原创：利用 kubeadm 1.15 生成 etcd 证书

etcd 一般通过 cfssl 或 openssl 生成证书， 增加了 kubernetes 集群的部署复杂度。本文描述了通过kubeadm自动化生成etcd的ca证书，以达到简化部署难度的目的。本文的编写参考了以前旧版本的思路，针对kubeadm 1.15 版本的变化做了更新。

# 生成 etcd-ca 
kubeadm init phase certs etcd-ca

# 把etcd服务器节点信息写入配置文件
cat > etcd-cert-conf.yaml <<-EOF
apiVersion: "kubeadm.k8s.io/v1beta2"
kind: ClusterConfiguration
etcd:
  local:
    serverCertSANs:
      - "ip-192-168-1-100.us-west-2.compute.internal"
      - "10.1.6.251"
      - "10.1.6.252"
      - "10.1.6.253"
      - "192.168.1.100"
    peerCertSANs:
      - "ip-192-168-1-100.us-west-2.compute.internal"
      - "10.1.6.251"
      - "10.1.6.252"
      - "10.1.6.253"
      - "192.168.1.100"
EOF

# 生成 server 和 peer 证书
kubeadm init phase certs etcd-ca --config etcd-cert-conf.yaml
kubeadm init phase certs etcd-server --config etcd-cert-conf.yaml
kubeadm init phase certs etcd-peer --config etcd-cert-conf.yaml
kubeadm init phase certs etcd-healthcheck-client --config etcd-cert-conf.yaml
kubeadm init phase certs apiserver-etcd-client --config etcd-cert-conf.yaml

#  服务端启动
ETCD_NAME="node1"
ETCD_DATA_DIR="/var/lib/etcd"
ETCD_LISTEN_CLIENT_URLS="https://0.0.0.0:2379"
ETCD_LISTEN_PEER_URLS="https://0.0.0.0:2380"
ETCD_ADVERTISE_CLIENT_URLS="https://192.168.1.100:2379"
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://192.168.1.100:2380"
ETCD_INITIAL_CLUSTER="node1=https://192.168.1.100:2380,\
node2=https://192.168.1.101:2380,\
node3=https://192.168.1.102:2380
ETCD_INITIAL_CLUSTER_STATE="new"
ETCD_INITIAL_CLUSTER_TOKEN="new-cluster"
ETCD_TRUSTED_CA_FILE="/etc/kubernetes/pki/etcd/ca.crt"
ETCD_CERT_FILE="/etc/kubernetes/pki/etcd/server.crt"
ETCD_KEY_FILE="/etc/kubernetes/pki/etcd/server.key"
ETCD_PEER_TRUSTED_CA_FILE="/etc/kubernetes/pki/etcd/ca.crt"
ETCD_PEER_CERT_FILE="/etc/kubernetes/pki/etcd/peer.crt"
ETCD_PEER_KEY_FILE="/etc/kubernetes/pki/etcd/peer.key"
ETCD_PEER_CLIENT_CERT_AUTH="true"
ETCD_CLIENT_CERT_AUTH="true"

# 客户端连接
ETCDCTL_API=3 etcdctl --cacert=/etc/kubernetes/pki/etcd/ca.crt \
--cert=/etc/kubernetes/pki/etcd/peer.crt \
--key=/etc/kubernetes/pki/etcd/peer.key \
--endpoints=https://192.168.1.100:2379,https://192.168.1.101:2379,\
https://192.168.1.102:2379
endpoint health

参考文档：
https://kubernetes.io/docs/reference/setup-tools/kubeadm/kubeadm-init-phase/#cmd-phase-etcd
https://blog.scottlowe.org/2018/08/21/bootstrapping-etcd-cluster-with-tls-using-kubeadm/
https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/setup-ha-etcd-with-kubeadm/