Etcd 集群配置证书通信

1、使用自制证书 etcd --name infra0 --initial-advertise-peer-urls http://10.0.1.10:2380 --listen-peer-urls https://10.0.1.10:2380 --listen-client-urls https://10.0.1.10:2379,https://127.0.0.1:2379 --advertise-client-urls https://10.0.1.10:2379 --initial-cluster-token etcd-cluster-1 --initial-cluster infra0=https://10.0.1.10:2380,infra1=https://10.0.1.11:2380,infra2=https://10.0.1.12:2380 --initial-cluster-state new --client-cert-auth --trusted-ca-file=/path/to/ca-client.crt --cert-file=/path/to/infra0-client.crt --key-file=/path/to/infra0-client.key --peer-client-cert-auth --peer-trusted-ca-file=ca-peer.crt --peer-cert-file=/path/to/infra0-peer.crt --peer-key-file=/path/to/infra0-peer.key

$ etcd --name infra1 --initial-advertise-peer-urls https://10.0.1.11:2380 --listen-peer-urls https://10.0.1.11:2380 --listen-client-urls https://10.0.1.11:2379,https://127.0.0.1:2379 --advertise-client-urls https://10.0.1.11:2379 --initial-cluster-token etcd-cluster-1 --initial-cluster infra0=https://10.0.1.10:2380,infra1=https://10.0.1.11:2380,infra2=https://10.0.1.12:2380 --initial-cluster-state new --client-cert-auth --trusted-ca-file=/path/to/ca-client.crt --cert-file=/path/to/infra1-client.crt --key-file=/path/to/infra1-client.key --peer-client-cert-auth --peer-trusted-ca-file=ca-peer.crt --peer-cert-file=/path/to/infra1-peer.crt --peer-key-file=/path/to/infra1-peer.key

$ etcd --name infra2 --initial-advertise-peer-urls https://10.0.1.12:2380 --listen-peer-urls https://10.0.1.12:2380 --listen-client-urls https://10.0.1.12:2379,https://127.0.0.1:2379 --advertise-client-urls https://10.0.1.12:2379 --initial-cluster-token etcd-cluster-1 --initial-cluster infra0=https://10.0.1.10:2380,infra1=https://10.0.1.11:2380,infra2=https://10.0.1.12:2380 --initial-cluster-state new --client-cert-auth --trusted-ca-file=/path/to/ca-client.crt --cert-file=/path/to/infra2-client.crt --key-file=/path/to/infra2-client.key --peer-client-cert-auth --peer-trusted-ca-file=ca-peer.crt --peer-cert-file=/path/to/infra2-peer.crt --peer-key-file=/path/to/infra2-peer.key

2、使用自动证书 $ etcd --name infra0 --initial-advertise-peer-urls https://10.0.1.10:2380 --listen-peer-urls https://10.0.1.10:2380 --listen-client-urls https://10.0.1.10:2379,https://127.0.0.1:2379 --advertise-client-urls https://10.0.1.10:2379 --initial-cluster-token etcd-cluster-1 --initial-cluster infra0=https://10.0.1.10:2380,infra1=https://10.0.1.11:2380,infra2=https://10.0.1.12:2380 --initial-cluster-state new --auto-tls --peer-auto-tls

$ etcd --name infra1 --initial-advertise-peer-urls https://10.0.1.11:2380 --listen-peer-urls https://10.0.1.11:2380 --listen-client-urls https://10.0.1.11:2379,https://127.0.0.1:2379 --advertise-client-urls https://10.0.1.11:2379 --initial-cluster-token etcd-cluster-1 --initial-cluster infra0=https://10.0.1.10:2380,infra1=https://10.0.1.11:2380,infra2=https://10.0.1.12:2380 --initial-cluster-state new --auto-tls --peer-auto-tls

$ etcd --name infra2 --initial-advertise-peer-urls https://10.0.1.12:2380 --listen-peer-urls https://10.0.1.12:2380 --listen-client-urls https://10.0.1.12:2379,https://127.0.0.1:2379 --advertise-client-urls https://10.0.1.12:2379 --initial-cluster-token etcd-cluster-1 --initial-cluster infra0=https://10.0.1.10:2380,infra1=https://10.0.1.11:2380,infra2=https://10.0.1.12:2380 --initial-cluster-state new --auto-tls --peer-auto-tls