案例说明：

对于KingbaseES V8R6C5版本在部集群时，需要建立kingbase、root用户在节点间的ssh互信，如果在生产环境禁用root用户ssh登录，则通过ssh部署会失败；V8R6C5版本新增securecmdd工具，在手工脚本部署时可以借用securecmdd工具进行节点之间通讯执行部署。

数据库版本：

一、在节点部署securecmdd工具

详细操作见：https://www.cnblogs.com/tiany1224/p/16302205.html

《KingbaseES V8R6C5集群部署启动securecmdd服务配置案例》

二、部署前的准备

=注意：已经配置了kingbase用户的ssh的互信，配置步骤略。=

1、数据库软件安装后，从相应目录下获取部署文件

2、将所需部署文件存储到一个目录下包括license

[kingbase@node1 r6_install]$ ls -lh
total 145M
-rw-rw-r--. 1 kingbase kingbase 145M Mar  1  2021 db.zip
-rwxr-xr-x. 1 kingbase kingbase 6.1K Mar  1  2021 install.conf
-rw-r--r--. 1 kingbase kingbase 3.4K Mar  1  2021 license.dat
-rwxr-xr-x. 1 kingbase kingbase 2.5K Mar  1  2021 trust_cluster.sh
-rwxr-xr-x. 1 kingbase kingbase  69K Mar  1  2021 V8R6_cluster_install.sh

3、创建集群部署目录（all nodes）

[kingbase@node1 r6_install]$ mkdir -p /home/kingbase/cluster/R6P/R6H/kingbase

4、将db.zip包上传到每个节点的集群安装目录下并解压（all nodes）

[kingbase@node2 kingbase]$ pwd
/home/kingbase/cluster/R6P/R6H/kingbase

[kingbase@node2 kingbase]$ unzip db.zip

[kingbase@node2 kingbase]$ ls -lh
total 338M
drwxr-xr-x 2 kingbase kingbase 4.0K Apr  7 16:16 bin
-rw-rw-r-- 1 kingbase kingbase 338M May 23 16:57 db.zip
drwxrwxr-x 5 kingbase kingbase 8.0K Apr  7 16:17 lib
drwxrwxr-x 8 kingbase kingbase 4.0K Apr  7 16:17 share

4、将license文件上传到每个节点的集群安装bin目录下（all nodes）

[kingbase@node1 r6_install]$ cp license.dat /home/kingbase/cluster/R6P/R6H/kingbase/bin/license.dat
[kingbase@node1 r6_install]$ scp license.dat node2:/home/kingbase/cluster/R6P/R6H/kingbase/bin/license.dat

二、编辑install.conf配置文件

[kingbase@node1 r6_install]$ cat install.conf |grep -v ^$|grep -v ^#
[install]
on_bmj=0
all_ip=(192.168.8.200 192.168.8.201)
witness_ip=""
production_ip=()
local_disaster_recovery_ip=()
remote_disaster_recovery_ip=()
install_dir="/home/kingbase/cluster/R6P/R6H"
zip_package="/home/kingbase/r6_install/db.zip"
license_file=(license.dat)
db_user="system"                 # the user name of database
db_port="54321"                  # the port of database, defaults is 54321
db_mode="oracle"                 # database mode: pg, oracle
db_auth="scram-sha-256"          # database authority: scram-sha-256, md5, default is scram-sha-256
db_case_sensitive="yes"          # database case sensitive settings: yes, no. default is yes - case sensitive; no - case insensitive (NOTE. cannot set to 'no' when db_mode="pg").
trusted_servers="192.168.8.1"
data_directory="/home/kingbase/cluster/R6P/R6H/kingbase/data"
virtual_ip="192.168.8.240/24"
net_device=(enp0s3 enp0s3)
net_device_ip=(192.168.8.200 192.168.8.201)
ipaddr_path="/sbin"
arping_path="/opt/Kingbase/ES/V8R6_054/Server/bin/"
ping_path="/bin"
super_user="root"
execute_user="kingbase"
deploy_by_sshd=0                # choose whether to use sshd when deploy, 0 means not to use (deploy by sys_securecmdd), 1 means to use (deploy by sshd), default value is 1; when on_bmj=1, it will auto set to no(deploy_by_sshd=0)
use_scmd=1                       # Is the cluster running on sys_securecmdd or sshd? 1 means yes (on sys_securecmdd), 0 means no (on sshd), default value is 1; when on_bmj=1, it will auto set to yes(use_scmd=1)
reconnect_attempts="10"          # the number of retries in the event of an error
reconnect_interval="6"           # retry interval
recovery="standby"               # the way of cluster recovery: standby/automatic/manual
ssh_port="22"                    # the port of ssh, default is 22
scmd_port="8890"                 # the port of sys_securecmdd, default is 8890
auto_cluster_recovery_level='1'
use_check_disk='off'
synchronous='quorum'

[expand]
expand_type=""                   # The node type of standby/witness node, which would be add to cluster. 0:standby  1:witness
primary_ip=""                    # The ip addr of cluster primary node, which need to expand a standby/witness node.
expand_ip=""                     # The ip addr of standby/witness node, which would be add to cluster.
node_id=""                       # The node_id of standby/witness node, which would be add to cluster. It does not the same with any one in  cluster node
                                 # for example: node_id="3"
install_dir=""
zip_package=""
net_device=()                    # if virtual_ip set,it must be set
net_device_ip=()                 # if virtual_ip set,it must be set
license_file=(license.dat)
deploy_by_sshd="1"
ssh_port="22"
scmd_port="8890"
[shrink]
shrink_type=""                   # The node type of standby/witness node, which would be delete from cluster. 0:standby  1:witness
primary_ip=""                    # The ip addr of cluster primary node, which need to shrink a standby/witness node.
shrink_ip=""                     # The ip addr of standby/witness node, which would be delete from cluster.
node_id=""                       # The node_id of standby/witness node, which would be delete from cluster. It does not the same with any one in  cluster node
                                 # for example: node_id="3"
install_dir=""
ssh_port="22"                    # the port of ssh, default is 22
scmd_port="8890"                 # the port of sys_securecmd, default is 8890

=注意：配置参数deploy_by_sshd=0 ，use_scmd=1在数据包分发时选择securecmdd而不是ssh。==

三、执行部署脚本

[kingbase@node1 r6_install]$ sh V8R6_cluster_install.sh
[CONFIG_CHECK] will deploy the cluster of DG
[CONFIG_CHECK] check if the virtual ip "192.168.8.240" already exist ...
[CONFIG_CHECK] there is no "192.168.8.240" on any host, OK
[CONFIG_CHECK] the number of net_device matches the length of all_ip or the number of net_device is 1 ... OK
[RUNNING] check if the host can be reached ...
[RUNNING] success connect to the target "192.168.8.200" ..... OK
.......
2022-05-23 17:12:02 repmgrd on "[192.168.8.201]" start success.
 ID | Name  | Role    | Status    | Upstream | repmgrd | PID   | Paused? | Upstream last seen
----+-------+---------+-----------+----------+---------+-------+---------+--------------------
 1  | node1 | primary | * running |          | running | 27062 | no      | n/a
 2  | node2 | standby |   running | node1    | running | 16079 | no      | 1 second(s) ago
[2022-05-23 17:12:15] [NOTICE] redirecting logging output to "/home/kingbase/cluster/R6P/R6H/kingbase/log/kbha.log"

[2022-05-23 17:12:29] [NOTICE] redirecting logging output to "/home/kingbase/cluster/R6P/R6H/kingbase/log/kbha.log"

2022-05-23 17:12:30 Done.
[INSTALL] start up the whole cluster ... OK

四、查看集群状态

=如下所示，集群部署成功。=

[kingbase@node1 bin]$ ./repmgr cluster show
 ID | Name  | Role    | Status    | Upstream | Location | Priority | Timeline | Connection string
----+-------+---------+-----------+----------+----------+----------+----------+---------------------------------------------------------------------------------------------------------------------------------------------------
 1  | node1 | primary | * running |          | default  | 100      | 1        | host=192.168.8.200 user=esrep dbname=esrep port=54321 connect_timeout=10 keepalives=1 keepalives_idle=10 keepalives_interval=1 keepalives_count=3
 2  | node2 | standby |   running | node1    | default  | 100      | 1        | host=192.168.8.201 user=esrep dbname=esrep port=54321 connect_timeout=10 keepalives=1 keepalives_idle=10 keepalives_interval=1 keepalives_count=3

五、总结

1、 对于生产环境不允许root用户ssh登录（普通用户可以并建立ssh互信）时，可以采用手工脚本方式部署集群，但是必须提前在所有节点部署和启动securecmdd服务。

2、然后在install.conf中配置选择securecmdd部署。

3、部署完成后，经测试，在root用户不能ssh登录系统，不影响集群的切换和启动及关闭。