etcd集群安装

1、安装cfssl

wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64

chmod +x cfssl_linux-amd64 cfssljson_linux-amd64

mv cfssl_linux-amd64 /usr/local/bin/cfssl
mv cfssljson_linux-amd64 /usr/local/bin/cfssljson

2、创建ca证书，客户端，服务端，节点之间的证书

Etcd属于server ,etcdctl 属于client，二者之间通过http协议进行通信。

• ca证书 自己给自己签名的权威证书，用来给其他证书签名
• server证书 etcd的证书
• client证书 客户端，比如etcdctl的证书
• peer证书 节点与节点之间通信的证书

1） 创建目录

mkdir -p /etc/etcd/pki
cd /etc/etcd/pki
cfssl print-defaults config > ca-config.json
cfssl print-defaults csr > ca-csr.json

2） 创建ca证书
修改ca-config.json
server auth表示client可以用该ca对server提供的证书进行验证
client auth表示server可以用该ca对client提供的证书进行验证

{
   
    "signing": {
   
        "default": {
   
            "expiry": "43800h"
        },
        "profiles": {
   
            "server": {
   
                "expiry": "43800h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "server auth",
                    "client auth"
                ]
            },
            "client": {
   
                "expiry": "43800h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "client auth"
                ]
            },
            "peer": {
   
                "expiry": "43800h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "server auth",
                    "client auth"
                ]
            }
        }
    }
}

创建证书签名请求ca-csr.json

{
   
    "CN": "etcd",
    "key": {
   
        "algo": "rsa",
        "size": 2048
    }
}

生成CA证书和私钥

cfssl gencert -initca ca-csr.json | cfssljson -bare ca
ls ca*
ca-config.json ca.csr ca-csr.json ca-key.pem ca.pem

3） 生成客户端证书

vim client.json
{
   
    "CN": "client",
    "key": {
   
        "algo": "ecdsa",
        "size": 256
    }
}

生成

cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=client client.json  | cfssljson -bare client -
ls ca*
ca-config.json ca.csr ca-csr.json ca-key.pem ca.pem client-key.pem client.pem

4） 生成server，peer证书

vim etcd.json
{
   
    "CN": "etcd",
    "hosts": [
        "127.0.0.1",