zoukankan      html  css  js  c++  java
  • 使用二进制文件部署Etcd集群

    Etcd 是一个分布式键值存储系统,Kubernetes使用Etcd进行数据存储,所以先准备一个Etcd数据库,为解决Etcd单点故障,应采用集群方式部署,这里使用3台组建集群,可容忍1台机器故障,当然,你也可以使用5台组建集群,可容忍2台机器故障。

    主机规划

    节点名称 IP
    etcd-1,k8s-master 192.168.80.220
    etcd-2,k8s-node1 192.168.80.221
    etcd-3,k8s-node1 192.168.80.222

    操作系统初始化配置

    # 关闭防火墙
    systemctl stop firewalld
    systemctl disable firewalld
    # 关闭 selinux
    sed -i 's/enforcing/disabled/' /etc/selinux/config # 永久
    setenforce 0 # 临时
    # 关闭 swap
    swapoff -a # 临时
    sed -ri 's/.*swap.*/#&/' /etc/fstab # 永久
    # 根据规划设置主机名
    hostnamectl set-hostname <hostname>
    # 在 master 添加 hosts
    cat >> /etc/hosts << EOF
    192.168.80.220 k8s-master1
    192.168.80.221 k8s-node1
    192.168.80.222 k8s-node2
    EOF
    # 将桥接的 IPv4 流量传递到 iptables 的链
    cat > /etc/sysctl.d/k8s.conf << EOF
    net.bridge.bridge-nf-call-ip6tables = 1
    net.bridge.bridge-nf-call-iptables = 1
    EOF
    sysctl --system # 生效
    # 时间同步
    yum install ntpdate -y
    ntpdate time.windows.com
    

    准备cfssl证书生成工具

    cfssl是一个开源的证书管理工具,使用json文件生成证书,相比openssl更方便使用。找任意一台服务器操作,这里用Master节点。

    wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
    wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
    wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64
    chmod +x cfssl_linux-amd64 cfssljson_linux-amd64 cfssl-certinfo_linux-amd64
    mv cfssl_linux-amd64 /usr/local/bin/cfssl
    mv cfssljson_linux-amd64 /usr/local/bin/cfssljson
    mv cfssl-certinfo_linux-amd64 /usr/bin/cfssl-certinfo
    

    若是下载不了的话可以用我下载好的这个:https://files.cnblogs.com/files/sanduzxcvbnm/etcd集群生成证书的工具.zip

    生成Etcd证书

    自签证书颁发机构(CA)

    # 创建工作目录
    mkdir -p ~/TLS/{etcd,k8s}
    cd ~/TLS/etcd
    # 自签CA
    cat > ca-config.json << EOF
    {
      "signing": {
        "default": {
          "expiry": "87600h"
        },
        "profiles": {
          "www": {
             "expiry": "87600h",
             "usages": [
                "signing",
                "key encipherment",
                "server auth",
                "client auth"
            ]
          }
        }
      }
    }
    EOF
    
    cat > ca-csr.json << EOF
    {
        "CN": "etcd CA",
        "key": {
            "algo": "rsa",
            "size": 2048
        },
        "names": [
            {
                "C": "CN",
                "L": "Beijing",
                "ST": "Beijing"
            }
        ]
    }
    EOF
    
    # 生成证书,会生成ca.pem和ca-key.pem文件
    cfssl gencert -initca ca-csr.json | cfssljson -bare ca -
    

    使用自签CA签发Etcd HTTPS证书

    # 创建证书申请文件
    # 文件hosts字段中IP为所有etcd节点的集群内部通信IP,一个都不能少!为了方便后期扩容可以多写几个预留的IP。
    cat > server-csr.json << EOF
    {
        "CN": "etcd",
        "hosts": [
        "192.168.80.220",
        "192.168.80.221",
        "192.168.80.222",
        "192.168.80.223",
        "192.168.80.224",
        "192.168.80.225"
        ],
        "key": {
            "algo": "rsa",
            "size": 2048
        },
        "names": [
            {
                "C": "CN",
                "L": "BeiJing",
                "ST": "BeiJing"
            }
        ]
    }
    EOF
    
    # 生成证书,会生成server.pem和server-key.pem文件
    cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=www server-csr.json | cfssljson -bare server
    

    从Github下载二进制文件

    可以使用迅雷下载
    https://github.com/etcd-io/etcd/releases/download/v3.5.0/etcd-v3.5.0-linux-amd64.tar.gz

    百度云网盘分享地址
    链接:https://pan.baidu.com/s/1LvnMZSGgwafkH3Bdce-s8A
    提取码:40bc

    部署Etcd集群

    以下在节点etcd-1上操作,为简化操作,待会将节点1生成的所有文件拷贝到节点2和节点3.

    # 创建工作目录并解压二进制包
    mkdir /opt/etcd/{bin,cfg,ssl} -p
    tar zxvf etcd-v3.5.0-linux-amd64.tar.gz
    mv etcd-v3.5.0-linux-amd64/{etcd,etcdctl} /opt/etcd/bin/
    
    # 创建etcd配置文件
    cat > /opt/etcd/cfg/etcd.conf << EOF
    #[Member]
    ETCD_NAME="etcd-1"
    ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
    ETCD_LISTEN_PEER_URLS="https://192.168.80.220:2380"
    ETCD_LISTEN_CLIENT_URLS="https://192.168.80.220:2379"
    
    #[Clustering]
    ETCD_INITIAL_ADVERTISE_PEER_URLS="https://192.168.80.220:2380"
    ETCD_ADVERTISE_CLIENT_URLS="https://192.168.80.220:2379"
    ETCD_INITIAL_CLUSTER="etcd-1=https://192.168.80.220:2380,etcd-2=https://192.168.80.221:2380,etcd-3=https://192.168.80.222:2380"
    ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
    ETCD_INITIAL_CLUSTER_STATE="new"
    EOF
    
    • ETCD_NAME:节点名称,集群中唯一
    • ETCD_DATA_DIR:数据目录
    • ETCD_LISTEN_PEER_URLS:集群通信监听地址
    • ETCD_LISTEN_CLIENT_URLS:客户端访问监听地址
    • ETCD_INITIAL_ADVERTISE_PEERURLS:集群通告地址
    • ETCD_ADVERTISE_CLIENT_URLS:客户端通告地址
    • ETCD_INITIAL_CLUSTER:集群节点地址
    • ETCD_INITIALCLUSTER_TOKEN:集群Token
    • ETCD_INITIALCLUSTER_STATE:加入集群的当前状态,new是新集群,existing表示加入已有集群
    # systemd管理etcd
    cat > /usr/lib/systemd/system/etcd.service << EOF
    [Unit]
    Description=Etcd Server
    After=network.target
    After=network-online.target
    Wants=network-online.target
    
    [Service]
    Type=notify
    EnvironmentFile=/opt/etcd/cfg/etcd.conf
    ExecStart=/opt/etcd/bin/etcd 
    --cert-file=/opt/etcd/ssl/server.pem 
    --key-file=/opt/etcd/ssl/server-key.pem 
    --peer-cert-file=/opt/etcd/ssl/server.pem 
    --peer-key-file=/opt/etcd/ssl/server-key.pem 
    --trusted-ca-file=/opt/etcd/ssl/ca.pem 
    --peer-trusted-ca-file=/opt/etcd/ssl/ca.pem 
    --logger=zap
    Restart=on-failure
    LimitNOFILE=65536
    
    [Install]
    WantedBy=multi-user.target
    EOF
    
    # 拷贝刚才生成的证书,把刚才生成的证书拷贝到配置文件中的路径
    cp ~/TLS/etcd/ca*pem ~/TLS/etcd/server*pem /opt/etcd/ssl/
    
    # 启动并设置开机启动
    systemctl daemon-reload
    systemctl start etcd  # 第一个节点启动比较慢,是连接另外俩节点连接不上超时导致的,等另外俩节点的etcd起来后状态就正常了
    systemctl enable etcd
    
    # 将上面节点etcd-1所有生成的文件拷贝到节点etcd-2和节点etcd-3
    scp -r /opt/etcd/ root@192.168.80.221:/opt/
    scp /usr/lib/systemd/system/etcd.service root@192.168.80.221:/usr/lib/systemd/system/
    scp -r /opt/etcd/ root@192.168.80.222:/opt/
    scp /usr/lib/systemd/system/etcd.service root@192.168.80.222:/usr/lib/systemd/system/
    
    # 在节点2和节点3分别修改etcd.conf配置文件中的节点名称和当前服务器IP
    vim /opt/etcd/cfg/etcd.conf
    #[Member]
    ETCD_NAME="etcd-1"    # 修改此处,节点2改为etcd-2,节点3改为etcd-3
    ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
    ETCD_LISTEN_PEER_URLS="https://192.168.80.220:2380"     # 修改此处为当前服务器IP
    ETCD_LISTEN_CLIENT_URLS="https://192.168.80.220:2379"   # 修改此处为当前服务器IP
    
    #[Clustering]
    ETCD_INITIAL_ADVERTISE_PEER_URLS="https://192.168.80.220:2380" # 修改此处为当前服务器IP
    ETCD_ADVERTISE_CLIENT_URLS="https://192.168.80.220:2379"       # 修改此处为当前服务器IP
    ETCD_INITIAL_CLUSTER="etcd-1=https://192.168.80.220:2380,etcd-2=https://192.168.80.221:2380,etcd-3=https://192.168.80.222:2380"
    ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
    ETCD_INITIAL_CLUSTER_STATE="new"
    
    # 最后启动etcd并设置开机启动,操作命令同上
    

    查看集群状态

    /opt/etcd/bin/etcdctl --cacert=/opt/etcd/ssl/ca.pem --cert=/opt/etcd/ssl/server.pem --key=/opt/etcd/ssl/server-key.pem --endpoints="https://192.168.80.220:2379,https://192.168.80.221:2379,https://192.168.80.222:2379" endpoint health --write-out=table
    
    +-----------------------------+--------+------------+-------+
    |          ENDPOINT           | HEALTH |    TOOK    | ERROR |
    +-----------------------------+--------+------------+-------+
    | https://192.168.80.220:2379 |   true | 7.327348ms |       |
    | https://192.168.80.221:2379 |   true | 7.532873ms |       |
    | https://192.168.80.222:2379 |   true | 7.732458ms |       |
    +-----------------------------+--------+------------+-------+
    

    如果输出上面信息,就说明集群部署成功。
    如果有问题第一步先看日志:/var/log/message 或 journalctl -u etcd

  • 相关阅读:
    IntelliJ IDEA 2019.3 安装+永久破解[Windows]
    word2016中如何实现类似目录样式的虚线对齐效果,可用于制作checklist
    测绘地图资源不够用?教你个万能图源制作方法
    真实评测:全球卫星地图哪个最清晰?
    【地图导航】3D地图软件是如何做路径规划的?为什么准确率这么高
    国产良心极简版地图软件,地图下载很丝滑,界面简洁无广告
    推荐几款实用性强的外业勘察地图软件
    重要通知!奥维地图被紧急下架,还有什么地图软件能用呢?
    单片机平台环境
    关于最近登陆需要验证手机
  • 原文地址:https://www.cnblogs.com/sanduzxcvbnm/p/14919655.html
Copyright © 2011-2022 走看看