安裝etcd叢集
kuberntes 系統使用 etcd 儲存所有資料，是最重要的元件之一，注意 etcd叢集只能有奇數個節點(1,3,5...)，本文件使用3個節點做叢集。
一、基礎環境
軟體包
etcd下載地址：https://github.com/coreos/etcd/releases
伺服器
架構圖
二、生成etcd證書與私鑰
建立etcd配置檔案
{ "CN": "etcd", "hosts": [ "127.0.0.1", "192.168.1.11", "192.168.1.12", "192.168.1.13", "etcd1", "etcd2", "etcd3" ], "key": { "algo": "rsa", "size": 2048 }, "names": [ { "C": "CN", "ST": "BeiJing", "L": "BeiJing", "O": "Ctyun", "OU": "ops" } ] }
hosts：定授權使用該證書的 etcd 節點 IP(應包含叢集內所有節點的IP與hostname)
C：國家
ST：省份
L：城市
O：公司
OU：部門
生成私鑰、證書請求檔案、證書
CA證書在前面的章節建立 Kubernetes證書相關(CFSSL)
cfssl gencert -ca=/opt/ssl/k8sca/ca.pem \ -ca-key=/opt/ssl/k8sca/ca-key.pem \ -config=/opt/ssl/k8sca/ca-config.json \ -profile=kubernetes /opt/ssl/etcd/etcd-csr.json | cfssljson -bare etcd
-ca：指定CA證書路徑
-ca-key：指定CAKey的路徑
-config：指定CA證書籤署策略配置檔案
二、啟動和配置etcd
建立etcd配置檔案etcd.conf，此配置檔案是定義一些變數，方便etcd.service檔案中直接引用、方便後期維護。
配置檔案的所有含義都在建立etcd.service配置檔案後有詳解。
mkdir -p /etc/etcd vim /etc/etcd/etcd.conf # [member] ETCD_NAME=etcd1 ETCD_DATA_DIR="/var/lib/etcd" ETCD_LISTEN_PEER_URLS="https://192.168.1.11:2380" ETCD_LISTEN_CLIENT_URLS="https://192.168.1.11:2379" #[cluster] ETCD_INITIAL_ADVERTISE_PEER_URLS="https://192.168.1.11:2380" ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster" ETCD_ADVERTISE_CLIENT_URLS="https://192.168.1.11:2379"
建立etcd.service配置檔案
etcd.service的變數都是引用etcd配置檔案中
mkdir /var/lib/etcd
vim /usr/lib/systemd/system/etcd.service
[Unit]
Description=Etcd Server
After=network.target
After=network-online.target
Wants=network-online.target
Documentation=https://github.com/coreos
[Service]
Type=notify
WorkingDirectory=${ETCD_DATA_DIR}
EnvironmentFile=/etc/etcd/etcd.conf
ExecStart=/usr/local/bin/etcd \
--name=etcd1 \
--cert-file=/opt/ssl/etcd/etcd.pem \
--key-file=/opt/ssl/etcd/etcd-key.pem \
--peer-cert-file=/opt/ssl/etcd/etcd.pem \
--peer-key-file=/opt/ssl/etcd/etcd-key.pem \
--trusted-ca-file=/opt/ssl/k8sca/ca.pem \
--peer-trusted-ca-file=/opt/ssl/k8sca/ca.pem \
--initial-advertise-peer-urls=${ETCD_INITIAL_ADVERTISE_PEER_URLS} \
--listen-peer-urls=${ETCD_LISTEN_PEER_URLS} \
--listen-client-urls=${ETCD_LISTEN_CLIENT_URLS},http://127.0.0.1:2379 \
--advertise-client-urls=${ETCD_ADVERTISE_CLIENT_URLS} \
--initial-cluster-token=${ETCD_INITIAL_CLUSTER_TOKEN} \
--initial-cluster etcd1=https://192.168.1.11:2380,etcd2=https://192.168.1.12:2380,etcd3=https://192.168.1.13:2380 \
--initial-cluster-state=new \
--data-dir=/var/lib/etcd
Restart=on-failure
RestartSec=5
LimitNOFILE=65536
[Install]
WantedBy=multi-user.target--initial-cluster：叢集當中的其他節點
--cert-file：etcd證書路徑
--key-file：etcd私鑰路徑
--peer-cert-file：對等證書(雙向證書)路徑
--peer-key-file：對等證書(雙向證書)私鑰路徑
--trusted-ca-file：作為客戶端時的CA證書路徑
--peer-trusted-ca-file：對等證書的CA證書路徑
--initial-advertise-peer-urls：列出叢集成員通訊的URL，用於通告叢集其他成員
--listen-peer-urls：用於監聽叢集其他成員的URL列表
--listen-client-urls：用於監聽客戶端通訊的URL列表
--advertise-client-urls：通告客戶端的URL，用於列出所有客戶端
--initial-cluster-token：etcd叢集的初始叢集令牌，伺服器必須通過令牌才能加入etcd叢集
啟動etcd叢集
叢集所有節點都配置好配置檔案，同時啟動。
systemctl daemon-reload && systemctl enable etcd && systemctl start etcd不使用變數的配置方法
前面分別建立了/etc/etcd/etcd.conf與/var/lib/systemd/system/etcd.service兩個配置檔案，且etcd.service引用了etcd.conf重定義的變數。
如若不想引用變數，可以不寫etcd.conf。僅建立etcd.service如下
[[email protected] k8sca]# cat /usr/lib/systemd/system/etcd.service
[Unit]
Description=Etcd Server
After=network.target
After=network-online.target
Wants=network-online.target
Documentation=https://github.com/coreos
[Service]
Type=notify
WorkingDirectory=/var/lib/etcd/
ExecStart=/usr/local/bin/etcd \
--name etcd1 \
--cert-file=/opt/ssl/etcd/etcd.pem \
--key-file=/opt/ssl/etcd/etcd-key.pem \
--peer-cert-file=/opt/ssl/etcd/etcd.pem \
--peer-key-file=/opt/ssl/etcd/etcd-key.pem \
--trusted-ca-file=/opt/ssl/k8sca/ca.pem \
--peer-trusted-ca-file=/opt/ssl/k8sca/ca.pem \
--initial-advertise-peer-urls=https://192.168.1.11:2380 \
--listen-peer-urls=https://192.168.1.11:2380 \
--listen-client-urls=https://192.168.1.11:2379,http://127.0.0.1:2379 \
--advertise-client-urls=https://192.168.1.11:2379 \
--initial-cluster-token=etcd-cluster-0 \
--initial-cluster etcd1=https://192.168.1.11:2380,etcd2=https://192.168.1.12:2380,etcd3=https://192.168.1.13:2380 \
--initial-cluster-state=new \
--data-dir=/var/lib/etcd
Restart=on-failure
RestartSec=5
LimitNOFILE=65536
[Install]
WantedBy=multi-user.target
三、測試叢集狀態
叢集中所有主機配置均一致，僅IP地址不同。
$ etcdctl --ca-file=/opt/ssl/k8sca/ca.pem --cert-file=/opt/ssl/etcd/etcd.pem --key-file=/opt/ssl/etcd/etcd-key.pem cluster-health
member aa869cb0f2e7ed31 is healthy: got healthy result from https://192.168.1.11:2379
member b08a644fd7247c5e is healthy: got healthy result from https://192.168.1.13:2379
member bb9bd2baaebf7d95 is healthy: got healthy result from https://192.168.1.12:2379
常見問題
- publish error: etcdserver: request timed out
我部署時先使用一臺進行測試，無論如何啟動etcd都無法啟動，提示publish error: etcdserver: request timed out。後來發現etcd.service中制定了其他etcd主機，所以當單獨啟動一臺是連線其他主機不通，那麼etcd就啟動失敗。所以要把etcd叢集中所有主機都配置好，同時啟動就OK了。
參考
http://blog.51cto.com/sgk2011/2108542
https://github.com/gjmzj/kubeasz/blob/master/docs/setup/02-install_etcd.md
https://blog.csdn.net/qq_33199919/article/details/80623055
https://skyao.gitbooks.io/learning-etcd3/content/