【K8S-ETCD初始化三节点集群】

@王先生12026-05-12 11:05

三个 etcd 节点共同操作

下载 etcd（在三个节点都执行）

bash 复制代码 
ETCD_VER=v3.5.6

curl -L https://github.com/etcd-io/etcd/releases/download/${ETCD_VER}/etcd-${ETCD_VER}-linux-amd64.tar.gz \ 
-o etcd.tar.gz
tar xzf etcd.tar.gz
cp etcd-${ETCD_VER}-linux-amd64/{etcd,etcdctl,etcdutl} /usr/local/bin/
rm -rf etcd-${ETCD_VER}-linux-amd64 etcd.tar.gz

1.2 生成 etcd 证书

在任意一个节点（比如 etcd-1）上使用 `cfssl` 生成证书，然后分发到其他节点。

bash 复制代码 
mkdir -p /etc/etcd/pki && cd /etc/etcd/pki

创建 CA 配置文件：

bash 复制代码 
cat > ca-config.json <<EOF
{
  "signing": {
    "default": {
      "expiry": "87600h"
    },
    "profiles": {
      "etcd": {
        "usages": ["signing", "key encipherment", "server auth", "client auth"],
        "expiry": "87600h"
      }
    }
  }
}
EOF

cat > ca-csr.json <<EOF
{
  "CN": "etcd-ca",
  "key": {
    "algo": "rsa",
    "size": 2048
  }
}
EOF

生成 CA 证书：

bash 复制代码 
cfssl gencert -initca ca-csr.json | cfssljson -bare ca

创建 etcd 证书配置：

bash 复制代码 
cat > etcd-csr.json <<EOF
{
  "CN": "etcd",
  "hosts": [
    "127.0.0.1",
    "192.168.220.111",
    "192.168.220.112",
    "192.168.220.113"
  ],
  "key": {
    "algo": "rsa",
    "size": 2048
  }
}
EOF

生成 etcd 服务端和 peer 证书：

bash 复制代码 
cfssl gencert \
  -ca=ca.pem -ca-key=ca-key.pem \
  -config=ca-config.json -profile=etcd \
  etcd-csr.json | cfssljson -bare etcd

# 为 apiserver 访问 etcd 生成客户端证书
cfssl gencert \
  -ca=ca.pem -ca-key=ca-key.pem \
  -config=ca-config.json -profile=etcd \
  -cn="apiserver-etcd-client" \
  etcd-csr.json | cfssljson -bare apiserver-etcd-client

分发证书到三个 etcd 节点：

bash 复制代码 
for host in 192.168.220.111 192.168.220.112 192.168.220.113; do
  ssh root@${host} "mkdir -p /etc/etcd/pki"
  scp ca.pem etcd.pem etcd-key.pem root@${host}:/etc/etcd/pki/
done

配置 etcd systemd 服务

三个节点分别创建对应的 service 文件：

etcd-1 (192.168.220.111)：

bash 复制代码 
cat > /etc/systemd/system/etcd.service <<EOF
[Unit]
Description=etcd
After=network.target

[Service]
Type=notify
ExecStart=/usr/local/bin/etcd \\
  --name etcd-1 \\
  --data-dir /var/lib/etcd \\
  --listen-client-urls https://192.168.220.111:2379,https://127.0.0.1:2379 \\
  --advertise-client-urls https://192.168.220.111:2379 \\
  --listen-peer-urls https://192.168.220.111:2380 \\
  --initial-advertise-peer-urls https://192.168.220.111:2380 \\
  --initial-cluster "etcd-1=https://192.168.220.111:2380,etcd-2=https://192.168.220.112:2380,etcd-3=https://192.168.220.113:2380" \\
  --initial-cluster-token etcd-cluster \\
  --initial-cluster-state new \\
  --client-cert-auth \\
  --trusted-ca-file /etc/etcd/pki/ca.pem \\
  --cert-file /etc/etcd/pki/etcd.pem \\
  --key-file /etc/etcd/pki/etcd-key.pem \\
  --peer-client-cert-auth \\
  --peer-trusted-ca-file /etc/etcd/pki/ca.pem \\
  --peer-cert-file /etc/etcd/pki/etcd.pem \\
  --peer-key-file /etc/etcd/pki/etcd-key.pem
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF

etcd-2 (192.168.220.112)：

bash 复制代码 
cat > /etc/systemd/system/etcd.service <<EOF
[Unit]
Description=etcd
After=network.target

[Service]
Type=notify
ExecStart=/usr/local/bin/etcd \\
  --name etcd-2 \\
  --data-dir /var/lib/etcd \\
  --listen-client-urls https://192.168.220.112:2379,https://127.0.0.1:2379 \\
  --advertise-client-urls https://192.168.220.112:2379 \\
  --listen-peer-urls https://192.168.220.112:2380 \\
  --initial-advertise-peer-urls https://192.168.220.112:2380 \\
  --initial-cluster "etcd-1=https://192.168.220.111:2380,etcd-2=https://192.168.220.112:2380,etcd-3=https://192.168.220.113:2380" \\
  --initial-cluster-token etcd-cluster \\
  --initial-cluster-state new \\
  --client-cert-auth \\
  --trusted-ca-file /etc/etcd/pki/ca.pem \\
  --cert-file /etc/etcd/pki/etcd.pem \\
  --key-file /etc/etcd/pki/etcd-key.pem \\
  --peer-client-cert-auth \\
  --peer-trusted-ca-file /etc/etcd/pki/ca.pem \\
  --peer-cert-file /etc/etcd/pki/etcd.pem \\
  --peer-key-file /etc/etcd/pki/etcd-key.pem
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF

etcd-3 (192.168.220.113)：

bash 复制代码 
cat > /etc/systemd/system/etcd.service <<EOF
[Unit]
Description=etcd
After=network.target

[Service]
Type=notify
ExecStart=/usr/local/bin/etcd \\
  --name etcd-3 \\
  --data-dir /var/lib/etcd \\
  --listen-client-urls https://192.168.220.113:2379,https://127.0.0.1:2379 \\
  --advertise-client-urls https://192.168.220.113:2379 \\
  --listen-peer-urls https://192.168.220.113:2380 \\
  --initial-advertise-peer-urls https://192.168.220.113:2380 \\
  --initial-cluster "etcd-1=https://192.168.220.111:2380,etcd-2=https://192.168.220.112:2380,etcd-3=https://192.168.220.113:2380" \\
  --initial-cluster-token etcd-cluster \\
  --initial-cluster-state new \\
  --client-cert-auth \\
  --trusted-ca-file /etc/etcd/pki/ca.pem \\
  --cert-file /etc/etcd/pki/etcd.pem \\
  --key-file /etc/etcd/pki/etcd-key.pem \\
  --peer-client-cert-auth \\
  --peer-trusted-ca-file /etc/etcd/pki/ca.pem \\
  --peer-cert-file /etc/etcd/pki/etcd.pem \\
  --peer-key-file /etc/etcd/pki/etcd-key.pem
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF

启动 etcd 并验证：

bash 复制代码 
# 三个节点同时启动
systemctl daemon-reload
systemctl enable etcd
systemctl start etcd

在任意一个节点验证集群状态：

预期输出三个节点都是 `started`，有一个 `leader`。

bash 复制代码 
etcdctl --endpoints=https://192.168.220.111:2379,https://192.168.220.112:2379,https://192.168.220.113:2379 \
  --cacert=/etc/etcd/pki/ca.pem \
  --cert=/etc/etcd/pki/etcd.pem \
  --key=/etc/etcd/pki/etcd-key.pem \
  member list --write-out=table
bash 复制代码 
etcdctl --endpoints=https://192.168.220.111:2379,https://192.168.220.112:2379,https://192.168.220.113:2379 \
  --cacert=/etc/etcd/pki/ca.pem \
  --cert=/etc/etcd/pki/etcd.pem \
  --key=/etc/etcd/pki/etcd-key.pem \
  endpoint status --write-out=table

第二步：部署 Master 节点（192.168.220.110）

2.1 分发 etcd 证书到 Master

bash 复制代码 
mkdir -p /etc/kubernetes/pki/etcd
scp etcd-1:/etc/etcd/pki/ca.pem           /etc/kubernetes/pki/etcd/ca.crt
scp etcd-1:/etc/etcd/pki/apiserver-etcd-client.pem   /etc/kubernetes/pki/apiserver-etcd-client.crt
scp etcd-1:/etc/etcd/pki/apiserver-etcd-client-key.pem /etc/kubernetes/pki/apiserver-etcd-client.key

2.2 创建 kubeadm 配置文件

bash 复制代码 
# /root/kubeadm-config.yaml
apiVersion: kubeadm.k8s.io/v1beta3
kind: ClusterConfiguration
kubernetesVersion: v1.23.17
controlPlaneEndpoint: "192.168.220.110:6443"
imageRepository: registry.cn-hangzhou.aliyuncs.com/google_containers
networking:
  serviceSubnet: "10.96.0.0/16"
  podSubnet: "172.16.0.0/16"
etcd:
  external:
    endpoints:
      - https://192.168.220.111:2379
      - https://192.168.220.112:2379
      - https://192.168.220.113:2379
    caFile: /etc/kubernetes/pki/etcd/ca.crt
    certFile: /etc/kubernetes/pki/apiserver-etcd-client.crt
    keyFile: /etc/kubernetes/pki/apiserver-etcd-client.key
---
apiVersion: kubeadm.k8s.io/v1beta3
kind: InitConfiguration
nodeRegistration:
  criSocket: unix:///var/run/containerd/containerd.sock
相关推荐
weixin_382395234 小时前
为小工厂量身打造：本地部署的物料管理系统带缺料计算
前端·制造
__zRainy__4 小时前
解决pnpm v10+不自动构建
前端·pnpm·工程化
猫猫不是喵喵.5 小时前
Vue3 Props 属性
前端·javascript·vue.js
醉城夜风~6 小时前
CSS元素显示模式（display）
前端·css
AI大模型-小华6 小时前
Codex 三方充值快速入门指南
java·前端·数据库·chatgpt·ai编程·codex·chatgpt pro
做前端的娜娜子9 小时前
同一链接实现 PC Web 与移动 H5 自适应
前端·掘金·金石计划
小帅不太帅9 小时前
架构没变、规模没变，DeepSeek V4 Flash 正式版凭什么暴涨 47 分？
前端·aigc·deepseek
jarvisuni9 小时前
DeepSeekFlash前端依旧拉垮，而且变慢了很多！
前端·javascript·算法
卷福同学10 小时前
AI编程出海第二步：验证关键词能否做站
前端·人工智能·后端
热门推荐
01GitHub 镜像站点02如何新建文件夹？ 电脑新建文件夹的4种方法03国内可直接用、免费额度/永久免费的大模型API清单（含 SiliconFlow、火山、阿里、智谱、百度、Kimi、DeepSeek、DMXAPI 等）042026年7月AI圈大地震：GPT-5.6被政府限制、Claude入驻Slack、Anthropic自研芯片05微信历史版本含下载地址（ Windows PC | 安卓 | MAC ）及设置微信不更新062026 国产 AI 大模型横评：DeepSeek、通义千问、Kimi、文心一言、星火、豆包谁更能打？07AI 编程 IDE 全景解析 2026：Agent 全面接管开发链路08Agnes AI 免费 API 接入指南：文本、生图、生视频，一套接口全免费09历年考研数学一、数学二、数学三真题试卷及答案PDF102026 年 AI 大模型 & AI 编程工具实战全总结