Kubernetes-V1.14.2 二进制编译安装(安装etcd篇)

安装etcd

1、安装配置CFSSL

1.1、下载配置CFSSL

# 使用wget下载cfssl包
wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64

# 移动下载好的包
mv cfssl_linux-amd64 /app/kubernetes/bin/cfssl
mv cfssljson_linux-amd64 /app/kubernetes/bin/cfssljson
mv cfssl-certinfo_linux-amd64 /app/kubernetes/bin/cfssl-certinfo

# 赋予执行权限
chmod +x /app/kubernetes/bin/*

# 设置系统环境变量(可二选一,推荐1)
# 方式1:
vim /etc/profile
export PATH=$PATH:/app/kubernetes/bin
source /etc/profile

#方式2:
mv cfssl_linux-amd64 /usr/local/bin/cfssl
mv cfssljson_linux-amd64 /usr/local/bin/cfssljson
mv cfssl-certinfo_linux-amd64 /usr/local/bin/cfssl-certinfo

# cfssl同步到两个节点上
scp /app/kubernetes/bin/cfssl* k8s-node-1:/app/kubernetes/bin
scp /app/kubernetes/bin/cfssl* k8s-node-2:/app/kubernetes/bin
# 同步profile配置文件
scp /etc/profile k8s-node-1:/etc
scp /etc/profile k8s-node-2:/etc
# 然后分别在两个节点上 执行
source /etc/profile

1.2、初始话CFSSL

mkdir /usr/local/src/ssl && cd /usr/local/src/ssl
cfssl print-defaults config > ca-config.json
cfssl print-defaults csr > ca-csr.json

1.3、创建用来生成 CA 文件的 JSON 配置文件

vim ca-config.json

{
  "signing": {
    "default": {
      "expiry": "8760h"
    },
    "profiles": {
      "kubernetes": {
        "usages": [
            "signing",
            "key encipherment",
            "server auth",
            "client auth"
        ],
        "expiry": "8760h"
      }
    }
  }
}

1.4、创建用来生成 CA 证书签名请求(CSR)的 JSON 配置文件

vim ca-csr.json

{
  "CN": "kubernetes",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "BeiJing",
      "L": "BeiJing",
      "O": "k8s",
      "OU": "System"
    }
  ]
}

1.5、生成CA证书(ca.pem)和密钥(ca-key.pem)

cfssl gencert -initca ca-csr.json | cfssljson -bare ca

[root@k8s-master-2 ssl]# ls -l ca*
-rw-r--r-- 1 root root  290 6月  11 11:52 ca-config.json
-rw-r--r-- 1 root root 1001 6月  11 11:55 ca.csr
-rw-r--r-- 1 root root  208 6月  11 11:53 ca-csr.json
-rw------- 1 root root 1679 6月  11 11:55 ca-key.pem
-rw-r--r-- 1 root root 1359 6月  11 11:55 ca.pem

1.6、分发证书

cp ca.csr ca.pem ca-key.pem ca-config.json /app/kubernetes/ssl
scp ca.csr ca.pem ca-key.pem ca-config.json k8s-node-1:/app/kubernetes/ssl
scp ca.csr ca.pem ca-key.pem ca-config.json k8s-node-2:/app/kubernetes/ssl

2、安装etcd

2.1、 准备etcd软件包

wget https://github.com/etcd-io/etcd/releases/download/v3.3.13/\
etcd-v3.3.13-linux-amd64.tar.gz
tar xf etcd-v3.3.13-linux-amd64.tar.gz && cd etcd-v3.3.13-linux-amd64/
cp etcd* /app/kubernetes/bin/
scp etcd* k8s-node-1:/app/kubernetes/bin/
scp etcd* k8s-node-2:/app/kubernetes/bin/

2.2、 创建 etcd 证书签名请求

vim etcd-csr.json

# 注意将hosts中的ip地址改写为自己机器的
{
  "CN": "etcd",
  "hosts": [
    "127.0.0.1",
    "192.168.189.139",
    "192.168.189.131",
    "192.168.189.132"
  ],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "BeiJing",
      "L": "BeiJing",
      "O": "k8s",
      "OU": "System"
    }
  ]
}

2.3、 生成 etcd 证书和私钥

cfssl gencert -ca=/app/kubernetes/ssl/ca.pem \
  -ca-key=/app/kubernetes/ssl/ca-key.pem \
  -config=/app/kubernetes/ssl/ca-config.json \
  -profile=kubernetes etcd-csr.json | cfssljson -bare etcd

2.4、 将证书移动到/opt/kubernetes/ssl目录下

scp etcd*.pem /app/kubernetes/ssl/
scp etcd*.pem k8s-node-1:/app/kubernetes/ssl/
scp etcd*.pem k8s-node-2:/app/kubernetes/ssl/

rm -rf etcd.csr etcd-csr.json

2.5、 设置ETCD配置文件

vim /app/kubernetes/cfg/etcd.conf

#[member]
ETCD_NAME="etcd-node1"
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
# ETCD_SNAPSHOT_COUNTER="10000"
# ETCD_HEARTBEAT_INTERVAL="100"
# ETCD_ELECTION_TIMEOUT="1000"
# 注意将ip地址改为自己机器的
ETCD_LISTEN_PEER_URLS="https://192.168.189.139:2380"
ETCD_LISTEN_CLIENT_URLS="https://192.168.189.139:2379,https://127.0.0.1:2379"
# ETCD_MAX_SNAPSHOTS="5"
# ETCD_MAX_WALS="5"
# ETCD_CORS=""
#[cluster]
# 注意将ip地址改为自己机器的
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://192.168.189.139:2380"
# if you use different ETCD_NAME (e.g. test),
# set ETCD_INITIAL_CLUSTER value for this name, i.e. "test=http://..."
ETCD_INITIAL_CLUSTER="etcd-node1=https://192.168.189.139:2380,etcd-node2=https://192.168.189.131:2380,etcd-node3=https://192.168.189.132:2380"
ETCD_INITIAL_CLUSTER_STATE="new"
ETCD_INITIAL_CLUSTER_TOKEN="k8s-etcd-cluster"
# 注意将ip地址改为自己机器的
ETCD_ADVERTISE_CLIENT_URLS="https://192.168.189.139:2379"
#[security]
CLIENT_CERT_AUTH="true"
ETCD_CA_FILE="/app/kubernetes/ssl/ca.pem"
ETCD_CERT_FILE="/app/kubernetes/ssl/etcd.pem"
ETCD_KEY_FILE="/app/kubernetes/ssl/etcd-key.pem"
PEER_CLIENT_CERT_AUTH="true"
ETCD_PEER_CA_FILE="/app/kubernetes/ssl/ca.pem"
ETCD_PEER_CERT_FILE="/app/kubernetes/ssl/etcd.pem"
ETCD_PEER_KEY_FILE="/app/kubernetes/ssl/etcd-key.pem"

2.6、 创建etcd启动服务

vim /etc/systemd/system/etcd.service
[Unit]
Description=Etcd Server
After=network.target
 
[Service]
Type=simple
WorkingDirectory=/var/lib/etcd
EnvironmentFile=-/app/kubernetes/cfg/etcd.conf
# set GOMAXPROCS to number of processors
ExecStart=/bin/bash -c "GOMAXPROCS=$(nproc) /app/kubernetes/bin/etcd"
Type=notify
 
[Install]
WantedBy=multi-user.target

2.7、 复制相关文件到其它机器

scp /app/kubernetes/cfg/etcd.conf k8s-node-1:/app/kubernetes/cfg/
scp /app/kubernetes/cfg/etcd.conf k8s-node-2:/app/kubernetes/cfg/
scp /etc/systemd/system/etcd.service k8s-node-1:/etc/systemd/system/
scp /etc/systemd/system/etcd.service k8s-node-2:/etc/systemd/system/

修改另外两台机器的etcd.conf文件中的ETCD_NAME和监听IP,如下图所示,其中标蓝线的地方,ip都更换为当前机器的ip

修改node几点etcd.conf需要注意的点

然后在每个机器上面创建 /var/lib/etcd的文件夹 mkdir /var/lib/etcd 然后启动服务

systemctl daemon-reload && systemctl enable etcd
systemctl start etcd && systemctl status etcd

systemctl daemon-reload&& systemctl restart etcd && systemctl status etcd

2.8、 验证集群

复制etcdctl可执行文件到/usr/local/bin下 cp etcdctl /usr/local/bin 文件在解压包中

etcdctl --endpoints=https://192.168.189.139:2379 \
  --ca-file=/app/kubernetes/ssl/ca.pem \
  --cert-file=/app/kubernetes/ssl/etcd.pem \
  --key-file=/app/kubernetes/ssl/etcd-key.pem cluster-health

如果成功,则输出

[root@k8s-master-2 etcd-v3.3.13-linux-amd64]# etcdctl \
--endpoints=https://192.168.189.139:2379   \
--ca-file=/app/kubernetes/ssl/ca.pem   \
--cert-file=/app/kubernetes/ssl/etcd.pem   \
--key-file=/app/kubernetes/ssl/etcd-key.pem cluster-health
member 503e8f4db410fddd is healthy: got healthy result from \
https://192.168.189.139:2379
member 9e40edb005055a20 is healthy: got healthy result from \
https://192.168.189.131:2379
member e2e15ce4d2c75a68 is healthy: got healthy result from \
https://192.168.189.132:2379

====================================================

Kubernetes-1.14.2的源码包+kernel-ml-4.18.9.tar.gz 有百度云盘资源,链接:https://pan.baidu.com/s/1NZW2DV64DkybD6QI42lw7Q ; 提取码:t5bv

====================================================

原创声明,本文系作者授权云+社区发表,未经许可,不得转载。

如有侵权,请联系 yunjia_community@tencent.com 删除。

编辑于

我来说两句

0 条评论
登录 后参与评论

扫码关注云+社区

领取腾讯云代金券