二进制安装 K8S 1.18.6 crio 容器运行时 (二) 安装 etcd

安装 etcd，在 master1 节点上操作

yum install wget -y
cd /data/software

wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64
chmod +x cfssl_linux-amd64 cfssljson_linux-amd64 cfssl-certinfo_linux-amd64
mv cfssl_linux-amd64 /usr/local/bin/cfssl
mv cfssljson_linux-amd64 /usr/local/bin/cfssljson
mv cfssl-certinfo_linux-amd64 /usr/bin/cfssl-certinfo

mkdir -p ~/TLS/

cd ~/TLS/

# 注意该集群 etcd 和 k8s 组件 kube-apiserver 证书公用同一套，意味着ip要写上所有 etcd 的ip

cat > ca-config.json << EOF
{
  "signing": {
    "default": {
      "expiry": "87600h"
    },
    "profiles": {
      "kubernetes": {
         "expiry": "87600h",
         "usages": [
            "signing",
            "key encipherment",
            "server auth",
            "client auth"
        ]
      }
    }
  }
}

EOF

cat > ca-csr.json << EOF
{
  "CN": "kubernetes",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "Guangzhou",
      "L": "Guangzhou",
      "O": "k8s",
      "OU": "System"
    }
  ],
    "ca": {
       "expiry": "87600h"
    }
}

EOF

# ca 生成证书：
cfssl gencert -initca ca-csr.json | cfssljson -bare ca -

# 使用自签CA签发 Etcd, K8S 证书
cat > kubernetes-csr.json << EOF
{
    "CN": "kubernetes",
    "hosts": [
      "127.0.0.1",
      "172.16.16.180",
      "172.16.16.181",
      "172.16.16.182",
      "172.16.16.210",
      "172.16.16.211",
      "10.254.0.1",
      "kubernetes",
      "kubernetes.default",
      "kubernetes.default.svc",
      "kubernetes.default.svc.cluster",
      "kubernetes.default.svc.cluster.local"
    ],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "ST": "Guangzhou",
            "L": "Guangzhou",
            "O": "k8s",
            "OU": "System"
        }
    ]
}

EOF

#注： 如果 hosts 字段不为空,需要指定授权使用该证书的 IP 或域名列表。 由于该证书后续被 kubernetes master 集群使用，需要将 master 节点的IP都填上，同时还需要填写 service 网络的首个IP。(一般是 kube-apiserver 指定的 service-cluster-ip-range 网段的第一个IP，如 10.254.0.1) 同时该证书还要给 etcd 集群使用，etcd 集群的 ip 也要加进去！

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kubernetes-csr.json | cfssljson -bare kubernetes


# 拷贝证书到对应的文件夹
mkdir -p /etc/kubernetes/cert/

cp kubernetes.pem kubernetes-key.pem ca.pem /etc/kubernetes/cert/

# 安装 etcd 
cd /data/software
tar zxvf etcd-v3.4.10-linux-amd64.tar.gz
mv etcd-v3.4.10-linux-amd64/{etcd,etcdctl} /usr/local/sbin/

cat > /usr/lib/systemd/system/etcd.service << EOF
[Unit]
Description=Etcd Server
After=network.target
After=network-online.target
Wants=network-online.target
Documentation=https://github.com/coreos

[Service]
Type=notify
WorkingDirectory=/var/lib/etcd/
ExecStart=/usr/local/sbin/etcd \\
  --name k8s-master-01 \\
  --cert-file=/etc/kubernetes/cert/kubernetes.pem \\
  --key-file=/etc/kubernetes/cert/kubernetes-key.pem \\
  --peer-cert-file=/etc/kubernetes/cert/kubernetes.pem \\
  --peer-key-file=/etc/kubernetes/cert/kubernetes-key.pem \\
  --trusted-ca-file=/etc/kubernetes/cert/ca.pem \\
  --peer-trusted-ca-file=/etc/kubernetes/cert/ca.pem \\
  --initial-advertise-peer-urls https://172.16.16.180:2380 \\
  --listen-peer-urls https://172.16.16.180:2380 \\
  --listen-client-urls  https://172.16.16.180:2379 ,http://127.0.0.1:2379 \\
  --advertise-client-urls https://172.16.16.180:2379 \\
  --initial-cluster-token etcd-cluster \\
  --initial-cluster k8s-master-01= https://172.16.16.180:2380,k8s-node-01=https://172.16.16.181:2380 ,k8s-node-02=https://172.16.16.182:2380 \\
  --initial-cluster-state new \\
  --data-dir=/var/lib/etcd
Restart=on-failure
RestartSec=5
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target
EOF

# 修改对应的 name, initial-advertise-peer-urls, listen-peer-urls, listen-client-urls, advertise-client-urls, initial-cluster

# 创建 etcd WorkingDirectory 
mkdir /var/lib/etcd/
chmod 700 /var/lib/etcd/

# 把 证书，etcd 配置传到 node 节点上
scp /usr/local/sbin/etcd 172.16.16.181:/usr/local/sbin/
scp /usr/lib/systemd/system/etcd.service 172.16.16.181:/usr/lib/systemd/system/etcd.service
scp -r /etc/kubernetes/cert/ 172.16.16.181:/tmp/

scp /usr/local/sbin/etcd 172.16.16.182:/usr/local/sbin/
scp /usr/lib/systemd/system/etcd.service 172.16.16.182:/usr/lib/systemd/system/etcd.service
scp -r /etc/kubernetes/cert/ 172.16.16.182:/tmp/

在 node 节点上操作

mkdir -p /etc/kubernetes/
mv /tmp/cert /etc/kubernetes/

mkdir /var/lib/etcd/
chmod 700 /var/lib/etcd/

# 修改 /usr/lib/systemd/system/etcd.service
# 修改对应的 name, initial-advertise-peer-urls, listen-peer-urls, listen-client-urls, advertise-client-urls, initial-cluster

所有节点上操作

# 启动 etcd 并设置开机启动
systemctl daemon-reload
systemctl start etcd
systemctl enable etcd

在 master 上进行测试

ETCDCTL_API=3 
/usr/local/sbin/etcdctl \
--cacert=/etc/kubernetes/cert/ca.pem \
--cert=/etc/kubernetes/cert/kubernetes.pem \
--key=/etc/kubernetes/cert/kubernetes-key.pem \
--endpoints=" https://172.16.16.180:2379,https://172.16.16.181:2379 ,https://172.16.16.182:2379" endpoint health