K8S(四)——部署master节点服务

------------恢复内容开始------------

来自视频：https://www.bilibili.com/video/BV1PJ411h7Sw?p=17

一、部署etcd集群

集群规划

主机名	角色	IP
SX7-12	etcd leader	10.4.7.12
SX7-21	etcd follow	10.4.7.21
SX7-22	etcd follow	10.4.7.22

1.创建基于根证书的config配置文件

cd /opt/certs
vim ca-config.json
{
  "signing": {
    "default": {
        "expiry": "175200h"
    },
    "profiles": {
        "server": {
            "expiry": "175200h",
            "usages": [
                "signing",
                "key encipherment",
                "server auth"
             ]
        },
        "client": {
            "expiry": "175200h",
            "usages": [
                "signing",
                "key encipherment",
                "client auth"
             ]
        },
        "peer": {
            "expiry": "175200h",
            "usages": [
                "signing",
                "key encipherment",
                "server auth",
                "client auth"
             ]
        }
      }
   }
}

2.创建K8S的证书请求文件

vim etcd-peer-csr.json
{
    "CN": "xyly",
    "hosts": [
        "10.4.7.11",
        "10.4.7.12",
        "10.4.7.21",
        "10.4.7.22"
    ],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {       
             "C": "CN",
             "ST": "ShangHai",
             "L": "ShangHai",
             "O": "xy",
             "OU": "ops"
        }
    ]
}

3.生成etcd证书和私钥

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=peer etcd-peer-csr.json | cfssl-json -bare etcd-peer

4.安装etcd

在SX7-12

useradd etcd -s /sbin/nologin -M     // 创建一个etcd用户

下载软件，解压后做一个软链接
mkdir /opt/src
cd /opt/src/
wget https://github.com/etcd-io/etcd/releases/download/v3.3.20/etcd-v3.3.20-linux-amd64.tar.gz     // github官网
wget https://mirrors.huaweicloud.com/etcd/v3.3.20/etcd-v3.3.20-linux-amd64.tar.gz/      // 官网实在下不下来，我用的华为的
tar -xvf etcd-v3.3.20-linux-amd64.tar.gz -C /opt/

做软链接
cd ..
mv etcd-v3.3.20-linux-amd64/ etcd-v3.3.20     // 重命名
ln -s /opt/etcd-v3.3.20/ /opt/etcd

•  创建证书目录、数据目录、日志目录

mkdir /opt/etcd/certs /data/etcd /data/logs/etcd-server -p

• 拷贝证书

scp sx7-200:/opt/certs/ca.pem /opt/etcd/certs/
scp sx7-200:/opt/certs/etcd-peer.pem /opt/etcd/certs/
scp sx7-200:/opt/certs/etcd-peer-key.pem /opt/etcd/certs/

• 创建etcd的启动脚本

vi /opt/etcd/etcd-server-startup.sh

#!/bin/sh
./etcd --name etcd-server-7-12 
       --data-dir /data/etcd/etcd-server 
       --listen-peer-urls https://10.4.7.12:2380 
       --listen-client-urls https://10.4.7.12:2379,http://127.0.0.1:2379 
       --quota-backend-bytes 8000000000 
       --initial-advertise-peer-urls https://10.4.7.12:2380 
       --advertise-client-urls https://10.4.7.12:2379,http://127.0.0.1:2379 
       --initial-cluster  etcd-server-7-12=https://10.4.7.12:2380,etcd-server-7-21=https://10.4.7.21:2380,etcd-server-7-22=https://10.4.7.22:2380 
       --ca-file ./certs/ca.pem 
       --cert-file ./certs/etcd-peer.pem 
       --key-file ./certs/etcd-peer-key.pem 
       --client-cert-auth  
       --trusted-ca-file ./certs/ca.pem 
       --peer-ca-file ./certs/ca.pem 
       --peer-cert-file ./certs/etcd-peer.pem 
       --peer-key-file ./certs/etcd-peer-key.pem 
       --peer-client-cert-auth 
       --peer-trusted-ca-file ./certs/ca.pem 
       --log-output stdout

chmod +x /opt/etcd/etcd-server-startup.sh
chown -R etcd.etcd /opt/etcd-v3.3.20
chown -R etcd.etcd /data/etcd/
chown -R etcd.etcd /data/logs/etcd-server/

• 安装supervisor软件

yum install -y supervisor.noarch
systemctl enable --now supervisord.servic

配置该文件
vim /etc/supervisord.d/etcd-server.ini
[program:etcd-server-7-12]
command=/opt/etcd/etcd-server-startup.sh                        ; the program (relative uses PATH, can take args)
numprocs=1                                                      ; number of processes copies to start (def 1)
directory=/opt/etcd                                             ; directory to cwd to before exec (def no cwd)
autostart=true                                                  ; start at supervisord start (default: true)
autorestart=true                                                ; retstart at unexpected quit (default: true)
startsecs=30                                                    ; number of secs prog must stay running (def. 1)
startretries=3                                                  ; max # of serial start failures (default 3)
exitcodes=0,2                                                   ; 'expected' exit codes for process (default 0,2)
stopsignal=QUIT                                                 ; signal used to kill process (default TERM)
stopwaitsecs=10                                                 ; max num secs to wait b4 SIGKILL (default 10)
user=etcd                                                       ; setuid to this UNIX account to run the program
redirect_stderr=true                                            ; redirect proc stderr to stdout (default false)
stdout_logfile=/data/logs/etcd-server/etcd.stdout.log           ; stdout log path, NONE for none; default AUTO
stdout_logfile_maxbytes=64MB                                    ; max # logfile bytes b4 rotation (default 50MB)
stdout_logfile_backups=4                                        ; # of stdout logfile backups (default 10)
stdout_capture_maxbytes=1MB                                     ; number of bytes in 'capturemode' (default 0)
stdout_events_enabled=false                                     ; emit events on stdout writes (default false)

启动并检查
supervisorctl update

5.安装其他etcd，同上

vi /opt/etcd/etcd-server-startup.sh      // 修改红色的地方为其他etcd的ip
./etcd --name etcd-server-7-12 
       --listen-peer-urls https://10.4.7.12:2380 
       --listen-client-urls https://10.4.7.12:2379,http://127.0.0.1:2379 
       --initial-advertise-peer-urls https://10.4.7.12:2380 
       --advertise-client-urls https://10.4.7.12:2379,http://127.0.0.1:2379 

vim /etc/supervisord.d/etcd-server.ini   // 修改红色的地方为其他etcd的ip
[program:etcd-server-7-12]

6.查看集群的健康状态