【Raspberry Pi】编译安装Etcd集群

生成CA证书

mkdir /etc/etcd/cert -v
curl -L https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 -o /usr/local/bin/cfssl
curl -L https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 -o /usr/local/bin/cfssljson
curl -L https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64 -o /usr/local/bin/cfssl-certinfo
chmod +x /usr/local/bin/cfssl /usr/local/bin/cfssljson /usr/local/bin/cfssl-certinfo
cat > /etc/etcd/cert/ca-config.json  << EOF
{
  "signing": {
    "default": {
      "expiry": "87600h"
    },
    "profiles": {
      "www": {
         "expiry": "87600h",
         "usages": [
            "signing",
            "key encipherment",
            "server auth",
            "client auth"
        ],
  "expiry": "87600h"
      }
    }
  }
}
EOF
cat > /etc/etcd/cert/ca-csr.json  << EOF
{
    "CN": "etcd CA",
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "ShenZhen",
            "ST": "ShenZhen",
      "O": "k8s",
            "OU": "System"
        }
    ],
    "ca": {
  "expiry": "87600h"
    }
}
EOF
cat > /etc/etcd/cert/server-csr.json  << EOF
{
    "CN": "etcd",
    "hosts": [
    "127.0.0.1",
    "172.16.0.0/16",
    "172.31.1.101",
    "172.31.1.102",
    "172.31.1.103",
    "172.31.1.201",
    "172.31.1.202",
    "172.31.1.203",
    "master1",
    "master2",
    "master3",
    "master1.k8s.abu.pub",
    "master2.k8s.abu.pub",
    "master3.k8s.abu.pub",
    "etcd1",
    "etcd2",
    "etcd3",
    "etcd1.k8s.abu.pub",
    "etcd2.k8s.abu.pub",
    "etcd3.k8s.abu.pub",
    "kubernetes",
    "kubernetes.default",
    "kubernetes.default.svc",
    "kubernetes.default.svc.cluster",
    "kubernetes.default.svc.cluster.local"
    ],
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "ShenZhen",
            "ST": "ShenZhen",
      "O": "k8s",
            "OU": "System"
        }
    ]
}
EOF
cd /etc/etcd/cert
cfssl gencert -initca ca-csr.json | cfssljson -bare ca -
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=www server-csr.json | cfssljson -bare server

安装ETCD

# yum install etcd-3.3.11 -y
ansible master -m yum -a "name=etcd-3.3.11 state=present"
ansible master -m shell -a "rpm -qa | grep etcd"
ansible master -m shell -a "systemctl enable etcd"
ansible master -m shell -a "systemctl status etcd"

分发证书

ansible master -m copy -a "src=/root/cert dest=/etc/etcd/"
ansible master -m shell -a "ls -l /etc/etcd/"

修改SYSTEMD

[root@node01 ~]# ssh master1
Last login: Tue Feb  9 20:24:48 2021 from 172.31.1.101
[root@master1 ~]# cat /usr/lib/systemd/system/etcd.service
[Unit]
Description=Etcd Server
After=network.target
After=network-online.target
Wants=network-online.target

[Service]
Type=notify
WorkingDirectory=/var/lib/etcd/
EnvironmentFile=-/etc/etcd/etcd.conf
User=etcd
# set GOMAXPROCS to number of processors
ExecStart=/bin/bash -c "GOMAXPROCS=$(nproc) /usr/bin/etcd --name=\"${ETCD_NAME}\" --data-dir=\"${ETCD_DATA_DIR}\" --listen-client-urls=\"${ETCD_LISTEN_CLIENT_URLS}\" --listen-peer-urls=\"${ETCD_LISTEN_PEER_URLS}\" --advertise-client-urls=\"${ETCD_ADVERTISE_CLIENT_URLS}\" --initial-cluster-token=\"${ETCD_INITIAL_CLUSTER_TOKEN}\" --initial-cluster=\"${ETCD_INITIAL_CLUSTER}\" --initial-cluster-state=\"${ETCD_INITIAL_CLUSTER_STATE}\" --cert-file=/etc/etcd/cert/server.pem --key-file=/etc/etcd/cert/server-key.pem --peer-cert-file=/etc/etcd/cert/server.pem --peer-key-file=/etc/etcd/cert/server-key.pem --trusted-ca-file=/etc/etcd/cert/ca.pem --peer-trusted-ca-file=/etc/etcd/cert/ca.pem"
Restart=on-failure
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target

修改配置文件

[root@node01 ~]# ansible master -m shell -a "cat /etc/etcd/etcd.conf"
master2 | CHANGED | rc=0 >>
ETCD_NAME=etcd2
ETCD_DATA_DIR="/var/lib/etcd/etcd2"
ETCD_LISTEN_PEER_URLS="https://172.31.1.202:2380"
ETCD_LISTEN_CLIENT_URLS="https://127.0.0.1:2379,https://172.31.1.202:2379"
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://172.31.1.202:2380"
ETCD_INITIAL_CLUSTER="etcd1=https://172.31.1.201:2380,etcd2=https://172.31.1.202:2380,etcd3=https://172.31.1.203:2380"
ETCD_INITIAL_CLUSTER_STATE="new"
ETCD_INITIAL_CLUSTER_TOKEN="etcd_cluster"
ETCD_ADVERTISE_CLIENT_URLS="https://172.31.1.202:2379"

master3 | CHANGED | rc=0 >>
ETCD_NAME=etcd3
ETCD_DATA_DIR="/var/lib/etcd/etcd3"
ETCD_LISTEN_PEER_URLS="https://172.31.1.203:2380"
ETCD_LISTEN_CLIENT_URLS="https://127.0.0.1:2379,https://172.31.1.203:2379"
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://172.31.1.203:2380"
ETCD_INITIAL_CLUSTER="etcd1=https://172.31.1.201:2380,etcd2=https://172.31.1.202:2380,etcd3=https://172.31.1.203:2380"
ETCD_INITIAL_CLUSTER_STATE="new"
ETCD_INITIAL_CLUSTER_TOKEN="etcd_cluster"
ETCD_ADVERTISE_CLIENT_URLS="https://172.31.1.203:2379"

master1 | CHANGED | rc=0 >>
ETCD_NAME=etcd1
ETCD_DATA_DIR="/var/lib/etcd/etcd1"
ETCD_LISTEN_PEER_URLS="https://172.31.1.201:2380"
ETCD_LISTEN_CLIENT_URLS="https://127.0.0.1:2379,https://172.31.1.201:2379"
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://172.31.1.201:2380"
ETCD_INITIAL_CLUSTER="etcd1=https://172.31.1.201:2380,etcd2=https://172.31.1.202:2380,etcd3=https://172.31.1.203:2380"
ETCD_INITIAL_CLUSTER_STATE="new"
ETCD_INITIAL_CLUSTER_TOKEN="etcd_cluster"
ETCD_ADVERTISE_CLIENT_URLS="https://172.31.1.201:2379"

启动集群

[root@node01 ~]# ansible master -m shell -a "ls -la /etc/etcd"
[root@node01 ~]# ansible master -m shell -a "chown etcd.etcd  -R /etc/etcd"
[root@node01 ~]# ansible master -m shell -a "ls -la /etc/etcd"
[root@node01 ~]# ansible master -m shell -a "systemctl daemon-reload"
[root@node01 ~]# ansible master -m shell -a "systemctl restart etcd"

分发HOSTS文件

[root@node01 ~]# ansible master -m copy -a "src=/etc/hosts dest=/etc/hosts"
[root@node01 ~]# ansible master -m shell -a "cat /etc/hosts"
master3 | CHANGED | rc=0 >>
127.0.0.1               localhost.localdomain localhost
::1             localhost6.localdomain6 localhost6
172.31.1.101 node01.k8s.abu.pub node01
172.31.1.201 master1.k8s.abu.pub master1 etcd1.k8s.abu.pub etcd1
172.31.1.202 master2.k8s.abu.pub master2 etcd2.k8s.abu.pub etcd2
172.31.1.203 master3.k8s.abu.pub master3 etcd3.k8s.abu.pub etcd3

master2 | CHANGED | rc=0 >>
127.0.0.1               localhost.localdomain localhost
::1             localhost6.localdomain6 localhost6
172.31.1.101 node01.k8s.abu.pub node01
172.31.1.201 master1.k8s.abu.pub master1 etcd1.k8s.abu.pub etcd1
172.31.1.202 master2.k8s.abu.pub master2 etcd2.k8s.abu.pub etcd2
172.31.1.203 master3.k8s.abu.pub master3 etcd3.k8s.abu.pub etcd3

master1 | CHANGED | rc=0 >>
127.0.0.1               localhost.localdomain localhost
::1             localhost6.localdomain6 localhost6
172.31.1.101 node01.k8s.abu.pub node01
172.31.1.201 master1.k8s.abu.pub master1 etcd1.k8s.abu.pub etcd1
172.31.1.202 master2.k8s.abu.pub master2 etcd2.k8s.abu.pub etcd2
172.31.1.203 master3.k8s.abu.pub master3 etcd3.k8s.abu.pub etcd3

查看集群节点

[root@node01 ~]# etcdctl --ca-file=/etc/etcd/cert/ca.pem --cert-file=/etc/etcd/cert/server.pem --key-file=/etc/etcd/cert/server-key.pem --endpoints="https://etcd1:2379,https://etcd2:2379,https://etcd3:2379" member list
50f4483344412302: name=etcd1 peerURLs=https://172.31.1.201:2380 clientURLs=https://172.31.1.201:2379 isLeader=false
8dac7320d24550da: name=etcd3 peerURLs=https://172.31.1.203:2380 clientURLs=https://172.31.1.203:2379 isLeader=true
95452f9b859b3d69: name=etcd2 peerURLs=https://172.31.1.202:2380 clientURLs=https://172.31.1.202:2379 isLeader=false

查看集群状况

[root@node01 ~]# etcdctl --ca-file=/etc/etcd/cert/ca.pem --cert-file=/etc/etcd/cert/server.pem --key-file=/etc/etcd/cert/server-key.pem --endpoints="https://etcd1:2379,https://etcd2:2379,https://etcd3:2379" cluster-health
member 50f4483344412302 is healthy: got healthy result from https://172.31.1.201:2379
member 8dac7320d24550da is healthy: got healthy result from https://172.31.1.203:2379
member 95452f9b859b3d69 is healthy: got healthy result from https://172.31.1.202:2379
cluster is healthy

Golang编程客户端

go env -w GOPROXY=https://goproxy.io,direct
# go env -w GOPRIVATE=*.code.abu.pub,github.com/abuxliu
# go env -w GO111MODULE=on
# go get -v github.com/coreos/etcd/clientv3
go get github.com/coreos/etcd/clientv3@v3.3.11

附件1：编译安装

wget -O etcd-v3.4.14.src.tgz https://github.com/etcd-io/etcd/archive/v3.4.14.tar.gz
tar -xzvf etcd-v3.4.14.src.tgz
cd etcd-3.4.14
export GO111MODULE=on
export GOPROXY=https://goproxy.cn
go mod vendor
./build
yum install etcd
rpm -ql etcd

附件2：命令行使用方式

yum install etcd -y
cat /etc/etcd/etcd.conf
etcd --version
etcdctl set /testdir/testkey "Hello world"
etcdctl get /testdir/testkey
etcdctl update /testdir/testkey "Hello"
etcdctl rm /testdir/testkey
etcdctl ls
etcdctl member list

参考文献

etcd源码编译和简单使用
etcd集群yum安装方法(带ssl安全认证)
Etcd集群的搭建以及分析
使用Go env命令设置Go的环境
etcd证书配置
Etcd clientV3 配置TLS证书
Go 学习笔记（58）— Go 第三方库之 etcd/clientv3（连接客户端、PUT、GET、Lease、Op、Txn、Watch 基础概念说明）
golang etcd clientv3踩坑，rpc error: code = 1 desc = "context canceled"以及github.com\coreos\etcd@v3.3...

最后编辑于 ：
©著作权归作者所有,转载或内容合作请联系作者
  • 人面猴
    序言：七十年代末，一起剥皮案震惊了整个滨河市，随后出现的几起案子，更是在滨河造成了极大的恐慌，老刑警刘岩，带你破解...
    沈念sama阅读 217,185评论 6赞 503
  • 死咒
    序言：滨河连续发生了三起死亡事件，死亡现场离奇诡异，居然都是意外死亡，警方通过查阅死者的电脑和手机，发现死者居然都...
    沈念sama阅读 92,652评论 3赞 393
  • 救了他两次的神仙让他今天三更去死
    文/潘晓璐 我一进店门，熙熙楼的掌柜王于贵愁眉苦脸地迎上来，“玉大人，你说我怎么就摊上这事。” “怎么了？”我有些...
    开封第一讲书人阅读 163,524评论 0赞 353
  • 道士缉凶录：失踪的卖姜人
    文/不坏的土叔 我叫张陵，是天一观的道长。 经常有香客问我，道长，这世上最难降的妖魔是什么？ 我笑而不...
    开封第一讲书人阅读 58,339评论 1赞 293
  • 港岛之恋（遗憾婚礼）
    正文 为了忘掉前任，我火速办了婚礼，结果婚礼上，老公的妹妹穿的比我还像新娘。我一直安慰自己，他们只是感情好，可当我...
    茶点故事阅读 67,387评论 6赞 391
  • 恶毒庶女顶嫁案：这布局不是一般人想出来的
    文/花漫 我一把揭开白布。 她就那样静静地躺着，像睡着了一般。 火红的嫁衣衬着肌肤如雪。 梳的纹丝不乱的头发上，一...
    开封第一讲书人阅读 51,287评论 1赞 301
  • 城市分裂传说
    那天，我揣着相机与录音，去河边找鬼。 笑死，一个胖子当着我的面吹牛，可吹牛的内容都是我干的。 我是一名探鬼主播，决...
    沈念sama阅读 40,130评论 3赞 418
  • 双鸳鸯连环套：你想象不到人心有多黑
    文/苍兰香墨 我猛地睁开眼，长吁一口气：“原来是场噩梦啊……” “哼！你这毒妇竟也来了？” 一声冷哼从身侧响起，我...
    开封第一讲书人阅读 38,985评论 0赞 275
  • 万荣杀人案实录
    序言：老挝万荣一对情侣失踪，失踪者是张志新（化名）和其女友刘颖，没想到半个月后，有当地人在树林里发现了一具尸体，经...
    沈念sama阅读 45,420评论 1赞 313
  • 护林员之死
    正文 独居荒郊野岭守林人离奇死亡，尸身上长有42处带血的脓包…… 初始之章·张勋 以下内容为张勋视角 年9月15日...
    茶点故事阅读 37,617评论 3赞 334
  • 白月光启示录
    正文 我和宋清朗相恋三年，在试婚纱的时候发现自己被绿了。 大学时的朋友给我发了我未婚夫和他白月光在一起吃饭的照片。...
    茶点故事阅读 39,779评论 1赞 348
  • 活死人
    序言：一个原本活蹦乱跳的男人离奇死亡，死状恐怖，灵堂内的尸体忽然破棺而出，到底是诈尸还是另有隐情，我是刑警宁泽，带...
    沈念sama阅读 35,477评论 5赞 345
  • 日本核电站爆炸内幕
    正文 年R本政府宣布，位于F岛的核电站，受9级特大地震影响，放射性物质发生泄漏。R本人自食恶果不足惜，却给世界环境...
    茶点故事阅读 41,088评论 3赞 328
  • 男人毒药：我在死后第九天来索命
    文/蒙蒙 一、第九天 我趴在偏房一处隐蔽的房顶上张望。 院中可真热闹，春花似锦、人声如沸。这庄子的主人今日做“春日...
    开封第一讲书人阅读 31,716评论 0赞 22
  • 一桩弑父案，背后竟有这般阴谋
    文/苍兰香墨 我抬头看了看天上的太阳。三九已至，却和暖如春，着一层夹袄步出监牢的瞬间，已是汗流浃背。 一阵脚步声响...
    开封第一讲书人阅读 32,857评论 1赞 269
  • 情欲美人皮
    我被黑心中介骗来泰国打工， 没想到刚下飞机就差点儿被人妖公主榨干…… 1. 我叫王不留，地道东北人。 一个月前我还...
    沈念sama阅读 47,876评论 2赞 370
  • 代替公主和亲
    正文 我出身青楼，却偏偏与公主长得像，于是被迫代替她去往敌国和亲。 传闻我的和亲对象是个残疾皇子，可洞房花烛夜当晚...
    茶点故事阅读 44,700评论 2赞 354

推荐阅读更多精彩内容