whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update high-availability.md (#8770)

Browse Source 
* Update high-availability.md

[fix]command should leading

* Repair code inside list items, remove "like so"

* Modify one code block, change 1-step procedures to not be procedures
This commit is contained in:
Stewart-YU
2018-06-01 07:02:56 +08:00
committed by k8s-ci-robot
parent 3e739c0e9f
commit ba96bc236e
1 changed files with 299 additions and 323 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/setup/independent/high-availability.md
+41 -65
View File
@@ -55,7 +55,7 @@ For **Option 2**: you can skip to the next step. Any reference to `etcd0`, `etcd
1. Install `cfssl` and `cfssljson`:
```shell
```bash
curl -o /usr/local/bin/cfssl https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
curl -o /usr/local/bin/cfssljson https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
chmod +x /usr/local/bin/cfssl*
@@ -63,11 +63,10 @@ For **Option 2**: you can skip to the next step. Any reference to `etcd0`, `etcd
1. SSH into `etcd0` and run the following:
```shell
```bash
mkdir -p /etc/kubernetes/pki/etcd
cd /etc/kubernetes/pki/etcd
```
```shell
cat >ca-config.json <<EOF
{
"signing": {
@@ -106,7 +105,7 @@ For **Option 2**: you can skip to the next step. Any reference to `etcd0`, `etcd
}
EOF
```
```shell
```bash
cat >ca-csr.json <<EOF
{
"CN": "etcd",
@@ -123,19 +122,16 @@ For **Option 2**: you can skip to the next step. Any reference to `etcd0`, `etcd
See [the CFSSL wiki](https://github.com/cloudflare/cfssl/wiki/Creating-a-new-CSR) for an example.
{{< /note >}}
1. Next, generate the CA certs like so:
```shell
1. Next, generate the CA certs:
```bash
cfssl gencert -initca ca-csr.json | cfssljson -bare ca -
```
### Generate etcd client certs
1. Generate the client certificates.
Generate the client certificates. While on `etcd0`, run the following:
While on `etcd0`, run the following:
```shell
```bash
cat >client.json <<EOF
{
"CN": "client",
@@ -146,11 +142,11 @@ For **Option 2**: you can skip to the next step. Any reference to `etcd0`, `etcd
}
EOF
```
```shell
```bash
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=client client.json | cfssljson -bare client
```
This should result in `client.pem` and `client-key.pem` being created.
Both `client.pem` and `client-key.pem` are created.
### Create SSH access
@@ -158,7 +154,7 @@ In order to copy certs between machines, you must enable SSH access for `scp`.
1. First, open new tabs in your shell for `etcd1` and `etcd2`. Ensure you are SSHed into all three machines and then run the following (it will be a lot quicker if you use tmux syncing - to do this in iTerm enter `cmd+shift+i`):
```shell
```bash
export PEER_NAME=$(hostname)
export PRIVATE_IP=$(ip addr show eth1 | grep -Po 'inet \K[\d.]+')
```
@@ -166,16 +162,14 @@ In order to copy certs between machines, you must enable SSH access for `scp`.
Make sure that `eth1` corresponds to the network interface for the IPv4 address of the private network. This might vary depending on your networking setup, so please check by running `echo $PRIVATE_IP` before continuing.
1. Next, generate some SSH keys for the boxes:
```shell
```bash
ssh-keygen -t rsa -b 4096 -C "<email>"
```
Make sure to replace `<email>` with your email, a placeholder, or an empty string. Keep hitting enter until files exist in `~/.ssh`.
1. Output the contents of the public key file for `etcd1` and `etcd2`, like so:
```shell
1. Output the contents of the public key file for `etcd1` and `etcd2`:
```bash
cat ~/.ssh/id_rsa.pub
```
@@ -184,8 +178,7 @@ In order to copy certs between machines, you must enable SSH access for `scp`.
### Generate etcd server and peer certs
1. In order to generate certs, each etcd machine needs the root CA generated by `etcd0`. On `etcd1` and `etcd2`, run the following:
```shell
```bash
mkdir -p /etc/kubernetes/pki/etcd
cd /etc/kubernetes/pki/etcd
scp root@<etcd0-ip-address>:/etc/kubernetes/pki/etcd/ca.pem .
@@ -198,13 +191,13 @@ In order to copy certs between machines, you must enable SSH access for `scp`.
Where `<etcd0-ip-address>` corresponds to the public or private IPv4 of `etcd0`.
1. Once this is done, run the following on all etcd machines:
```shell
```bash
cfssl print-defaults csr > config.json
sed -i '0,/CN/{s/example\.net/'"$PEER_NAME"'/}' config.json
sed -i 's/www\.example\.net/'"$PRIVATE_IP"'/' config.json
sed -i 's/example\.net/'"$PEER_NAME"'/' config.json
```
```bash
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=server config.json | cfssljson -bare server
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=peer config.json | cfssljson -bare peer
```
@@ -212,17 +205,16 @@ In order to copy certs between machines, you must enable SSH access for `scp`.
The above will replace the default configuration with your machine's hostname as the peer name, and its IP addresses. Make sure
these are correct before generating the certs. If you found an error, reconfigure `config.json` and re-run the `cfssl` commands.
This will result in the following files: `peer.pem`, `peer-key.pem`, `server.pem`, `server-key.pem`.
This results in the following files: `peer.pem`, `peer-key.pem`, `server.pem`, `server-key.pem`.
### {{< tabs name="etcd_mode" >}}
{{% tab name="Choose one..." %}}
Please select one of the tabs to see installation instructions for the respective way to run etcd.
{{% /tab %}}
{{% tab name="systemd" %}}
1. First you will install etcd binaries like so:
```shell
ETCD_VERSION="v3.1.12"; curl -sSL https://github.com/coreos/etcd/releases/download/${ETCD_VERSION}/etcd-${ETCD_VERSION}-linux-amd64.tar.gz | tar -xzv --strip-components=1 -C /usr/local/bin/
1. First, install etcd binaries:
```bash
ETCD_VERSION="v3.1.12" curl -sSL https://github.com/coreos/etcd/releases/download/${ETCD_VERSION}/etcd-${ETCD_VERSION}-linux-amd64.tar.gz | tar -xzv --strip-components=1 -C /usr/local/bin/
```
It is worth noting that etcd v3.1.12 is the preferred version for Kubernetes v1.10. For other versions of Kubernetes please consult [the changelog](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG.md).
@@ -230,16 +222,14 @@ Please select one of the tabs to see installation instructions for the respectiv
Also, please realize that most distributions of Linux already have a version of etcd installed, so you will be replacing the system default.
1. Next, generate the environment file that systemd will use:
```
```bash
touch /etc/etcd.env
echo "PEER_NAME=${PEER_NAME}" >> /etc/etcd.env
echo "PRIVATE_IP=${PRIVATE_IP}" >> /etc/etcd.env
```
1. Now copy the systemd unit file like so:
```shell
1. Now copy the systemd unit file:
```none
cat >/etc/systemd/system/etcd.service <<EOF
[Unit]
Description=etcd
@@ -264,25 +254,24 @@ Please select one of the tabs to see installation instructions for the respectiv
Make sure you replace `<etcd0-ip-address>`, `<etcd1-ip-address>` and `<etcd2-ip-address>` with the appropriate IPv4 addresses. Replace `<name>` with the name of this etcd member. Modify the values of `--listen-client-urls`, `--advertise-client-urls`, `--listen-peer-urls` and `--initial-advertise-peer-urls` if needed. Replace `<etcd0>`, `<etcd1>` and `<etcd2>` with real hostnames of each machine. These machines must be able to reach every other using DNS or make sure that records are added to `/etc/hosts`.
1. Finally, launch etcd like so:
```shell
1. Finally, launch etcd:
```bash
systemctl daemon-reload
systemctl start etcd
```
1. Check that it launched successfully:
```shell
```bash
systemctl status etcd
```
{{% /tab %}}
{{% tab name="Static Pods" %}}
**Note**: This is only supported on nodes that have the all dependencies for the kubelet installed. If you are hosting etcd on the master nodes, this has already been set up. If you are hosting etcd on dedicated nodes, you should either use systemd or run the [installation guide](/docs/setup/independent/install-kubeadm/) on each dedicated etcd machine.
1. The first step is to run the following to generate the manifest file:
Run the following to generate the manifest file:
```shell
<!-- Using indentation instead of code fencing because of https://github.com/russross/blackfriday/issues/239 -->
cat >/etc/kubernetes/manifests/etcd.yaml <<EOF
apiVersion: v1
kind: Pod
@@ -349,7 +338,6 @@ Please select one of the tabs to see installation instructions for the respectiv
path: /etc/kubernetes/pki/etcd
name: certs
EOF
```
Make sure you replace:
* `<podname>` with the name of the node you're running on (e.g. `etcd0`, `etcd1` or `etcd2`)
@@ -381,8 +369,7 @@ As an example we outline a simple setup based on keepalived. Depending on enviro
1. Install keepalived, e.g. using your distribution's package manager. The configuration shown here works with version `1.3.5` but is expected to work with may other versions. Make sure to have it enabled (chkconfig, systemd, ...) so that it starts automatically when the respective node comes up.
2. Create the following configuration file _/etc/keepalived/keepalived.conf_ on all master nodes:
```shell
```none
! Configuration File for keepalived
global_defs {
router_id LVS_DEVEL
@@ -423,8 +410,7 @@ As an example we outline a simple setup based on keepalived. Depending on enviro
* `virtual_ipaddresses` should contain the virtual IP for the master nodes.
3. Install the following health check script to _/etc/keepalived/check_apiserver.sh_ on all master nodes:
```shell
```bash
#!/bin/sh
errorExit() {
@@ -452,8 +438,7 @@ Only follow this step if your etcd is hosted on dedicated nodes (**Option 1**).
1. Generate SSH keys for each of the master nodes by following the steps in the [create ssh access](#create-ssh-access) section. After doing this, each master will have an SSH key in `~/.ssh/id_rsa.pub` and an entry in `etcd0`'s `~/.ssh/authorized_keys` file.
1. Run the following:
```shell
```bash
mkdir -p /etc/kubernetes/pki/etcd
scp root@<etcd0-ip-address>:/etc/kubernetes/pki/etcd/ca.pem /etc/kubernetes/pki/etcd
scp root@<etcd0-ip-address>:/etc/kubernetes/pki/etcd/client.pem /etc/kubernetes/pki/etcd
@@ -463,8 +448,7 @@ Only follow this step if your etcd is hosted on dedicated nodes (**Option 1**).
## Run `kubeadm init` on `master0` {#kubeadm-init-master0}
1. In order for kubeadm to run, you first need to write a configuration file:
```shell
```bash
cat >config.yaml <<EOF
apiVersion: kubeadm.k8s.io/v1alpha1
kind: MasterConfiguration
@@ -496,9 +480,8 @@ Only follow this step if your etcd is hosted on dedicated nodes (**Option 1**).
**Note:** If you are using Kubernetes 1.9+, you can replace the `apiserver-count: 3` extra argument with `endpoint-reconciler-type: lease`. For more information, see [the documentation](/docs/admin/high-availability/#endpoint-reconciler).
1. When this is done, run kubeadm like so:
```shell
1. When this is done, run kubeadm:
```bash
kubeadm init --config=config.yaml
```
@@ -510,15 +493,14 @@ Before running kubeadm on the other masters, you need to first copy the K8s CA c
1. Follow the steps in the [create ssh access](#create-ssh-access) section, but instead of adding to `etcd0`'s `authorized_keys` file, add them to `master0`.
1. Once you've done this, run:
```shell
```bash
scp root@<master0-ip-address>:/etc/kubernetes/pki/* /etc/kubernetes/pki
rm apiserver.*
```
#### Option 2: Copy paste
1. Copy the contents of `/etc/kubernetes/pki/ca.crt`, `/etc/kubernetes/pki/ca.key`, `/etc/kubernetes/pki/sa.key` and `/etc/kubernetes/pki/sa.pub` and create these files manually on `master1` and `master2`.
Copy the contents of `/etc/kubernetes/pki/ca.crt`, `/etc/kubernetes/pki/ca.key`, `/etc/kubernetes/pki/sa.key` and `/etc/kubernetes/pki/sa.pub` and create these files manually on `master1` and `master2`.
When this is done, you can follow the [previous step](#kubeadm-init-master0) to install the control plane with kubeadm.
@@ -539,8 +521,7 @@ Next provision and set up the worker nodes. To do this, you will need to provisi
## Configure workers
1. Reconfigure kube-proxy to access kube-apiserver via the load balancer:
```shell
```bash
kubectl get configmap -n kube-system kube-proxy -o yaml > kube-proxy-cm.yaml
sed -i 's#server:.*#server: https://<masterLoadBalancerFQDN>:6443#g' kube-proxy-cm.yaml
kubectl apply -f kube-proxy-cm.yaml --force
@@ -549,12 +530,7 @@ Next provision and set up the worker nodes. To do this, you will need to provisi
```
1. Reconfigure the kubelet to access kube-apiserver via the load balancer:
```shell
```bash
sudo sed -i 's#server:.*#server: https://<masterLoadBalancerFQDN>:6443#g' /etc/kubernetes/kubelet.conf
sudo systemctl restart kubelet
```