使用 etcdadm 部署 etcd 集群

$ etcdadm --help
Tool to bootstrap etcdadm on the host

Usage:
  etcdadm [command]

Available Commands:
  download    Download etcd binary
  help        Help about any command
  info        Information about the local etcd member
  init        Initialize a new etcd cluster
  join        Join an existing etcd cluster
  reset       Remove this etcd member from the cluster and uninstall etcd
  version     Print version information

Flags:
  -h, --help               help for etcdadm
  -l, --log-level string   set log level for output, permitted values debug, info, warn, error, fatal and panic (default "info")

Use "etcdadm [command] --help" for more information about a command.

$ etcdadm help init
Initialize a new etcd cluster

Usage:
  etcdadm init [flags]

Flags:
      --certs-dir string                    certificates directory (default "/etc/etcd/pki")
      --disk-priorities stringArray         Setting etcd disk priority (default [Nice=-10,IOSchedulingClass=best-effort,IOSchedulingPriority=2])
      --download-connect-timeout duration   Maximum time in seconds that you allow the connection to the server to take. (default 10s)
  -h, --help                                help for init
      --install-dir string                  install directory (default "/opt/bin/")
      --name string                         etcd member name
      --release-url string                  URL used to download etcd (default "https://github.com/coreos/etcd/releases/download")
      --server-cert-extra-sans strings      optional extra Subject Alternative Names for the etcd server signing cert, can be multiple comma separated DNS names or IPs
      --skip-hash-check                     Ignore snapshot integrity hash value (required if copied from data directory)
      --snapshot string                     Etcd v3 snapshot file used to initialize member
      --version string                      etcd version (default "3.4.9")

Global Flags:
  -l, --log-level string   set log level for output, permitted values debug, info, warn, error, fatal and panic (default "info")

root@etcd1:~# etcdadm init --release-url https://gh-proxy.com/https://github.com/coreos/etcd/releases/download --server-cert-extra-sans "etcd1,etcd2,etcd3,172.17.0.3,172.17.0.4,172.17.0.5" --version 3.5.13
INFO[0000] [install] Artifact not found in cache. Trying to fetch from upstream: https://gh-proxy.com/https://github.com/coreos/etcd/releases/download
INFO[0000] [install] Downloading & installing etcd https://gh-proxy.com/https://github.com/coreos/etcd/releases/download from 3.5.13 to /var/cache/etcdadm/etcd/v3.5.13
INFO[0000] [install] downloading etcd from https://gh-proxy.com/https://github.com/coreos/etcd/releases/download/v3.5.13/etcd-v3.5.13-linux-amd64.tar.gz to /var/cache/etcdadm/etcd/v3.5.13/etcd-v3.5.13-linux-amd64.tar.gz
######################################################################## 100.0%
INFO[0000] [install] extracting etcd archive /var/cache/etcdadm/etcd/v3.5.13/etcd-v3.5.13-linux-amd64.tar.gz to /tmp/etcd713259203
INFO[0000] [install] verifying etcd 3.5.13 is installed in /opt/bin/
INFO[0000] [certificates] creating PKI assets
INFO[0000] creating a self signed etcd CA certificate and key files
[certificates] Generated ca certificate and key.
INFO[0000] creating a new server certificate and key files for etcd
[certificates] Generated server certificate and key.
[certificates] server serving cert is signed for DNS names [etcd1 etcd2 etcd3 etcd1] and IPs [172.17.0.3 172.17.0.4 172.17.0.5 172.17.0.3 127.0.0.1]
INFO[0000] creating a new certificate and key files for etcd peering
[certificates] Generated peer certificate and key.
[certificates] peer serving cert is signed for DNS names [etcd1] and IPs [172.17.0.3]
INFO[0001] creating a new client certificate for the etcdctl
[certificates] Generated etcdctl-etcd-client certificate and key.
INFO[0001] creating a new client certificate for the apiserver calling etcd
[certificates] Generated apiserver-etcd-client certificate and key.
[certificates] valid certificates and keys now exist in "/etc/etcd/pki"
INFO[0002] [health] Checking local etcd endpoint health
INFO[0002] [health] Local etcd endpoint is healthy
INFO[0002] To add another member to the cluster, copy the CA cert/key to its certificate dir and run:
INFO[0002] 	etcdadm join https://172.17.0.3:2379

root@etcd1:~# cat /etc/etcd/
etcd.env     etcdctl.env  pki/
root@etcd1:~# cat /etc/etcd/etcd.env
ETCD_NAME=etcd1

# Initial cluster configuration
ETCD_INITIAL_CLUSTER=etcd1=https://172.17.0.3:2380
ETCD_INITIAL_CLUSTER_TOKEN=45f0428a
ETCD_INITIAL_CLUSTER_STATE=new

# Peer configuration
ETCD_INITIAL_ADVERTISE_PEER_URLS=https://172.17.0.3:2380
ETCD_LISTEN_PEER_URLS=https://172.17.0.3:2380

ETCD_CLIENT_CERT_AUTH=true
ETCD_PEER_CERT_FILE=/etc/etcd/pki/peer.crt
ETCD_PEER_KEY_FILE=/etc/etcd/pki/peer.key
ETCD_PEER_TRUSTED_CA_FILE=/etc/etcd/pki/ca.crt

# Client/server configuration
ETCD_ADVERTISE_CLIENT_URLS=https://172.17.0.3:2379
ETCD_LISTEN_CLIENT_URLS=https://172.17.0.3:2379,https://127.0.0.1:2379

ETCD_PEER_CLIENT_CERT_AUTH=true
ETCD_CERT_FILE=/etc/etcd/pki/server.crt
ETCD_KEY_FILE=/etc/etcd/pki/server.key
ETCD_TRUSTED_CA_FILE=/etc/etcd/pki/ca.crt

# Other
ETCD_DATA_DIR=/var/lib/etcd
ETCD_STRICT_RECONFIG_CHECK=true
GOMAXPROCS=6

root@etcd1:~# cat /etc/etcd/etcdctl.env
export ETCDCTL_API=3

export ETCDCTL_CACERT=/etc/etcd/pki/ca.crt
export ETCDCTL_CERT=/etc/etcd/pki/etcdctl-etcd-client.crt
export ETCDCTL_KEY=/etc/etcd/pki/etcdctl-etcd-client.key

export ETCDCTL_DIAL_TIMEOUT=3s

$ etcdadm help join
Join an existing etcd cluster

Usage:
  etcdadm join [flags]

Flags:
      --certs-dir string                 certificates directory (default "/etc/etcd/pki")
      --disk-priorities stringArray      Setting etcd disk priority (default [Nice=-10,IOSchedulingClass=best-effort,IOSchedulingPriority=2])
  -h, --help                             help for join
      --install-dir string               install directory (default "/opt/bin/")
      --name string                      etcd member name
      --release-url string               URL used to download etcd (default "https://github.com/coreos/etcd/releases/download")
      --retry                            Enable or disable backoff retry when join etcd member to cluster (default true)
      --server-cert-extra-sans strings   optional extra Subject Alternative Names for the etcd server signing cert, can be multiple comma separated DNS names or IPs
      --version string                   etcd version (default "3.4.9")

Global Flags:
  -l, --log-level string   set log level for output, permitted values debug, info, warn, error, fatal and panic (default "info")

root@etcd2:~# etcdadm join https://172.17.0.3:2379 --release-url https://gh-proxy.com/https://github.com/coreos/etcd/releases/download --server-cert-extra-sans "etcd1,etcd2,etcd3,172.17.0.3,172.17.0.4,172.17.0.5"  --log-level debug --version 3.5.13
INFO[0000] [certificates] creating PKI assets
INFO[0000] creating a self signed etcd CA certificate and key files
[certificates] Using the existing ca certificate and key.
INFO[0000] creating a new server certificate and key files for etcd
[certificates] Using the existing server certificate and key.
INFO[0000] creating a new certificate and key files for etcd peering
[certificates] Using the existing peer certificate and key.
INFO[0000] creating a new client certificate for the etcdctl
[certificates] Using the existing etcdctl-etcd-client certificate and key.
INFO[0000] creating a new client certificate for the apiserver calling etcd
[certificates] Using the existing apiserver-etcd-client certificate and key.
[certificates] valid certificates and keys now exist in "/etc/etcd/pki"
INFO[0000] [membership] Checking if this member was added
INFO[0000] [membership] Member was not added
INFO[0000] Removing existing data dir "/var/lib/etcd"
INFO[0000] [membership] Adding member
INFO[0000] [membership] Checking if member was started
INFO[0000] [membership] Member was not started
INFO[0000] [membership] Removing existing data dir "/var/lib/etcd"
INFO[0000] [install] extracting etcd archive /var/cache/etcdadm/etcd/v3.5.13/etcd-v3.5.13-linux-amd64.tar.gz to /tmp/etcd204417867
INFO[0001] [install] verifying etcd 3.5.13 is installed in /opt/bin/
INFO[0010] [health] Checking local etcd endpoint health
INFO[0010] [health] Local etcd endpoint is healthy

$ openssl x509 -in /etc/etcd/pki/server.crt -noout -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 961923162268170567 (0xd5970050436f947)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = etcd
        Validity
            Not Before: Apr 21 10:54:52 2024 GMT
            Not After : Apr 21 10:54:53 2025 GMT
        Subject: CN = etcd1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    xxx
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Authority Key Identifier:
                keyid:3C:53:43:2E:40:CA:BA:67:1F:DC:F0:CF:80:31:C6:36:0B:F5:D7:16

            X509v3 Subject Alternative Name:
                DNS:etcd1, IP Address:172.17.0.3, IP Address:127.0.0.1
    Signature Algorithm: sha256WithRSAEncryption
    xxx