1. 首页
  2. 文章中心
  3. K8S

【2022】二进制方式部署etcd高可用集群安装部分生成证书ETCD配置

107 阅读 0 评论
我是靠谱客的博主 威武书包，最近开发中收集的这篇文章主要介绍【2022】二进制方式部署etcd高可用集群安装部分生成证书ETCD配置，觉得挺不错的，现在分享给大家，希望可以做个参考。

概述

目录

  • 安装部分
  • 生成证书
  • ETCD配置

安装部分

二进制方式部署ETCD高可用集群

  • 环境准备：
    在这里插入图片描述

  • 在etcd-01主机上下载安装包，并解压至/usr/local/bin目录下

[root@etcd-01 ~]# wget https://github.com/etcd-io/etcd/releases/download/v3.5.5/etcd-v3.5.5-linux-amd64.tar.gz
[root@etcd-01 ~]# tar zxf etcd-v3.5.5-linux-amd64.tar.gz --strip-components=1 -C /usr/local/bin etcd-v3.5.5-linux-amd64/etcd{,ctl}
  • 操作成功即为安装成功（也可以查看都有什么内容）；可以查看版本
[root@etcd-01 ~]# etcdctl version
etcdctl version: 3.5.5
API version: 3.5
  • 将组件分发至其他节点（因为内容一样，所以没必要在下载一次），注意如果使用节点名要提前做好hosts解析
[root@etcd-01 ~]# scp /usr/local/bin/* etcd-02:/usr/local/bin/
[root@etcd-01 ~]# scp /usr/local/bin/* etcd-03:/usr/local/bin/

生成证书

  • 本例使用cfssl工具生成证书，所以下载cfssl工具
[root@etcd-01 ~]# wget "https://github.com/cloudflare/cfssl/releases/download/v1.6.2/cfssl_1.6.2_linux_amd64" -O /usr/local/bin/cfssl
[root@etcd-01 ~]# wget "https://github.com/cloudflare/cfssl/releases/download/v1.6.2/cfssljson_1.6.2_linux_amd64" -O /usr/local/bin/cfssljson
[root@etcd-01 ~]# chmod +x /usr/local/bin/cfssl /usr/local/bin/cfssljson 
[root@etcd-01 ~]# cfssl version
Version: 1.6.2
Runtime: go1.18
  • 创建一个证书存放目录，这一步需要所有节点都创建
[root@etcd-01 ~]# mkdir -p /etc/etcd/ssl
[root@etcd-02 ~]# mkdir -p /etc/etcd/ssl
[root@etcd-03 ~]# mkdir -p /etc/etcd/ssl
  • 创建一个用于证书的json文件
[root@etcd-01 ~]# vim ca-config.json
{
  "signing": {
    "default": {
      "expiry": "876000h"
    },
    "profiles": {
      "etcd": {
        "usages": [
            "signing",
            "key encipherment",
            "server auth",
            "client auth"
        ],
        "expiry": "876000h"
      }
    }
  }
}
  • 创建一个用于生成CA证书和key的json文件
[root@etcd-01 ~]# cat etcd-ca-csr.json 
{
  "CN": "etcd",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "Beijing",
      "L": "Beijing",
      "O": "etcd",
      "OU": "Etcd Security"
    }
  ],
  "ca": {
    "expiry": "876000h"
  }
}
  • 生成CA证书和证书的key
[root@etcd-01 ~]# cfssl gencert -initca etcd-ca-csr.json | cfssljson -bare /etc/etcd/ssl/etcd-ca
[root@etcd-01 ~]# ls /etc/etcd/ssl/
etcd-ca.csr  etcd-ca-key.pem  etcd-ca.pem
  • 创建用于etcd服务证书的json
[root@etcd-01 ~]# cat etcd-csr.json 
{
  "CN": "etcd",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "Beijing",
      "L": "Beijing",
      "O": "etcd",
      "OU": "Etcd Security"
    }
  ]
}
  • 生成ETCD服务证书
[root@etcd-01 ~]# cfssl gencert -ca=/etc/etcd/ssl/etcd-ca.pem -ca-key=/etc/etcd/ssl/etcd-ca-key.pem -config=ca-config.json -hostname=127.0.0.1,etcd-01,etcd-02,etcd-03,192.168.10.3,192.168.10.4,192.168.10.5 -profile=etcd etcd-csr.json | cfssljson -bare /etc/etcd/ssl/etcd
[root@etcd-01 ~]# ls /etc/etcd/ssl/
etcd-ca.csr  etcd-ca-key.pem  etcd-ca.pem  etcd.csr  etcd-key.pem  etcd.pem
  • 将证书复制到其他节点
[root@etcd-01 ssl]# for FILE in etcd-ca-key.pem  etcd-ca.pem  etcd-key.pem  etcd.pem; do        scp /etc/etcd/ssl/${FILE} etcd-02:/etc/etcd/ssl/${FILE};      done
[root@etcd-01 ssl]# for FILE in etcd-ca-key.pem  etcd-ca.pem  etcd-key.pem  etcd.pem; do        scp /etc/etcd/ssl/${FILE} etcd-03:/etc/etcd/ssl/${FILE};      done

ETCD配置

  • 创建etcd配置文件
[root@etcd-01 ~]# cat /etc/etcd/etcd.config.yml 
name: 'etcd-01'
data-dir: /var/lib/etcd
wal-dir: /var/lib/etcd/wal
snapshot-count: 5000
heartbeat-interval: 100
election-timeout: 1000
quota-backend-bytes: 0
listen-peer-urls: 'https://192.168.10.3:2380'
listen-client-urls: 'https://192.168.10.3:2379,http://127.0.0.1:2379'
max-snapshots: 3
max-wals: 5
cors:
initial-advertise-peer-urls: 'https://192.168.10.3:2380'
advertise-client-urls: 'https://192.168.10.3:2379'
discovery:
discovery-fallback: 'proxy'
discovery-proxy:
discovery-srv:
initial-cluster: 'etcd-01=https://192.168.10.3:2380,etcd-02=https://192.168.10.4:2380,etcd-03=https://192.168.10.5:2380'
initial-cluster-token: 'etcd-cluster'
initial-cluster-state: 'new'
strict-reconfig-check: false
enable-v2: true
enable-pprof: true
proxy: 'off'
proxy-failure-wait: 5000
proxy-refresh-interval: 30000
proxy-dial-timeout: 1000
proxy-write-timeout: 5000
proxy-read-timeout: 0
client-transport-security:
  cert-file: '/etc/etcd/ssl/etcd.pem'
  key-file: '/etc/etcd/ssl/etcd-key.pem'
  client-cert-auth: true
  trusted-ca-file: '/etc/etcd/ssl/etcd-ca.pem'
  auto-tls: true
peer-transport-security:
  cert-file: '/etc/etcd/ssl/etcd.pem'
  key-file: '/etc/etcd/ssl/etcd-key.pem'
  peer-client-cert-auth: true
  trusted-ca-file: '/etc/etcd/ssl/etcd-ca.pem'
  auto-tls: true
debug: false
log-package-levels:
log-outputs: [default]
force-new-cluster: false

  • 其他两个节点配置文件只需要修改各自的节点名和IP即可

  • 创建service文件

[root@etcd-01 ~]# cat /usr/lib/systemd/system/etcd.service
[Unit]
Description=Etcd Service
Documentation=https://coreos.com/etcd/docs/latest/
After=network.target

[Service]
Type=notify
ExecStart=/usr/local/bin/etcd --config-file=/etc/etcd/etcd.config.yml
Restart=on-failure
RestartSec=10
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target
Alias=etcd3.service
  • 其他两个节点配置一样，复制即可
  • 所有启动etcd服务
systemctl daemon-reload
systemctl enable --now etcd
  • 查看ETCD状态
[root@etcd-01 ~]# export ETCDCTL_API=3
[root@etcd-01 ~]# etcdctl --endpoints="192.168.10.5:2379,192.168.10.4:2379,192.168.10.3:2379" --cacert=/etc/etcd/ssl/etcd-ca.pem --cert=/etc/etcd/ssl/etcd.pem --key=/etc/etcd/ssl/etcd-key.pem  endpoint status --write-out=table
+-------------------+------------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+
|     ENDPOINT      |        ID        | VERSION | DB SIZE | IS LEADER | IS LEARNER | RAFT TERM | RAFT INDEX | RAFT APPLIED INDEX | ERRORS |
+-------------------+------------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+
| 192.168.10.5:2379 | 4ee1cc1544fd02a3 |   3.5.5 |   20 kB |     false |      false |         2 |          9 |                  9 |        |
| 192.168.10.4:2379 | 2af255134b508f21 |   3.5.5 |   20 kB |     false |      false |         2 |          9 |                  9 |        |
| 192.168.10.3:2379 | 86ef4da6f07b0d20 |   3.5.5 |   20 kB |      true |      false |         2 |          9 |                  9 |        |
+-------------------+------------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+

到这里二进制部署etcd集群就结束了！

最后

以上就是威武书包为你收集整理的【2022】二进制方式部署etcd高可用集群安装部分生成证书ETCD配置的全部内容，希望文章能够帮你解决【2022】二进制方式部署etcd高可用集群安装部分生成证书ETCD配置所遇到的程序开发问题。

如果觉得靠谱客网站的内容还不错，欢迎将靠谱客网站推荐给程序员好友。

本图文内容来源于网友提供，作为学习参考使用，或来自网络收集整理，版权属于原作者所有。
点赞(71)

相关文章

etcd集群部署前言：节点1中：节点2中：应用：
etcd集群部署前言：节点1中：节点2中：应用：
Kubernetes 1.18单节点二进制部署实验环境：实验步骤：
Kubernetes 1.18单节点二进制部署实验环境：实验步骤：
K8S 二进制方式部署单节点K8S一、K8S 单节点部署
K8S 二进制方式部署单节点K8S一、K8S 单节点部署
kubeadm部署k8s1.9高可用集群--2搭建etcd集群搭建etcd集群
kubeadm部署k8s1.9高可用集群--2搭建etcd集群搭建etcd集群
【2022】二进制方式部署etcd高可用集群安装部分生成证书ETCD配置
【2022】二进制方式部署etcd高可用集群安装部分生成证书ETCD配置
005.Kubernetes二进制部署kubectl
005.Kubernetes二进制部署kubectl
使用docker安装etcd
使用docker安装etcd
(4)二进制文件方式部署Kubernetes高可用集群----------安装kubectl命令行工具3 安装kubectl命令行工具
(4)二进制文件方式部署Kubernetes高可用集群----------安装kubectl命令行工具3 安装kubectl命令行工具

评论列表共有 0 条评论

立即
投稿
返回
顶部