分发etcd软件包
[root@master01 ~]# tar xf etcd-v3.2.25-linux-amd64.tar.gz
[root@master01 ~]# cd etcd-v3.2.25-linux-amd64
[root@master01 etcd-v3.2.25-linux-amd64]# scp etcd etcdctl node01:/opt/kubernetes/bin/
[root@master01 etcd-v3.2.25-linux-amd64]# scp etcd etcdctl node02:/opt/kubernetes/bin/
[root@master01 etcd-v3.2.25-linux-amd64]# scp etcd etcdctl node03:/opt/kubernetes/bin/
1.创建 etcd 证书签名请求：
[root@master01 ssl]# vim etcd-csr.json{ "CN": "etcd", "hosts": [ "127.0.0.1", "10.80.4.203", "10.80.4.204", "10.80.4.205" ], "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "ST": "ShenZheng", "L": "ShenZheng", "O": "k8s", "OU": "System" } ] }
2.生成 etcd 证书和私钥：
[root@master01 ssl ~]# cfssl gencert -ca=/opt/kubernetes/ssl/ca.pem \-ca-key=/opt/kubernetes/ssl/ca-key.pem \ -config=/opt/kubernetes/ssl/ca-config.json \ -profile=kubernetes etcd-csr.json | cfssljson -bare etcd 会生成以下证书文件[root@master01 ssl]# ls -l etcd* -rw-r--r-- 1 root root 1070 Oct 25 15:30 etcd.csr -rw-r--r-- 1 root root 285 Oct 25 15:29 etcd-csr.json -rw------- 1 root root 1679 Oct 25 15:30 etcd-key.pem -rw-r--r-- 1 root root 1444 Oct 25 15:30 etcd.pem
3.将证书移动到/opt/kubernetes/ssl目录下
[root@master01 ssl]# scp etcd*.pem node01:/opt/kubernetes/ssl/
[root@master01 ssl]# scp etcd*.pem node02:/opt/kubernetes/ssl/
[root@master01 ssl]# scp etcd*.pem node03:/opt/kubernetes/ssl/
[root@k8s-master ~]# rm -f etcd.csr etcd-csr.json
4.设置ETCD配置文件
[root@node01 ~]# vim /opt/kubernetes/cfg/etcd.conf#[member] ETCD_NAME="etcd-node1" ETCD_DATA_DIR="/var/lib/etcd/default.etcd" #ETCD_SNAPSHOT_COUNTER="10000" #ETCD_HEARTBEAT_INTERVAL="100" #ETCD_ELECTION_TIMEOUT="1000" ETCD_LISTEN_PEER_URLS="https://10.80.4.203:2380" ETCD_LISTEN_CLIENT_URLS="https://10.80.4.203:2379,https://127.0.0.1:2379" #ETCD_MAX_SNAPSHOTS="5" #ETCD_MAX_WALS="5" #ETCD_CORS="" #[cluster] ETCD_INITIAL_ADVERTISE_PEER_URLS="https://10.80.4.203:2380" # if you use different ETCD_NAME (e.g. test), # set ETCD_INITIAL_CLUSTER value for this name, i.e. "test=http://..." ETCD_INITIAL_CLUSTER="etcd-node1=https://10.80.4.203:2380,etcd-node2=https://10.80.4.204:2380,etcd-node3=https://10.80.4.205:2380" ETCD_INITIAL_CLUSTER_STATE="new" ETCD_INITIAL_CLUSTER_TOKEN="k8s-etcd-cluster" ETCD_ADVERTISE_CLIENT_URLS="https://10.80.4.203:2379" #[security] CLIENT_CERT_AUTH="true" ETCD_CA_FILE="/opt/kubernetes/ssl/ca.pem" ETCD_CERT_FILE="/opt/kubernetes/ssl/etcd.pem" ETCD_KEY_FILE="/opt/kubernetes/ssl/etcd-key.pem" PEER_CLIENT_CERT_AUTH="true" ETCD_PEER_CA_FILE="/opt/kubernetes/ssl/ca.pem" ETCD_PEER_CERT_FILE="/opt/kubernetes/ssl/etcd.pem" ETCD_PEER_KEY_FILE="/opt/kubernetes/ssl/etcd-key.pem"
5.创建ETCD系统服务
[root@node01 ~]# vim /etc/systemd/system/etcd.service[Unit] Description=Etcd Server After=network.target [Service] Type=simple WorkingDirectory=/var/lib/etcd EnvironmentFile=-/opt/kubernetes/cfg/etcd.conf # set GOMAXPROCS to number of processors ExecStart=/bin/bash -c "GOMAXPROCS=$(nproc) /opt/kubernetes/bin/etcd" Type=notify [Install] WantedBy=multi-user.target
6.重新加载系统服务
[root@node01 ~]# systemctl daemon-reload
[root@node01 ~]# systemctl enable etcd
[root@node01 ~]# scp /opt/kubernetes/cfg/etcd.conf 10.80.4.204:/opt/kubernetes/cfg/ # 该文件部分配置需要按节点信息进行修改，否则将启动失败。
[root@node01 ~]# scp /opt/kubernetes/cfg/etcd.conf 10.80.4.205:/opt/kubernetes/cfg/# 该文件部分配置需要按节点信息进行修改，否则将启动失败。
[root@node01 ~]# scp /etc/systemd/system/etcd.service 10.80.4.204:/etc/systemd/system/etcd.service
[root@node01 ~]# scp /etc/systemd/system/etcd.service 10.80.4.205:/etc/systemd/system/etcd.service在所有节点上创建etcd存储目录并启动etcd
[root@node01 ~]# mkdir /var/lib/etcd
[root@node01 ~]# systemctl start etcd
[root@node01 ~]# systemctl status etcd
下面需要大家在所有的 etcd 节点重复上面的步骤，直到所有机器的 etcd 服务都已启动。
7.验证集群
[root@node01 ~]# etcdctl --endpoints=https://10.80.4.203:2379 \ --ca-file=/opt/kubernetes/ssl/ca.pem \ --cert-file=/opt/kubernetes/ssl/etcd.pem \ --key-file=/opt/kubernetes/ssl/etcd-key.pem cluster-healthmember 16a450a53543d26b is healthy: got healthy result from https://10.80.4.204:2379 member 2e5d89bd5e41bf83 is healthy: got healthy result from https://10.80.4.203:2379 member a4cea1f3bf3ae07e is healthy: got healthy result from https://10.80.4.205:2379 cluster is health