首页 > 其他分享 >二机制安装Kubernetes 1.29 高可用集群(3)--etcd集群配置

二机制安装Kubernetes 1.29 高可用集群(3)--etcd集群配置

时间：2024-02-18 22:24:38浏览次数：28  
标签：Kubernetes -- cfssl etc cert 集群 usr etcd pki

1. 在所有etcd节点解压安装包

tar -zxf etcd-v3.5.12-linux-amd64.tar.gz
cp etcd-v3.5.12-linux-amd64/etcd /usr/local/bin/ && cp etcd-v3.5.12-linux-amd64/etcdctl /usr/local/bin/

#查看版本信息
# etcdctl version
etcdctl version: 3.5.12
API version: 3.5

2.1 在所有etcd节点准备cfssl生成工具

cp cfssl_1.6.4_linux_amd64 /usr/local/bin/cfssl && cp cfssljson_1.6.4_linux_amd64 /usr/local/bin/cfssljson && cp cfssl-certinfo_1.6.4_linux_amd64 /usr/local/bin/cfssl-certinfo 
chmod +x /usr/local/bin/cfssl /usr/local/bin/cfssljson /usr/local/bin/cfssl-certinfo /usr/local/bin/cfssl-certinfo

2.2 在所有etcd节点创建工作目录

mkdir -p /etc/etcd/{yaml,pki,cert}

ssh root@k8s-master-etcd02 "mkdir -p /etc/etcd/{yaml,pki,cert}"
ssh root@k8s-etcd03 "mkdir -p /etc/etcd/{yaml,pki,cert}"

3. 在etcd01节点创建CA证书

3.1.1 配置CA证书请求文件

cat > /etc/etcd/cert/ca-csr.json << EOF
{
  "CN": "kubernetes",
  "key": {
      "algo": "rsa",
      "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "Beijing",
      "L": "Beijing",
      "O": "etcd",
      "OU": "CNPC Group"
    }
  ],
  "ca": {
          "expiry": "876000h"
  }
}
EOF

3.1.2 创建CA证书

cfssl gencert -initca /etc/etcd/cert/ca-csr.json | cfssljson -bare /etc/etcd/pki/ca

3.1.3 创建CA证书策略

cat > /etc/etcd/cert/ca-config.json << EOF
{
  "signing": {
      "default": {
          "expiry": "87600h"
        },
      "profiles": {
          "kubernetes": {
              "usages": [
                  "signing",
                  "key encipherment",
                  "server auth",
                  "client auth"
              ],
              "expiry": "876000h"
          }
      }
  }
}
EOF

3.2 创建etcd证书

3.2.1 创建etcd请求文件

cat > /etc/etcd/cert/etcd-csr.json << EOF
{
  "CN": "etcd",
  "hosts": [
    "127.0.0.1",
    "192.168.83.210",
    "192.168.83.211",
    "192.168.83.212",
    "192.168.83.213",
    "192.168.83.214"
  ],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [{
    "C": "CN",
    "ST": "Beijing",
    "L": "Beijing",
    "O": "etcd",
    "OU": "CNPC Group"
  }]
}
EOF

注：192.168.83.213/214为预留IP

 3.2.2 生成etcd证书

cfssl gencert \
-ca=/etc/etcd/pki/ca.pem \
-ca-key=/etc/etcd/pki/ca-key.pem \
-config=/etc/etcd/cert/ca-config.json \
-profile=kubernetes \
/etc/etcd/cert/etcd-csr.json | cfssljson -bare /etc/etcd/pki/etcd

3.2.3 将etcd证书从etcd01节点拷贝到etcd02/03节点

scp /etc/etcd/cert/* root@k8s-master-etcd02:/etc/etcd/cert
scp /etc/etcd/pki/* root@k8s-master-etcd02:/etc/etcd/pki
scp /etc/etcd/pki/* root@k8s-etcd03:/etc/etcd/pki

4. 在etcd各节点分别创建etcd配置文件

4.1  在etcd01节点创建配置文件

cat > /etc/etcd/yaml/etcd.config.yml << EOF 
name: 'k8s-master-etcd01'
data-dir: /var/lib/etcd
wal-dir: /var/lib/etcd/wal
snapshot-count: 5000
heartbeat-interval: 100
election-timeout: 1000
quota-backend-bytes: 0
listen-peer-urls: 'https://192.168.83.210:2380'
listen-client-urls: 'https://192.168.83.210:2379,http://127.0.0.1:2379'
max-snapshots: 3
max-wals: 5
cors:
initial-advertise-peer-urls: 'https://192.168.83.210:2380'
advertise-client-urls: 'https://192.168.83.210:2379'
discovery:
discovery-fallback: 'proxy'
discovery-proxy:
discovery-srv:
initial-cluster: 'k8s-master-etcd01=https://192.168.83.210:2380,k8s-master-etcd02=https://192.168.83.211:2380,k8s-etcd03=https://192.168.83.212:2380'
initial-cluster-token: 'etcd-k8s-cluster'
initial-cluster-state: 'new'
strict-reconfig-check: false
enable-v2: true
enable-pprof: true
proxy: 'off'
proxy-failure-wait: 5000
proxy-refresh-interval: 30000
proxy-dial-timeout: 1000
proxy-write-timeout: 5000
proxy-read-timeout: 0
client-transport-security:
  cert-file: '/etc/etcd/pki/etcd.pem'
  key-file: '/etc/etcd/pki/etcd-key.pem'
  client-cert-auth: true
  trusted-ca-file: '/etc/etcd/pki/ca.pem'
  auto-tls: true
peer-transport-security:
  cert-file: '/etc/etcd/pki/etcd.pem'
  key-file: '/etc/etcd/pki/etcd-key.pem'
  peer-client-cert-auth: true
  trusted-ca-file: '/etc/etcd/pki/ca.pem'
  auto-tls: true
debug: false
log-package-levels:
log-outputs: [default]
force-new-cluster: false
EOF

 4.2  在etcd02节点创建配置文件

cat > /etc/etcd/yaml/etcd.config.yml << EOF 
name: 'k8s-master-etcd02'
data-dir: /var/lib/etcd
wal-dir: /var/lib/etcd/wal
snapshot-count: 5000
heartbeat-interval: 100
election-timeout: 1000
quota-backend-bytes: 0
listen-peer-urls: 'https://192.168.83.211:2380'
listen-client-urls: 'https://192.168.83.211:2379,http://127.0.0.1:2379'
max-snapshots: 3
max-wals: 5
cors:
initial-advertise-peer-urls: 'https://192.168.83.211:2380'
advertise-client-urls: 'https://192.168.83.211:2379'
discovery:
discovery-fallback: 'proxy'
discovery-proxy:
discovery-srv:
initial-cluster: 'k8s-master-etcd01=https://192.168.83.210:2380,k8s-master-etcd02=https://192.168.83.211:2380,k8s-etcd03=https://192.168.83.212:2380'
initial-cluster-token: 'etcd-k8s-cluster'
initial-cluster-state: 'new'
strict-reconfig-check: false
enable-v2: true
enable-pprof: true
proxy: 'off'
proxy-failure-wait: 5000
proxy-refresh-interval: 30000
proxy-dial-timeout: 1000
proxy-write-timeout: 5000
proxy-read-timeout: 0
client-transport-security:
  cert-file: '/etc/etcd/pki/etcd.pem'
  key-file: '/etc/etcd/pki/etcd-key.pem'
  client-cert-auth: true
  trusted-ca-file: '/etc/etcd/pki/ca.pem'
  auto-tls: true
peer-transport-security:
  cert-file: '/etc/etcd/pki/etcd.pem'
  key-file: '/etc/etcd/pki/etcd-key.pem'
  peer-client-cert-auth: true
  trusted-ca-file: '/etc/etcd/pki/ca.pem'
  auto-tls: true
debug: false
log-package-levels:
log-outputs: [default]
force-new-cluster: false
EOF

4.3 在etcd03节点上创建配置文件

cat > /etc/etcd/yaml/etcd.config.yml << EOF 
name: 'k8s-etcd03'
data-dir: /var/lib/etcd
wal-dir: /var/lib/etcd/wal
snapshot-count: 5000
heartbeat-interval: 100
election-timeout: 1000
quota-backend-bytes: 0
listen-peer-urls: 'https://192.168.83.212:2380'
listen-client-urls: 'https://192.168.83.212:2379,http://127.0.0.1:2379'
max-snapshots: 3
max-wals: 5
cors:
initial-advertise-peer-urls: 'https://192.168.83.212:2380'
advertise-client-urls: 'https://192.168.83.212:2379'
discovery:
discovery-fallback: 'proxy'
discovery-proxy:
discovery-srv:
initial-cluster: 'k8s-master-etcd01=https://192.168.83.210:2380,k8s-master-etcd02=https://192.168.83.211:2380,k8s-etcd03=https://192.168.83.212:2380'
initial-cluster-token: 'etcd-k8s-cluster'
initial-cluster-state: 'new'
strict-reconfig-check: false
enable-v2: true
enable-pprof: true
proxy: 'off'
proxy-failure-wait: 5000
proxy-refresh-interval: 30000
proxy-dial-timeout: 1000
proxy-write-timeout: 5000
proxy-read-timeout: 0
client-transport-security:
  cert-file: '/etc/etcd/pki/etcd.pem'
  key-file: '/etc/etcd/pki/etcd-key.pem'
  client-cert-auth: true
  trusted-ca-file: '/etc/etcd/pki/ca.pem'
  auto-tls: true
peer-transport-security:
  cert-file: '/etc/etcd/pki/etcd.pem'
  key-file: '/etc/etcd/pki/etcd-key.pem'
  peer-client-cert-auth: true
  trusted-ca-file: '/etc/etcd/pki/ca.pem'
  auto-tls: true
debug: false
log-package-levels:
log-outputs: [default]
force-new-cluster: false
EOF

5. 在所有etcd节点创建启动文件并启动

cat > /usr/lib/systemd/system/etcd.service << EOF
[Unit]
Description=Etcd Service
Documentation=https://coreos.com/etcd/docs/latest/
After=network.target

[Service]
Type=notify
ExecStart=/usr/local/bin/etcd --config-file=/etc/etcd/yaml/etcd.config.yml
Restart=on-failure
RestartSec=10
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target
Alias=etcd3.service
EOF

systemctl daemon-reload
systemctl enable etcd
systemctl start etcd
systemctl status etcd

6. 查看etcd状态

etcdctl member list
etcdctl member list -w table

#创建etcd状态查看文件
cat > /etc/etcd/etcd_status.sh << EOF
#!/bin/bash
cd /etc/etcd
export ETCDCTL_API=3
etcdctl --endpoints="192.168.83.210:2379,192.168.83.211:2379,192.168.83.212:2379" \
--cacert=/etc/etcd/pki/ca.pem \
--cert=/etc/etcd/pki/etcd.pem \
--key=/etc/etcd/pki/etcd-key.pem \
endpoint status --write-out=table
EOF

#执行etcd状态查看文件
chmod +x /etc/etcd/etcd_status.sh
bash /etc/etcd/etcd_status.sh

 

标签：Kubernetes,--,cfssl,etc,cert,集群,usr,etcd,pki
From： https://www.cnblogs.com/cn-jasonho/p/18014662

相关文章

  • 二机制安装Kubernetes 1.29 高可用集群(2)--haproxy节点配置
    1.1在所有haproxy节点安装haproxyyum-yinstallhaproxy1.2在所有haproxy节点创建haproxy配置文件cat>/etc/haproxy/haproxy.cfg<<EOFglobalmaxconn3000ulimit-n16384log127.0.0.1local0errstatstimeout30sde......
  • 二机制安装Kubernetes 1.29 高可用集群(1)--系统初始配置
    软件环境描述说明：OS：openEuler22.03LTSSP3kubernetes：1.29.2etcd：3.5.12calico：3.27.0cri-docker：0.3.10cfssl/cfssljson/cfssl-certinfo：1.64haproxy：2.2.6keepalived：2.2.4网段规划：物理主机：192.168.83.0/24      ServiceIP：10.66.0.0/16   PodIP：172.31.0.0......
  • Window10 通过 SSH 访问 Docker 容器
    参考https://zhuanlan.zhihu.com/p/462481693https://blog.csdn.net/piaopu0120/article/details/120550181https://blog.csdn.net/qq_27865227/article/details/121649574https://blog.csdn.net/fighterandknight/article/details/124478429环境软件/系统版本说明......
  • 二机制安装Kubernetes 1.29 高可用集群(6)--calico网络组件和CoreDNS配置
    1.部署Calico网络组件1.1k8s-master节点上下载calico的创建文件下载地址：https://docs.tigera.io/calico/latest/getting-started/kubernetes/quickstartwgethttps://raw.githubusercontent.com/projectcalico/calico/v3.27.2/manifests/tigera-operator.yamlwgethttps://ra......
  • 思维导图工具Xmind
    下载链接：https://pan.baidu.com/s/12wVLRIrwy4rOzvMuzy8ofg?pwd=h008xmind免费安装使用教程_xmind安装csdn-CSDN博客......
  • 《程序是怎样跑起来的》第一章其余节
    读书笔记：1.2：寄存器的类型及功能：累加器——存放执行运算的数据和运算结果；标志寄存器：存放运算后的CPU的状态；程序计算器：存放下一条指令所在内存的地址；基址寄存器：存放数据内存的起始地址；变址寄存器：存放基址寄存器的相对地址；通用寄存器：存放任意数据；指令寄存器：存放指令。这个寄存器由CPU......
  • 数组 容器 递归 普通排序 线性排序
    《数据结构与算法之美》读书笔记写在前面这本书的大部分内容比较浅显，因此只挑DSAA课程上没有涉及或没有深入讨论的点总结第二章数组相关提高传统数组插入/删除数据效率的方法：如果插入的数据不要求有序，可以直接把某位的原数据替换成新数据，然后把原数据放到数组末尾，避免大......
  • .NET周刊【2月第1期 2024-02-04】
    祝大家新年快乐，龙年大吉~国内文章C#/.NET/.NETCore优秀项目和框架2024年1月简报https://www.cnblogs.com/Can-daydayup/p/18000401本文介绍了公众号“追逐时光者”定期分享的C#/.NET/.NETCore优秀项目和框架，包括项目介绍、功能特点、使用方式和功能截图，并提供了源码地址。文......
  • EPLAN插件 - 设置导出PDF路径并自动备份PDF
    前言EPLAN导出PDF默认路径为$(DOC)，此路径在嵌套很深，每次点都感觉很麻烦，在工作中经常会要求备份PDF图纸的要求。需要导出PDF要找到相应的文件然后复制到指定的文件夹，总感觉非常的麻烦。于是写了这个插件。此插件设置导出PDF的路径在项目文件同级文件夹中新建PDF文件夹，同时可以设置......
  • 代码随想录 day54 买卖股票
    买卖股票的最佳时机III这题可以一天进行两次交易解法增加了两种状态虽然不知道为什么这样就可以work但是挺符合逻辑的意思就是把之前的两天交易合到一天进行计算收益也在之前一次交易基础上进行计算买卖股票的最佳时机IV这题就是这类问题的最难情况解法的思想就是......

赞助商

阅读排行

网站主页关于我们联系我们网站地图

本网站内容转载自其他媒体，侵权联系[admin##ips99.com]。

Copyright © 2020-2023 IPS99 版权所有 IPS99