5.創(chuàng)建單節(jié)點etcd
kuberntes 系統(tǒng)使用 etcd 存儲所有數(shù)據(jù)，本文介紹單節(jié)點etcd部署方式
TLS 認(rèn)證文件
需要為 etcd 集群創(chuàng)建加密通信的 TLS 證書，這里復(fù)用以前創(chuàng)建的 kubernetes 證書
確認(rèn)以下證書是否存在
$ ls /etc/kubernetes/ssl
ca.pem kubernetes-key.pem kubernetes.pem
下載etcd二進(jìn)制文件
wget https://github.com/coreos/etcd/releases/download/v3.1.5/etcd-v3.1.5-linux-amd64.tar.gz
tar -xvf etcd-v3.1.5-linux-amd64.tar.gz
mv etcd-v3.1.5-linux-amd64/etcd* /usr/local/bin
創(chuàng)建 etcd 的 systemd unit 文件
在/usr/lib/systemd/system/目錄下創(chuàng)建文件etcd.service，內(nèi)容如下。
[Unit]
Description=Etcd Server
After=network.target
After=network-online.target
Wants=network-online.target
Documentation=https://github.com/coreos
[Service]
Type=notify
WorkingDirectory=/var/lib/etcd/
EnvironmentFile=-/etc/etcd/etcd.conf
ExecStart=/usr/local/bin/etcd \
--name ${ETCD_NAME} \
--cert-file=/etc/kubernetes/ssl/kubernetes.pem \
--key-file=/etc/kubernetes/ssl/kubernetes-key.pem \
--peer-cert-file=/etc/kubernetes/ssl/kubernetes.pem \
--peer-key-file=/etc/kubernetes/ssl/kubernetes-key.pem \
--trusted-ca-file=/etc/kubernetes/ssl/ca.pem \
--peer-trusted-ca-file=/etc/kubernetes/ssl/ca.pem \
--initial-advertise-peer-urls ${ETCD_INITIAL_ADVERTISE_PEER_URLS} \
--listen-peer-urls ${ETCD_LISTEN_PEER_URLS} \
--listen-client-urls ${ETCD_LISTEN_CLIENT_URLS},http://127.0.0.1:2379 \
--advertise-client-urls ${ETCD_ADVERTISE_CLIENT_URLS} \
--initial-cluster-token ${ETCD_INITIAL_CLUSTER_TOKEN} \
--initial-cluster infra1=https://127.0.0.1:2380
--initial-cluster-state new \
--data-dir=${ETCD_DATA_DIR}
Restart=on-failure
RestartSec=5
LimitNOFILE=65536
[Install]
WantedBy=multi-user.target
- 指定 etcd 的工作目錄為
/var/lib/etcd，數(shù)據(jù)目錄為/var/lib/etcd，需在啟動服務(wù)前創(chuàng)建這個目錄，否則啟動服務(wù)的時候會報錯“Failed at step CHDIR spawning /usr/bin/etcd: No such file or directory”； - 為了保證通信安全，需要指定 etcd 的公私鑰
(cert-file和key-file)、Peers 通信的公私鑰和 CA 證書(peer-cert-file、peer-key-file、peer-trusted-ca-file)、客戶端的CA證書（trusted-ca-file）； - 創(chuàng)建
kubernetes.pem證書時使用的kubernetes-csr.json文件的 hosts 字段包含所有 etcd 節(jié)點的IP，否則證書校驗會出錯； -
--initial-cluster-state值為 new 時，--name的參數(shù)值必須位于--initial-cluster列表中；
環(huán)境變量配置文件/etc/etcd/etcd.conf
mkdir /etc/etcd
vi /etc/etcd/etcd.conf
# [member]
ETCD_NAME=infra1
ETCD_DATA_DIR="/var/lib/etcd"
ETCD_LISTEN_PEER_URLS="https://127.0.0.1:2380"
ETCD_LISTEN_CLIENT_URLS="https://127.0.0.1:2379"
#[cluster]
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://127.0.0.1:2380"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
ETCD_ADVERTISE_CLIENT_URLS="https://127.0.0.1:2379"
啟動 etcd 服務(wù)
systemctl daemon-reload
systemctl enable etcd
systemctl start etcd
systemctl status etcd
注意:如果日志中出現(xiàn)連接異常信息，請確認(rèn)所有節(jié)點防火墻是否開放2379,2380端口。 以centos7為例：
firewall-cmd --zone=public --add-port=2380/tcp --permanent
firewall-cmd --zone=public --add-port=2379/tcp --permanent
firewall-cmd --reload
驗證服務(wù)
[root@k8s bin]# etcdctl \
--ca-file=/etc/kubernetes/ssl/ca.pem \
--cert-file=/etc/kubernetes/ssl/kubernetes.pem \
--key-file=/etc/kubernetes/ssl/kubernetes-key.pem \
cluster-health
2021-06-30 17:06:24.650133 I | warning: ignoring ServerName for user-provided CA for backwards compatibility is deprecated
2021-06-30 17:06:24.650546 I | warning: ignoring ServerName for user-provided CA for backwards compatibility is deprecated
member a874c87fd42044f is healthy: got healthy result from https://127.0.0.1:2379
cluster is healthy
結(jié)果最后一行為 cluster is healthy 時表示集群服務(wù)正常。
