如何在 CentOS 上为 Kubernetes 设置 HA，运行 1 个 Master 2 Worker 已经使用 kubeadm

Question

我已成功设置普通集群，现在当我尝试按照文档 https://kubernetes.io/docs/admin/high-availability/ 进行 HA 设置时

在 /etc/kubernetes/manifest 中复制 etcd.yaml 文件后，我在集群中看到了 3 个 etcd 容器

default etcd-server-kuber-poc-app1 1/1 Running 1 2d default etcd-server-kuber-poc-app2 1/1 Running 72 20h kube-system etcd-kuber-poc-app1 1/1 Running 4 13d

但是当我检查任何 etcd pod 的日志时，我会看到类似的错误

2017-11-15 08:53:25.398815 E |发现：错误＃0：x509：未能 加载系统根目录，没有提供根目录

2017-11-15 08:53:25.398907 我 |发现：集群状态检查：错误 连接到https://discovery.etcd.io，18h12m16s 重试

似乎缺少他们的证书

但我不确定要创建哪些证书以及放置在哪里

Yaml 内容

apiVersion: v1
kind: Pod
metadata:
  name: etcd-server
spec:
  hostNetwork: true
  containers:
  - image: gcr.io/google_containers/etcd:3.0.17
    name: etcd-container
    command:
    - /usr/local/bin/etcd
    - --name
    - NODE-1
    - --initial-advertise-peer-urls
    - http://10.127.38.18:2380
    - --listen-peer-urls
    - http://10.127.38.18:2380
    - --advertise-client-urls
    - http://10.127.38.18:4001
    - --listen-client-urls
    - http://127.0.0.1:4001
    - --data-dir
    - /var/etcd/data
    - --discovery
    - https://discovery.etcd.io/9458bcd46077d558fd26ced5cb9f2a6a
    ports:
    - containerPort: 2380
      hostPort: 2380
      name: serverport
    - containerPort: 4001
      hostPort: 4001
      name: clientport
    volumeMounts:
    - mountPath: /var/etcd
      name: varetcd
    - mountPath: /etc/ssl
      name: etcssl
      readOnly: true
    - mountPath: /usr/share/ssl
      name: usrsharessl
      readOnly: true
    - mountPath: /var/ssl
      name: varssl
      readOnly: true
    - mountPath: /usr/ssl
      name: usrssl
      readOnly: true
    - mountPath: /usr/lib/ssl
      name: usrlibssl
      readOnly: true
    - mountPath: /usr/local/openssl
      name: usrlocalopenssl
      readOnly: true
    - mountPath: /etc/openssl
      name: etcopenssl
      readOnly: true
    - mountPath: /etc/pki/tls
      name: etcpkitls
      readOnly: true
  volumes:
  - hostPath:
      path: /var/etcd/data
    name: varetcd
  - hostPath:
      path: /etc/ssl
    name: etcssl
  - hostPath:
      path: /usr/share/ssl
    name: usrsharessl
  - hostPath:
      path: /var/ssl
    name: varssl
  - hostPath:
      path: /usr/ssl
    name: usrssl
  - hostPath:
      path: /usr/lib/ssl
    name: usrlibssl
  - hostPath:
      path: /usr/local/openssl
    name: usrlocalopenssl
  - hostPath:
      path: /etc/openssl
    name: etcopenssl
  - hostPath:
      path: /etc/pki/tls
    name: etcpkitls

第二期

1) 如何创建证书？

2) 将它们保存在哪里？

Answer 1

我认为我们不能将 kubeadm 集群设为 HA。您的选择是使用 kubespray https://github.com/kubespray/kubespray-cli 工具重新创建集群，这将创建包含所有节点的证书。

如需分步说明，请遵循 Kubernetes The Hard Way https://github.com/kelseyhightower/kubernetes-the-hard-way