k8s集群之etcd

在正式环境我是三台主机做的集群，这里我就只能用一台虚拟机三个进程分别起etcd实际上原理是一样的。另外基础环境比如dns服务器（参考我前面dns文章）这里略过，做了正向、反向dns。

cfssl version
Version: 1.2.0
Revision: dev
Runtime: go1.6
etcd version：
etcdctl version: 3.3.13
API version: 2

1、安装 CFSSL

下载cfssl：
https://pkg.cfssl.org/R1.2/SHA256SUMS
https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64

安装 CFSSL
chmod +x cfssl*
mv cfssl_linux-amd64 /usr/local/bin/cfssl -v
mv cfssljson_linux-amd64 /usr/local/bin/cfssljson -v

2、准备etcd使用的证书

2、准备etcd使用的证书
mkdir /etc/k8s/ssl/ -pv
mkdir -pv /tmp/certs && cd /tmp/certs

ca配置文件：
cat > ca-config.json < /tmp/certs/ca-csr.json < /tmp/certs/gencert.json < /tmp/certs/etcd-csr.json <

3、安装etcd集群

我用一台服务跑三个etcd进程来模拟三台etcd服务器。
下载etcd：
https://github.com/etcd-io/etcd/releases/download/v3.3.13/etcd-v3.3.13-linux-amd64.tar.gz

在三个节点都安装etcd，下面的操作需要再三个节点都执行一遍
tar -xf etcd-v3.3.13-linux-amd64.tar.gz -C /usr/local/ && cd /usr/local/etcd-v3.3.13-linux-amd64/
ln -sv /usr/local/etcd-v3.3.13-linux-amd64/etcd /usr/local/bin/
ln -sv /usr/local/etcd-v3.3.13-linux-amd64/etcdctl /usr/local/bin/


mkdir -pv /var/lib/etcd{1,2,3}

配置etcd：
cat > /tmp/etcd1.service < /tmp/etcd2.service < /tmp/etcd3.service <

4、验证etcd集群

查看etcd2状态：
 ETCDCTL_API=3 /usr/local/bin/etcdctl  \
--endpoints 10.0.0.11:2379,10.0.0.11:22379,10.0.0.11:32379  \
--cacert /etc/k8s/ssl/ca.pem   \
--cert /etc/k8s/ssl/etcd.pem   \
--key /etc/k8s/ssl/etcd-key.pem   \
endpoint health

10.0.0.11:22379 is healthy: successfully committed proposal: took = 4.000979ms
10.0.0.11:32379 is healthy: successfully committed proposal: took = 4.907629ms
10.0.0.11:2379 is healthy: successfully committed proposal: took = 11.089059ms

查看那台为leader：
etcdctl  --cert-file=/etc/k8s/ssl/etcd.pem \
--key-file=/etc/k8s/ssl/etcd-key.pem \
--ca-file=/etc/k8s/ssl/ca.pem \
--endpoints https://10.0.0.11:2379,https://10.0.0.11:22379,https://10.0.0.11:32379 \
member list

6246c0e15cee547e: name=etcd2 peerURLs=https://10.0.0.11:22380 clientURLs=https://10.0.0.11:22379 isLeader=false
799f3a7a5ffa02a6: name=etcd1 peerURLs=https://10.0.0.11:2380 clientURLs=https://10.0.0.11:2379 isLeader=true
7d932a4207ff1146: name=etcd3 peerURLs=https://10.0.0.11:32380 clientURLs=https://10.0.0.11:32379 isLeader=false


关闭etcd2：
systemctl stop etcd1

etcdctl  --cert-file=/etc/k8s/ssl/etcd.pem \
--key-file=/etc/k8s/ssl/etcd-key.pem \
--ca-file=/etc/k8s/ssl/ca.pem \
--endpoints https://10.0.0.11:2379,https://10.0.0.11:22379,https://10.0.0.11:32379 \
cluster-health

member 6246c0e15cee547e is healthy: got healthy result from https://10.0.0.11:22379
failed to check the health of member 799f3a7a5ffa02a6 on https://10.0.0.11:2379: Get https://10.0.0.11:2379/health: dial tcp 10.0.0.11:2379: connect: connection refused
member 799f3a7a5ffa02a6 is unreachable: [https://10.0.0.11:2379] are all unreachable
member 7d932a4207ff1146 is healthy: got healthy result from https://10.0.0.11:32379
cluster is degraded


启动etcd1：
systemctl start etcd1

etcdctl  --cert-file=/etc/k8s/ssl/etcd.pem \
--key-file=/etc/k8s/ssl/etcd-key.pem \
--ca-file=/etc/k8s/ssl/ca.pem \
--endpoints https://10.0.0.11:2379,https://10.0.0.11:22379,https://10.0.0.11:32379 \
cluster-health

member 6246c0e15cee547e is healthy: got healthy result from https://10.0.0.11:22379
member 799f3a7a5ffa02a6 is healthy: got healthy result from https://10.0.0.11:2379
member 7d932a4207ff1146 is healthy: got healthy result from https://10.0.0.11:32379
cluster is healthy