[draft] 우분투에서 TLS를 사용하는 etcd 클러스터를 설정하는 방법

우분투에서 TLS를 사용하는 etcd 클러스터를 설정하는 방법

테스트 환경

역할	호스트 이름	아이피 주소	비고
etcd 서버	node211	192.168.0.211
etcd 서버	node212	192.168.0.212
etcd 서버	node213	192.168.0.213

 

APT 패키지 리스트 업데이트

sudo apt-get update

etcd 설치

sudo apt-get install -y etcd

TLS/SSL 인증서 생성

curl -fsSL https://raw.githubusercontent.com/anti1346/zz/main/ubuntu/sslcert_generator.sh -o sslcert_generator.sh

vim sslcert_generator.sh

 

# 설정 값 정의
export NAME1="node211"
export ADDRESS1="192.168.0.211"
export NAME2="node212"
export ADDRESS2="192.168.0.212"
export NAME3="node213"
export ADDRESS3="192.168.0.213"

chmod +x sslcert_generator.sh

bash sslcert_generator.sh

tar cfz ssl.tar.gz ssl

인증서 파일 배포

생성된 인증서 파일을 각 노드에 복사합니다.

scp ssl.tar.gz ubuntu@127.0.0.1:~

scp ssl.tar.gz ubuntu@192.168.0.212:~

scp ssl.tar.gz ubuntu@192.168.0.213:~

각 노드에서 적절한 위치로 이동시키고 권한을 설정합니다.

sudo mkdir -p /etc/etcd /var/lib/etcd

tar xfz /home/ubuntu/ssl.tar.gz -C /etc/etcd

sudo chown -R etcd:etcd /etc/etcd

etcd 데이터 디렉토리 생성 및 권한 여부

sudo mkdir -p /var/lib/etcd

sudo chown -R etcd:etcd /var/lib/etcd

sudo chmod -R 700 /var/lib/etcd

etcd 서비스 구성

• 설치가 완료되면 etcd 서비스를 구성해야 합니다.
• 기본적으로 /etc/default/etcd 파일을 편집하여 환경 변수를 설정할 수 있습니다.

• node211

cat <<EOF | sudo tee /etc/default/etcd
ETCD_NAME="node211"
ETCD_DATA_DIR="/var/lib/etcd"
ETCD_LISTEN_PEER_URLS="https://0.0.0.0:2380"
ETCD_LISTEN_CLIENT_URLS="https://0.0.0.0:2379"
ETCD_ADVERTISE_CLIENT_URLS="https://192.168.0.211:2379"
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://192.168.0.211:2380"
ETCD_INITIAL_CLUSTER="node211=https://192.168.0.211:2380,node212=https://192.168.0.212:2380,node213=https://192.168.0.213:2380"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
ETCD_INITIAL_CLUSTER_STATE="new"

ETCD_TRUSTED_CA_FILE="/etc/etcd/ssl/ca.crt"
ETCD_CERT_FILE="/etc/etcd/ssl/node.crt"
ETCD_KEY_FILE="/etc/etcd/ssl/node.key"
ETCD_CLIENT_CERT_AUTH="true"

ETCD_PEER_TRUSTED_CA_FILE="/etc/etcd/ssl/ca.crt"
ETCD_PEER_CERT_FILE="/etc/etcd/ssl/peer.crt"
ETCD_PEER_KEY_FILE="/etc/etcd/ssl/peer.key"
ETCD_PEER_CLIENT_CERT_AUTH="true"
EOF

• node212

cat <<EOF | sudo tee /etc/default/etcd
ETCD_NAME="node212"
ETCD_DATA_DIR="/var/lib/etcd"
ETCD_LISTEN_PEER_URLS="https://0.0.0.0:2380"
ETCD_LISTEN_CLIENT_URLS="https://0.0.0.0:2379"
ETCD_ADVERTISE_CLIENT_URLS="https://192.168.0.212:2379"
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://192.168.0.212:2380"
ETCD_INITIAL_CLUSTER="node211=https://192.168.0.211:2380,node212=https://192.168.0.212:2380,node213=https://192.168.0.213:2380"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
ETCD_INITIAL_CLUSTER_STATE="new"

ETCD_TRUSTED_CA_FILE="/etc/etcd/ssl/ca.crt"
ETCD_CERT_FILE="/etc/etcd/ssl/node.crt"
ETCD_KEY_FILE="/etc/etcd/ssl/node.key"
ETCD_CLIENT_CERT_AUTH="true"

ETCD_PEER_TRUSTED_CA_FILE="/etc/etcd/ssl/ca.crt"
ETCD_PEER_CERT_FILE="/etc/etcd/ssl/peer.crt"
ETCD_PEER_KEY_FILE="/etc/etcd/ssl/peer.key"
ETCD_PEER_CLIENT_CERT_AUTH="true"
EOF

• node213

cat <<EOF | sudo tee /etc/default/etcd
ETCD_NAME="node213"
ETCD_DATA_DIR="/var/lib/etcd"
ETCD_LISTEN_PEER_URLS="https://0.0.0.0:2380"
ETCD_LISTEN_CLIENT_URLS="https://0.0.0.0:2379"
ETCD_ADVERTISE_CLIENT_URLS="https://192.168.0.213:2379"
ETCD_INITIAL_ADVERTISE_PEER_URLS="https://192.168.0.213:2380"
ETCD_INITIAL_CLUSTER="node211=https://192.168.0.211:2380,node212=https://192.168.0.212:2380,node213=https://192.168.0.213:2380"
ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster"
ETCD_INITIAL_CLUSTER_STATE="new"

ETCD_TRUSTED_CA_FILE="/etc/etcd/ssl/ca.crt"
ETCD_CERT_FILE="/etc/etcd/ssl/node.crt"
ETCD_KEY_FILE="/etc/etcd/ssl/node.key"
ETCD_CLIENT_CERT_AUTH="true"

ETCD_PEER_TRUSTED_CA_FILE="/etc/etcd/ssl/ca.crt"
ETCD_PEER_CERT_FILE="/etc/etcd/ssl/peer.crt"
ETCD_PEER_KEY_FILE="/etc/etcd/ssl/peer.key"
ETCD_PEER_CLIENT_CERT_AUTH="true"
EOF

728x90

환경 변수 설정

• etcd 3.x 버전부터는 API v3가 기본값이지만 명시적으로 설정해보는 것이 좋습니다.

export ETCDCTL_API=3

etcd 서비스 시작 및 활성화

• etcd 서비스를 시작하고 시스템 부팅 시 자동으로 시작되도록 설정합니다.

sudo systemctl start etcd

sudo systemctl enable etcd

etcd 상태 확인

• etcd 서비스가 정상적으로 실행 중인지 확인합니다.

sudo systemctl status etcd

지정된 엔드포인의 health 상태 확인

etcdctl endpoint health \
--cacert=/etc/etcd/ssl/ca.crt \
--cert=/etc/etcd/ssl/peer.crt \
--key=/etc/etcd/ssl/peer.key \
--endpoints=https://192.168.0.211:2379

https://192.168.0.211:2379 is healthy: successfully committed proposal: took = 13.726492ms

클러스터 전체의 health 상태 확인

etcdctl endpoint health \
--cacert=/etc/etcd/ssl/ca.crt \
--cert=/etc/etcd/ssl/peer.crt \
--key=/etc/etcd/ssl/peer.key \
--endpoints=https://192.168.0.211:2379

https://192.168.0.211:2379 is healthy: successfully committed proposal: took = 18.23104ms
https://192.168.0.212:2379 is healthy: successfully committed proposal: took = 42.124884ms
https://192.168.0.213:2379 is healthy: successfully committed proposal: took = 43.353518ms

etcd 클라이언트의 모든 멤버를 목록 확인

etcdctl member list \
--cacert=/etc/etcd/ssl/ca.crt \
--cert=/etc/etcd/ssl/peer.crt \
--key=/etc/etcd/ssl/peer.key \
--endpoints=https://192.168.0.211:2379

9871a5b8e09439cb, started, node213, https://192.168.0.213:2380, https://192.168.0.213:2379, false
d1e97ac3dce77936, started, node212, https://192.168.0.212:2380, https://192.168.0.212:2379, false
f151a08f96159b75, started, node211, https://192.168.0.211:2380, https://192.168.0.211:2379, false