kubernetes从入门到放弃之二进制部署k8s集群(安装etcd)

悠悠 2023-07-22 09:21 13阅读 0赞

本文承接上篇文章[kubernetes从入门到放弃之二进制部署k8s集群(安装docker)][kubernetes_k8s_docker]

## 安装etcd集群 ##

etcd是一个分布式键值存储系统，用于保存集群状态数据，比如pod、service等对象信息。

*  安装前的准备工作  
    安装位置  
    我们在192.168.1.130、192.168.1.128、192.168.1.129三台服务器上安装，切记，生产环境需要安装到k8s集群之外的服务器（所有服务器关闭防火墙、同步时间），我们只是为了学习，所以就复用服务器了，  
    1、关闭selinux  
    sed -i ‘s/enforcing/disabled/’ /etc/selinux/config  
    setenforce 0  
    2、 关闭swap分区  
    vim /etc/fstab  
    注释掉 /dev/mapper/cl-swap swap swap defaults 0 0  
    echo vm.swappiness=0 >> /etc/sysctl.conf  
    3、reboot重启
 *  安装etcd  
    1、使用cfssl来生成自签证书，先下载cfssl工具,创建cfssl.sh脚本输入以下内容并执行，证书这块知道怎么生成、怎么用即可，建议暂时不必过多研究；

curl -L https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 -o /usr/local/bin/cfssl
    curl -L https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 -o /usr/local/bin/cfssljson
    curl -L https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64 -o /usr/local/bin/cfssl-certinfo
    chmod +x /usr/local/bin/cfssl /usr/local/bin/cfssljson /usr/local/bin/cfssl-certinfo

2、执行cfssl.sh chmod +x cfssl.sh sh cfssl.sh  
![在这里插入图片描述][20200405171442835.png_pic_center]  
3、生成证书 ，创建etcd-cert.sh脚本并输入下面的内容，更改里面的ip为自己服务器的ip

cat > ca-config.json <<EOF
    { 
      "signing": { 
        "default": { 
          "expiry": "87600h"
        },
        "profiles": { 
          "www": { 
             "expiry": "87600h",
             "usages": [
                "signing",
                "key encipherment",
                "server auth",
                "client auth"
            ]
          }
        }
      }
    }
    EOF
    
    cat > ca-csr.json <<EOF
    { 
        "CN": "etcd CA",
        "key": { 
            "algo": "rsa",
            "size": 2048
        },
        "names": [
            { 
                "C": "CN",
                "L": "Beijing",
                "ST": "Beijing"
            }
        ]
    }
    EOF
    
    cfssl gencert -initca ca-csr.json | cfssljson -bare ca -
    
    #-----------------------
    
    cat > server-csr.json <<EOF
    { 
        "CN": "etcd",
        "hosts": [
        "192.168.1.128",
        "192.168.1.129",
        "192.168.1.130"
        ],
        "key": { 
            "algo": "rsa",
            "size": 2048
        },
        "names": [
            { 
                "C": "CN",
                "L": "BeiJing",
                "ST": "BeiJing"
            }
        ]
    }
    EOF
    
    cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=www server-csr.json | cfssljson -bare server

4、执行etcd-cert.sh chmod +x etcd-cert.sh sh etcd-cert.sh , ls *pem查看生成的证书  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQwMTg0NTYz_size_16_color_FFFFFF_t_70_pic_center]  
5、创建目录 mkdir /opt/etcd/\{bin,ssl,cfg\} -p  
6、将证书放进创建的ssl目录  
cp ca*pem server\*pem /opt/etcd/ssl  
7、下载etcd https://github.com/etcd-io/etcd/releases  
8、解压并移动  
tar -zxvf etcd-v3.3.18-linux-amd64.tar.gz  
mv etcd-v3.3.18-linux-amd64/\{etcd,etcdctl\} /opt/etcd/bin/  
9、systemd管理etcd，创建etcd.sh输入以下内容

#!/bin/bash
    # example: ./etcd.sh etcd01 192.168.1.10 etcd02=https://192.168.1.11:2380,etcd03=https://192.168.1.12:2380
    
    ETCD_NAME=$1
    ETCD_IP=$2
    ETCD_CLUSTER=$3
    
    WORK_DIR=/opt/etcd
    
    cat <<EOF >$WORK_DIR/cfg/etcd
    #[Member]
    ETCD_NAME="${ETCD_NAME}"
    ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
    ETCD_LISTEN_PEER_URLS="https://${ETCD_IP}:2380"
    ETCD_LISTEN_CLIENT_URLS="https://${ETCD_IP}:2379"
    
    #[Clustering]
    ETCD_INITIAL_ADVERTISE_PEER_URLS="https://${ETCD_IP}:2380"
    ETCD_ADVERTISE_CLIENT_URLS="https://${ETCD_IP}:2379"
    ETCD_INITIAL_CLUSTER="etcd01=https://${ETCD_IP}:2380,${ETCD_CLUSTER}"
    ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
    ETCD_INITIAL_CLUSTER_STATE="new"
    EOF
    
    cat <<EOF >/usr/lib/systemd/system/etcd.service
    [Unit]
    Description=Etcd Server
    After=network.target
    After=network-online.target
    Wants=network-online.target
    
    [Service]
    Type=notify
    EnvironmentFile=${ WORK_DIR}/cfg/etcd
    ExecStart=${ WORK_DIR}/bin/etcd \
    --name=\${ ETCD_NAME} \
    --data-dir=\${ ETCD_DATA_DIR} \
    --listen-peer-urls=\${ ETCD_LISTEN_PEER_URLS} \
    --listen-client-urls=\${ ETCD_LISTEN_CLIENT_URLS},http://127.0.0.1:2379 \
    --advertise-client-urls=\${ ETCD_ADVERTISE_CLIENT_URLS} \
    --initial-advertise-peer-urls=\${ ETCD_INITIAL_ADVERTISE_PEER_URLS} \
    --initial-cluster=\${ ETCD_INITIAL_CLUSTER} \
    --initial-cluster-token=\${ ETCD_INITIAL_CLUSTER_TOKEN} \
    --initial-cluster-state=new \
    --cert-file=${ WORK_DIR}/ssl/server.pem \
    --key-file=${ WORK_DIR}/ssl/server-key.pem \
    --peer-cert-file=${ WORK_DIR}/ssl/server.pem \
    --peer-key-file=${ WORK_DIR}/ssl/server-key.pem \
    --trusted-ca-file=${ WORK_DIR}/ssl/ca.pem \
    --peer-trusted-ca-file=${ WORK_DIR}/ssl/ca.pem
    Restart=on-failure
    LimitNOFILE=65536
    
    [Install]
    WantedBy=multi-user.target
    EOF
    
    systemctl daemon-reload
    systemctl enable etcd
    systemctl restart etcd

10、执行脚本 chmod +x etcd.sh  
./etcd.sh etcd01 192.168.1.130 etcd02=https://192.168.1.128:2380,etcd03=https://192.168.1.129:2380

其中etcd01 192.168.1.130指的是正在安装的节点的ip，etcd02=https://192.168.1.128:2380,etcd03=https://192.168.1.129:2380是其他两个节点的ip

备注：  
• ETCD\_NAME 节点名称  
• ETCD\_DATA\_DIR 数据目录  
• ETCD\_LISTEN\_PEER\_URLS 集群通信监听地址  
• ETCD\_LISTEN\_CLIENT\_URLS 客户端访问监听地址  
• ETCD\_INITIAL\_ADVERTISE\_PEER\_URLS 集群通告地址  
• ETCD\_ADVERTISE\_CLIENT\_URLS 客户端通告地址  
• ETCD\_INITIAL\_CLUSTER 集群节点地址  
• ETCD\_INITIAL\_CLUSTER\_TOKEN 集群Token  
• ETCD\_INITIAL\_CLUSTER\_STATE 加入集群的当前状态，new是新集群，existing表示加入已有集群

11、启动etcd systemctl start etcd  
12、将安装目录及启动文件拷贝到其他节点，其他节点更改vim /opt/etcd/cfg/etcd 的ip和节点名即可

scp -r /opt/etcd/ m1p128:/opt/  
scp -r /opt/etcd/ m1p129:/opt/  
scp -r /usr/lib/systemd/system/etcd.service m1p128:/usr/lib/systemd/system  
scp -r /usr/lib/systemd/system/etcd.service m1p129:/usr/lib/systemd/system

13、各个节点重启配置  
systemctl daemon-reload  
systemctl restart etcd  
systemctl enable etcd  
14、查看集群健康状态，在任意节点执行以下命令

/opt/etcd/bin/etcdctl --ca-file=/opt/etcd/ssl/ca.pem --cert-file=/opt/etcd/ssl/server.pem --key-file=/opt/etcd/ssl/server-key.pem \
    --endpoints="https://192.168.1.130:2379,https://192.168.1.128:2379,https://192.168.1.129:2379" \
    cluster-health

搭建成功后如下图  
![在这里插入图片描述][20200405172920501.png_pic_center]

本篇内容参考自李振良老师的技术博客及视频资料，他的博客地址http://blog.51cto.com/lizhenliang

下篇文章将继续介绍如何部署flannel

[kubernetes_k8s_docker]: https://blog.csdn.net/qq_40184563/article/details/105325238
[20200405171442835.png_pic_center]: /images/20230528/0cac48287df748bca3f73a80176012b6.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQwMTg0NTYz_size_16_color_FFFFFF_t_70_pic_center]: /images/20230528/f213b7a161314f47af709d6a827fea20.png
[20200405172920501.png_pic_center]: /images/20230528/2e63823bc2024dacb980d4e5c906ed5c.png