etcd版本
[root@localhost etcd]# ./etcdctl version
etcdctl version: 3.5.1
API version: 3.5
系统版本
[root@localhost etcd]# cat /etc/redhat-release
CentOS Linux release 7.4.1708 (Core)
/data/etcd/etcd.conf
etced配置文件
ETCD_NAME="etcd01"
ETCD_DATA_DIR="/data/etcddata"
ETCD_LISTEN_PEER_URLS="https://192.168.73.130:2380"
ETCD_LISTEN_CLIENT_URLS="https://192.168.73.130:2379,https://127.0.0.1:2379"
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://192.168.73.130:2380"
ETCD_ADVERTISE_CLIENT_URLS="https://192.168.73.130:2379"
ETCD_INITIAL_CLUSTER="etcd01=https://192.168.73.130:2380,etcd02=https://192.168.73.131:2380,etcd03=https://192.168.73.132:2380"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
ETCD_NAME="etcd02"
ETCD_DATA_DIR="/data/etcddata"
ETCD_LISTEN_PEER_URLS="https://192.168.73.131:2380"
ETCD_LISTEN_CLIENT_URLS="https://192.168.73.131:2379,https://127.0.0.1:2379"
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://192.168.73.131:2380"
ETCD_ADVERTISE_CLIENT_URLS="https://192.168.73.131:2379"
ETCD_INITIAL_CLUSTER="etcd01=https://192.168.73.130:2380,etcd02=https://192.168.73.131:2380,etcd03=https://192.168.73.132:2380"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
ETCD_NAME="etcd03"
ETCD_DATA_DIR="/data/etcddata"
ETCD_LISTEN_PEER_URLS="https://192.168.73.132:2380"
ETCD_LISTEN_CLIENT_URLS="https://192.168.73.132:2379,https://127.0.0.1:2379"
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://192.168.73.132:2380"
ETCD_ADVERTISE_CLIENT_URLS="https://192.168.73.132:2379"
ETCD_INITIAL_CLUSTER="etcd01=https://192.168.73.130:2380,etcd02=https://192.168.73.131:2380,etcd03=https://192.168.73.132:2380"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
/usr/lib/systemd/system/etcd.service
etcd启动文件
[Unit]
Description=Etcd Server
After=network.target
After=network-online.target
Wants=network-online.target
[Service]
Type=notify
WorkingDirectory=/data/etcd/
EnvironmentFile=/data/etcd/etcd.conf
ExecStart=/data/etcd/etcd \
--initial-cluster-state=new \
--cert-file=/data/etcd/ssl/server.pem \
--key-file=/data/etcd/ssl/server-key.pem \
--peer-cert-file=/data/etcd/ssl/server.pem \
--peer-key-file=/data/etcd/ssl/server-key.pem \
--trusted-ca-file=/data/etcd/ssl/ca.pem \
--peer-trusted-ca-file=/data/etcd/ssl/ca.pem
Restart=on-failure
LimitNOFILE=65536
[Install]
WantedBy=multi-user.target
13、创建TLS证书
cd /data/
wget https://github.com/cloudflare/cfssl/releases/download/v1.6.1/cfssl-certinfo_1.6.1_linux_amd64
wget https://github.com/cloudflare/cfssl/releases/download/v1.6.1/cfssljson_1.6.1_linux_amd64
wget https://github.com/cloudflare/cfssl/releases/download/v1.6.1/cfssl_1.6.1_linux_amd64
mv cfssl-certinfo_1.6.1_linux_amd64 cfssl-certinfo
mv cfssl_1.6.1_linux_amd64 cfssl
mv cfssljson_1.6.1_linux_amd64 cfssljson
chmod +x cfssl*
tls.sh 文件内容如下全部内容(先修改其中的IP地址,其中hosts尽可能多加)
# etcd
# cat ca-config.json
cat > ca-config.json <<EOF
{
"signing": {
"default": {
"expiry": "87600h"
},
"profiles": {
"www": {
"expiry": "87600h",
"usages": [
"signing",
"key encipherment",
"server auth",
"client auth"
]
}
}
}
}
EOF
# cat ca-csr.json
cat > ca-csr.json <<EOF
{
"CN": "etcd CA",
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"L": "Beijing",
"ST": "Beijing"
}
]
}
EOF
# cat server-csr.json
cat > server-csr.json <<EOF
{
"CN": "etcd",
"hosts": [
"127.0.0.1",
"192.168.73.130",
"192.168.73.131",
"192.168.73.132",
"192.168.73.158",
"192.168.73.157",
"192.168.73.156"
],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"L": "BeiJing",
"ST": "BeiJing"
}
]
}
EOF
执行如下命令
sh tls.sh
/data/cfssl gencert -initca ca-csr.json | /data/cfssljson -bare ca -
/data/cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=www server-csr.json | /data/cfssljson -bare server
ls *.pem
然后将生成的4个pem文件证书复制到各个机器的/data/etcd/ssl目录中
启动服务etcd
systemctl daemon-reload
systemctl enable etcd
systemctl start etcd
查看集群状态
集群状态主要是etcdctl endpoint status和etcdctl endpoint health两条命令
cd /data/etcd/ && ./etcdctl \
--endpoints="https://192.168.73.130:2379,https://192.168.73.131:2379,https://192.168.73.132:2379" \
--cacert=ssl/ca.pem \
--key=ssl/server-key.pem \
--cert=ssl/server.pem \
endpoint health
https://192.168.73.130:2379 is healthy: successfully committed proposal: took = 41.287713ms
https://192.168.73.131:2379 is healthy: successfully committed proposal: took = 44.011272ms
https://192.168.73.132:2379 is healthy: successfully committed proposal: took = 45.182357ms
cd /data/etcd/ && ./etcdctl \
--endpoints="https://192.168.73.130:2379,https://192.168.73.131:2379,https://192.168.73.132:2379" \
--cacert=ssl/ca.pem \
--key=ssl/server-key.pem \
--cert=ssl/server.pem \
endpoint status
https://192.168.73.130:2379, c72a9875502ca9ec, 3.5.1, 20 kB, true, false, 2, 18, 18,
https://192.168.73.131:2379, eae86f80f91acc92, 3.5.1, 20 kB, false, false, 2, 18, 18,
https://192.168.73.132:2379, f4a2f8e0a48075dc, 3.5.1, 20 kB, false, false, 2, 18, 18,
cd /data/etcd/ && ./etcdctl \
--endpoints="https://192.168.73.130:2379,https://192.168.73.131:2379,https://192.168.73.132:2379" \
--cacert=ssl/ca.pem \
--key=ssl/server-key.pem \
--cert=ssl/server.pem \
endpoint health endpoint health
https://192.168.73.130:2379 is healthy: successfully committed proposal: took = 21.621538ms
https://192.168.73.131:2379 is healthy: successfully committed proposal: took = 21.835347ms
https://192.168.73.132:2379 is healthy: successfully committed proposal: took = 30.630989ms
etcd集群安装
于 2022-05-10 11:17:33 首次发布