#!/bin/sh

STRING=

if [ -z "$STRING" ]; then 
    echo "STRING is empty" 
fi

if [ -n "$STRING" ]; then 
    echo "STRING is not empty" 
fi

kubeadm-1.10.2-0.x86_64.rpm  
kubectl-1.10.2-0.x86_64.rpm  
kubelet-1.10.2-0.x86_64.rpm  
kubernetes-cni-0.6.0-0.x86_64.rpm

yum install *

kubeadm token create --print-join-command

    # 创建角色和rbac绑定
    $ kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/traefik-rbac.yaml
    
    # ServiceAccount, DaemonSet(直接绑定主机端口)，service
    $ kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/traefik-ds.yaml

# ns

apiVersion: v1
kind: Namespace
metadata:
  name: demo1
  labels:
    nsname: demo1
---
apiVersion: v1
kind: Namespace
metadata:
  name: demo2
  labels:
    nsname: demo2

apiVersion: apps/v1
kind: Deployment
metadata:
  name: busybox-deployment
  namespace: demo2
spec:
  selector:
    matchLabels:
      app: busybox
  replicas: 1
  template:
    metadata:
      labels:
        app: busybox
    spec:
      containers:
      - name: busybox
        image: busybox:1.28.4
        command: [ "/bin/sh" ]
        tty: true
      dnsConfig:
        options:
          - name: single-request-reopen
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-test
  namespace: demo2
spec:
  selector:
    matchLabels:
      app: nginx-test
  replicas: 2
  template:
    metadata:
      labels:
        app: nginx-test
    spec:
      containers:
      - name: nginx
        image: nginx:latest
        resources:
          requests:
            cpu: 100m
            memory: 100Mi
        ports:
        - containerPort: 80
      restartPolicy: Always
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: busybox-deployment
  namespace: demo1
spec:
  selector:
    matchLabels:
      app: busybox
  replicas: 1
  template:
    metadata:
      labels:
        app: busybox
    spec:
      containers:
      - name: busybox
        image: busybox:1.28.4
        command: [ "/bin/sh" ]
        tty: true
      dnsConfig:
        options:
          - name: single-request-reopen
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-test
  namespace: demo1
spec:
  selector:
    matchLabels:
      app: nginx-test
  replicas: 2
  template:
    metadata:
      labels:
        app: nginx-test
    spec:
      containers:
      - name: nginx
        image: nginx:latest
        resources:
          requests:
            cpu: 100m
            memory: 100Mi
        ports:
        - containerPort: 80
      restartPolicy: Always

kind: Service
apiVersion: v1
metadata:
  labels:
    app: nginx-test
  name: nginx-test
  namespace: demo2
spec:
  type: NodePort
  ports:
  - port: 8080
    targetPort: 80
    nodePort: 32004
  selector:
    app: nginx-test
---
kind: Service
apiVersion: v1
metadata:
  labels:
    app: nginx-test
  name: nginx-test
  namespace: demo1
spec:
  type: NodePort
  ports:
  - port: 8080
    targetPort: 80
    nodePort: 32003
  selector:
    app: nginx-test

echo "下载 cfssl"
curl -o /usr/local/bin/cfssl https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
curl -o /usr/local/bin/cfssljson https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
chmod +x /usr/local/bin/cfssl*

mkdir -p /etc/etcd/ssl
cd /etc/etcd/ssl
cat >ca-config.json <<EOF
{
    "signing": {
        "default": {
            "expiry": "87600h"
        },
        "profiles": {
            "server": {
                "expiry": "87600h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "server auth",
                    "client auth"
                ]
            },
            "client": {
                "expiry": "87600h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "client auth"
                ]
            },
            "peer": {
                "expiry": "87600h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "server auth",
                    "client auth"
                ]
            }
        }
    }
}
EOF

cat >ca-csr.json <<EOF
{
    "CN": "etcd",
    "key": {
        "algo": "rsa",
        "size": 2048
    }
}
EOF

cfssl gencert -initca ca-csr.json | cfssljson -bare ca -

cat >config.json <<EOF
{
    "CN": "etcd-0",
    "hosts": [
        "localhost",
        "10.19.0.55",
        "10.19.0.56",
        "10.19.0.57"
    ],
    "key": {
        "algo": "ecdsa",
        "size": 256
    },
    "names": [
        {
            "C": "US",
            "L": "CA",
            "ST": "San Francisco"
        }
    ]
}
EOF

echo "生成服务器端证书 server.csr server.pem server-key.pem"
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=server config.json | cfssljson -bare server

echo "生成peer端证书 peer.csr peer.pem peer-key.pem"
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=peer config.json | cfssljson -bare peer

wget https://github.com/coreos/etcd/releases/download/v3.1.8/etcd-v3.1.8-linux-amd64.tar.gz
tar -zxvf etcd-v3.1.8-linux-amd64.tar.gz

ln -s /app/allblue/etcd/etcd-v3.1.18-linux-amd64/etcd /usr/bin/etcd
ln -s /app/allblue/etcd/etcd-v3.1.18-linux-amd64/etcdctl /usr/bin/etcdctl

vi /etc/etcd/etcd.conf

ETCD_NAME=node01
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
ETCD_LISTEN_PEER_URLS="https://0.0.0.0:2380"
ETCD_LISTEN_CLIENT_URLS="https://0.0.0.0:2379"

#[cluster]
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://etcd-0:2380"
ETCD_INITIAL_CLUSTER="node01=https://node01:2380,node02=https://node02:2380,node03=https://node03:2380"
ETCD_INITIAL_CLUSTER_STATE="new"
ETCD_INITIAL_CLUSTER_TOKEN="nodecluster"
ETCD_ADVERTISE_CLIENT_URLS="https://node01:2379"
#ETCD_DISCOVERY=""
#ETCD_DISCOVERY_SRV=""
#ETCD_DISCOVERY_FALLBACK="proxy"
#ETCD_DISCOVERY_PROXY=""
#ETCD_STRICT_RECONFIG_CHECK="false"
#ETCD_AUTO_COMPACTION_RETENTION="0"
#
#[proxy]
#ETCD_PROXY="off"
#ETCD_PROXY_FAILURE_WAIT="5000"
#ETCD_PROXY_REFRESH_INTERVAL="30000"
#ETCD_PROXY_DIAL_TIMEOUT="1000"
#ETCD_PROXY_WRITE_TIMEOUT="5000"
#ETCD_PROXY_READ_TIMEOUT="0"
#
#[security]
ETCD_CERT_FILE="/etc/etcd/ssl/server.pem"
ETCD_KEY_FILE="/etc/etcd/ssl/server-key.pem"
ETCD_CLIENT_CERT_AUTH="true"
ETCD_TRUSTED_CA_FILE="/etc/etcd/ssl/ca.pem"
ETCD_AUTO_TLS="true"
ETCD_PEER_CERT_FILE="/etc/etcd/ssl/peer.pem"
ETCD_PEER_KEY_FILE="/etc/etcd/ssl/peer-key.pem"
#ETCD_PEER_CLIENT_CERT_AUTH="false"
ETCD_PEER_TRUSTED_CA_FILE="/etc/etcd/ssl/ca.pem"
ETCD_PEER_AUTO_TLS="true"
#
#[logging]
#ETCD_DEBUG="false"
# examples for -log-package-levels etcdserver=WARNING,security=DEBUG
#ETCD_LOG_PACKAGE_LEVELS=""
#[profiling]
#ETCD_ENABLE_PPROF="false"
#ETCD_METRICS="basic"

vi /etc/systemd/system/etcd.service

[Unit]
Description=Etcd Server
After=network.target
After=network-online.target
Wants=network-online.target
Documentation=https://github.com/coreos

[Service]
Type=notify
WorkingDirectory=/app/allblue/etcddata/
EnvironmentFile=/app/allblue/etcd/etcd.conf
User=root
ExecStart=/usr/bin/etcd \
  --name node01  \
  --cert-file=/app/allblue/etcd/ssl/server.pem  \
  --key-file=/app/allblue/etcd/ssl/server-key.pem  \
  --peer-cert-file=/app/allblue/etcd/ssl/peer.pem  \
  --peer-key-file=/app/allblue/etcd/ssl/peer-key.pem  \
  --trusted-ca-file=/app/allblue/etcd/ssl/ca.pem  \
  --peer-trusted-ca-file=/app/allblue/etcd/ssl/ca.pem  \
  --initial-advertise-peer-urls https://10.19.0.55:2380  \
  --listen-peer-urls https://10.19.0.55:2380  \
  --listen-client-urls https://10.19.0.55:2379,http://127.0.0.1:2379  \
  --advertise-client-urls https://10.19.0.55:2379  \
  --initial-cluster-token etcd-cluster-0  \
  --initial-cluster node01=https://10.19.0.55:2380,node02=https://10.19.0.56:2380,node03=https://10.19.0.57:2380  \
  --initial-cluster-state new  \
  --data-dir=/app/allblue/etcddata
Restart=on-failure
RestartSec=5
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target

systemctl daemon-reload
systemctl enable etcd

systemctl start etcd

systemctl start etcd

vi check.sh

#!/usr/bin/env bash

etcdctl \
  --ca-file=/app/allblue/etcd/ssl/ca.pem \
  --cert-file=/app/allblue/etcd/ssl/peer.pem \
  --key-file=/app/allblue/etcd/ssl/peer-key.pem \
  --endpoints=https://10.19.0.55:2379,https://10.19.0.56:2379,https://10.19.0.57:2379  \
  cluster-health

2018-07-02 16:12:01.988067 I | warning: ignoring ServerName for user-provided CA for backwards compatibility is deprecated
2018-07-02 16:12:01.988388 I | warning: ignoring ServerName for user-provided CA for backwards compatibility is deprecated
member 2e433331257e2668 is healthy: got healthy result from https://10.19.0.57:2379
member 884de43739502011 is healthy: got healthy result from https://10.19.0.56:2379
member fb3e4a0d91e719a6 is healthy: got healthy result from https://10.19.0.55:2379
cluster is healthy

rw init = /bin/bash