernetes/

scp -r /opt/kubernetes/ssl/ [email protected]:/opt/kubernetes/
scp -r /opt/kubernetes/ssl/ [email protected]:/opt/kubernetes/

scp -r /opt/kubernetes/cfg/ [email protected]:/opt/kubernetes/
scp -r /opt/kubernetes/cfg/ [email protected]:/opt/kubernetes/

scp /usr/lib/systemd/system/etcd.service [email protected]:/usr/lib/systemd/system
scp /usr/lib/systemd/system/etcd.service [email protected]:/usr/lib/systemd/system
#全部复制就行

修改其它两个服务器的配置文件就可以

vim /etc/profile
#添加下面一行，方面使用变量
PATH=$PATH:/opt/kubernetes/bin
source /etc/profile

#测试是否配置好
#要关闭防火墙 关键这是个坑
#如果修改了配置文件 启动失败 需要删除/var/lib/etcd 数据目录
etcdctl --ca-file=ca.pem --cert-file=server.pem --key-file=server-key.pem --endpoints="https://10.186.104.102:2379,https://10.186.104.103:2379,https://10.186.104.90:2379" cluster-health