K8S(四)——部署master节点服务

------------恢复内容开始------------

来自视频：https://www.bilibili.com/video/BV1PJ411h7Sw?p=17

一、部署etcd集群

集群规划

主机名	角色	IP
SX7-12	etcd leader	10.4.7.12
SX7-21	etcd follow	10.4.7.21
SX7-22	etcd follow	10.4.7.22

1.创建基于根证书的config配置文件

cd /opt/certs
vim ca-config.json
{
  "signing": {
    "default": {
        "expiry": "175200h"
    },
    "profiles": {
        "server": {
            "expiry": "175200h",
            "usages": [
                "signing",
                "key encipherment",
                "server auth"
             ]
        },
        "client": {
            "expiry": "175200h",
            "usages": [
                "signing",
                "key encipherment",
                "client auth"
             ]
        },
        "peer": {
            "expiry": "175200h",
            "usages": [
                "signing",
                "key encipherment",
                "server auth",
                "client auth"
             ]
        }
      }
   }
}

2.创建K8S的证书请求文件

vim etcd-peer-csr.json { "CN": "xyly", "hosts": [ "10.4.7.11", "10.4.7.12", "10.4.7.21", "10.4.7.22" ], "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "ST": "ShangHai", "L": "ShangHai", "O": "xy", "OU": "ops" } ] }

3.生成etcd证书和私钥

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=peer etcd-peer-csr.json | cfssl-json -bare etcd-peer

4.安装etcd

在SX7-12

useradd etcd -s /sbin/nologin -M // 创建一个etcd用户

下载软件，解压后做一个软链接 mkdir /opt/src cd /opt/src/
wget https://github.com/etcd-io/etcd/releases/download/v3.3.20/etcd-v3.3.20-linux-amd64.tar.gz     // github官网
wget https://mirrors.huaweicloud.com/etcd/v3.3.20/etcd-v3.3.20-linux-amd64.tar.gz/      // 官网实在下不下来，我用的华为的
tar -xvf etcd-v3.3.20-linux-amd64.tar.gz -C /opt/

做软链接
cd ..
mv etcd-v3.3.20-linux-amd64/ etcd-v3.3.20     // 重命名
ln -s /opt/etcd-v3.3.20/ /opt/etcd

•  创建证书目录、数据目录、日志目录

mkdir /opt/etcd/certs /data/etcd /data/logs/etcd-server -p

• 拷贝证书

scp sx7-200:/opt/certs/ca.pem /opt/etcd/certs/
scp sx7-200:/opt/certs/etcd-peer.pem /opt/etcd/certs/
scp sx7-200:/opt/certs/etcd-peer-key.pem /opt/etcd/certs/

• 创建etcd的启动脚本

vi /opt/etcd/etcd-server-startup.sh

#!/bin/sh ./etcd --name etcd-server-7-12 \ --data-dir /data/etcd/etcd-server \ --listen-peer-urls https://10.4.7.12:2380 \ --listen-client-urls https://10.4.7.12:2379,http://127.0.0.1:2379 \ --quota-backend-bytes 8000000000 \ --initial-advertise-peer-urls https://10.4.7.12:2380 \ --advertise-client-urls https://10.4.7.12:2379,http://127.0.0.1:2379 \ --initial-cluster etcd-server-7-12=https://10.4.7.12:2380,etcd-server-7-21=https://10.4.7.21:2380,etcd-server-7-22=https://10.4.7.22:2380 \ --ca-file ./certs/ca.pem \ --cert-file ./certs/etcd-peer.pem \ --key-file ./certs/etcd-peer-key.pem \ --client-cert-auth \ --trusted-ca-file ./certs/ca.pem \ --peer-ca-file ./certs/ca.pem \ --peer-cert-file ./certs/etcd-peer.pem \ --peer-key-file ./certs/etcd-peer-key.pem \ --peer-client-cert-auth \ --peer-trusted-ca-file ./certs/ca.pem \ --log-output stdout

chmod +x /opt/etcd/etcd-server-startup.sh
chown -R etcd.etcd /opt/etcd-v3.3.20
chown -R etcd.etcd /data/etcd/
chown -R etcd.etcd /data/logs/etcd-server/

• 安装supervisor软件

yum install -y supervisor.noarch
systemctl enable --now supervisord.servic

配置该文件
vim /etc/supervisord.d/etcd-server.ini
[program:etcd-server-7-12] command=/opt/etcd/etcd-server-startup.sh ; the program (relative uses PATH, can take args) numprocs=1 ; number of processes copies to start (def 1) directory=/opt/etcd ; directory to cwd to before exec (def no cwd) autostart=true ; start at supervisord start (default: true) autorestart=true ; retstart at unexpected quit (default: true) startsecs=30 ; number of secs prog must stay running (def. 1) startretries=3 ; max # of serial start failures (default 3) exitcodes=0,2 ; 'expected' exit codes for process (default 0,2) stopsignal=QUIT ; signal used to kill process (default TERM) stopwaitsecs=10 ; max num secs to wait b4 SIGKILL (default 10) user=etcd ; setuid to this UNIX account to run the program redirect_stderr=true ; redirect proc stderr to stdout (default false) stdout_logfile=/data/logs/etcd-server/etcd.stdout.log ; stdout log path, NONE for none; default AUTO stdout_logfile_maxbytes=64MB ; max # logfile bytes b4 rotation (default 50MB) stdout_logfile_backups=4 ; # of stdout logfile backups (default 10) stdout_capture_maxbytes=1MB ; number of bytes in 'capturemode' (default 0) stdout_events_enabled=false ; emit events on stdout writes (default false)

启动并检查
supervisorctl update

5.安装其他etcd，同上

vi /opt/etcd/etcd-server-startup.sh // 修改红色的地方为其他etcd的ip
./etcd --name etcd-server-7-12 \ --listen-peer-urls https://10.4.7.12:2380 \ --listen-client-urls https://10.4.7.12:2379,http://127.0.0.1:2379 \
 --initial-advertise-peer-urls https://10.4.7.12:2380 \ --advertise-client-urls https://10.4.7.12:2379,http://127.0.0.1:2379 \ 

vim /etc/supervisord.d/etcd-server.ini  // 修改红色的地方为其他etcd的ip
[program:etcd-server-7-12]

6.查看集群的健康状态