etcd安装

签发etcd证书

配置etcd-peer-csr.json文件

{
    "CN": "etce-peer",
    "hosts": [
	"172.16.0.8",
	"172.16.0.15",
	"172.16.0.16",
	"172.16.16.17"
    ],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "GuiZhou",
            "ST": "GuiZhou"
        }
    ]
}

生成证书

cfssl gencert -ca=../ca.pem -ca-key=../ca-key.pem -config=../ca-config.json -profile=peer etcd-peer-csr.json | cfssl-json -bare etcd-peer

创建etcd用户

useradd -s /sbin/nologin -M etcd

下载etcd

wget https://github.com/etcd-io/etcd/releases/download/v3.4.8/etcd-v3.4.8-linux-amd64.tar.gz

解压

tar zxvf etcd-v3.4.8-linux-amd64.tar.gz

创建目录

mkdir -p /data/etcd /data/logs/etcd-server

分配目录用户

chown -R etcd.etcd /data/etcd /data/logs/etcd-server/

创建etcd的证书目录

mkdir -p /opt/etcd/certs

主机上生成的ca.pem、etcd-peer-key.pem、etcd-peer.pem拷贝到/opt/etcd/certs目录中，注意私钥文件权限600

[root@VM_0_8_centos certs]# ll
total 12
-rw-r--r-- 1 root root 1281 May 19 14:42 ca.pem
-rw------- 1 root root 1675 May 19 14:41 etcd-peer-key.pem
-rw-r--r-- 1 root root 1363 May 19 14:41 etcd-peer.pem

给/opt/etcd/certs文件分配etcd用户

chown -R etcd.etcd /opt/etcd/certs/

创建etcd服务启动脚本

vim /opt/etcd/etcd-server-startup.sh

#!/bin/sh
./etcd 	--name etcd-server-0-2 \
	--data-dir /data/etcd/etcd-server \
	--listen-client-urls https://172.16.0.2:2379 \
	--advertise-client-urls https://172.16.0.2:2379 \
	--listen-peer-urls https://172.16.0.2:2380 \
	--initial-advertise-peer-urls https://172.16.0.2:2380 \
	--initial-cluster etcd-server-0-2=https://172.16.0.2:2380,etcd-server-0-4=https://172.16.0.4:2380,etcd-server-0-9=https://172.16.0.9:2380 \
	--initial-cluster-token tkn \
	--initial-cluster-state new \
	--client-cert-auth \
	--trusted-ca-file ./certs/ca.pem \
	--cert-file ./certs/etcd-peer.pem \
	--key-file ./certs/etcd-peer-key.pem \
	--peer-client-cert-auth \
	--peer-trusted-ca-file ./certs/ca.pem \
	--peer-cert-file ./certs/etcd-peer.pem \
	--peer-key-file ./certs/etcd-peer-key.pem

调整权限和目录

chmod +x /opt/etcd/etcd-server-startup.sh

安装supervisor软件

yum install supervisor -y
systemctl start supervisord
systemctl enable supervisord

创建etcd-server的启动配置

vim /etc/supervisord.d/etcd-server.ini


[program:etcd-server-0-2]
command=/opt/etcd/etcd-server-startup.sh                        ; the program (relative uses PATH, can take args)
numprocs=1                                                      ; number of processes copies to start (def 1)
directory=/opt/etcd                                             ; directory to cwd to before exec (def no cwd)
autostart=true                                                  ; start at supervisord start (default: true)
autorestart=true                                                ; retstart at unexpected quit (default: true)
startsecs=22                                                    ; number of secs prog must stay running (def. 1)
startretries=3                                                  ; max # of serial start failures (default 3)
exitcodes=0,2                                                   ; 'expected' exit codes for process (default 0,2)
stopsignal=QUIT                                                 ; signal used to kill process (default TERM)
stopwaitsecs=10                                                 ; max num secs to wait b4 SIGKILL (default 10)
user=etcd                                                       ; setuid to this UNIX account to run the program
redirect_stderr=false                                           ; redirect proc stderr to stdout (default false)
stdout_logfile=/data/logs/etcd-server/etcd.stdout.log           ; stdout log path, NONE for none; default AUTO
stdout_logfile_maxbytes=64MB                                    ; max # logfile bytes b4 rotation (default 50MB)
stdout_logfile_backups=4                                        ; # of stdout logfile backups (default 10)
stdout_capture_maxbytes=1MB                                     ; number of bytes in 'capturemode' (default 0)
stdout_events_enabled=false                                     ; emit events on stdout writes (default false)
stderr_logfile=/data/logs/etcd-server/etcd.stderr.log           ; stderr log path, NONE for none; default AUTO
stderr_logfile_maxbytes=64MB                                    ; max # logfile bytes b4 rotation (default 50MB)
stderr_logfile_backups=4                                        ; # of stderr logfile backups (default 10)
stderr_capture_maxbytes=1MB                                     ; number of bytes in 'capturemode' (default 0)
stderr_events_enabled=false                                     ; emit events on stderr writes (default false)

启动etcd服务并检查

supervisorctl update
supervisorctl start all
supervisorctl status