kuberntes 系統(tǒng)使用 etcd 存儲(chǔ)所有數(shù)據(jù)，是最重要的組件之一，注意 etcd集群只能有奇數(shù)個(gè)節(jié)點(diǎn)(1,3,5…)，本文檔使用3個(gè)節(jié)點(diǎn)做集群。

一、基礎(chǔ)環(huán)境

軟件包

etcd下載地址：https://github.com/coreos/etcd/releases

服務(wù)器

架構(gòu)圖

二、生成etcd證書與私鑰

創(chuàng)建etcd配置文件

{    "CN": "etcd",    "hosts": [      "127.0.0.1",      "192.168.1.11",      "192.168.1.12",      "192.168.1.13",      "etcd1",      "etcd2",      "etcd3"    ],    "key": {      "algo": "rsa",      "size": 2048    },    "names": [      {        "C": "CN",        "ST": "BeiJing",        "L": "BeiJing",        "O": "Ctyun",        "OU": "ops"      }    ]  }

hosts：定授權(quán)使用該證書的 etcd 節(jié)點(diǎn) IP(應(yīng)包含集群內(nèi)所有節(jié)點(diǎn)的IP與hostname)
C：國(guó)家
ST：省份
L：城市
O：公司
OU：部門

生成私鑰、證書請(qǐng)求文件、證書

CA證書在前面的章節(jié)創(chuàng)建 Kubernetes證書相關(guān)(CFSSL)

cfssl gencert -ca=/opt/ssl/k8sca/ca.pem   -ca-key=/opt/ssl/k8sca/ca-key.pem   -config=/opt/ssl/k8sca/ca-config.json   -profile=kubernetes /opt/ssl/etcd/etcd-csr.json | cfssljson -bare etcd

-ca：指定CA證書路徑
-ca-key：指定CAKey的路徑
-config：指定CA證書簽署策略配置文件

二、啟動(dòng)和配置etcd

創(chuàng)建etcd配置文件etcd.conf，此配置文件是定義一些變量，方便etcd.service文件中直接引用、方便后期維護(hù)。
配置文件的所有含義都在創(chuàng)建etcd.service配置文件后有詳解。

mkdir -p /etc/etcd  vim /etc/etcd/etcd.conf  # [member]  ETCD_NAME=etcd1  ETCD_DATA_DIR="/var/lib/etcd"  ETCD_LISTEN_PEER_URLS="https://192.168.1.11:2380"   ETCD_LISTEN_CLIENT_URLS="https://192.168.1.11:2379" #[cluster]  ETCD_INITIAL_ADVERTISE_PEER_URLS="https://192.168.1.11:2380"  ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"  ETCD_ADVERTISE_CLIENT_URLS="https://192.168.1.11:2379"

創(chuàng)建etcd.service配置文件

etcd.service的變量都是引用etcd配置文件中

mkdir /var/lib/etcd  vim /usr/lib/systemd/system/etcd.service   [Unit]  Description=Etcd Server  After=network.target  After=network-online.target  Wants=network-online.target  Documentation=https://github.com/coreos    [Service]  Type=notify  WorkingDirectory=${ETCD_DATA_DIR}   EnvironmentFile=/etc/etcd/etcd.conf  ExecStart=/usr/local/bin/etcd     --name=etcd1     --cert-file=/opt/ssl/etcd/etcd.pem     --key-file=/opt/ssl/etcd/etcd-key.pem     --peer-cert-file=/opt/ssl/etcd/etcd.pem     --peer-key-file=/opt/ssl/etcd/etcd-key.pem     --trusted-ca-file=/opt/ssl/k8sca/ca.pem     --peer-trusted-ca-file=/opt/ssl/k8sca/ca.pem     --initial-advertise-peer-urls=${ETCD_INITIAL_ADVERTISE_PEER_URLS}     --listen-peer-urls=${ETCD_LISTEN_PEER_URLS}     --listen-client-urls=${ETCD_LISTEN_CLIENT_URLS},http://127.0.0.1:2379     --advertise-client-urls=${ETCD_ADVERTISE_CLIENT_URLS}     --initial-cluster-token=${ETCD_INITIAL_CLUSTER_TOKEN}     --initial-cluster etcd1=https://192.168.1.11:2380,etcd2=https://192.168.1.12:2380,etcd3=https://192.168.1.13:2380     --initial-cluster-state=new     --data-dir=/var/lib/etcd  Restart=on-failure  RestartSec=5  LimitNOFILE=65536    [Install]  WantedBy=multi-user.target

--initial-cluster：集群當(dāng)中的其他節(jié)點(diǎn)
--cert-file：etcd證書路徑
--key-file：etcd私鑰路徑
--peer-cert-file：對(duì)等證書(雙向證書)路徑
--peer-key-file：對(duì)等證書(雙向證書)私鑰路徑
--trusted-ca-file：作為客戶端時(shí)的CA證書路徑
--peer-trusted-ca-file：對(duì)等證書的CA證書路徑
--initial-advertise-peer-urls：列出集群成員通信的URL，用于通告集群其他成員
--listen-peer-urls：用于監(jiān)聽集群其他成員的URL列表
--listen-client-urls：用于監(jiān)聽客戶端通訊的URL列表
--advertise-client-urls：通告客戶端的URL，用于列出所有客戶端
--initial-cluster-token：etcd集群的初始集群令牌，服務(wù)器必須通過令牌才能加入etcd集群

啟動(dòng)etcd集群

集群所有節(jié)點(diǎn)都配置好配置文件，同時(shí)啟動(dòng)。

systemctl daemon-reload && systemctl enable etcd && systemctl start etcd

不使用變量的配置方法

前面分別創(chuàng)建了/etc/etcd/etcd.conf與/var/lib/systemd/system/etcd.service兩個(gè)配置文件，且etcd.service引用了etcd.conf重定義的變量。

如若不想引用變量，可以不寫etcd.conf。僅創(chuàng)建etcd.service如下

[root@etcd1 k8sca]# cat /usr/lib/systemd/system/etcd.service  [Unit]  Description=Etcd Server  After=network.target  After=network-online.target  Wants=network-online.target  Documentation=https://github.com/coreos    [Service]  Type=notify  WorkingDirectory=/var/lib/etcd/  ExecStart=/usr/local/bin/etcd     --name etcd1     --cert-file=/opt/ssl/etcd/etcd.pem     --key-file=/opt/ssl/etcd/etcd-key.pem     --peer-cert-file=/opt/ssl/etcd/etcd.pem     --peer-key-file=/opt/ssl/etcd/etcd-key.pem     --trusted-ca-file=/opt/ssl/k8sca/ca.pem     --peer-trusted-ca-file=/opt/ssl/k8sca/ca.pem     --initial-advertise-peer-urls=https://192.168.1.11:2380     --listen-peer-urls=https://192.168.1.11:2380     --listen-client-urls=https://192.168.1.11:2379,http://127.0.0.1:2379     --advertise-client-urls=https://192.168.1.11:2379     --initial-cluster-token=etcd-cluster-0     --initial-cluster etcd1=https://192.168.1.11:2380,etcd2=https://192.168.1.12:2380,etcd3=https://192.168.1.13:2380     --initial-cluster-state=new     --data-dir=/var/lib/etcd  Restart=on-failure  RestartSec=5  LimitNOFILE=65536    [Install]  WantedBy=multi-user.target  

三、測(cè)試集群狀態(tài)

集群中所有主機(jī)配置均一致，僅IP地址不同。

$ etcdctl --ca-file=/opt/ssl/k8sca/ca.pem --cert-file=/opt/ssl/etcd/etcd.pem --key-file=/opt/ssl/etcd/etcd-key.pem cluster-health  member aa869cb0f2e7ed31 is healthy: got healthy result from https://192.168.1.11:2379  member b08a644fd7247c5e is healthy: got healthy result from https://192.168.1.13:2379  member bb9bd2baaebf7d95 is healthy: got healthy result from https://192.168.1.12:2379 

常見問題

• publish error: etcdserver: request timed out
  我部署時(shí)先使用一臺(tái)進(jìn)行測(cè)試，無(wú)論如何啟動(dòng)etcd都無(wú)法啟動(dòng)，提示publish error: etcdserver: request timed out。后來(lái)發(fā)現(xiàn)etcd.service中制定了其他etcd主機(jī)，所以當(dāng)單獨(dú)啟動(dòng)一臺(tái)是連接其他主機(jī)不通，那么etcd就啟動(dòng)失敗。所以要把etcd集群中所有主機(jī)都配置好，同時(shí)啟動(dòng)就OK了。