1、仓库14上对etcd签发证书
vim /opt/certs/ca-config.json
{
"signing": {
"default": {
"expiry": "175200h"
},
"profiles": {
"server": {
"expiry": "175200h",
"usages": [
"signing",
"key encipherment",
"server auth"
]
},
"client": {
"expiry": "175200h",
"usages": [
"signing",
"key encipherment",
"client auth"
]
},
"peer": {
"expiry": "175200h",
"usages": [
"signing",
"key encipherment",
"server auth",
"client auth"
]
}
}
}
}
vim /opt/certs/etcd-peer-csr.json
{
"CN": "k8s-etcd",
"hosts": [
"10.4.7.10",
"10.4.7.11",
"10.4.7.12",
"10.4.7.13"
],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"ST": "beijing",
"L": "beijing",
"O": "k8s",
"OU": "system"
}
]
}
cd /opt/certs/
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=peer etcd-peer-csr.json |cfssl-json -bare etcd-peer
2、10.4.7.11上创建etcd用户
useradd -s /sbin/nologin -M etcd
3、github上复制下载地址下载etcd,https://github.com/etcd-io/etcd/releases
wget https://github.com/etcd-io/etcd/releases/download/v3.4.7/etcd-v3.4.7-linux-amd64.tar.gz
tar zxvf etcd-v3.4.7-linux-amd64.tar.gz -C /opt
mv etcd-v3.4.7-linux-amd64/ etcd-v3.4.7
ln -s /opt/etcd-v3.4.7 /opt/etcd
mkdir -p /opt/etcd/certs /data/etcd /data/logs/etcd-server
cd /opt/etcd/certs
scp root@10.4.7.14:/opt/certs/ca.pem ./
scp root@10.4.7.14:/opt/certs/etcd-peer.pem ./
scp root@10.4.7.14:/opt/certs/etcd-peer-key.pem ./
vim etcd-server-startup.sh
#!/bin/sh
./etcd --name etcd-server-7-11 \
--data-dir /data/etcd/etcd-server \
--listen-peer-urls https://10.4.7.11:2380 \
--listen-client-urls https://10.4.7.11:2379,http://127.0.0.1:2379 \
--quota-backend-bytes 8000000000 \
--initial-advertise-peer-urls https://10.4.7.11:2380 \
--advertise-client-urls https://10.4.7.11:2379,http://127.0.0.1:2379 \
--initial-cluster etcd-server-7-11=https://10.4.7.11:2380,etcd-server-7-12=https://10.4.7.12:2380,etcd-server-7-13=https://10.4.7.13:2380 \
--ca-file ./certs/ca.pem \
--cert-file ./certs/etcd-peer.pem \
--key-file ./certs/etcd-peer-key.pem \
--client-cert-auth \
--trusted-ca-file ./certs/ca.pem \
--peer-ca-file ./certs/ca.pem \
--peer-cert-file ./certs/etcd-peer.pem \
--peer-key-file ./certs/etcd-peer-key.pem \
--peer-client-cert-auth \
--peer-trusted-ca-file ./certs/ca.pem \
--log-output stdout
chmod +x etcd-server-startup.sh
chown -R etcd.etcd /opt/etcd-v3.4.7/ /data/etcd/ /data/logs/etcd-server/
yum install supervisor -y
systemctl start supervisord
systemctl enable supervisord
vim /etc/supervisord.d/etcd-server.ini
[program:etcd-server-7-11]
command=/opt/etcd/etcd-server-startup.sh ; the program (relative uses PATH, can take args)
numprocs=1 ; number of processes copies to start (def 1)
directory=/opt/etcd ; directory to cwd to before exec (def no cwd)
autostart=true ; start at supervisord start (default: true)
autorestart=true ; retstart at unexpected quit (default: true)
startsecs=30 ; number of secs prog must stay running (def. 1)
startretries=3 ; max # of serial start failures (default 3)
exitcodes=0,2 ; 'expected' exit codes for process (default 0,2)
stopsignal=QUIT ; signal used to kill process (default TERM)
stopwaitsecs=10 ; max num secs to wait b4 SIGKILL (default 10)
user=etcd ; setuid to this UNIX account to run the program
redirect_stderr=true ; redirect proc stderr to stdout (default false)
stdout_logfile=/data/logs/etcd-server/etcd.stdout.log ; stdout log path, NONE for none; default AUTO
stdout_logfile_maxbytes=64MB ; max # logfile bytes b4 rotation (default 50MB)
stdout_logfile_backups=4 ; # of stdout logfile backups (default 10)
stdout_capture_maxbytes=1MB ; number of bytes in 'capturemode' (default 0)
stdout_events_enabled=false ; emit events on stdout writes (default false)
supervisorctl update
supervisorctl status
状态有报错,查看日志vim /data/logs/etcd-server/etcd.stdout.log
flag provided but not defined: -ca-file
看起来CA证书文件有问题,查看证书目录是有证书文件的,看报错提示应该是-ca-file这个字段没定义,那么有可能是我使用的是最新版的etcd修改了这个字段
使用./etcd -h查看帮助,果然字段中没有包含这个
尝试将这一行注释并重新加载supervisorctl reload
又报证书文件没有颁发。。。
果然使用最新版容易踩坑,还查不到解决方法。果断换个版本。重新下载3.3.20。
修改软连接到3.3.20版本,拷贝原来的certs目录和etcd-server-startup.sh到当前版本etcd目录下,重新赋予权限,并sh脚本中去掉之前加的注释
chmod +x etcd-server-startup.sh
chown -R etcd.etcd /opt/etcd-v3.3.20/ /data/etcd/ /data/logs/etcd-server/
supervisorctl reload
supervisorctl status