kuberntes 系统使用 etcd 存储所有数据，本文档介绍部署一个三节点高可用 etcd 集群的步骤,这三个节点复用 kubernetes 集群机器k8s-master、k8s-node1、k8s-node2.

1.准备etcd软件包并分发etcd文件:

[root@k8s-master ~]# cd /usr/local/src
[root@k8s-master src]#wget https://github.com/coreos/etcd/releases/download/v3.2.18/etcd-v3.2.18-linux-amd64.tar.gz
[root@k8s-master src]# tar zxf etcd-v3.2.18-linux-amd64.tar.gz
[root@k8s-master src]# cd etcd-v3.2.18-linux-amd64
[root@k8s-master etcd-v3.2.18-linux-amd64]# cp etcd etcdctl /opt/kubernetes/bin/ 
[root@k8s-master etcd-v3.2.18-linux-amd64]# scp etcd etcdctl 10.88.0.2:/opt/kubernetes/bin/
[root@k8s-master etcd-v3.2.18-linux-amd64]# scp etcd etcdctl 10.88.0.3:/opt/kubernetes/bin/

2.创建 etcd 证书签名请求：

[root@k8s-master ~]# cd /usr/local/src/ssl
[root@k8s-master ssl]# cat > etcd-csr.json <<EOF
{
  "CN": "etcd",
  "hosts": [
  "127.0.0.1",
  "10.88.0.1",
  "10.88.0.2",
  "10.88.0.3"
  ],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "BeiJing",
      "L": "BeiJing",
      "O": "k8s",
      "OU": "System"
    }
  ]
}
EOF

3.生成 etcd 证书和私钥：

[root@k8s-master ssl]# cfssl gencert -ca=/opt/kubernetes/ssl/ca.pem   -ca-key=/opt/kubernetes/ssl/ca-key.pem   -config=/opt/kubernetes/ssl/ca-config.json   -profile=kubernetes etcd-csr.json | cfssljson -bare etcd
会生成以下证书文件
[root@k8s-master ssl]# ls -l etcd*
-rw-r--r-- 1 root root 1062 May  4 19:33 etcd.csr
-rw-r--r-- 1 root root  279 May  4 19:33 etcd-csr.json
-rw------- 1 root root 1679 May  4 19:33 etcd-key.pem
-rw-r--r-- 1 root root 1436 May  4 19:33 etcd.pem

4.将证书移动到/opt/kubernetes/ssl目录下:

[root@k8s-master ssl]# cp etcd*.pem /opt/kubernetes/ssl
[root@k8s-master ssl]# scp etcd*.pem 10.88.0.2:/opt/kubernetes/ssl
[root@k8s-master ssl]# scp etcd*.pem 10.88.0.3:/opt/kubernetes/ssl
[root@k8s-master ssl]# rm -f etcd.csr etcd-csr.json

5.设置ETCD 配置文件

root@k8s-master ssl]#cat > /opt/kubernetes/cfg/etcd.conf <<EOF
#[member]
ETCD_NAME="k8s-master"
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
#ETCD_SNAPSHOT_COUNTER="10000"
#ETCD_HEARTBEAT_INTERVAL="100"
#ETCD_ELECTION_TIMEOUT="1000"
ETCD_LISTEN_PEER_URLS="https://10.88.0.1:2380"
ETCD_LISTEN_CLIENT_URLS="https://10.88.0.1:2379,https://127.0.0.1:2379"
#ETCD_MAX_SNAPSHOTS="5"
#ETCD_MAX_WALS="5"
#ETCD_CORS=""
#[cluster]
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://10.88.0.1:2380"
# if you use different ETCD_NAME (e.g. test),
# set ETCD_INITIAL_CLUSTER value for this name, i.e. "test=http://..."
ETCD_INITIAL_CLUSTER="k8s-master=https://10.88.0.1:2380,k8s-node1=https://10.88.0.2:2380,k8s-node2=https://10.88.0.3:2380"
ETCD_INITIAL_CLUSTER_STATE="new"
ETCD_INITIAL_CLUSTER_TOKEN="k8s-etcd-cluster"
ETCD_ADVERTISE_CLIENT_URLS="https://10.88.0.1:2379"
#[security]
CLIENT_CERT_AUTH="true"
ETCD_CA_FILE="/opt/kubernetes/ssl/ca.pem"
ETCD_CERT_FILE="/opt/kubernetes/ssl/etcd.pem"
ETCD_KEY_FILE="/opt/kubernetes/ssl/etcd-key.pem"
PEER_CLIENT_CERT_AUTH="true"
ETCD_PEER_CA_FILE="/opt/kubernetes/ssl/ca.pem"
ETCD_PEER_CERT_FILE="/opt/kubernetes/ssl/etcd.pem"
ETCD_PEER_KEY_FILE="/opt/kubernetes/ssl/etcd-key.pem"

EOF

6.创建ETCD系统服务

mkdir -p /var/lib/etcd/

[root@k8s-master ssl]# cat > /etc/systemd/system/etcd.service <<EOF
[Unit]
Description=Etcd Server
After=network.target

[Service]
Type=simple
WorkingDirectory=/var/lib/etcd
EnvironmentFile=-/opt/kubernetes/cfg/etcd.conf
# set GOMAXPROCS to number of processors
ExecStart=/bin/bash -c "GOMAXPROCS=$(nproc) /opt/kubernetes/bin/etcd"
Type=notify

[Install]
WantedBy=multi-user.target

EOF

7.文件分发到两个node节点中:

[root@k8s-master ~]# scp /opt/kubernetes/cfg/etcd.conf 10.88.0.2:/opt/kubernetes/cfg/
[root@k8s-master ~]# scp /etc/systemd/system/etcd.service 10.88.0.2:/etc/systemd/system/
[root@k8s-master ~]# scp /opt/kubernetes/cfg/etcd.conf 10.88.0.3:/opt/kubernetes/cfg/
[root@k8s-master ~]# scp /etc/systemd/system/etcd.service 10.88.0.3:/etc/systemd/system/

8.修改node节点etcd.conf文件,ETCD_NAME改为本机的hostname.ETCD...URLS改为本机的ip地址

在k8s-node1 修改etcd.conf文件

mkdir -p /var/lib/etcd/

[root@k8s-node1 ~]# cat >/opt/kubernetes/cfg/etcd.conf <<EOF
#[member]
ETCD_NAME="k8s-node1"
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
#ETCD_SNAPSHOT_COUNTER="10000"
#ETCD_HEARTBEAT_INTERVAL="100"
#ETCD_ELECTION_TIMEOUT="1000"
ETCD_LISTEN_PEER_URLS="https://10.88.0.2:2380"
ETCD_LISTEN_CLIENT_URLS="https://10.88.0.2:2379,https://127.0.0.1:2379"
#ETCD_MAX_SNAPSHOTS="5"
#ETCD_MAX_WALS="5"
#ETCD_CORS=""
#[cluster]
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://10.88.0.2:2380"
# if you use different ETCD_NAME (e.g. test),
# set ETCD_INITIAL_CLUSTER value for this name, i.e. "test=http://..."
ETCD_INITIAL_CLUSTER="k8s-master=https://10.88.0.1:2380,k8s-node1=https://10.88.0.2:2380,k8s-node2=https://10.88.0.3:2380"
ETCD_INITIAL_CLUSTER_STATE="new"
ETCD_INITIAL_CLUSTER_TOKEN="k8s-etcd-cluster"
ETCD_ADVERTISE_CLIENT_URLS="https://10.88.0.2:2379"
#[security]
CLIENT_CERT_AUTH="true"
ETCD_CA_FILE="/opt/kubernetes/ssl/ca.pem"
ETCD_CERT_FILE="/opt/kubernetes/ssl/etcd.pem"
ETCD_KEY_FILE="/opt/kubernetes/ssl/etcd-key.pem"
PEER_CLIENT_CERT_AUTH="true"
ETCD_PEER_CA_FILE="/opt/kubernetes/ssl/ca.pem"
ETCD_PEER_CERT_FILE="/opt/kubernetes/ssl/etcd.pem"
ETCD_PEER_KEY_FILE="/opt/kubernetes/ssl/etcd-key.pem"

EOF

在k8s-node-2节点 修改etcd.conf文件

mkdir -p /var/lib/etcd/

[root@k8s-node-2 ~]# cat >/opt/kubernetes/cfg/etcd.conf  <<EOF
#[member]
ETCD_NAME="k8s-node2"
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
#ETCD_SNAPSHOT_COUNTER="10000"
#ETCD_HEARTBEAT_INTERVAL="100"
#ETCD_ELECTION_TIMEOUT="1000"
ETCD_LISTEN_PEER_URLS="https://10.88.0.3:2380"
ETCD_LISTEN_CLIENT_URLS="https://10.88.0.3:2379,https://127.0.0.1:2379"
#ETCD_MAX_SNAPSHOTS="5"
#ETCD_MAX_WALS="5"
#ETCD_CORS=""
#[cluster]
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://10.88.0.3:2380"
# if you use different ETCD_NAME (e.g. test),
# set ETCD_INITIAL_CLUSTER value for this name, i.e. "test=http://..."
ETCD_INITIAL_CLUSTER="k8s-master=https://10.88.0.1:2380,k8s-node1=https://10.88.0.2:2380,k8s-node2=https://10.88.0.3:2380"
ETCD_INITIAL_CLUSTER_STATE="new"
ETCD_INITIAL_CLUSTER_TOKEN="k8s-etcd-cluster"
ETCD_ADVERTISE_CLIENT_URLS="https://10.88.0.3:2379"
#[security]
CLIENT_CERT_AUTH="true"
ETCD_CA_FILE="/opt/kubernetes/ssl/ca.pem"
ETCD_CERT_FILE="/opt/kubernetes/ssl/etcd.pem"
ETCD_KEY_FILE="/opt/kubernetes/ssl/etcd-key.pem"
PEER_CLIENT_CERT_AUTH="true"
ETCD_PEER_CA_FILE="/opt/kubernetes/ssl/ca.pem"
ETCD_PEER_CERT_FILE="/opt/kubernetes/ssl/etcd.pem"
ETCD_PEER_KEY_FILE="/opt/kubernetes/ssl/etcd-key.pem"

EOF

9.加载并启动系统服务(先启动node节点的ectd服务，然后在启动master端的etcd服务，避免timeout.):

[root@k8s-master ~]# systemctl daemon-reload
[root@k8s-master ~]# systemctl enable etcd
[root@k8s-master ~]# systemctl start etcd
[root@k8s-master ~]# systemctl status etcd

10.验证集群

[root@k8s-master ~]#etcdctl --endpoints=https://10.88.0.1:2379   --ca-file=/opt/kubernetes/ssl/ca.pem   --cert-file=/opt/kubernetes/ssl/etcd.pem   --key-file=/opt/kubernetes/ssl/etcd-key.pem cluster-health

输出结果：

member 6d4fc213f2c2ae11 is healthy: got healthy result from https://10.88.0.2:2379
member a5765747c7d494a5 is healthy: got healthy result from https://10.88.0.3:2379
member ca66181342ddcde3 is healthy: got healthy result from https://10.88.0.1:2379
cluster is healthy

使用etcdctl member list 来查看集群中的成员列表

[root@k8s-master ~]# etcdctl --endpoints=https://10.88.0.1:2379   --ca-file=/opt/kubernetes/ssl/ca.pem   --cert-file=/opt/kubernetes/ssl/etcd.pem   --key-file=/opt/kubernetes/ssl/etcd-key.pem member list

输出结果：

6d4fc213f2c2ae11: name=k8s-node1 peerURLs=https://10.88.0.2:2380 clientURLs=https://10.88.0.2:2379 isLeader=true
a5765747c7d494a5: name=k8s-node2 peerURLs=https://10.88.0.3:2380 clientURLs=https://10.88.0.3:2379 isLeader=false
ca66181342ddcde3: name=k8s-master peerURLs=https://10.88.0.1:2380 clientURLs=https://10.88.0.1:2379 isLeader=false

至此etcd集群搭建完成!!!

53d62c133ffbcea5e4edf3da0cce3af0.png

 

 

 

# kubernetes # etcd # docker
Logo
K8S/Kubernetes

K8S/Kubernetes社区为您提供最前沿的新闻资讯和知识内容

更多推荐

【深度】阿里巴巴万级规模 K8s 集群全局高可用体系之美

作者 |  韩堂、柘远、沉醉来源 | 阿里巴巴云原生公众号​前言台湾作家林清玄在接受记者采访的时候，如此评价自己 30 多年写作生涯：“第一个十年我才华横溢，‘贼光闪现’，令周边黯然失色；第二个十年，我终于‘宝光现形’，不再去抢风头，反而与身边的美丽相得益彰；进入第三个十年，繁华落尽见真醇，我进入了‘醇光初现’的阶段，真正体味到了境界之美”。​长夜有穷，真水无香。领略过了 K8s“身在江

avatar K8S/Kubernetes

如何基于 K8s 构建下一代 DevOps 平台？

作者 | 孙健波（天元）导读：当前云原生 DevOps 体系现状如何？面临哪些挑战？如何通过 OAM 解决云原生 DevOps 场景下的诸多问题？云原生开发应用模型 OAM(Open Application Model) 社区核心成员孙健波将为大家一一解答，并分享如何基于 OAM 和 Kubernetes 打造无限能力的下一代 DevOps 平台。什么是 DevOps？为什么基于 Kub

avatar K8S/Kubernetes

k8s 火了！

2020，上云之年，产品云端化成为一种趋势。在一线城市，很多公司都已经构建了自己的私有云环境，比如阿里云、网易云、华为云等。而Kubernetes 作为基于容器编排领域的王者，具备扩展...

avatar K8S/Kubernetes