正文

etcd集群搭建

X糊涂仙儿  2022-02-16  244

关键词：

1、集群

主机名	ip	配置
etcd-01	192.168.1.61	8C/16G/100G
etcd-02	192.168.1.62	8C/16G/100G
etcd-03	192.168.1.63	8C/16G/100G

2、配置etcd集群

1> hosts文件

[root@k01 ~]# cat /etc/hosts

127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.1.61 k01
192.168.1.62 k02
192.168.1.63 k03
192.168.1.71 node01
192.168.1.72 node02

2> 创建 ca证书

mkdir -pv etcdssl
cd etcdssl

创建ca-config、ca-csr

cat ca-config.json << EOF
{
  "signing": {
    "default": {
      "expiry": "87600h"
    },
    "profiles": {
      "www": {
         "expiry": "87600h",
         "usages": [
            "signing",
            "key encipherment",
            "server auth",
            "client auth"
        ]
      }
    }
  }
}
EOF

cat ca-csr.json << EOF
{
    "CN": "etcd CA",
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "Beijing",
            "ST": "Beijing"
        }
    ]
}
EOF

生成证书

[root@k01 etcdssl]# cfssl gencert -initca ca-csr.json | cfssljson -bare ca -
2021/08/20 21:05:48 [INFO] generating a new CA key and certificate from CSR
2021/08/20 21:05:48 [INFO] generate received request
2021/08/20 21:05:48 [INFO] received CSR
2021/08/20 21:05:48 [INFO] generating key: rsa-2048
2021/08/20 21:05:48 [INFO] encoded CSR
2021/08/20 21:05:48 [INFO] signed certificate with serial number 437xxxxxxxxxxxxxx394879734494661358352

查看

[root@k01 etcdssl]# ls
ca-config.json  ca.csr  ca-csr.json  ca-key.pem  ca.pem

3> 使用ca签发etcd证书

创建etcd证书签名请求文件

[root@k01 etcdssl]# cat server-csr.json 
{
    "CN": "etcd",
    "hosts": [
    "192.168.1.61",
    "192.168.1.62",
    "192.168.1.63",
    "192.168.1.64"
    ],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "BeiJing",
            "ST": "BeiJing"
        }
    ]
}

生成证书

[root@k01 etcdssl]# cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=www server-csr.json | cfssljson -bare server
2021/08/20 21:07:05 [INFO] generate received request
2021/08/20 21:07:05 [INFO] received CSR
2021/08/20 21:07:05 [INFO] generating key: rsa-2048
2021/08/20 21:07:06 [INFO] encoded CSR
2021/08/20 21:07:06 [INFO] signed certificate with serial number 5579849624423xxxxxxxxxxxxxxxxx91627608515054481
2021/08/20 21:07:06 [WARNING] This certificate lacks a "hosts" field. This makes it unsuitable for
websites. For more information see the Baseline Requirements for the Issuance and Management
of Publicly-Trusted Certificates, v.1.1.6, from the CA/Browser Forum (https://cabforum.org);
specifically, section 10.2.3 ("Information Requirements").

证书分发至其它节点

创建目录

[root@k01 etcdssl]# ansible etcd -m shell -a "mkdir -p /opt/etcd/ssl"

创建分发脚本

vim scpetcdssl.sh
#！/bin/bash

for node in k01 k02 k03 
do
	ssh root@${node} "mkdir -pv /opt/etcd/ssl"
	scp ./ca*.pem  root@${node}:/opt/etcd/ssl
	scp ./server*.pem  root@${node}:/opt/etcd/ssl
done

三、部署Etcd

解压创建配置文件

tar xzvf etcd-v3.4.16-linux-amd64.tar.gz
cp -a etcd-v3.4.16-linux-amd64/etcd* /usr/local/bin/
ansible etcd -m shell -a "mkdir -pv /opt/etcd/cfg"

cat >/opt/etcd/cfg/etcd.conf <<EOF
#[Member]
ETCD_NAME="etcd-01"
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
ETCD_LISTEN_PEER_URLS="https://192.168.1.61:2380"
ETCD_LISTEN_CLIENT_URLS="https://192.168.1.61:2379,http://127.0.0.1:2379"
#[Clustering]
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://192.168.1.61:2380"
ETCD_ADVERTISE_CLIENT_URLS="https://192.168.1.61:2379"
ETCD_INITIAL_CLUSTER="etcd-01=https://192.168.1.61:2380,etcd-02=https://192.168.1.62:2380,etcd-03=https://192.168.1.63:2380"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
ETCD_INITIAL_CLUSTER_STATE="new"
EOF

[root@k01 ~]# cat /usr/lib/systemd/system/etcd.service << EOF
[Unit]
Description=Etcd Server
After=network.target
After=network-online.target
Wants=network-online.target
[Service]
Type=notify
EnvironmentFile=/opt/etcd/cfg/etcd.conf
ExecStart=/usr/local/bin/etcd \
--cert-file=/opt/etcd/ssl/server.pem \
--key-file=/opt/etcd/ssl/server-key.pem \
--peer-cert-file=/opt/etcd/ssl/server.pem \
--peer-key-file=/opt/etcd/ssl/server-key.pem \
--trusted-ca-file=/opt/etcd/ssl/ca.pem \
--peer-trusted-ca-file=/opt/etcd/ssl/ca.pem \
--logger=zap
Restart=on-failure
LimitNOFILE=65536
[Install]
WantedBy=multi-user.target
EOF

注：
ETCD_NAME：节点名称，集群中唯一
ETCD_DATA_DIR：数据目录
ETCD_LISTEN_PEER_URLS：集群通信监听地址
ETCD_LISTEN_CLIENT_URLS：客户端访问监听地址
ETCD_INITIAL_ADVERTISE_PEER_URLS：集群通告地址
ETCD_ADVERTISE_CLIENT_URLS：客户端通告地址
ETCD_INITIAL_CLUSTER：集群节点地址
ETCD_INITIAL_CLUSTER_TOKEN：集群Token
ETCD_INITIAL_CLUSTER_STATE：加入集群的当前状态，new是新集群，existing表示加入已有集群

启动服务

systemctl start etcd.service
systemctl enable etcd.service
[root@k01 ~]# systemctl status etcd.service
● etcd.service - Etcd Server
   Loaded: loaded (/usr/lib/systemd/system/etcd.service; enabled; vendor preset: disabled)
   Active: active (running) since Sun 2021-08-22 18:26:28 CST; 5h 11min ago
 Main PID: 17312 (etcd)
    Tasks: 15
   Memory: 54.3M
   CGroup: /system.slice/etcd.service
           └─17312 /usr/local/bin/etcd --cert-file=/opt/etcd/ssl/server.pem --key-file=/opt/etcd/ssl/server-key.pem --peer-cert-file=/opt/etcd/ssl/server.pem --peer-key-file=/opt/etcd/ssl/server-key.pem --tr...

Aug 22 23:36:04 k01 etcd[17312]: {"level":"warn","ts":"2021-08-22T23:36:04.194+0800","caller":"rafthttp/probing_status.go:86","msg":"prober found high clock drift","round-tripper-name":"ROUND_...":"30.14026ms"}

健康状态检查

[root@k01 ~]# etcdctl --cacert=/opt/etcd/ssl/ca.pem --cert=/opt/etcd/ssl/server.pem --key=/opt/etcd/ssl/server-key.pem --endpoints="https://192.168.1.61:2379,https://192.168.1.62:2379,https://192.168.1.63:2379" endpoint health
https://192.168.1.61:2379 is healthy: successfully committed proposal: took = 57.708307ms
https://192.168.1.62:2379 is healthy: successfully committed proposal: took = 59.868422ms
https://192.168.1.63:2379 is healthy: successfully committed proposal: took = 94.302948ms

搭建etcd集群(代码片段)

...，这里做下简单记录。本系列总共3篇：《搭建etcd集群》：介绍搭建etcd集群方式、遇到的问题及处理方式；《编译安装etcd-cpp-apiv3》：介绍etcd-cpp-apiv3编译安装方式、常见问题及处理方式；《etcd-cpp-apiv3使用... 查看详情

etcdv3版本生产级集群搭建以及实现一键启动脚本

...3.开放防火墙端口1.4.创建必要的目录1.5.下载etcd并解压1.6.集群主机免密登陆二、集群启动与验证2.1.一键启动脚本实现2.2.验证集群本专栏的上一篇文章写了《长篇图解etcd核心应用场景及编码实战》，本文继续。后续计划章节内容... 查看详情

架构师面试题库1—etcd高可用集群搭建(代码片段)

环境准备操作系统：CentOS7搭建一个三节点的etcd集群机器名:etcd01IP地址:192.168.154.133机器名:etcd03IP地址:192.168.154.145机器名:etcd04IP地址:192.168.154.146etcd包下载安装1、下载https://github.com/etcd-io/etcd/releases/download/v3.3.1/etcd-v3.3.1-linux-amd... 查看详情

k8s------kubernetes单master集群二进制搭建(代码片段)

目录前言Kubernetes单Master节点集群二进制部署一.Kubernetes单Master集群架构二.环境准备三.Etcd集群部署1.准备签发证书环境2.生成CA证书、etcd服务器证书以及私钥3.安装Etcd4.在Master01节点启动Etcd集群节点015.将证书，命令文件，... 查看详情

k8s------kubernetes单master集群二进制搭建(代码片段)

kubernetes学习一：kubernetes集群搭建之etcd安装部署(代码片段)

目录1、软件版本和环境介绍2、服务器信息介绍（以下称主机名）3、etcd安装部署3.1、cfssl安装3.2、创建etcd证书3.3、etcdca配置3.4、etcdca证书3.5、etcdserver证书3.6、生成etcdca证书和私钥初始化ca3.7、生成server证书3.8、下发证书... 查看详情

2二进制方式搭建k8s集群(代码片段)

本文介绍单/多Master的K8S集群搭建全过程。目录1环境要求、节点规划、配置1.1环境要求1.2节点规划1.3操作系统初始化配置2ETCD集群部署2.1 准备cfssl证书生成工具2.2 生成ETCD证书2.3下载ETCD的二进制文件2.4部署ETCD集群3安装Docker4部... 查看详情

云原生|kubernetes篇自建高可用k8s集群搭建(代码片段)

文末有惊喜文章目录自建高可用k8s集群搭建一、所有节点基础环境1、环境准备与内核升级2、安装Docker二、PKI三、证书工具准备1、下载证书工具2、ca根配置3、ca签名请求4、生成证书5、k8s集群是如何使用证书的四、etcd高可用搭建... 查看详情

linux企业运维——k8s高可用集群架构搭建详解(代码片段)

K8s高可用集群文章目录K8s高可用集群一、K8s高可用集群架构原理二、实验环境三、K8s高可用集群架构搭建3.1、负载均衡Loadbalancer部署—haproxy3.2、Docker部署3.3、K8s集群部署3.4、K8s集群添加worker节点四、集群高可用性能测试一、K8s... 查看详情

使用docker运行etcd单实例/集群(代码片段)

...errun启动etcda.运行容器b.参数介绍c.管理etcdd.使用etcd三.etcd集群1.准备a.创建数据目录与配置目录b.编写配置etcdconfig2.docker-composea.docker-compose配置文件b.参数介绍c.运行并使用etcdcluster四.其他1.mac下主机不能直接访问容器ipa.解决方法1,... 查看详情

k8s------kubernetes单master集群二进制搭建(代码片段)

etcd-cpp-apiv3使用示例介绍(代码片段)

2etcd单机部署和集群部署(代码片段)

上一章我们认识了etcd，简单的介绍了etcd的基础概念，但是理解起来还是比较抽象的。这一章我们就一起来部署下etcd。这样可以让我们对etcd有更加确切的认识。1、etcd单实例部署对于平常的学习，其实搭建一个单机节点是够了的... 查看详情

kubernetes集群之二进制安装部署（单master节点）(代码片段)

...见的K8S按照部署方式二、安装部署分析三、首先部署ETCD集群3.1ETCD介绍3.2准备CFSSL证书签发环境3.3环境部署3.3.1搭建ETCD步骤3.3.2下载准备CFSSL证书制作工具3.3.3上传etcd-cert.sh和etcd.sh到/opt/k8s/目录中3.3.4安装ETCD服务3.3.5配置ETCD集群3.3.... 查看详情

编译etcd-cpp-apiv3(代码片段)

...，这里做下简单记录。本系列总共3篇：《搭建etcd集群》：介绍搭建etcd集群方式、遇到的问题及处理方式；《编译安装etcd-cpp-apiv3》：介绍etcd-cpp-api 查看详情

openshift集群搭建指南

OpenShift集群搭建指南v1.0搭建Hyper-v虚拟机或物理机配置物理机静态IP，启用Hyper-v服务。规划服务器节点节点说明主机名IPMaster主控制节点openshiftmaster.dynastech.com192.168.30.95Etcd协调服务节点openshiftetcd.dynastech.com192.168.30.96Node1计算节点1... 查看详情