|NO.Z.00007|——————————|^^ 部署 ^^|——|Kubernetes&二进制部署.V03|——|部署ETCD集群|

一、部署Etcd集群
节点名称 IP
etcd-1 10.10.10.11
etcd-2 10.10.10.12
etcd-3 10.10.10.13 
### --- 部署Etcd集群
~~~     Etcd是一个分布式键值存储系统，kubernetes使用Etcd进行数据存储，
~~~     所以先准备一个Etcd数据库，为解决Etcd单点故障，应采用集群方式部署，
~~~     这里使用3台组建集群，可容忍1台机器故障，
~~~     当然，你也可以使用5台组件集群，可容忍2台机器故障

~~~     # 注：为了节省机器，这里与k8s节点机器复用，也可以独立于k8s集群之外部署，
~~~     只要apiserver能连接到就行
一、准备cfssl证书生成工具
### --- 准备cfssl证书生成工具
~~~		cfssl是一个开源的证书管理工具，使用json文件生成证书，
~~~		相比openssl更方便使用，找任意一台服务器操作，这里用Master节点

[root@k8s-master ~]# wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
[root@k8s-master ~]# wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
[root@k8s-master ~]# wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64
[root@k8s-master ~]# chmod +x cfssl_linux-amd64 cfssljson_linux-amd64 cfssl-certinfo_linux-amd64 
[root@k8s-master ~]# mv cfssl_linux-amd64 /usr/local/bin/cfssl
[root@k8s-master ~]# mv cfssljson_linux-amd64 /usr/local/bin/cfssljson
[root@k8s-master ~]# mv cfssl-certinfo_linux-amd64 /usr/bin/cfssl-certinfo
二、生成Etcd证书
### --- 自签证书颁发机构（CA）
~~~		创建工作目录：

[root@k8s-master ~]# mkdir -p ~/TLS/{etcd,k8s}
[root@k8s-master ~]# cd TLS/etcd/
### --- 自签CA：

[root@k8s-master etcd]# cat > ca-config.json<< EOF
> {
>     "signing": {
>      "default": {
>       "expiry": "87600h"
>     },
>     "profiles": {
>       "www": {
>         "expiry": "87600h",
>         "usages": [
>            "signing",
>         "key encipherment",
>         "server auth",
>         "client auth"
>         ]
>     }
>   }
>  }
> }
> EOF
[root@k8s-master etcd]# cat > ca-csr.json<< EOF
> {
>     "CN": "etcd CA",
>     "key": {
>         "algo": "rsa",
>         "size": 2048
>     },
>     "names": [
>         {
>             "C": "CN",
>             "L": "Beijing",
>             "ST": "Beijing"
>         }
>     ]
> }
> EOF
### --- 生成Etcd证书
~~~		自签证书颁发机构（CA）
~~~		创建工作目录：

[root@k8s-master ~]# mkdir -p ~/TLS/{etcd,k8s}
[root@k8s-master ~]# cd TLS/etcd/
### --- 自签CA：

[root@k8s-master etcd]# cat > ca-config.json<< EOF
> {
>     "signing": {
>      "default": {
>       "expiry": "87600h"
>     },
>     "profiles": {
>       "www": {
>         "expiry": "87600h",
>         "usages": [
>            "signing",
>         "key encipherment",
>         "server auth",
>         "client auth"
>         ]
>     }
>   }
>  }
> }
> EOF
[root@k8s-master etcd]# cat > ca-csr.json<< EOF
> {
>     "CN": "etcd CA",
>     "key": {
>         "algo": "rsa",
>         "size": 2048
>     },
>     "names": [
>         {
>             "C": "CN",
>             "L": "Beijing",
>             "ST": "Beijing"
>         }
>     ]
> }
> EOF
### --- 生成证书

[root@k8s-master etcd]# cfssl gencert -initca ca-csr.json | cfssljson -bare ca -
2021/02/21 14:20:35 [INFO] generating a new CA key and certificate from CSR
2021/02/21 14:20:35 [INFO] generate received request
2021/02/21 14:20:35 [INFO] received CSR
2021/02/21 14:20:35 [INFO] generating key: rsa-2048
2021/02/21 14:20:35 [INFO] encoded CSR
2021/02/21 14:20:35 [INFO] signed certificate with serial number 306606402513971446614021556661539535740629642904
[root@k8s-master etcd]# ls *pem
ca-key.pem  ca.pem
三、使用自签CA签发Etcd HTTPS证书
### --- 创建证书申请文件
~~~		注：上述文件hosts字段中IP为所有etcd节点的集群内部通信IP，一个都不能少！
~~~		为了方便后期扩容可以多写几个预留的IP

[root@k8s-master etcd]# cat > server-csr.json<< EOF
> {
>     "CN": "etcd",
>     "hosts": [
>     "10.10.10.11",
>     "10.10.10.12",
>     "10.10.10.13"
>     ],
>     "key": {
>         "algo": "rsa",
>         "size": 2048
>     },
>     "names": [
>         {
>             "C": "CN",
>             "L": "BeiJing",
>             "ST": "BeiJing"
>         }
>     ]
> }
> EOF
### --- 生成证书

[root@k8s-master etcd]# cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=www server-csr.json | cfssljson -bare server
[root@k8s-master etcd]# cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=www server-csr.json | cfssljson -bare server
2021/02/21 14:25:09 [INFO] generate received request
2021/02/21 14:25:09 [INFO] received CSR
2021/02/21 14:25:09 [INFO] generating key: rsa-2048
2021/02/21 14:25:09 [INFO] encoded CSR
2021/02/21 14:25:09 [INFO] signed certificate with serial number 539994125224611670227816838844455276188447644135
2021/02/21 14:25:09 [WARNING] This certificate lacks a "hosts" field. This makes it unsuitable for
websites. For more information see the Baseline Requirements for the Issuance and Management
of Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser Forum (https://cabforum.org);
specifically, section 10.2.3 ("Information Requirements").
### --- 最终生成的证书文件

[root@k8s-master etcd]# ls server*pem
server-key.pem  server.pem
[root@k8s-master etcd]# ls *pem            
ca-key.pem  ca.pem  server-key.pem  server.pem
四、部署Etcd集群：节点一
### --- 下载地址：

[root@k8s-master ~]# wget https://github.com/etcd-io/etcd/releases/download/v3.4.9/etcd-v3.4.9-linux-amd64.tar.gz
### --- 以下在节点1上操作，为简化操作，待会将节点1生成的所有文件拷贝到节点2和节点3
### --- 创建工作目录并解压二进制包

[root@k8s-master ~]# mkdir -p  /opt/etcd/{bin,cfg,ssl}
[root@k8s-master ~]# tar -zxvf etcd-v3.4.9-linux-amd64.tar.gz  
[root@k8s-master ~]# mv etcd-v3.4.9-linux-amd64/{etcd,etcdctl} /opt/etcd/bin/  
### --- 创建etcd配置文件
~~~		ETCD_NAME:节点名称，集群中唯一
~~~		ETCD_DATA_DIR:数据目录
~~~		ETCD_LISTEN_PEER_URLS: 集群通信监听地址
~~~		ETCD_LISTEN_CLIENT_URLS:客户端访问监听地址
~~~		ETCD_INITIAL_ADVERTISE_PEER_URLS:集群通告第一种
~~~		ETCD_ADVERTISE_CLIENT_URLS:客户端通告地址
~~~		ETCD_INITIAL_CLUSTER:集群节点地址
~~~		ETCD_INITIAL_CLUSTER_TOKEN:集群Token
~~~		ETCD_INITIAL_CLUSTER_STATE:加入集群的当前状态，new是新集群，existing表示加入已有集群

[root@k8s-master ~]# cat > /opt/etcd/cfg/etcd.conf << EOF
> #[Member]
> ETCD_NAME="etcd-1"
> ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
> ETCD_LISTEN_PEER_URLS="https://10.10.10.11:2380"
> ETCD_LISTEN_CLIENT_URLS="https://10.10.10.11:2379"
> #[Clustering]
> ETCD_INITIAL_ADVERTISE_PEER_URLS="https://10.10.10.11:2380"
> ETCD_ADVERTISE_CLIENT_URLS="https://10.10.10.11:2379"
> ETCD_INITIAL_CLUSTER="etcd-1=https://10.10.10.11:2380,etcd-2=https://10.10.10.12:2380,etcd-3=https://10.10.10.13:2380"
> ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
> ETCD_INITIAL_CLUSTER_STATE="new"
> EOF
### --- systemd管理etcd

[root@k8s-master ~]# cat > /usr/lib/systemd/system/etcd.service << EOF
> [Unit]
> Description=Etcd Server
> After=network.target
> After=network-online.target
> Wants=network-online.target
> [Service]
> Type=notify
> EnvironmentFile=/opt/etcd/cfg/etcd.conf
> ExecStart=/opt/etcd/bin/etcd \
> --cert-file=/opt/etcd/ssl/server.pem \
> --key-file=/opt/etcd/ssl/server-key.pem \
> --peer-cert-file=/opt/etcd/ssl/server.pem \
> --peer-key-file=/opt/etcd/ssl/server-key.pem \
> --trusted-ca-file=/opt/etcd/ssl/ca.pem \
> --peer-trusted-ca-file=/opt/etcd/ssl/ca.pem \
> --logger=zap
> Restart=on-failure
> LimitNOFILE=65536
> [Install]
> WantedBy=multi-user.target
> EOF
### --- 拷贝刚才生成的证书
~~~		把刚才生成的证书拷贝到配置文件中的路径

[root@k8s-master ~]# cp ~/TLS/etcd/ca*pem ~/TLS/etcd/server*pem /opt/etcd/ssl/
[root@k8s-master ~]# ls /opt/etcd/ssl/
ca-key.pem  ca.pem  server-key.pem  server.pem  
### --- 将上面节点1所有生成的文件拷贝到节点2和节点3

[root@k8s-master ~]# scp -r /opt/etcd/ root@10.10.10.12:/opt/
[root@k8s-master ~]# scp /usr/lib/systemd/system/etcd.service root@10.10.10.12:/usr/lib/systemd/system/
[root@k8s-master ~]# scp -r /opt/etcd/ root@10.10.10.13:/opt/                                                                                                                                   100% 1338   782.0KB/s   00:00    
[root@k8s-master ~]# scp /usr/lib/systemd/system/etcd.service root@10.10.10.13:/usr/lib/systemd/system/
~~~		然后在节点2和节点3分别修改etcd.conf配置文件中的节点名称和当前服务器IP：

[root@k8s-node1 ~]# vim /opt/etcd/cfg/etcd.conf
#[Member]
ETCD_NAME="etcd-1"                                              #修改此处，节点2改为etcd-2；节点3改为etcd-3
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
ETCD_LISTEN_CLIENT_URLS="https://10.10.10.11:2379"              #修改此处当期服务器的IP地址
ETCD_LISTEN_CLIENT_URLS="https://10.10.10.12:2379"              #修改此处为当前服务器IP地址
#[Clustering]
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://10.10.10.12:2380"     #修改此处为当前服务器IP地址
ETCD_ADVERTISE_CLIENT_URLS="https://10.10.10.12:2379"           #修改此处为当前服务器IP地址
ETCD_INITIAL_CLUSTER="etcd-1=https://10.10.10.11:2380,etcd-2=https://10.10.10.12:2380,etcd-3=https://10.10.10.13:2380"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
ETCD_INITIAL_CLUSTER_STATE="new"
### --- 最后启动etcd并设置开机启动：启动并设置开启启动

[root@k8s-master ~]# systemctl  daemon-reload
[root@k8s-master ~]# systemctl  start etcd
[root@k8s-master ~]# systemctl enable etcd
五、部署Etcd集群：节点二、三
### --- 以下在节点1上操作，为简化操作，待会将节点1生成的所有文件拷贝到节点2和节点3
### --- 创建工作目录并解压二进制包

[root@k8s-master ~]# mkdir -p  /opt/etcd/{bin,cfg,ssl}
[root@k8s-master ~]# tar -zxvf etcd-v3.4.9-linux-amd64.tar.gz  
[root@k8s-master ~]# mv etcd-v3.4.9-linux-amd64/{etcd,etcdctl} /opt/etcd/bin/  
### --- 创建etcd配置文件
~~~		ETCD_NAME:节点名称，集群中唯一
~~~		ETCD_DATA_DIR:数据目录
~~~		ETCD_LISTEN_PEER_URLS: 集群通信监听地址
~~~		ETCD_LISTEN_CLIENT_URLS:客户端访问监听地址
~~~		ETCD_INITIAL_ADVERTISE_PEER_URLS:集群通告第一种
~~~		ETCD_ADVERTISE_CLIENT_URLS:客户端通告地址
~~~		ETCD_INITIAL_CLUSTER:集群节点地址
~~~		ETCD_INITIAL_CLUSTER_TOKEN:集群Token
~~~		ETCD_INITIAL_CLUSTER_STATE:加入集群的当前状态，new是新集群，existing表示加入已有集群

[root@k8s-master ~]# cat > /opt/etcd/cfg/etcd.conf << EOF
> #[Member]
> ETCD_NAME="etcd-1"
> ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
> ETCD_LISTEN_PEER_URLS="https://10.10.10.11:2380"
> ETCD_LISTEN_CLIENT_URLS="https://10.10.10.11:2379"
> #[Clustering]
> ETCD_INITIAL_ADVERTISE_PEER_URLS="https://10.10.10.11:2380"
> ETCD_ADVERTISE_CLIENT_URLS="https://10.10.10.11:2379"
> ETCD_INITIAL_CLUSTER="etcd-1=https://10.10.10.11:2380,etcd-2=https://10.10.10.12:2380,etcd-3=https://10.10.10.13:2380"
> ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
> ETCD_INITIAL_CLUSTER_STATE="new"
> EOF
### --- systemd管理etcd

[root@k8s-master ~]# cat > /usr/lib/systemd/system/etcd.service << EOF
> [Unit]
> Description=Etcd Server
> After=network.target
> After=network-online.target
> Wants=network-online.target
> [Service]
> Type=notify
> EnvironmentFile=/opt/etcd/cfg/etcd.conf
> ExecStart=/opt/etcd/bin/etcd \
> --cert-file=/opt/etcd/ssl/server.pem \
> --key-file=/opt/etcd/ssl/server-key.pem \
> --peer-cert-file=/opt/etcd/ssl/server.pem \
> --peer-key-file=/opt/etcd/ssl/server-key.pem \
> --trusted-ca-file=/opt/etcd/ssl/ca.pem \
> --peer-trusted-ca-file=/opt/etcd/ssl/ca.pem \
> --logger=zap
> Restart=on-failure
> LimitNOFILE=65536
> [Install]
> WantedBy=multi-user.target
> EOF
### --- 拷贝刚才生成的证书
~~~		把刚才生成的证书拷贝到配置文件中的路径

[root@k8s-master ~]# cp ~/TLS/etcd/ca*pem ~/TLS/etcd/server*pem /opt/etcd/ssl/
[root@k8s-master ~]# ls /opt/etcd/ssl/
ca-key.pem  ca.pem  server-key.pem  server.pem  
### --- 将上面节点1所有生成的文件拷贝到节点2和节点3

[root@k8s-master ~]# scp -r /opt/etcd/ root@10.10.10.12:/opt/
[root@k8s-master ~]# scp /usr/lib/systemd/system/etcd.service root@10.10.10.12:/usr/lib/systemd/system/
[root@k8s-master ~]# scp -r /opt/etcd/ root@10.10.10.13:/opt/                                                                                                                                   100% 1338   782.0KB/s   00:00    
[root@k8s-master ~]# scp /usr/lib/systemd/system/etcd.service root@10.10.10.13:/usr/lib/systemd/system/
~~~		然后在节点2和节点3分别修改etcd.conf配置文件中的节点名称和当前服务器IP：

[root@k8s-node1 ~]# vim /opt/etcd/cfg/etcd.conf
#[Member]
ETCD_NAME="etcd-1"                                              #修改此处，节点2改为etcd-2；节点3改为etcd-3
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
ETCD_LISTEN_CLIENT_URLS="https://10.10.10.11:2379"              #修改此处当期服务器的IP地址
ETCD_LISTEN_CLIENT_URLS="https://10.10.10.12:2379"              #修改此处为当前服务器IP地址
#[Clustering]
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://10.10.10.12:2380"     #修改此处为当前服务器IP地址
ETCD_ADVERTISE_CLIENT_URLS="https://10.10.10.12:2379"           #修改此处为当前服务器IP地址
ETCD_INITIAL_CLUSTER="etcd-1=https://10.10.10.11:2380,etcd-2=https://10.10.10.12:2380,etcd-3=https://10.10.10.13:2380"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
ETCD_INITIAL_CLUSTER_STATE="new"
### --- 最后启动etcd并设置开机启动
~~~		启动并设置开启启动

[root@k8s-master ~]# systemctl  daemon-reload
[root@k8s-master ~]# systemctl  start etcd
[root@k8s-master ~]# systemctl enable etcd
### --- 查看集群状态
~~~		如果输出上面的信息，就说明集群部署成功，
~~~		如果有问题第一步先看日志/var/log/message或journalctl -u etcd

[root@k8s-master ~]# ETCDCTL_API=3 /opt/etcd/bin/etcdctl --cacert=/opt/etcd/ssl/ca.pem --cert=/opt/etcd/ssl/server.pem --key=/opt/etcd/ssl/server-key.pem --endpoints="https://10.10.10.11:2379,https://10.10.10.12:2379,https://10.10.10.13:2379" endpoint health
https://10.10.10.12:2379 is healthy: successfully committed proposal: took = 21.971063ms
https://10.10.10.13:2379 is healthy: successfully committed proposal: took = 29.694864ms
https://10.10.10.11:2379 is healthy: successfully committed proposal: took = 32.719135ms
 
 
 
 
 
 
 
 
 
Walter Savage Landor:strove with none,for none was worth my strife.Nature I loved and, next to Nature, Art:I warm'd both hands before the fire of life.It sinks, and I am ready to depart
                                                                                                                                                   ——W.S.Landor
 

posted on   yanqi_vip  阅读(46)  评论(0)  编辑  收藏  举报

相关博文：
· |NO.Z.00053|——————————|^^ 部署 ^^|——|KuberNetes&二进制部署.V06|3台Server|——|etcd配置|
· |NO.Z.00028|——————————|^^ 部署 ^^|——|KuberNetes&二进制部署.V06|5台Server|——|etcd配置|
· etcd3.5.0版本集群部署
· 二进制部署1.23.4版本k8s集群-4-部署etcd集群
· Etcd 证书集群部署
阅读排行：
· 阿里最新开源QwQ-32B，效果媲美deepseek-r1满血版，部署成本又又又降低了！
· SQL Server 2025 AI相关能力初探
· AI编程工具终极对决：字节Trae VS Cursor，谁才是开发者新宠？
· 开源Multi-agent AI智能体框架aevatar.ai，欢迎大家贡献代码
· Manus重磅发布：全球首款通用AI代理技术深度解析与实战指南
< 2025年3月 >
日 一 二 三 四 五 六
23 24 25 26 27 28 1
2 3 4 5 6 7 8
9 10 11 12 13 14 15
16 17 18 19 20 21 22
23 24 25 26 27 28 29
30 31 1 2 3 4 5

导航

统计

点击右上角即可分享
微信分享提示
AI IDE Trae