etcd 集群部署（etcd 外挂）

最新推荐文章于 2026-05-12 12:03:05 发布

原创最新推荐文章于 2026-05-12 12:03:05 发布 · 271 阅读

0 ·

本内容遵循CC 4.0 BY-SA版权协议

标签

#kubernetes #运维 #linux

kubenetes 同时被 2 个专栏收录

12 篇文章

订阅专栏

linux

7 篇文章

订阅专栏

本文档详细介绍了如何在Kubernetes集群中配置etcd，包括证书的生成、etcd的安装与配置，以及k8s与etcd的连接。首先，通过cfssl工具生成etcd集群所需的证书，然后在三台机器上部署etcd并配置相应的SSL证书。接着，展示了etcd的配置文件内容，解释了各参数含义。最后，给出了kubeadm配置文件中与etcd连接的部分，展示如何连接外部etcd集群。

kubernetes 集群资源清单

	IP	hostname	etcd
master	10.0.2.4	master-2-4	etcd1	etcd 外挂
node1	10.0.2.5	node1-2-5	etcd2	使用https
node2	10.0.2.6	node2-2-6	etcd3

1、准备生成证书工具

wget https://github.com/cloudflare/cfssl/releases/download/v1.6.0/cfssl_1.6.0_linux_amd64 -O cfssl
wget https://github.com/cloudflare/cfssl/releases/download/v1.6.0/cfssljson_1.6.0_linux_amd64 -O cfssljson
wget https://github.com/cloudflare/cfssl/releases/download/v1.6.0/cfssl-certinfo_1.6.0_linux_amd64 -O cfssl-certinfo

chmod +x cfssl*
mv cfssl* /usr/local/bin/

2、准备json 文件,生成证书

下载3个工具，编辑4个json文件，生成5个pem

root@BJ-HW-VM-17-61 etcd]# cat ca-csr.json
{
  "CN": "etcd-ca",
  "key": {
      "algo": "rsa",
      "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "Beijing",
      "L": "Beijing",
      "O": "etcd-ca",
      "OU": "etcd-ca"
    }
  ],
  "ca": {
          "expiry": "876000h"
  }
}


cfssl gencert -initca ca-csr.json | cfssljson -bare ca

=> 会生成：ca-key.pem, ca.csr, ca.pem


[root@BJ-HW-VM-17-61 etcd]# cat ca-config.json
{
  "signing": {
      "default": {
          "expiry": "876000h"
        },
      "profiles": {
          "etcd-ca": {
              "usages": [
                  "signing",
                  "key encipherment",
                  "server auth",
                  "client auth"
              ],
              "expiry": "876000h"
          }
      }
  }
}


[root@BJ-HW-VM-17-61 etcd]# cat etcd-csr.json
{
  "CN": "etcd",
  "hosts": [
    "127.0.0.1",
    "10.0.2.4",
    "10.0.2.5",
    "10.0.2.6",
    "algo": "rsa",
    "size": 2048
  },
  "names": [{
    "C": "CN",
    "ST": "Beijing",
    "L": "Beijing",
    "O": "etcd",
    "OU": "etcd"
  }]
}


 cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=etcd-ca etcd-csr.json | cfssljson  -bare etcd
 会生成：etcd-key.pem, etcd.csr, etcd.pem
 

 [root@BJ-HW-VM-17-61 etcd]# cat client-csr.json
{
  "CN": "client",
  "hosts": [""],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [{
    "C": "CN",
    "ST": "Beijing",
    "L": "Beijing",
    "O": "etcd",
    "OU": "etcd"
  }]
}

 cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=etcd-ca client-csr.json | cfssljson  -bare client
 
 
 将来有用的：ca.pem  etcd.pem etcd-key.pem client.pem client-key.pem
 
 同样的文件，复制到3个机器上/etc/etcd/etcdssl/ 下
 
 修改权限 chmod 755 /etc/etcd/etcdssl/*

3、安装etcd

yum install -y etcd
systemctl enable etcd --now
systemctl restart etcd
systemctl status etcd
systemctl stop etcd

4、配置etcd

cat /etc/etcd/etcd.conf
#[Member]
ETCD_DATA_DIR="/data/etcd"  #目录必须存在
ETCD_LISTEN_PEER_URLS="https://10.0.2.4:2380"  #IP地址根据主机更改
ETCD_LISTEN_CLIENT_URLS="https://10.0.2.4:2379" #IP地址根据主机更改
ETCD_NAME="etcd1"
#[Clustering]
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://10.0.2.4:2380"
ETCD_ADVERTISE_CLIENT_URLS="https://10.0.2.4:2379"
ETCD_INITIAL_CLUSTER="etcd1=https://10.0.2.4:2380,etcd2=https://10.0.2.5:2380,etcd3=https://10.0.2.6:2380"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
ETCD_INITIAL_CLUSTER_STATE="new"
#[Security]
ETCD_CERT_FILE="/etc/etcd/etcdssl/etcd.pem"
ETCD_KEY_FILE="/etc/etcd/etcdssl/etcd-key.pem"
ETCD_CLIENT_CERT_AUTH="true"
ETCD_TRUSTED_CA_FILE="/etc/etcd/etcdssl/ca.pem"
ETCD_AUTO_TLS="true"
ETCD_PEER_CERT_FILE="/etc/etcd/etcdssl/etcd.pem"
ETCD_PEER_KEY_FILE="/etc/etcd/etcdssl/etcd-key.pem"
ETCD_PEER_CLIENT_CERT_AUTH="true"
ETCD_PEER_TRUSTED_CA_FILE="/etc/etcd/etcdssl/ca.pem"
ETCD_PEER_AUTO_TLS="true"

同时将以上的 etcd.conf 配置文件拷贝到其他两台机器上面

上述配置项的说明

--name：etcd集群中的节点名，这里可以随意，可区分且不重复就行
--listen-peer-urls：监听的用于节点之间通信的url，可监听多个，集群内部将通过这些url进行数据交互(如选举，数据同步等)
--initial-advertise-peer-urls：建议用于节点之间通信的url，节点间将以该值进行通信。
--listen-client-urls：监听的用于客户端通信的url，同样可以监听多个。
--advertise-client-urls：建议使用的客户端通信 url，该值用于 etcd 代理或 etcd 成员与 etcd 节点通信。
--initial-cluster-token： etcd-cluster-1，节点的 token 值，设置该值后集群将生成唯一 id，并为每个节点也生成唯一 id，当使用相同配置文件再启动一个集群时，只要该 token 值不一样，etcd 集群就不会相互影响。
--initial-cluster：也就是集群中所有的 initial-advertise-peer-urls 的合集。
--initial-cluster-state：new，新建集群的标志

5、etcd集群和 k8s 连接（kubeadm-config.yaml）

apiVersion: kubeadm.k8s.io/v1beta3
bootstrapTokens:
- groups:
  - system:bootstrappers:kubeadm:default-node-token
  token: abcdef.0123456789abcdef
  ttl: 24h0m0s
  usages:
  - signing
  - authentication
kind: InitConfiguration
localAPIEndpoint:
  advertiseAddress: 10.0.2.4
  bindPort: 6443
nodeRegistration:
  criSocket: /var/run/dockershim.sock
  imagePullPolicy: IfNotPresent
  name: master-2-4
  taints: null
---
apiServer:
  timeoutForControlPlane: 4m0s
apiVersion: kubeadm.k8s.io/v1beta3
certificatesDir: /etc/kubernetes/pki
imageRepository: registry.cn-hangzhou.aliyuncs.com/google_containers
clusterName: kubernetes
controllerManager: {}
dns: {}
etcd:     
    external:  #表示外部etcd
        endpoints:
        - https://10.0.2.4:2379
        - https://10.0.2.5:2379
        - https://10.0.2.6:2379
        caFile: /etc/etcd/etcdssl/ca.pem
        certFile: /etc/etcd/etcdssl/etcd.pem
        keyFile: /etc/etcd/etcdssl/etcd-key.pem
kind: ClusterConfiguration
kubernetesVersion: 1.22.0
networking:
  dnsDomain: cluster.local
  podSubnet: 10.244.0.0/16
  serviceSubnet: 10.96.0.0/12
scheduler: {}