#[Member]
#ETCD_CORS=""
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
#ETCD_WAL_DIR=""
ETCD_LISTEN_PEER_URLS="https://192.168.10.202:2380"
ETCD_LISTEN_CLIENT_URLS="https://192.168.10.202:2379,http://127.0.0.1:2379"
#ETCD_MAX_SNAPSHOTS="5"
#ETCD_MAX_WALS="5"
ETCD_NAME="k8s11"
#ETCD_SNAPSHOT_COUNT="100000"
#ETCD_HEARTBEAT_INTERVAL="100"
#ETCD_ELECTION_TIMEOUT="1000"
#ETCD_QUOTA_BACKEND_BYTES="0"
#ETCD_MAX_REQUEST_BYTES="1572864"
#ETCD_GRPC_KEEPALIVE_MIN_TIME="5s"
#ETCD_GRPC_KEEPALIVE_INTERVAL="2h0m0s"
#ETCD_GRPC_KEEPALIVE_TIMEOUT="20s"
#
#[Clustering]
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://192.168.10.202:2380"
ETCD_ADVERTISE_CLIENT_URLS="https://192.168.10.202:2379"
#ETCD_DISCOVERY=""
#ETCD_DISCOVERY_FALLBACK="proxy"
#ETCD_DISCOVERY_PROXY=""
#ETCD_DISCOVERY_SRV=""
ETCD_INITIAL_CLUSTER="k8s11=https://192.168.10.202:2380,k8s12=https://192.168.10.203:2380,k8s13=https://192.168.10.204:2380,"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
ETCD_INITIAL_CLUSTER_STATE="new"
#ETCD_STRICT_RECONFIG_CHECK="true"
#ETCD_ENABLE_V2="true"
#
#[Proxy]
#ETCD_PROXY="off"
#ETCD_PROXY_FAILURE_WAIT="5000"
#ETCD_PROXY_REFRESH_INTERVAL="30000"
#ETCD_PROXY_DIAL_TIMEOUT="1000"
#ETCD_PROXY_WRITE_TIMEOUT="5000"
#ETCD_PROXY_READ_TIMEOUT="0"
#
#[Security]
ETCD_CERT_FILE="/etc/etcd/ssl/etcd.pem"
ETCD_KEY_FILE="/etc/etcd/ssl/etcd-key.pem"
ETCD_CLIENT_CERT_AUTH="true"
ETCD_TRUSTED_CA_FILE="/etc/etcd/ssl/etcd-root-ca.pem"
ETCD_AUTO_TLS="true"
ETCD_PEER_CERT_FILE="/etc/etcd/ssl/etcd.pem"
ETCD_PEER_KEY_FILE="/etc/etcd/ssl/etcd-key.pem"
ETCD_PEER_CLIENT_CERT_AUTH="true"
ETCD_PEER_TRUSTED_CA_FILE="/etc/etcd/ssl/etcd-root-ca.pem"
ETCD_PEER_AUTO_TLS="true"
#
#[Logging]
#ETCD_DEBUG="false"
#ETCD_LOG_PACKAGE_LEVELS=""
#ETCD_LOG_OUTPUT="default"
#
#[Unsafe]
#ETCD_FORCE_NEW_CLUSTER="false"
#
#[Version]
#ETCD_VERSION="false"
#ETCD_AUTO_COMPACTION_RETENTION="0"
#
#[Profiling]
#ETCD_ENABLE_PPROF="false"
#ETCD_METRICS="basic"
#
#[Auth]
#ETCD_AUTH_TOKEN="simple"

etcdctl   --endpoints=https://192.168.10.202:2379,https://192.168.10.203:2379,https://192.168.10.204:2379   --ca-file=/etc/etcd/ssl/ca.pem   --cert-file=/etc/etcd/ssl/etcd.pem   --key-file=/etc/etcd/ssl/etcd-key.pem   cluster-health

#! Configuration File for keepalived
 
global_defs {
   notification_email {
      bbotte@163.com
   }
   router_id LVS_k8s
}
 
vrrp_script CheckK8sMaster {
    script "curl -k https://192.168.10.207:6443"  #VIP
    interval 3
    timeout 9
    fall 2
    rise 2
}
 
vrrp_instance VI_1 {
    state MASTER            #MASTER/SLAVE
    interface eth0      
    virtual_router_id 51
    priority 100           
    advert_int 1
    # local host ip
    mcast_src_ip 192.168.10.202
    authentication {
        auth_type PASS
        auth_pass bbotte_k8s
    }
    unicast_peer {
        192.168.10.203
        192.168.10.204
    }
    virtual_ipaddress {
        192.168.10.207/24
    }
    track_script {
        CheckK8sMaster    
    }
}

#! Configuration File for keepalived
 
global_defs {
   notification_email {
      bbotte@163.com
   }
   router_id LVS_k8s
}
 
vrrp_script CheckK8sMaster {
    script "curl -k https://192.168.10.207:6443"  #VIP
    interval 3
    timeout 9
    fall 2
    rise 2
}
 
vrrp_instance VI_1 {
    state BACKUP            #MASTER/SLAVE
    interface eth0      
    virtual_router_id 51
    priority 99           
    advert_int 1
    # local host ip
    mcast_src_ip 192.168.10.203
    authentication {
        auth_type PASS
        auth_pass bbotte_k8s
    }
    unicast_peer {
        192.168.10.202
        192.168.10.204
    }
    virtual_ipaddress {
        192.168.10.207/24
    }
    track_script {
        CheckK8sMaster    
    }
}

[root@k8s11 ~]# cat /etc/kubernetes/config.yaml 
apiVersion: kubeadm.k8s.io/v1alpha1
kind: MasterConfiguration
etcd:
  endpoints:
  - https://192.168.10.202:2379    
  - https://192.168.10.203:2379
  - https://192.168.10.204:2379
  caFile: /etc/etcd/ssl/ca.pem  
  certFile: /etc/etcd/ssl/etcd.pem 
  keyFile: /etc/etcd/ssl/etcd-key.pem
  dataDir: /var/lib/etcd
networking:
  podSubnet: 10.244.0.0/16
kubernetesVersion: 1.9.4
api:
  advertiseAddress: "192.168.10.207"  
token: "4bdbca.6e3531d0ec698d96"
tokenTTL: "0s"
apiServerCertSANs:
- k8s1
- k8s2
- k8s3
- 192.168.10.202
- 192.168.10.203
- 192.168.10.204
- 192.168.10.207
featureGates:
  CoreDNS: true