文章目录

什么是ETCD？

  Etcd是Kubernetes集群中的一个十分重要的组件，用于保存集群所有的网络配置和对象的状态信息,K8S中所有持久化的状态信息都是以Key-Value的形式存储在ETCD中，提供分布式协调服务。之所以说kubenetes各个组件是无状态的，就是因为其中把数据都存放在ETCD中。
  由于ETCD支持集群，本实验中在三台主机上都部署上ETCD.

  1. 准备ETCD软件包

[root@linux-node1 src]# pwd
/usr/local/src
[root@linux-node1 src]# wget https://github.com/coreos/etcd/releases/download/v3.2.18/etcd-v3.2.18-linux-amd64.tar.gz
[root@linux-node1 src]# tar zxf etcd-v3.2.18-linux-amd64.tar.gz　　#解压etcd
[root@linux-node1 src]# cd etcd-v3.2.18-linux-amd64　　#有2个文件，etcdctl是操作etcd的命令
[root@linux-node1 etcd-v3.2.18-linux-amd64]# cp etcd etcdctl /opt/kubernetes/bin/ 
[root@linux-node1 etcd-v3.2.18-linux-amd64]# scp etcd etcdctl 192.168.219.136:/opt/kubernetes/bin/
[root@linux-node1 etcd-v3.2.18-linux-amd64]# scp etcd etcdctl 192.168.219.137:/opt/kubernetes/bin/

  2. 创建ETCD证书签名请求

[root@linux-node1 ~]# cd /usr/local/src/ssl
[root@linux-node1 ssl]# vim etcd-csr.json
{
  "CN": "etcd",
  
#此处的ip是etcd集群中各个节点的ip地址
  "hosts": [
    "127.0.0.1",
    "192.168.219.135",
    "192.168.219.136",
    "192.168.219.137"
  ],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "ShangHai",
      "L": "ShangHai",
      "O": "k8s",
      "OU": "System"
    }
  ]
}

  3. 生成ETCD证书和私钥

[root@linux-node1 ~]# cfssl gencert -ca=/opt/kubernetes/ssl/ca.pem \
  -ca-key=/opt/kubernetes/ssl/ca-key.pem \
  -config=/opt/kubernetes/ssl/ca-config.json \
  -profile=kubernetes etcd-csr.json | cfssljson -bare etcd
[root@linux-node1 ssl]# ls -l etcd*
-rw-r--r--. 1 root root 1066 5月   8 09:45 etcd.csr
-rw-r--r--. 1 root root  307 5月   8 10:35 etcd-csr.json
-rw-------. 1 root root 1675 5月   8 09:45 etcd-key.pem
-rw-r--r--. 1 root root 1440 5月   8 09:45 etcd.pem

  4. 将证书拷贝到三台主机的/opt/kurbernetes/ssl目录下

[root@linux-node1 ~]# cp etcd*.pem /opt/kubernetes/ssl
[root@linux-node1 ~]# scp etcd*.pem 192.168.219.136:/opt/kubernetes/ssl
[root@linux-node1 ~]# scp etcd*.pem 192.168.219.137:/opt/kubernetes/ssl

  5. 配置ETCD的配置文件

    2379端口用于外部通信，2380用于内部通信

    Linux-node1(Master)
[root@linux-node1 ~]# vim /opt/kubernetes/cfg/etcd.conf 
#[member]
##ETCD节点名称修改，这个ETCD_NAME每个节点必须不同
ETCD_NAME="etcd-node1"
#ETCD数据目录
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"

#ETCD_SNAPSHOT_COUNTER="10000"
#ETCD_HEARTBEAT_INTERVAL="100"
#ETCD_ELECTION_TIMEOUT="1000"
#
##ETCD监听的URL，每个节点不同需要修改
ETCD_LISTEN_PEER_URLS="https://192.168.219.135:2380"

#外部通信监听URL修改，每个节点不同需要修改
ETCD_LISTEN_CLIENT_URLS="https://192.168.219.135:2379,https://127.0.0.1:2379"
#ETCD_MAX_SNAPSHOTS="5"
#ETCD_MAX_WALS="5"
#ETCD_CORS=""
#[cluster]
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://192.168.219.135:2380"
# if you use different ETCD_NAME (e.g. test),
# set ETCD_INITIAL_CLUSTER value for this name, i.e. "test=http://..."
ETCD_INITIAL_CLUSTER="etcd-node1=https://192.168.219.135:2380,etcd-node2=https://192.168.219.136:2380,etcd-node3=https://192.168.219.137:2380"
ETCD_INITIAL_CLUSTER_STATE="new"
ETCD_INITIAL_CLUSTER_TOKEN="k8s-etcd-cluster"
ETCD_ADVERTISE_CLIENT_URLS="https://192.168.219.135:2379"
#[security]
CLIENT_CERT_AUTH="true"
ETCD_CA_FILE="/opt/kubernetes/ssl/ca.pem"
ETCD_CERT_FILE="/opt/kubernetes/ssl/etcd.pem"
ETCD_KEY_FILE="/opt/kubernetes/ssl/etcd-key.pem"
PEER_CLIENT_CERT_AUTH="true"
ETCD_PEER_CA_FILE="/opt/kubernetes/ssl/ca.pem"
ETCD_PEER_CERT_FILE="/opt/kubernetes/ssl/etcd.pem"
ETCD_PEER_KEY_FILE="/opt/kubernetes/ssl/etcd-key.pem"
    Linux-node2
[root@linux-node2 ~]# vim /opt/kubernetes/cfg/etcd.conf
#[member]
##ETCD节点名称修改，这个ETCD_NAME每个节点必须不同
ETCD_NAME="etcd-node2"
#ETCD数据目录
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
#ETCD_SNAPSHOT_COUNTER="10000"
#ETCD_HEARTBEAT_INTERVAL="100"
#ETCD_ELECTION_TIMEOUT="1000"
##ETCD监听的URL，每个节点不同需要修改

ETCD_LISTEN_PEER_URLS="https://192.168.219.136:2380"
#外部通信监听URL修改，每个节点不同需要修改
ETCD_LISTEN_CLIENT_URLS="https://192.168.219.136:2379,https://127.0.0.1:2379"
#ETCD_MAX_SNAPSHOTS="5"
#ETCD_MAX_WALS="5"
#ETCD_CORS=""
#[cluster]
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://192.168.219.136:2380"
# if you use different ETCD_NAME (e.g. test),
# set ETCD_INITIAL_CLUSTER value for this name, i.e. "test=http://..."
# #添加集群访问
#
ETCD_INITIAL_CLUSTER="etcd-node1=https://192.168.219.135:2380,etcd-node2=https://192.168.219.136:2380,etcd-node3=https://192.168.219.137:2380"
ETCD_INITIAL_CLUSTER_STATE="new"
ETCD_INITIAL_CLUSTER_TOKEN="k8s-etcd-cluster"
ETCD_ADVERTISE_CLIENT_URLS="https://192.168.219.136:2379"
#[security]
CLIENT_CERT_AUTH="true"
ETCD_CA_FILE="/opt/kubernetes/ssl/ca.pem"
ETCD_CERT_FILE="/opt/kubernetes/ssl/etcd.pem"
ETCD_KEY_FILE="/opt/kubernetes/ssl/etcd-key.pem"
PEER_CLIENT_CERT_AUTH="true"
ETCD_PEER_CA_FILE="/opt/kubernetes/ssl/ca.pem"
ETCD_PEER_CERT_FILE="/opt/kubernetes/ssl/etcd.pem"
ETCD_PEER_KEY_FILE="/opt/kubernetes/ssl/etcd-key.pem"
    Linux-node3
[root@linux-node3 ~]# vim /opt/kubernetes/cfg/etcd.conf
#[member]
##ETCD节点名称修改，这个ETCD_NAME每个节点必须不同
ETCD_NAME="etcd-node3"
#ETCD数据目录
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"　　
#ETCD_SNAPSHOT_COUNTER="10000"
#ETCD_HEARTBEAT_INTERVAL="100"
#ETCD_ELECTION_TIMEOUT="1000"
##ETCD监听的URL，每个节点不同需要修改
ETCD_LISTEN_PEER_URLS="https://192.168.219.137:2380"
#外部通信监听URL修改，每个节点不同需要修改
ETCD_LISTEN_CLIENT_URLS="https://192.168.219.137:2379,https://127.0.0.1:2379"
#ETCD_MAX_SNAPSHOTS="5"
#ETCD_MAX_WALS="5"
#ETCD_CORS=""
#[cluster]
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://192.168.219.137:2380"
# if you use different ETCD_NAME (e.g. test),
# set ETCD_INITIAL_CLUSTER value for this name, i.e. "test=http://..."
# 添加集群访问
ETCD_INITIAL_CLUSTER="etcd-node1=https://192.168.219.135:2380,etcd-node2=https://192.168.219.136:2380,etcd-node3=https://192.168.219.137:2380"
ETCD_INITIAL_CLUSTER_STATE="new"
ETCD_INITIAL_CLUSTER_TOKEN="k8s-etcd-cluster"
ETCD_ADVERTISE_CLIENT_URLS="https://192.168.219.137:2379"
#[security]
CLIENT_CERT_AUTH="true"
ETCD_CA_FILE="/opt/kubernetes/ssl/ca.pem"
ETCD_CERT_FILE="/opt/kubernetes/ssl/etcd.pem"
ETCD_KEY_FILE="/opt/kubernetes/ssl/etcd-key.pem"
PEER_CLIENT_CERT_AUTH="true"
ETCD_PEER_CA_FILE="/opt/kubernetes/ssl/ca.pem"
ETCD_PEER_CERT_FILE="/opt/kubernetes/ssl/etcd.pem"
ETCD_PEER_KEY_FILE="/opt/kubernetes/ssl/etcd-key.pem"

  6. 创建ETCD系统服务

    在linux-node1、linux-node2、linux-node3都创建ETCD系统服务。
[root@linux-node1 ~]# vim /etc/systemd/system/etcd.service

[Unit]
Description=Etcd Server
After=network.target

[Service]
Type=simple
WorkingDirectory=/var/lib/etcd
EnvironmentFile=-/opt/kubernetes/cfg/etcd.conf
# set GOMAXPROCS to number of processors
ExecStart=/bin/bash -c "GOMAXPROCS=$(nproc) /opt/kubernetes/bin/etcd"
Type=notify

[Install]
WantedBy=multi-user.target

  7. 重新加载系统服务

    在linux-node1、linux-node2、linux-node3都重新加载并设置开机启动ETCD系统服务。
[root@linux-node1 ~]# systemctl daemon-reload
[root@linux-node1 ~]# systemctl enable etcd
    默认不会创建etcd的数据存储目录，这里在三个节点上创建etcd数据存储目录
[root@linux-node1 ~]# mkdir /var/lib/etcd
[root@linux-node1 ~]# systemctl start etcd
[root@linux-node1 ~]# systemctl status etcd

[root@linux-node2 ~]# mkdir /var/lib/etcd
[root@linux-node2 ~]# systemctl start etcd
[root@linux-node2 ~]# systemctl status etcd

[root@linux-node3 ~]# mkdir /var/lib/etcd
[root@linux-node3 ~]# systemctl start etcd
[root@linux-node3 ~]# systemctl status etc

#在各节点上查看是否监听了2379和2380端口
#linux-node1
[root@linux-node1 ~]# ss -tulnp | grep etcd
tcp    LISTEN     0      128    192.168.219.135:2379                  *:*                   users:(("etcd",pid=24791,fd=7))
tcp    LISTEN     0      128    127.0.0.1:2379                  *:*                   users:(("etcd",pid=24791,fd=6))
tcp    LISTEN     0      128    192.168.219.135:2380                  *:*                   users:(("etcd",pid=24791,fd=5))

#linux-node2
[root@localhost ~]# ss -tulnp | grep etcd
tcp    LISTEN     0      128    192.168.219.136:2379                  *:*                   users:(("etcd",pid=21073,fd=7))
tcp    LISTEN     0      128    127.0.0.1:2379                  *:*                   users:(("etcd",pid=21073,fd=6))
tcp    LISTEN     0      128    192.168.219.136:2380                  *:*                   users:(("etcd",pid=21073,fd=5))

#linux-node3
[root@localhost ~]# ss -tulnp |grep etcd
tcp    LISTEN     0      128    192.168.219.137:2379                  *:*                   users:(("etcd",pid=9336,fd=7))
tcp    LISTEN     0      128    127.0.0.1:2379                  *:*                   users:(("etcd",pid=9336,fd=6))
tcp    LISTEN     0      128    192.168.219.137:2380                  *:*                   users:(("etcd",pid=9336,fd=5))

  8. 验证ETCD集群

[root@linux-node1 ~]#etcdctl --endpoints=https://192.168.219.135:2379 \
>   --ca-file=/opt/kubernetes/ssl/ca.pem \
>   --cert-file=/opt/kubernetes/ssl/etcd.pem \
>   --key-file=/opt/kubernetes/ssl/etcd-key.pem cluster-health

member 252a9cd8ec6cef2d is healthy: got healthy result from https://192.168.219.137:2379
member 2de3a11ecb96f087 is healthy: got healthy result from https://192.168.219.136:2379
member a60cce210fbb41a1 is healthy: got healthy result from https://192.168.219.135:2379
cluster is healthy

参考：《每天5分钟玩转Kubernetes》、https://www.cnblogs.com/linuxk/

Logo
K8S/Kubernetes

K8S/Kubernetes社区为您提供最前沿的新闻资讯和知识内容

更多推荐

【深度】阿里巴巴万级规模 K8s 集群全局高可用体系之美

作者 |  韩堂、柘远、沉醉来源 | 阿里巴巴云原生公众号​前言台湾作家林清玄在接受记者采访的时候，如此评价自己 30 多年写作生涯：“第一个十年我才华横溢，‘贼光闪现’，令周边黯然失色；第二个十年，我终于‘宝光现形’，不再去抢风头，反而与身边的美丽相得益彰；进入第三个十年，繁华落尽见真醇，我进入了‘醇光初现’的阶段，真正体味到了境界之美”。​长夜有穷，真水无香。领略过了 K8s“身在江

avatar K8S/Kubernetes

如何基于 K8s 构建下一代 DevOps 平台？

作者 | 孙健波（天元）导读：当前云原生 DevOps 体系现状如何？面临哪些挑战？如何通过 OAM 解决云原生 DevOps 场景下的诸多问题？云原生开发应用模型 OAM(Open Application Model) 社区核心成员孙健波将为大家一一解答，并分享如何基于 OAM 和 Kubernetes 打造无限能力的下一代 DevOps 平台。什么是 DevOps？为什么基于 Kub

avatar K8S/Kubernetes

k8s 火了！

2020，上云之年，产品云端化成为一种趋势。在一线城市，很多公司都已经构建了自己的私有云环境，比如阿里云、网易云、华为云等。而Kubernetes 作为基于容器编排领域的王者，具备扩展...

avatar K8S/Kubernetes