部署 ETCD

    会生成下面两个重要的文件:

    • : kube-apiserver 证书密钥
    • etcd.pem: kube-apiserver 证书

    下载 release 包:

    1. wget -q --show-progress --https-only --timestamping \
    2.   "https://github.com/etcd-io/etcd/releases/download/v3.4.1/etcd-v3.4.1-linux-amd64.tar.gz"
    1. tar -xvf etcd-v3.4.1-linux-amd64.tar.gz
    2. sudo mv etcd-v3.4.1-linux-amd64/etcd* /usr/local/bin/

    创建配置相关目录，放入证书文件:

    etcd 集群每个成员都需要一个名字，这里第一个成员名字用 infra0，第二个可以用 infra1，以此类推，你也可以直接用节点的 hostname:

    1. NAME=infra0

    记当前部署 ETCD 的节点的内网 IP 为 INTERNAL_IP:

    1. INTERNAL_IP=10.200.16.79

    创建 systemd 配置:

    1. cat <<EOF | sudo tee /etc/systemd/system/etcd.service
    2. [Unit]
    3. Description=etcd
    6. Type=notify
    7. ExecStart=/usr/local/bin/etcd \\
    8.   --name ${NAME} \\
    9.   --cert-file=/etc/etcd/etcd.pem \\
    10.   --key-file=/etc/etcd/etcd-key.pem \\
    11.   --peer-cert-file=/etc/etcd/etcd.pem \\
    12.   --peer-key-file=/etc/etcd/etcd-key.pem \\
    13.   --trusted-ca-file=/etc/etcd/ca.pem \\
    14.   --peer-trusted-ca-file=/etc/etcd/ca.pem \\
    15.   --peer-client-cert-auth \\
    16.   --client-cert-auth \\
    17.   --initial-advertise-peer-urls https://${INTERNAL_IP}:2380 \\
    18.   --listen-peer-urls https://${INTERNAL_IP}:2380 \\
    19.   --listen-client-urls https://${INTERNAL_IP}:2379,https://127.0.0.1:2379 \\
    20.   --initial-cluster-token etcd-cluster-0 \\
    21.   --initial-cluster ${ETCD_SERVERS} \\
    22.   --initial-cluster-state new \\
    23.   --data-dir=/var/lib/etcd
    24. Restart=on-failure
    25. RestartSec=5
    27. [Install]
    28. WantedBy=multi-user.target
    29. EOF
    1. sudo systemctl daemon-reload
    2. sudo systemctl enable etcd
    3. sudo systemctl start etcd

    等所有 etcd 成员安装启动成功后，来验证下是否可用:

    输出:

    1. a7f995caeeaf7a59, started, infra1, https://10.200.17.6:2380, https://10.200.17.6:2379, false
    3. ba126eb695f5ba71, started, infra0, https://10.200.16.79:2380, https://10.200.16.79:2379, false