ETCD 安全证书(1)

3、添加可执行权限

[root@localhost etcd]# chmod +x /usr/bin/{cfssl,cfssljson}

4、配置CA选项

[root@localhost etcd]# mkdir etcd-ca-gen

[root@localhost etcd]# cd etcd-ca-gen

[root@localhost etcd]# cat > ca-config.json << EOF

{

“signing”: {

“default”: {

“expiry”: “43800h”

},

“profiles”: {

“server”: {

“expiry”: “43800h”,

“usages”: [

“signing”,

“key encipherment”,

“server auth”,

“client auth”

]

},

“client”: {

“expiry”: “43800h”,

“usages”: [

“signing”,

“key encipherment”,

“client auth”

]

},

“peer”: {

“expiry”: “43800h”,

“usages”: [

“signing”,

“key encipherment”,

“server auth”,

“client auth”

]

}

}

}

}

EOF

[root@localhost etcd]# cat > ca-csr.json <<EOF

{

“CN”: “WAE Etcd CA”,

“key”: {

“algo”: “rsa”,

“size”: 2048

},

“names”: [

{

“C”: “CN”,

“L”: “FJ”,

“ST”: “Xia Men”

}

]

}

EOF

5、生成CA证书

[root@localhost etcd]# cfssl gencert -initca ca-csr.json | cfssljson -bare ca -#将会生成以下几个文件：

ca-key.pem

ca.csr

ca.pem

6、生成服务器端证书

[root@localhost etcd]# cat > server.json <<EOF

{

“CN”: “WAE Etcd Server”,

“hosts”: [

“127.0.0.1”,

“etcd1-com-hakim.com”,

“etcd2-com-hakim.com”,

“etcd3-com-hakim.com”,

“etcd4-com-hakim.com”,

“etcd5-com-hakim.com”

],

“key”: {

“algo”: “rsa”,

“size”: 2048

},

“names”: [

{

“C”: “CN”,

“L”: “FJ”,

“ST”: “Xia Men”

}

]

}

EOF

[root@localhost etcd]# cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=server server.json | cfssljson -bare server

7、生成对等证书

$ cp server.json member.json

$ cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=peer member.json | cfssljson -bare member

8、生成客户端证书

[root@localhost etcd]# cat > client.json <<EOF

{

“CN”: “client”,

“hosts”: [“”],

“key”: {

“algo”: “rsa”,

“size”: 2048

},

“names”: [

{

“C”: “CN”,

“L”: “FJ”,

“ST”: “Xia Men”

}

]

}

EOF

[root@localhost etcd]# cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=client client.json | cfssljson -bare client

9、保存证书和密钥

将所有 pem 文件复制到 /etc/etcd/etcd-ca/ 目录下，命令如下：

[root@localhost etcd]# mkdir /etc/etcd/etcd-ca/

[root@localhost etcd]# cp *.pem /etc/etcd/etcd-ca/

三、配置Etcd

---

增加etcd配置文件，内容如下：

[root@localhost etcd]# vim /etc/etcd/etcd.conf

[member]

ETCD_NAME=etcd1

ETCD_DATA_DIR=“/var/lib/etcd/data”

ETCD_LISTEN_PEER_URLS=“https://0.0.0.0:2380”

ETCD_LISTEN_CLIENT_URLS=“https://0.0.0.0:2379”

#[cluster]

ETCD_INITIAL_ADVERTISE_PEER_URLS=“https://etcd1-com-hakim.com:2380”

ETCD_INITIAL_CLUSTER=“etcd1=https://etcd1-com-hakim.com:2380,etcd2=https://etcd2-com-hakim.com:2380,etcd3=https://etcd3-com-hakim.com:2380,etcd4=https://etcd4-com-hakim.com:2380,etcd5=https://etcd5-com-hakim.com:2380”

ETCD_INITIAL_CLUSTER_STATE=“new”

ETCD_INITIAL_CLUSTER_TOKEN=“etcd-cluster”

ETCD_ADVERTISE_CLIENT_URLS=“https://etcd1-com-hakim.com:2379”

#[security]

ETCD_CERT_FILE=“/etc/etcd/etcd-ca/server.pem”

ETCD_KEY_FILE=“/etc/etcd/etcd-ca/server-key.pem”

ETCD_CLIENT_CERT_AUTH=“true”

ETCD_TRUSTED_CA_FILE=“/etc/etcd/etcd-ca/ca.pem”

ETCD_AUTO_TLS=“true”

ETCD_PEER_CERT_FILE=“/etc/etcd/etcd-ca/member.pem”

ETCD_PEER_KEY_FILE=“/etc/etcd/etcd-ca/member-key.pem”

ETCD_PEER_CLIENT_CERT_AUTH=“true”

ETCD_PEER_TRUSTED_CA_FILE=“/etc/etcd/etcd-ca/ca.pem”

ETCD_PEER_AUTO_TLS=“true”