yum -y install etcd
vim /etc/systemd/system/etcd.service # etcd.service同级文件
在每个节点上的该文件做出以下修改：
WorkingDirectory data-dir保证创建这两个目录
把172.20.0.68 这个IP换成部署本机的
把initial-cluster 这个属性下 写入集群所有的需要部署的ip，这里需要每台机子的名字要和name属性那里对应上比如本机的IP是172.20.0.68：
--name=etcd02 \
--initial-cluster=etcd02=http://172.20.0.68:2380,etcd01=http://172.20.0.67:2380
systemctl daemon-reload && systemctl start etcd && systemctl enable etcd && systemctl status etcd
etcdctl endpoints=https://172.20.0.68:2379,https://172.20.0.67:2379,https://172.20.0.69:2379 member list #查看集群成员
etcdctl endpoints=https://172.20.0.68:2379,https://172.20.0.67:2379,https://172.20.0.69:2379 cluster-health#查看集群状态
参考文件
------------------------------------
[Unit]
Description=Etcd Server
After=network.target
After=network-online.target
Wants=network-online.target
[Service]
Type=notify
WorkingDirectory=/var/lib/etcd/
User=root
# set GOMAXPROCS to number of processors
ExecStart=/usr/bin/etcd \
--name=etcd2 \
--initial-advertise-peer-urls=http://172.20.0.68:2380 \
--listen-peer-urls=http://172.20.0.68:2380 \
--listen-client-urls=http://172.20.0.68:2379,http://127.0.0.1:2379 \
--advertise-client-urls=http://172.20.0.68:2379 \
--initial-cluster-token=k8s-etcd-cluster \
--initial-cluster=etcd2=http://172.20.0.68:2380,etcd1=http://172.20.0.67:2380,etcd3=http://172.20.0.69:2380 \
--initial-cluster-state=existing \
--data-dir=/opt/etcd/
Restart=on-failure
RestartSec=5
LimitNOFILE=65536
[Install]
WantedBy=multi-user.target
------------------------------------
每次k8s集群重新部署时，需要清楚etcd，重启etcd集群
先在各节点执行systemctl
stop etcd，把服务停掉，不然你执行完，查看状态就会看见etcd状态失败，因为有节点还没有停止服务，两边不一致
然后清除数据重启服务，就干干净净了
rm -rf /opt/etcd/*
systemctl daemon-reload && systemctlstart etcd && systemctl enable etcd
systemctl status etcd
我这里没有加入身份验证，假如是内网就不用。如果要加则需要做以下修改：
https://blog.51cto.com/xiaocainiaox/2169475?source=dra
这一套ca证书和k8s那个ca证书是两套，互相没有关联
先安装cfssl（用来制造证书加密的）
创建config.json和csr.json文件
cfssl gencert-initca csr.json | cfssljson -bare ca
创建etcd-csr.json
cfssl gencert-ca=ca.pem -ca-key=ca-key.pem -config=config.json -profile=kubernetes etcd-csr.json |cfssljson -bare etcd
然后把这些生成的文件放入所有etcdh节点的目录下/etc/kubernetes/pki/etcd/
在etcd.service的—name=etcd01下面中加入
--cert-file=/etc/kubernetes/pki/etcd/etcd.pem \
--key-file=/etc/kubernetes/pki/etcd/etcd-key.pem \
--peer-cert-file=/etc/kubernetes/pki/etcd/etcd.pem \
--peer-key-file=/etc/kubernetes/pki/etcd/etcd-key.pem \
--trusted-ca-file=/etc/kubernetes/pki/etcd/ca.pem \
--peer-trusted-ca-file=/etc/kubernetes/pki/etcd/ca.pem \
查看集群信息和健康状态的语句需要加上验证文件
etcdctl --endpoints=https://172.20.0.68:2379,https://172.20.0.67:2379,https://172.20.0.69:2379--cert-file=/etc/kubernetes/pki/etcd/etcd.pem--ca-file=/etc/kubernetes/pki/etcd/ca.pem--key-file=/etc/kubernetes/pki/etcd/etcd-key.pem member list
etcdctl--endpoints=https://172.20.0.68:2379,https://172.20.0.67:2379,https://172.20.0.69:2379--cert-file=/etc/kubernetes/pki/etcd/etcd.pem--ca-file=/etc/kubernetes/pki/etcd/ca.pem--key-file=/etc/kubernetes/pki/etcd/etcd-key.pem cluster-health
网友评论