一. 二进制部署kubernetes，etcd 篇

3台centos7.5 服务器192.168.1.119，192.168.1.120，192.168.1.121

基本操作：关闭selinx firewall 修改hostname 安装ntp 同步时间等

1.首先安装cfssl

curl -L https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 -o /usr/local/bin/cfssl
curl -L https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 -o /usr/local/bin/cfssljson
curl -L https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64 -o /usr/local/bin/cfssl-certinfo
chmod +x /usr/local/bin/cfssl /usr/local/bin/cfssljson /usr/local/bin/cfssl-certinfo

2.制作证书 sh etcd-cert.sh 生成 ca.pem server-key.pem server.pem 注意：把脚本里的etcd节点ip修改成自己的etcd节点ip

[root@k8s-master k8s]# cat etcd-cert.sh 
cat > ca-config.json <<EOF
{
  "signing": {
    "default": {
      "expiry": "87600h"
    },
    "profiles": {
      "www": {
         "expiry": "87600h",
         "usages": [
            "signing",
            "key encipherment",
            "server auth",
            "client auth"
        ]
      }
    }
  }
}
EOF

cat > ca-csr.json <<EOF
{
    "CN": "etcd CA",
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "Beijing",
            "ST": "Beijing"
        }
    ]
}
EOF

cfssl gencert -initca ca-csr.json | cfssljson -bare ca -

#-----------------------

cat > server-csr.json <<EOF
{
    "CN": "etcd",
    "hosts": [
    "192.168.1.119",
    "192.168.1.120",
    "192.168.1.121",
    "192.168.1.122",
    "192.168.1.123"
    ],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "BeiJing",
            "ST": "BeiJing"
        }
    ]
}
EOF

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=www server-csr.json | cfssljson -bare server

3.安装etcd

下载安装包 https://github.com/etcd-io/etcd/releases

创建安装目录，把安装包里的文件etcd etcdctl解压出来拷贝到bin目录把刚生成的 ca.pem server.pem server-key.pem 拷贝到ssl目录里

[root@k8s-master k8s]# mkdir -p /opt/etcd/{bin,cfg,ssl}  #创建etcd目录，bin存放二进制文件，cfg存放配置文件，ssl存放证书
[root@k8s-master k8s]# cp ca.pem   server.pem  server-key.pem  /opt/etcd/ssl/  #将证书拷贝到 ssl目录
[root@k8s-master soft]# tar zxvf etcd-v3.3.10-linux-amd64.tar.gz  #解压etcd安装包
[root@k8s-master soft]# cd etcd-v3.3.10-linux-amd64
[root@k8s-master etcd-v3.3.10-linux-amd64]# ls
Documentation  etcd  etcdctl  README-etcdctl.md  README.md  READMEv2-etcdctl.md
[root@k8s-master etcd-v3.3.10-linux-amd64]# cp etcd etcdctl  /opt/etcd/bin/  #将二进制文件拷贝到 /opt/etcd/bin/

4.配置etcd [root@k8s-master soft]# cat etcd.sh

#!/bin/bash
# example: ./etcd.sh etcd01 192.168.1.119 etcd02=https://192.168.1.120:2380,etcd03=https://192.168.1.121:2380

ETCD_NAME=$1
ETCD_IP=$2
ETCD_CLUSTER=$3

WORK_DIR=/opt/etcd

cat <<EOF >$WORK_DIR/cfg/etcd
#[Member]
ETCD_NAME="${ETCD_NAME}"
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
ETCD_LISTEN_PEER_URLS="https://${ETCD_IP}:2380"
ETCD_LISTEN_CLIENT_URLS="https://${ETCD_IP}:2379"

#[Clustering]
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://${ETCD_IP}:2380"
ETCD_ADVERTISE_CLIENT_URLS="https://${ETCD_IP}:2379"
ETCD_INITIAL_CLUSTER="etcd01=https://${ETCD_IP}:2380,${ETCD_CLUSTER}"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
ETCD_INITIAL_CLUSTER_STATE="new"
EOF

cat <<EOF >/usr/lib/systemd/system/etcd.service
[Unit]
Description=Etcd Server
After=network.target
After=network-online.target
Wants=network-online.target

[Service]
Type=notify
EnvironmentFile=${WORK_DIR}/cfg/etcd
ExecStart=${WORK_DIR}/bin/etcd \
--name=\${ETCD_NAME} \
--data-dir=\${ETCD_DATA_DIR} \
--listen-peer-urls=\${ETCD_LISTEN_PEER_URLS} \
--listen-client-urls=\${ETCD_LISTEN_CLIENT_URLS},http://127.0.0.1:2379 \
--advertise-client-urls=\${ETCD_ADVERTISE_CLIENT_URLS} \
--initial-advertise-peer-urls=\${ETCD_INITIAL_ADVERTISE_PEER_URLS} \
--initial-cluster=\${ETCD_INITIAL_CLUSTER} \
--initial-cluster-token=\${ETCD_INITIAL_CLUSTER_TOKEN} \
--initial-cluster-state=new \
--cert-file=${WORK_DIR}/ssl/server.pem \
--key-file=${WORK_DIR}/ssl/server-key.pem \
--peer-cert-file=${WORK_DIR}/ssl/server.pem \
--peer-key-file=${WORK_DIR}/ssl/server-key.pem \
--trusted-ca-file=${WORK_DIR}/ssl/ca.pem \
--peer-trusted-ca-file=${WORK_DIR}/ssl/ca.pem
Restart=on-failure
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable etcd
systemctl restart etcd

[root@k8s-master soft]# ./etcd.sh etcd01 192.168.1.119 etcd02=https://192.168.1.120:2380,etcd03=https://192.168.1.121:2380

5.将安装目录下的/opt/etcd 目录拷贝到其他2个节点

[root@k8s-master opt]# ssh-keygen 
[root@k8s-master opt]# ssh-copy-id  root@192.168.1.120
[root@k8s-master opt]# ssh-copy-id  root@192.168.1.121
[root@k8s-master opt]# scp -r /opt/* root@192.168.1.120:/opt/
[root@k8s-master opt]# scp -r /opt/* root@192.168.1.121:/opt/
[root@k8s-master opt]# scp /usr/lib/systemd/system/etcd.service root@192.168.1.120:/usr/lib/systemd/system/
[root@k8s-master opt]# scp /usr/lib/systemd/system/etcd.service root@192.168.1.121:/usr/lib/systemd/system/

6.登陆其他2台服务器修改/opt/etcd/cfg/etcd文件

[root@k8s-master soft]# ssh root@192.168.1.120
Last login: Tue Oct  8 14:42:03 2019 from 192.168.1.119
[root@k8s-node1 ~]# cat /opt/etcd/cfg/etcd  #修改后配置如下 把etcd01 改成etcd02 ，119改成120
#[Member]
ETCD_NAME="etcd02"
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
ETCD_LISTEN_PEER_URLS="https://192.168.1.120:2380"
ETCD_LISTEN_CLIENT_URLS="https://192.168.1.120:2379"

#[Clustering]
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://192.168.1.120:2380"
ETCD_ADVERTISE_CLIENT_URLS="https://192.168.1.120:2379"
ETCD_INITIAL_CLUSTER="etcd01=https://192.168.1.119:2380,etcd02=https://192.168.1.120:2380,etcd03=https://192.168.1.121:2380"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
ETCD_INITIAL_CLUSTER_STATE="new"
[root@k8s-node1 ~]# systemctl enable etcd
[root@k8s-node1 ~]# systemctl restart etcd
[root@k8s-node1 ~]# exit
logout
Connection to 192.168.1.120 closed.
[root@k8s-master soft]# ssh root@192.168.1.121
Last login: Tue Oct  8 14:44:33 2019 from 192.168.1.119
[root@k8s-node2 ~]# cat /opt/etcd/cfg/etcd   #修改后配置如下 把etcd01 改成etcd03 ，119改成121
#[Member]
ETCD_NAME="etcd03"
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
ETCD_LISTEN_PEER_URLS="https://192.168.1.121:2380"
ETCD_LISTEN_CLIENT_URLS="https://192.168.1.121:2379"

#[Clustering]
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://192.168.1.121:2380"
ETCD_ADVERTISE_CLIENT_URLS="https://192.168.1.121:2379"
ETCD_INITIAL_CLUSTER="etcd01=https://192.168.1.119:2380,etcd02=https://192.168.1.120:2380,etcd03=https://192.168.1.121:2380"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
ETCD_INITIAL_CLUSTER_STATE="new"
[root@k8s-node2 ~]# systemctl enable etcd
[root@k8s-node2 ~]# systemctl restart etcd
[root@k8s-node2 ~]# exit
logout
Connection to 192.168.1.121 closed.

7.测试etcd集群是否正常，正常结果如下

[root@k8s-master soft]# /opt/etcd/bin/etcdctl \
> --ca-file=/opt/etcd/ssl/ca.pem --cert-file=/opt/etcd/ssl/server.pem --key-file=/opt/etcd/ssl/server-key.pem \
> --endpoints="https://192.168.1.119:2379,https://192.168.1.120:2379,https://192.168.1.121:2379" \
> cluster-health
member 140f63cd51ff8859 is healthy: got healthy result from https://192.168.1.121:2379
member 68531359f58cd0b6 is healthy: got healthy result from https://192.168.1.119:2379
member 9d3df5fa7887debf is healthy: got healthy result from https://192.168.1.120:2379
cluster is healthy

posted @ 2019-10-08 15:42 caonw 阅读(289) 评论(0) 编辑收藏举报

会员力量，点亮园子希望

刷新页面返回顶部

平凡不甘平庸

一. 二进制部署kubernetes，etcd 篇