k8s集群二进制安装--etcd集群部署

2.etcd集群部署
2.1 cfssl工具安装

##下载
wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64

##授权和命名
chmod a+x cffssl*
mv cfssl_linux-amd64 /usr/local/bin/cfssl
mv cfssljson_linux-amd64 /usr/local/bin/cfssljson
mv cfssl-certinfo_linux-amd64 /usr/local/bin/cfssl-certinfo

2.2 利用cfssl生产etcd证书
mkdir -p ~/TLS/{etcd,k8s}
cd ~/TLS/etcd

##创建ca配置文件
vi ca-config.json
{
“signing”: {
“default”: {
“expiry”: “87600h”
},
“profiles”: {
“www”: {
“expiry”: “87600h”,
“usages”: [
“signing”,
“key encipherment”,
“server auth”,
“client auth”
]
}
}
}
}

##创建ca-csr配置
vi ca-csr.json
{
“CN”: “etcd CA”,
“key”: {
“algo”: “rsa”,
“size”: 2048
},
“names”: [
{
“C”: “CN”,
“L”: “Beijing”,
“ST”: “Beijing”
}
]
}

##初始化证书，生产ca-key.pem和ca.pem文件
cfssl gencert -initca ca-csr.json | cfssljson -bare ca –

[INFO] generating a new CA key and certificate from CSR
[INFO] generate received request
[INFO] received CSR
[INFO] generating key: rsa-2048
[INFO] encoded CSR
[INFO] signed certificate with serial number 646656641171053641605250111163100532150959695309

##创建证书申请文件

##hosts字段的IP为所有etcd节点内部通信IP，为了方便扩容可以预留IP
vi server-csr.json
{
“CN”: “etcd”,
“hosts”: [
“172.16.0.104”,
“172.16.0.103”,
“172.16.0.105”
],
“key”: {
“algo”: “rsa”,
“size”: 2048
},
“names”: [
{
“C”: “CN”,
“L”: “BeiJing”,
“ST”: “BeiJing”
}
]
}

##证书生成
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=www server-csr.json | cfssljson -bare server

[INFO] generate received request
[INFO] received CSR
[INFO] generating key: rsa-2048
[INFO] encoded CSR
[INFO] signed certificate with serial number 132082648740083706791715125649193739449972481019
[WARNING] This certificate lacks a “hosts” field. This makes it unsuitable for
websites. For more information see the Baseline Requirements for the Issuance and Management
of Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser Forum (https://cabforum.org);
specifically, section 10.2.3 (“Information Requirements”).

2.3 搭建etcd集群
#下载
https://github.com/etcd-io/etcd/releases/download/v3.3.10/etcd-v3.3.10-linux-amd64.tar.gz

#上传解压
tar -zxvf etcd-v3.3.10-linux-amd64.tar

##复制etcd、etcdctl到/usr/bin/
cd etcd-v3.3.10-linux-amd64
cp etcd* /usr/bin/

#创建etcd配置文件
mkdir -p /data/etcd/default.etcd
mkdir -p /etc/etcd/{cfg,ssl}

cp ca.pem /etc/etcd/ssl/
cp server.pem /etc/etcd/ssl/
cp server-key.pem /etc/etcd/ssl/
cp ca-key.pem /etc/etcd/ssl/

vi /etc/etcd/cfg/etcd.conf
#[Member]
ETCD_NAME=“etcd-1”
ETCD_DATA_DIR="/data/etcd/default.etcd"
ETCD_LISTEN_PEER_URLS=“https://0.0.0.0:2380”
ETCD_LISTEN_CLIENT_URLS=“https://0.0.0.0:2379,https://0.0.0.0:4001”
#[Clustering]
ETCD_INITIAL_ADVERTISE_PEER_URLS=“https://172.16.0.104:2380”
ETCD_ADVERTISE_CLIENT_URLS=“https://172.16.0.104:2379,https://172.16.0.104:4001”
ETCD_INITIAL_CLUSTER=“etcd-1=https://172.16.0.104:2380,etcd-2=https://172.16.0.105:2380”
ETCD_INITIAL_CLUSTER_TOKEN=“etcd-cluster”
ETCD_INITIAL_CLUSTER_STATE=“new”

##创建etcd.service
vi /usr/lib/systemd/system/etcd.service

[Unit]
Description=Etcd Server
After=network.target
After=network-online.target
Wants=network-online.target
[Service]
Type=notify
EnvironmentFile=/etc/etcd/cfg/etcd.conf
ExecStart=/usr/bin/etcd
–cert-file=/etc/etcd/ssl/server.pem
–key-file=/etc/etcd/ssl/server-key.pem
–peer-cert-file=/etc/etcd/ssl/server.pem
–peer-key-file=/etc/etcd/ssl/server-key.pem
–trusted-ca-file=/etc/etcd/ssl/ca.pem
–peer-trusted-ca-file=/etc/etcd/ssl/ca.pem
Restart=on-failure
LimitNOFILE=65536
[Install]
WantedBy=multi-user.target

#将配置传输到node1节点上,修改对应的ip配置信息
cd /etc/
scp -r etcd/ root@‘172.16.0.105’:/etc/
scp /usr/lib/systemd/system/etcd.service root@‘172.16.0.105’:/usr/lib/systemd/system/

#同时启动集群中的etcd服务
systemctl daemon-reload
systemctl start etcd
systemctl enable etcd

##检查是否启动成功
curl --cacert /etc/etcd/ssl/ca.pem --cert /etc/etcd/ssl/server.pem --key /etc/etcd/ssl/server-key.pem https://172.16.0.104:2379/health

curl --cacert /etc/etcd/ssl/ca.pem --cert /etc/etcd/ssl/server.pem --key /etc/etcd/ssl/server-key.pem https://172.16.0.105:2379/health

返回值：{“health”:“true”}说明成功

参考文档：
##k8s集群安装
https://www.cnblogs.com/xulan0922/p/14583596.html
##etcd的4001问题
https://blog.csdn.net/wangshuminjava/article/details/81218084