安装etcd
证书制作
- ca制作
cat << EOF > ca-config.json
{
"signing": {
"default": {
"expiry": "876000h"
},
"profiles": {
"kubernetes": {
"usages": [
"signing",
"key encipherment",
"server auth",
"client auth"
],
"expiry": "876000h"
}
}
}
}
EOF
cat << EOF > ca-csr.json
{
"CN": "kubernetes",
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"ST": "BeiJing",
"L": "BeiJing",
"O": "k8s",
"OU": "System"
}
],
"ca": {
"expiry": "876000h"
}
}
EOF
cfssl gencert -initca ca-csr.json | cfssljson -bare ca -
- etcd pki制作
cat << EOF > etcd-csr.json
{
"CN": "kubernetes",
"hosts": [
"127.0.0.1",
"172.18.2.26",
"172.18.2.40",
"172.18.2.43",
"appserver-nacos-01",
"appserver-nacos-02",
"appserver-nacos-03",
"localhost"
],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"ST": "BeiJing",
"L": "BeiJing",
"O": "k8s",
"OU": "System"
}
]
}
EOF
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes etcd-csr.json | cfssljson -bare etcd
# tree etcd-pki/
etcd-pki/
├── ca-config.json
├── ca.csr
├── ca-csr.json
├── ca-key.pem
├── ca.pem
├── etcd.csr
├── etcd-csr.json
├── etcd-key.pem
└── etcd.pem
0 directories, 9 files
下载
https://github.com/etcd-io/etcd/releases/download/v3.5.13/etcd-v3.5.13-linux-arm64.tar.gz
生成配置
#!/bin/bash
#auto create k8s CA file
#author zqliu
#time 2019-08-06
service (){
cat > etcd.service <<EOF
[Unit]
Description=Etcd Server
After=network.target
After=network-online.target
Wants=network-online.target
Documentation=https://github.com/coreos
[Service]
Type=notify
WorkingDirectory=${DATA_DIR}
ExecStart=/usr/local/bin/etcd \
--name master1 \
--cert-file=${SSL_DIR}etcd.pem \
--key-file=${SSL_DIR}etcd-key.pem \
--peer-cert-file=${SSL_DIR}etcd.pem \
--peer-key-file=${SSL_DIR}etcd-key.pem \
--trusted-ca-file=${SSL_DIR}ca.pem \
--peer-trusted-ca-file=${SSL_DIR}ca.pem \
--initial-advertise-peer-urls https://${master01}:${nodePort} \
--listen-peer-urls https://${master01}:${nodePort} \
--listen-client-urls https://${master01}:${clientPort},http://127.0.0.1:${clientPort} \
--advertise-client-urls https://${master01}:${clientPort} \
--initial-cluster-token etcd-cluster-0 \
--initial-cluster master1=https://${master01}:${nodePort},master2=https://${master02}:${nodePort},master3=https://${master03}:${nodePort} \
--initial-cluster-state new \
--heartbeat-interval 250 \
--election-timeout 1250 \
--quota-backend-bytes '8589934592' \
--data-dir=${DATA_DIR}
User=zdxlz
Restart=on-failure
RestartSec=5
LimitNOFILE=65536
[Install]
WantedBy=multi-user.target
EOF
}
slave_service(){
cp etcd.service etcd.service.${master02}
cp etcd.service etcd.service.${master03}
sed -i "s/${master01}/${master02}/g" etcd.service.${master02}
sed -i "s/${master01}/${master03}/g" etcd.service.${master03}
sed -i "s#master1=https://${master02}#master1=https://${master01}#g" etcd.service.${master02}
sed -i "s#master1=https://${master03}#master1=https://${master01}#g" etcd.service.${master03}
sed -i 's/--name master1/--name master2/g' etcd.service.${master02}
sed -i 's/--name master1/--name master3/g' etcd.service.${master03}
}
main(){
#2379用于客户端通信,2380用于节点通信
clientPort=2379
nodePort=2380
#etcd的数据存放目录
DATA_DIR=/zdxlz/public/etcd/data/
#证书密码文件存放目录SSL_DIR=/etc/kubernetes/pki/
SSL_DIR=/zdxlz/public/etcd/pki/
master01=$1
master02=$2
master03=$3
service
slave_service
}
#输入etcd服务端的三个ip地址
main 172.18.2.26 172.18.2.40 172.18.2.43
验证
./etcdctl --cacert=/zdxlz/public/etcd/pki/ca.pem --cert=/zdxlz/public/etcd/pki/etcd.pem --key=/zdxlz/public/etcd/pki/etcd-key.pem --endpoints=172.18.2.43:2379 endpoint health
安装apisix
yum
sudo yum install -y https://repos.apiseven.com/packages/centos/apache-apisix-repo-1.0-1.noarch.rpm
yum仓库
- 更改为centos8
[root@appserver-apisix-0001 ~]# cat /etc/yum.repos.d/apache-apisix.repo
[release]
name=Apache APISIX Repository for CentOS
baseurl=https://repos.apiseven.com/packages/centos/8/$basearch
skip_if_unavailable=False
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://repos.apiseven.com/KEYS
enabled=1
enabled_metadata=1
[root@appserver-apisix-0001 ~]# cat /etc/yum.repos.d/
apache-apisix.repo ctyunos.repo openresty.repo
[root@appserver-apisix-0001 ~]# cat /etc/yum.repos.d/openresty.repo
[openresty]
name=Official OpenResty Open Source Repository for CentOS
baseurl=https://openresty.org/package/centos/8/$basearch
skip_if_unavailable=False
gpgcheck=1
repo_gpgcheck=0
gpgkey=https://openresty.org/package/pubkey.gpg
enabled=1
enabled_metadata=1
- 安装指定版本
- yum install apisix-3.2.2
安装apisix-dashboard
docker pull apache/apisix-dashboard
docker run -d --name dashboard \
-p 9000:9000 \
-v /zdxlz/public/apisix-dashboard/conf.yaml:/usr/local/apisix-dashboard/conf/conf.yaml \
-v /zdxlz/public/apisix-dashboard/pki:/tmp/ \
registry.cn-hangzhou.aliyuncs.com/middleware-zq/apisix-dashboard:2.13.1-alpine