etcd二进制安装，启动单节点https证书

etcd单节点安装；
1， 生成 TLS 秘钥对
生成步骤：
1，下载 cfssl
2，初始化证书颁发机构
3，配置 CA 选项
4，生成服务器端证书
5，生成对等证书
6，生成客户端证书

 

1，下载 cfssl
mkdir ~/bin
curl -s -L -o ~/bin/cfssl https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
curl -s -L -o ~/bin/cfssljson https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
chmod +x ~/bin/{cfssl,cfssljson}
export PATH=$PATH:~/bin

2，初始化证书颁发机构
mkdir ~/cfssl
cd ~/cfssl
cfssl print-defaults config > ca-config.json
cfssl print-defaults csr > ca-csr.json

证书类型介绍：
client certificate  用于通过服务器验证客户端。例如etcdctl，etcd proxy，fleetctl或docker客户端。
server certificate 由服务器使用，并由客户端验证服务器身份。例如docker服务器或kube-apiserver。
peer certificate 由 etcd 集群成员使用，供它们彼此之间通信使用。

3，配置 CA 选项
$ cat << EOF > ca-config.json
{
    "expiry": "175200h",
    "signing": {
        "default": {
            "expiry": "87600h"
        },
        "profiles": {
            "server": {
                "expiry": "175200h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "server auth"
                ]
            },
            "client": {
                "expiry": "175200h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "client auth"
                ]
            },
            "peer": {
                "expiry": "175200h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "server auth",
                    "client auth"
                ]
            }
        }
    }
}

 cat << EOF > ca-csr.json
{
    "CN": "k8s root CA",
    "ca": {
        "expiry": "175200h"