[root@etcd1 ~]# etcdctl endpoint status --cluster -w table
+----------------------------+------------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+
| ENDPOINT | ID | VERSION | DB SIZE | IS LEADER | IS LEARNER | RAFT TERM| RAFT INDEX | RAFT APPLIED INDEX | ERRORS |
+----------------------------+------------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+
| http://192.168.93.103:2379 | 3d33f92152eaee46 |3.4.23 |20 kB |false|false|2|8|8||| http://192.168.93.102:2379 | 5abc4e842d3ab1d6 |3.4.23 |20 kB |false|false|2|8|8||| http://192.168.93.101:2379 | f416c4d7e7853c3a |3.4.23 |20 kB |true|false|2|8|8||
+----------------------------+------------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+
在启动新的etcd节点前，先向etcd集群声明添加节点的peer-urls和节点名称
[root@etcd1 ~]# etcdctl member add etcd4 --peer-urls=http://192.168.93.104:2380
Member dd2947c31edb0d2 added to cluster b59d820ff8caf3f4
ETCD_NAME="etcd4"ETCD_INITIAL_CLUSTER="etcd4=http://192.168.93.104:2380,etcd3=http://192.168.93.103:2380,etcd2=http://192.168.93.102:2380,etcd1=http://192.168.93.101:2380"ETCD_INITIAL_ADVERTISE_PEER_URLS="http://192.168.93.104:2380"ETCD_INITIAL_CLUSTER_STATE="existing"
# ID 为 104 [root@etcd1 ~]# etcdctl member update dd2947c31edb0d2 --peer-urls=http://192.168.93.105:2380
Member dd2947c31edb0d2 updated in cluster b59d820ff8caf3f4
查看集群节点信息，节点信息更新完成。
[root@etcd1 ~]# etcdctl endpoint status --cluster -w table
+----------------------------+------------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+
| ENDPOINT | ID | VERSION | DB SIZE | IS LEADER | IS LEARNER | RAFT TERM| RAFT INDEX | RAFT APPLIED INDEX | ERRORS |
+----------------------------+------------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+
| http://192.168.93.105:2379 | dd2947c31edb0d2 |3.4.23 |20 kB |false|false|2|14|14||| http://192.168.93.103:2379 | 3d33f92152eaee46 |3.4.23 |20 kB |false|false|2|14|14||| http://192.168.93.102:2379 | 5abc4e842d3ab1d6 |3.4.23 |20 kB |false|false|2|14|14||| http://192.168.93.101:2379 | f416c4d7e7853c3a |3.4.23 |20 kB |true|false|2|14|14||
+----------------------------+------------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+
# dd2947c31edb0d2 为 etcd5 的 ID[root@etcd1 ~]# etcdctl member remove dd2947c31edb0d2
Member dd2947c31edb0d2 removed from cluster b59d820ff8caf3f4
[root@etcd1 ~]# etcdctl endpoint status --cluster -w table
+----------------------------+------------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+
| ENDPOINT | ID | VERSION | DB SIZE | IS LEADER | IS LEARNER | RAFT TERM| RAFT INDEX | RAFT APPLIED INDEX | ERRORS |
+----------------------------+------------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+
| http://192.168.93.103:2379 | 3d33f92152eaee46 |3.4.23 |20 kB |false|false|4|21|21||| http://192.168.93.102:2379 | 5abc4e842d3ab1d6 |3.4.23 |20 kB |false|false|4|21|21||| http://192.168.93.101:2379 | f416c4d7e7853c3a |3.4.23 |20 kB |true|false|4|21|21||
+----------------------------+------------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+
四、数据库操作命令
4.1、增加(put)
添加一个键值对，基本用法如下所示
etcdctl put [options]<key><value>[flags]
常用参数如下所示：
参数
功能描述
–perv-kv
输出修改前的键值
注意事项：
其中value接受从stdin的输入内容
如果value是以横线-开始，将会被视为flag，如果不希望出现这种情况，可以使用两个横线代替–
若键已经存在，则进行更新并覆盖原有值，若不存在，则进行添加
[root@etcd1 ~]# etcdctl put name wzh
OK
[root@etcd1 ~]# etcdctl put location -- -shanghai
OK
[root@etcd1 ~]# etcdctl put foo1 bar1
OK
[root@etcd1 ~]# etcdctl put foo2 bar2
OK
[root@etcd1 ~]# etcdctl put foo3 bar3
OK
4.2、查询(get)
查询键值对，基本用法如下所示
etcdctl get [options]<key>[range_end][flags]
常用参数如下所示
参数
功能描述
–hex
以十六进制形式输出
–limit number
设置是输出结果的最大值
–prefix
根据prefix进行匹配key
–order
对输出结果进行排序，ASCEND或DESCEND
–sort-by
按给定字段排序，CREATE,KEYMODIFY,VALUE,VERSION
–print-value-only
仅输出value值
–from-key
按byte进行比较，获取大于等于指定key的结果
–keys-only
仅获取keys
示例
# 获取键值[root@etcd1 ~]# etcdctl get name
name
wzh
# 只获取值[root@etcd1 ~]# etcdctl get location --print-value-only
-shanghai
# 批量取从 foo1-foo3 的值， 不包括 foo3[root@etcd1 ~]# etcdctl get foo1 foo3 --print-value-only
bar1
bar2
# 批量获取前缀为 foo 的值[root@etcd1 ~]# etcdctl get --prefix foo --print-value-only
bar1
bar2
bar3
# 批量获取符合前缀的两个值[root@etcd1 ~]# etcdctl get --prefix --limit=2 foo --print-value-only
bar1
bar2
# 批量获取前缀为 foo 的值， 并排序[root@etcd1 ~]# etcdctl get --prefix foo --print-value-only --order DESCEND
bar3
bar2
bar1
4.3、删除(del)
删除键值，基本用法如下所示
etcdctl del [options]<key>[range_end][flags]
常用参数如下所示
参数
功能描述
–prefix
根据prefix进行匹配删除
–prev-kv
输出删除的键值
–form-key
按byte进行比较，删除大于指定key的结果
示例
# 删除name的键值[root@etcd1 ~]# etcdctl del name1# 删除从foo1到foo3且不包含foo3的键值[root@etcd1 ~]# etcdctl del foo1 foo32# 删除前缀为foo的所有键值[root@etcd1 ~]# etcdctl del --prefix foo1
4.4、更新(put覆盖)
若键值已经存在，则进行更新并覆盖原有值，若不存在，则进行添加
4.5、查询键历史记录查询
etcd在每次键值变更时，都会记录变更信息，便于我们查看键变更记录
4.6、监听命令
watch是监听或前缀发生改变的事件流，只要用法如下所示：
etcdctl watch[options][key or prefix][range_end][--][exec-command arg1 arg2 ...][flags]
示例如下所示:
# 对某个 key 监听操作, 当 key1 发生改变时, 会返回最新值[root@etcd1 ~]# etcdctl watch name# 监听 key 前缀[root@etcd1 ~]# etcdctl watch name --prefix# 监听到改变后执行相关操作[root@etcd1 ~]# etcdctl watch name -- etcdctl get age
4.6、监听单个建
# 启动监听命令[root@etcd1 ~]# etcdctl watch foo# 另一个控制台执行新增命令[root@etcd1 ~]# etcdctl put foo bar
OK
# 观察控制台监听输出[root@etcd1 ~]# etcdctl watch foo
PUT
foo
bar
# 另一个控制台执行删除命令[root@etcd1 ~]# etcdctl del foo1# 观察控制台监听输出[root@etcd1 ~]# etcdctl watch foo
PUT
foo
bar
DELETE
foo
4.7、同时监听多个建
# 监听前缀为 foo 的建[root@etcd1 ~]# etcdctl watch --prefix foo# 另一个控制台执行操作[root@etcd1 ~]# etcdctl put foo1 bar1
OK
[root@etcd1 ~]# etcdctl put foo2 bar2
OK
[root@etcd1 ~]# etcdctl del foo11# 观察控制台输出[root@etcd1 ~]# etcdctl watch --prefix foo
PUT
foo1
bar1
PUT
foo2
bar2
DELETE
foo1
# 监听指定的多个建[root@etcd1 ~]# etcdctl watch -i watch name
watch location
# 另一个控制台执行操作[root@etcd1 ~]# etcdctl put name wzh
OK
[root@etcd1 ~]# etcdctl del name1[root@etcd1 ~]# etcdctl put location shanghai
OK
# 观察控制台输出[root@etcd1 ~]# etcdctl watch -i watch name
watch location
PUT
name
wzh
DELETE
name
PUT
location
shanghai
# 设置 60 秒后过期时间[root@etcd1 ~]# etcdctl lease grant 60
lease 3c3a9a4cb7661512 granted with TTL(60s)# 把 foo 和租约绑定, 设置为60秒后过期[root@etcd1 ~]# etcdctl put --lease=3c3a9a4cb7661512 foo bar
OK
# 租约期内查询键值[root@etcd1 ~]# etcdctl get foo
foo
bar
# 租约期外查询键值(没有任何回显)[root@etcd1 ~]# etcdctl get foo
etcdctl user add < user name or user:password > [options] [flags]
添加新用户
delete
etcdctl user delete < user name > [flags]
删除用户
list
etcdctl user list [flags]
列出所有用户
get
etcdctl user get < user name [options] [flags]
获取用户详细信息
passwd
etcdctl user passwd < user name > [options] [flags]
修改密码
grant-role
etcdctl user grant-role < user name > < role name > [flags]
赋予用户角色
revoke-role
etcdctl user revoke-role < user name > < role name > [flags]
7.2、角色管理
其主要用法如下所示：
etcdctl role <subcommand>[flags]
其主要子命令主要如下所示：
子命令
常用用法
功能描述
add
etcdctl role add < role name [flags]
添加角色
delete
etcdctl role delete [flags]
删除角色
list
etcdctl role list [flags]
列出所有角色
get
etcdctl role get [flags]
获取角色详情
grant-permission
etcdctl role grant-permission [options] < role name > < permission tye > < < key > > [endkey] [flags]
把key操作权限授予一个角色
revoke-permission
etcdctl role revoke-permission < role name > < key > [endkey] [flags]
7.3、开启root身份验证
在开启身份验证后，注意事项如下所示：
开启身份验证：所有etcdctl命令操作都需要指定用户参数–user，参数值为用户名:密码
开启证书验证：所有etcdctl命令操作都需要添加证书参数–cacert
开启root身份验证的步骤如下所示：
# 添加 root 用户, 密码为 123456[root@etcd1 ~]# etcdctl user add root:123456
User root created
# 开启身份验证, 开启为 enable, 取消为 disable[root@etcd1 ~]# etcdctl auth enable --user=root:123456{"level":"warn","ts":"2025-11-04T15:45:30.570+0800","caller":"clientv3/retry_interceptor.go:62","msg":"retrying of unary invoker failed","target":"endpoint://client-a1a91c15-df9d-4e6f-80d3-7f388e9188f4/127.0.0.1:2379","attempt":0,"error":"rpc error: code = FailedPrecondition desc = etcdserver: authentication is not enabled"}{"level":"warn","ts":"2025-11-04T15:45:30.575+0800","caller":"clientv3/retry_interceptor.go:62","msg":"retrying of unary invoker failed","target":"endpoint://client-a1a91c15-df9d-4e6f-80d3-7f388e9188f4/127.0.0.1:2379","attempt":0,"error":"rpc error: code = FailedPrecondition desc = etcdserver: root user does not have root role"}
Authentication Enabled
# 开启身份验证后, 直接获取键值报错[root@etcd1 ~]# etcdctl get name{"level":"warn","ts":"2025-11-04T15:47:25.710+0800","caller":"clientv3/retry_interceptor.go:62","msg":"retrying of unary invoker failed","target":"endpoint://client-09b2c5c3-3be4-45f9-8465-cb85c80dfc80/127.0.0.1:2379","attempt":0,"error":"rpc error: code = InvalidArgument desc = etcdserver: user name is empty"}
Error: etcdserver: user name is empty
# 添加用户信息访问[root@etcd1 ~]# etcdctl get name --user=root:123456
name
wzh
7.4、角色授权
在开启了root身份验证后，就可以对普通用户和角色操作了
7.4.1、用户增删改查
# 添加普通[root@etcd1 ~]# etcdctl user add test:123 --user=root:123456
User test created
# 用户用户信息[root@etcd1 ~]# etcdctl user get test --user=root:123456
User: test
Roles:
# 查看所有用户[root@etcd1 ~]# etcdctl user list --user=root:123456
root
test# 修改用户密码[root@etcd1 ~]# etcdctl user passwd test --user=root:123456
Password of test:
Type password of test again for confirmation:
Password updated
# 删除用户[root@etcd1 ~]# etcdctl user delete test --user=root:123456
User test deleted
7.4.2、用户角色绑定
# 增加普通用户[root@etcd1 ~]# etcdctl user add test:123 --user=root:123456
User test created
# 添加角色[root@etcd1 ~]# etcdctl role add test-role --user=root:123456
Role test-role created
# 将角色绑定给指定用户[root@etcd1 ~]# etcdctl user grant-role test test-role --user=root:123456
Role test-role is granted to user test# 查看用户信息[root@etcd1 ~]# etcdctl user get test --user=root:123456
User: test
Roles: test-role
7.4.3、角色授权
权限分为：只读（read），只写（write）和读写（readwrite）权限
# 使用 test 用户获取 name 值会报错, 权限拒绝[root@etcd1 ~]# etcdctl get name --user=test:123{"level":"warn","ts":"2025-11-04T16:00:59.605+0800","caller":"clientv3/retry_interceptor.go:62","msg":"retrying of unary invoker failed","target":"endpoint://client-af949a12-8f25-4070-8fef-b7bad516d71b/127.0.0.1:2379","attempt":0,"error":"rpc error: code = PermissionDenied desc = etcdserver: permission denied"}
Error: etcdserver: permission denied
# 按 key 进行授权, test-role 角色可以读写 name[root@etcd1 ~]# etcdctl role grant-permission test-role readwrite name --user=root:123456
Role test-role updated
# 查看角色权限详情[root@etcd1 ~]# etcdctl role get test-role --user=root:123456
Role test-role
KV Read:
name
KV Write:
name
# 撤销角色权限[root@etcd1 ~]# etcdctl role revoke-permission test-role name --user=root:123456
Permission of key name is revoked from role test-role
# 查看角色权限详情[root@etcd1 ~]# etcdctl role get test-role --user=root:123456
Role test-role
KV Read:
KV Write:
浙公网安备 33010602011771号