Kubernetes安裝之三：etcd集羣的配置

爲何要首先配置etcd集羣呢，由於etcd集羣是Kubernetes的基礎，全部數據都存儲在這裏

1.生成etcd證書 

其實這裏建議使用主機名，避免ip變化而致使的數據庫不可用,可是我習慣用ip，爲避免證書看起來不那麼亂，因此我將不一樣的證書放置到不一樣的目錄裏面

cat > /etc/ssl/etcd/etcd-csr.json <<EOF
{
  "CN": "etcd",
  "hosts": [
    "127.0.0.1",
    "192.168.1.40",
    "192.168.1.41",
    "192.168.1.42"
  ],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "ChengDu",
      "L": "ChengDu",
      "O": "k8s",
      "OU": "dessler"
    }
  ]
}
EOF
複製代碼

cfssl gencert -ca=/etc/ssl/ca.pem \
    -ca-key=/etc/ssl/ca-key.pem \
    -config=/etc/ssl/ca-config.json \
    -profile=kubernetes etcd-csr.json | cfssljson -bare etcd複製代碼

ls
etcd.csr  etcd-csr.json  etcd-key.pem  etcd.pem
複製代碼

2.分發證書及二進制文件

過程我就省略了，都是些基本的文件傳輸操做

3.準備證書環境

（本身注意數據保存目錄，根據本身的狀況決定）

chmod 644 /etc/ssl/etcd/etcd-key.pem
useradd -s /sbin/nologin -M etcd
mkdir -p /var/lib/etcd/
chown -R etcd:etcd /var/lib/etcd/
複製代碼

4.配置etcd的服務

這裏須要特別注意就是etcd的名字，集羣的3個節點是不能重複的，還有和這個名字和集羣的配置（好比我這裏的etcd01，etcd02，etcd03）

4.1服務器a配置etcd服務

cat > /usr/lib/systemd/system/etcd.service <<EOF
[Unit]
Description=Etcd Server
After=network.target
After=network-online.target
Wants=network-online.target
Documentation=https://github.com/coreos

[Service]
User=etcd
Type=notify
WorkingDirectory=/var/lib/etcd/
ExecStart=/usr/bin/etcd \\
  --data-dir=/var/lib/etcd \\
  --name=etcd01 \\
  --cert-file=/etc/ssl/etcd/etcd.pem \\
  --key-file=/etc/ssl/etcd/etcd-key.pem \\
  --trusted-ca-file=/etc/ssl/ca.pem \\
  --peer-cert-file=/etc/ssl/etcd/etcd.pem \\
  --peer-key-file=/etc/ssl/etcd/etcd-key.pem \\
  --peer-trusted-ca-file=/etc/ssl/ca.pem \\
  --peer-client-cert-auth \\
  --client-cert-auth \\
  --listen-peer-urls=https://192.168.1.40:2380 \\
  --initial-advertise-peer-urls=https://192.168.1.40:2380 \\
  --listen-client-urls=https://192.168.1.40:2379,http://127.0.0.1:2379 \\
  --advertise-client-urls=https://192.168.1.40:2379 \\
  --initial-cluster-token=etcd-cluster-0 \\
  --initial-cluster=etcd01=https://192.168.1.40:2380,etcd02=https://192.168.1.41:2380,etcd03=https://192.168.1.42:2380 \\
  --initial-cluster-state=new
Restart=on-failure
RestartSec=5
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target
EOF複製代碼

4.2服務器a配置etcd服務

cat > /usr/lib/systemd/system/etcd.service <<EOF
[Unit]
Description=Etcd Server
After=network.target
After=network-online.target
Wants=network-online.target
Documentation=https://github.com/coreos

[Service]
User=etcd
Type=notify
WorkingDirectory=/var/lib/etcd/
ExecStart=/usr/bin/etcd \\
  --data-dir=/var/lib/etcd \\
  --name=etcd02 \\
  --cert-file=/etc/ssl/etcd/etcd.pem \\
  --key-file=/etc/ssl/etcd/etcd-key.pem \\
  --trusted-ca-file=/etc/ssl/ca.pem \\
  --peer-cert-file=/etc/ssl/etcd/etcd.pem \\
  --peer-key-file=/etc/ssl/etcd/etcd-key.pem \\
  --peer-trusted-ca-file=/etc/ssl/ca.pem \\
  --peer-client-cert-auth \\
  --client-cert-auth \\
  --listen-peer-urls=https://192.168.1.41:2380 \\
  --initial-advertise-peer-urls=https://192.168.1.41:2380 \\
  --listen-client-urls=https://192.168.1.41:2379,http://127.0.0.1:2379 \\
  --advertise-client-urls=https://192.168.1.41:2379 \\
  --initial-cluster-token=etcd-cluster-0 \\
  --initial-cluster=etcd01=https://192.168.1.40:2380,etcd02=https://192.168.1.41:2380,etcd03=https://192.168.1.42:2380 \\
  --initial-cluster-state=new
Restart=on-failure
RestartSec=5
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target
EOF複製代碼

4.3服務器a配置etcd服務

cat > /usr/lib/systemd/system/etcd.service <<EOF
[Unit]
Description=Etcd Server
After=network.target
After=network-online.target
Wants=network-online.target
Documentation=https://github.com/coreos

[Service]
User=etcd
Type=notify
WorkingDirectory=/var/lib/etcd/
ExecStart=/usr/bin/etcd \\
  --data-dir=/var/lib/etcd \\
  --name=etcd03 \\
  --cert-file=/etc/ssl/etcd/etcd.pem \\
  --key-file=/etc/ssl/etcd/etcd-key.pem \\
  --trusted-ca-file=/etc/ssl/ca.pem \\
  --peer-cert-file=/etc/ssl/etcd/etcd.pem \\
  --peer-key-file=/etc/ssl/etcd/etcd-key.pem \\
  --peer-trusted-ca-file=/etc/ssl/ca.pem \\
  --peer-client-cert-auth \\
  --client-cert-auth \\
  --listen-peer-urls=https://192.168.1.42:2380 \\
  --initial-advertise-peer-urls=https://192.168.1.42:2380 \\
  --listen-client-urls=https://192.168.1.42:2379,http://127.0.0.1:2379 \\
  --advertise-client-urls=https://192.168.1.42:2379 \\
  --initial-cluster-token=etcd-cluster-0 \\
  --initial-cluster=etcd01=https://192.168.1.40:2380,etcd02=https://192.168.1.41:2380,etcd03=https://192.168.1.42:2380 \\
  --initial-cluster-state=new
Restart=on-failure
RestartSec=5
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target
EOF
複製代碼

5.檢查集羣狀態

etcdctl --endpoints=https://192.168.1.40:2379,https://192.168.1.41:2379,https://192.168.1.42:2379 \
>         --cert-file=/etc/ssl/etcd/etcd.pem \
>         --ca-file=/etc/ssl/ca.pem \
>         --key-file=/etc/ssl/etcd/etcd-key.pem \
>         cluster-health
member e42b05792291d17 is healthy: got healthy result from https://192.168.1.41:2379
member 68326dea8aa5233d is healthy: got healthy result from https://192.168.1.40:2379
member e10fc861b3b13bc0 is healthy: got healthy result from https://192.168.1.42:2379複製代碼

注意的幾個地方：name 須要一一對應，ip地址也容易出錯

集羣狀態正常，etd集羣建立成果

• 說明：
• User：指定以 k8s 帳戶運行
• WorkingDirectory、--data-dir：指定工做目錄和數據目錄爲/var/lib/etcd，需在啓動服務前建立這個目錄
• --name：指定節點名稱，當--initial-cluster-state 值爲 new 時，--name 的參數值必須位於 --initial-cluster 列表中
• --cert-file、--key-file：etcd server 與 client 通訊時使用的證書和私鑰
• --trusted-ca-file：簽名 client 證書的 CA 證書，用於驗證 client 證書
• --peer-cert-file、--peer-key-file：etcd 與 peer 通訊使用的證書和私鑰
• --peer-trusted-ca-file：簽名 peer 證書的 CA 證書，用於驗證 peer 證書