apisix-yum安装

最新推荐文章于 2024-07-17 11:17:04 发布

那达慕zqliu

最新推荐文章于 2024-07-17 11:17:04 发布

阅读量241

点赞数 1

文章标签：云原生

本文链接：https://blog.csdn.net/weixin_43599889/article/details/137878338

版权

本文详细描述了如何在etcd环境中创建证书、ca配置、csr文件，并通过示例脚本指导设置etcd服务及其SSL证书，包括kubernetes认证以及apisix和OpenResty的安装配置。

摘要由CSDN通过智能技术生成

安装etcd

证书制作

ca制作

cat << EOF > ca-config.json
{
  "signing": {
    "default": {
      "expiry": "876000h"
    },
    "profiles": {
      "kubernetes": {
        "usages": [
            "signing",
            "key encipherment",
            "server auth",
            "client auth"
        ],
        "expiry": "876000h"
      }
    }
  }
}
EOF

cat << EOF > ca-csr.json 
{
  "CN": "kubernetes",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "BeiJing",
      "L": "BeiJing",
      "O": "k8s",
      "OU": "System"
    }
  ],
  "ca": {
    "expiry": "876000h"
 }
}
EOF

cfssl gencert -initca ca-csr.json | cfssljson -bare ca -

etcd pki制作

cat << EOF > etcd-csr.json 
{
   "CN": "kubernetes",
    "hosts": [
      "127.0.0.1",
      "172.18.2.26",
      "172.18.2.40",
      "172.18.2.43",
      "appserver-nacos-01",
      "appserver-nacos-02",
      "appserver-nacos-03",
      "localhost"
    ],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "ST": "BeiJing",
            "L": "BeiJing",
            "O": "k8s",
            "OU": "System"
        }
    ]
}
EOF


cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes etcd-csr.json | cfssljson -bare etcd

# tree etcd-pki/
etcd-pki/
├── ca-config.json
├── ca.csr
├── ca-csr.json
├── ca-key.pem
├── ca.pem
├── etcd.csr
├── etcd-csr.json
├── etcd-key.pem
└── etcd.pem

0 directories, 9 files

下载

https://github.com/etcd-io/etcd/releases/download/v3.5.13/etcd-v3.5.13-linux-arm64.tar.gz

生成配置

#!/bin/bash
#auto create k8s CA file
#author zqliu
#time 2019-08-06

service (){
cat > etcd.service <<EOF
[Unit]
Description=Etcd Server
After=network.target
After=network-online.target
Wants=network-online.target
Documentation=https://github.com/coreos

[Service]
Type=notify
WorkingDirectory=${DATA_DIR}
ExecStart=/usr/local/bin/etcd \
  --name master1 \
  --cert-file=${SSL_DIR}etcd.pem \
  --key-file=${SSL_DIR}etcd-key.pem \
  --peer-cert-file=${SSL_DIR}etcd.pem \
  --peer-key-file=${SSL_DIR}etcd-key.pem \
  --trusted-ca-file=${SSL_DIR}ca.pem \
  --peer-trusted-ca-file=${SSL_DIR}ca.pem \
  --initial-advertise-peer-urls https://${master01}:${nodePort} \
  --listen-peer-urls https://${master01}:${nodePort} \
  --listen-client-urls https://${master01}:${clientPort},http://127.0.0.1:${clientPort} \
  --advertise-client-urls https://${master01}:${clientPort} \
  --initial-cluster-token etcd-cluster-0 \
  --initial-cluster master1=https://${master01}:${nodePort},master2=https://${master02}:${nodePort},master3=https://${master03}:${nodePort} \
  --initial-cluster-state new \
  --heartbeat-interval 250 \
  --election-timeout 1250 \
  --quota-backend-bytes '8589934592' \
  --data-dir=${DATA_DIR}
User=zdxlz
Restart=on-failure
RestartSec=5
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target
EOF
}
slave_service(){
cp etcd.service etcd.service.${master02}
cp etcd.service etcd.service.${master03}
sed -i "s/${master01}/${master02}/g" etcd.service.${master02}
sed -i "s/${master01}/${master03}/g" etcd.service.${master03}
sed -i "s#master1=https://${master02}#master1=https://${master01}#g" etcd.service.${master02}
sed -i "s#master1=https://${master03}#master1=https://${master01}#g" etcd.service.${master03}
sed -i 's/--name master1/--name master2/g' etcd.service.${master02}
sed -i 's/--name master1/--name master3/g' etcd.service.${master03}
}
main(){
	#2379用于客户端通信，2380用于节点通信
	clientPort=2379
	nodePort=2380
	#etcd的数据存放目录
	DATA_DIR=/zdxlz/public/etcd/data/
	#证书密码文件存放目录SSL_DIR=/etc/kubernetes/pki/
	SSL_DIR=/zdxlz/public/etcd/pki/
	master01=$1
	master02=$2
	master03=$3
	
	service
	slave_service
}
#输入etcd服务端的三个ip地址
main 172.18.2.26 172.18.2.40 172.18.2.43

验证

./etcdctl --cacert=/zdxlz/public/etcd/pki/ca.pem --cert=/zdxlz/public/etcd/pki/etcd.pem     --key=/zdxlz/public/etcd/pki/etcd-key.pem   --endpoints=172.18.2.43:2379 endpoint health

安装apisix

yum

sudo yum install -y https://repos.apiseven.com/packages/centos/apache-apisix-repo-1.0-1.noarch.rpm

yum仓库

更改为centos8

[root@appserver-apisix-0001 ~]# cat /etc/yum.repos.d/apache-apisix.repo 
[release]
name=Apache APISIX Repository for CentOS
baseurl=https://repos.apiseven.com/packages/centos/8/$basearch
skip_if_unavailable=False
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://repos.apiseven.com/KEYS
enabled=1
enabled_metadata=1
[root@appserver-apisix-0001 ~]# cat /etc/yum.repos.d/
apache-apisix.repo  ctyunos.repo        openresty.repo      
[root@appserver-apisix-0001 ~]# cat /etc/yum.repos.d/openresty.repo 
[openresty]
name=Official OpenResty Open Source Repository for CentOS
baseurl=https://openresty.org/package/centos/8/$basearch
skip_if_unavailable=False
gpgcheck=1
repo_gpgcheck=0
gpgkey=https://openresty.org/package/pubkey.gpg
enabled=1
enabled_metadata=1

安装指定版本
- yum install apisix-3.2.2

安装apisix-dashboard

docker pull apache/apisix-dashboard
docker run -d --name dashboard \
           -p 9000:9000        \
           -v /zdxlz/public/apisix-dashboard/conf.yaml:/usr/local/apisix-dashboard/conf/conf.yaml \
           -v /zdxlz/public/apisix-dashboard/pki:/tmp/ \
           registry.cn-hangzhou.aliyuncs.com/middleware-zq/apisix-dashboard:2.13.1-alpine