溫馨提示×
您好，登錄后才能下訂單哦！
點擊 登錄注冊 即表示同意《億速云用戶服務條款》
您好，登錄后才能下訂單哦！
這篇文章的知識點包括：在根證書服務器上創(chuàng)建基于根證書的config配置文件、創(chuàng)建etcd自簽證書簽名請求csr的json配置文件和在三臺主機上安裝etcd服務等方法，閱讀完整文相信大家對etcd組件的使用有了一定的認識。
200 certs]# cd /opt/certs/
200 certs]# vi /opt/certs/ca-config.json
{
"signing": {
"default": {
"expiry": "175200h"
},
"profiles": {
"server": {
"expiry": "175200h",
"usages": [
"signing",
"key encipherment",
"server auth"
]
},
"client": {
"expiry": "175200h",
"usages": [
"signing",
"key encipherment",
"client auth"
]
},
"peer": {
"expiry": "175200h",
"usages": [
"signing",
"key encipherment",
"server auth",
"client auth"
]
}
}
}
}200 certs]# vi etcd-peer-csr.json
{
"CN": "k8s-etcd",
"hosts": [
"10.3.153.212",
"10.3.153.221",
"10.3.153.222"
],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"ST": "beijing",
"L": "beijing",
"O": "od",
"OU": "ops"
}
]
}
200 certs]# cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=peer etcd-peer-csr.json |cfssl-json -bare etcd-peer
[root@test-operator certs]# ll | grep etcd-peer
-rw-r--r-- 1 root root 1062 Feb 1 00:19 etcd-peer.csr
-rw-r--r-- 1 root root 375 Feb 1 00:15 etcd-peer-csr.json
-rw------- 1 root root 1675 Feb 1 00:19 etcd-peer-key.pem #證書私鑰
-rw-r--r-- 1 root root 1428 Feb 1 00:19 etcd-peer.pem #證書文件
# 212/221/222機器：
~]# mkdir /opt/src~]# cd /opt/src/ src]# useradd -s /sbin/nologin -M etcd src]# id etcd # 到GitHub下載或者直接用我給得安裝包 https://github.com/etcd-io/etcd/tags src]# tar xf etcd-v3.1.20-linux-amd64.tar.gz -C /opt opt]# mv etcd-v3.1.20-linux-amd64/ etcd-v3.1.20 opt]# ln -s /opt/etcd-v3.1.20/ /opt/etcd opt]# cd etcd ~~~ ~~~ # 212/221/222機器： etcd]# mkdir -p /opt/etcd/certs /data/etcd /data/logs/etcd-server etcd]# cd certs/ certs]# scp 10.3.153.200:/opt/certs/ca.pem . # 輸入200虛機密碼 certs]# scp 10.3.153.200:/opt/certs/etcd-peer.pem . certs]# scp 10.3.153.200:/opt/certs/etcd-peer-key.pem . certs]# cd .. etcd]# vi /opt/etcd/etcd-server-startup.sh # 注意，如果是21機器，這下面得12都得改成21，initial-cluster則是全部機器都有，不需要改，一共5處 #!/bin/sh ./etcd --name etcd-server-7-12 \ --data-dir /data/etcd/etcd-server \ --listen-peer-urls https://10.3.153.212:2380 \ --listen-client-urls https://10.3.153.212:2379,http://127.0.0.1:2379 \ --quota-backend-bytes 8000000000 \ --initial-advertise-peer-urls https://10.3.153.212:2380 \ --advertise-client-urls https://10.4.7.12:2379,http://127.0.0.1:2379 \ --initial-cluster etcd-server-7-12=https://10.3.153.212:2380,etcd-server-7-21=https://10.3.153.221:2380,etcd-server-7-22=https://10.3.153.222:2380 \ --ca-file ./certs/ca.pem \ --cert-file ./certs/etcd-peer.pem \ --key-file ./certs/etcd-peer-key.pem \ --client-cert-auth \ --trusted-ca-file ./certs/ca.pem \ --peer-ca-file ./certs/ca.pem \ --peer-cert-file ./certs/etcd-peer.pem \ --peer-key-file ./certs/etcd-peer-key.pem \ --peer-client-cert-auth \ --peer-trusted-ca-file ./certs/ca.pem \ --log-output stdout etcd]# chmod +x etcd-server-startup.sh etcd]# chown -R etcd.etcd /opt/etcd-v3.1.20/ etcd]# chown -R etcd.etcd /data/etcd/ etcd]# chown -R etcd.etcd /data/logs/etcd-server/ ~~~ ~~~ # 212/221/222機器： etcd]# yum install supervisor -y #用于把服務以后臺服務啟動 etcd]# systemctl start supervisord etcd]# systemctl enable supervisord etcd]# vi /etc/supervisord.d/etcd-server.ini # 注意修改下面得7-12，對應上機器，如21機器就是7-21，一共一處 [program:etcd-server-7-12] command=/opt/etcd/etcd-server-startup.sh ; the program (relative uses PATH, can take args) numprocs=1 ; number of processes copies to start (def 1) directory=/opt/etcd ; directory to cwd to before exec (def no cwd) autostart=true ; start at supervisord start (default: true) autorestart=true ; retstart at unexpected quit (default: true) startsecs=30 ; number of secs prog must stay running (def. 1) startretries=3 ; max # of serial start failures (default 3) exitcodes=0,2 ; 'expected' exit codes for process (default 0,2) stopsignal=QUIT ; signal used to kill process (default TERM) stopwaitsecs=10 ; max num secs to wait b4 SIGKILL (default 10) user=etcd ; setuid to this UNIX account to run the program redirect_stderr=true ; redirect proc stderr to stdout (default false) stdout_logfile=/data/logs/etcd-server/etcd.stdout.log ; stdout log path, NONE for none; default AUTO stdout_logfile_maxbytes=64MB ; max # logfile bytes b4 rotation (default 50MB) stdout_logfile_backups=4 ; # of stdout logfile backups (default 10) stdout_capture_maxbytes=1MB ; number of bytes in 'capturemode' (default 0) stdout_events_enabled=false ; emit events on stdout writes (default false) 12 etcd]# supervisorctl update # out：etcd-server-7-21: added process group 12 etcd]# supervisorctl status # out: etcd-server-7-12 RUNNING pid 16582, uptime 0:00:59 12 etcd]# netstat -luntp|grep etcd # 必須是監(jiān)聽了2379和2380這兩個端口才算成功 12 etcd]# etcd-server-7-12: added process group ~~~ ~~~ # 任意節(jié)點檢測集群健康狀態(tài)的兩種方法 22 etcd]# ./etcdctl cluster-health [root@test-nodes1 etcd]# ./etcdctl cluster-health member 3657c30473e13ab3 is healthy: got healthy result from http://127.0.0.1:2379 member 6cbe98b6a135fd14 is healthy: got healthy result from http://127.0.0.1:2379 member b7ffbb00070336e7 is healthy: got healthy result from http://127.0.0.1:2379 cluster is healthy 22 etcd]# ./etcdctl member list [root@test-nodes1 etcd]# ./etcdctl member list 3657c30473e13ab3: name=etcd-server-7-12 peerURLs=https://10.3.153.212:2380 clientURLs=http://127.0.0.1:2379,https://10.3.153.212:2379 isLeader=false 6cbe98b6a135fd14: name=etcd-server-7-21 peerURLs=https://10.3.153.221:2380 clientURLs=http://127.0.0.1:2379,https://10.3.153.221:2379 isLeader=false b7ffbb00070336e7: name=etcd-server-7-22 peerURLs=https://10.3.153.222:2380 clientURLs=http://127.0.0.1:2379,https://10.3.153.222:2379 isLeader=true
以上就是kubernetes集群etcd組件的全方位使用，看完之后是否有所收獲呢？如果想了解更多相關內(nèi)容，歡迎關注億速云行業(yè)資訊！
免責聲明：本站發(fā)布的內(nèi)容（圖片、視頻和文字）以原創(chuàng)、轉載和分享為主，文章觀點不代表本網(wǎng)站立場，如果涉及侵權請聯(lián)系站長郵箱：is@yisu.com進行舉報，并提供相關證據(jù)，一經(jīng)查實，將立刻刪除涉嫌侵權內(nèi)容。
