高可用etcd集群（三节点） + ssl双向认证

# etcd下载地址
https://github.com/etcd-io/etcd/tags
wget https://github.com/etcd-io/etcd/releases/download/v3.1.20/etcd-v3.1.20-linux-amd64.tar.gz

# 创建etcd启动用户
useradd -s /sbin/nologin -M etcd

# 设置etcd工作空间　
tar -xf etcd-v3.1.20-linux-amd64.tar.gz -C /opt/
mv etcd-v3.1.20-linux-amd64 etcd-v3.1.20
ln -s etcd-v3.1.20 etcd

# 创建etcd工作目录
mkdir -p /opt/etcd/certs /data/etcd /data/logs/etcd-server


# 将提前生成好的etcd双向证书放置/opt/etcd/certs目录
# 证书生成，请参考：https://www.cnblogs.com/ipyanthony/p/12011893.html
[root@hdss7-12 opt]# ls /opt/etcd/certs/
ca.pem  etcd-peer-key.pem  etcd-peer.pem




# 创建etcd启动脚本
/opt/etcd/etcd-server-startup.sh

#!/bin/sh
./etcd --name etcd-server-7-12 \
       --data-dir /data/etcd/etcd-server \
       --listen-peer-urls https://10.4.7.12:2380 \
       --listen-client-urls https://10.4.7.12:2379,http://127.0.0.1:2379 \
       --quota-backend-bytes 8000000000 \
       --initial-advertise-peer-urls https://10.4.7.12:2380 \
       --advertise-client-urls https://10.4.7.12:2379,http://127.0.0.1:2379 \
       --initial-cluster  etcd-server-7-12=https://10.4.7.12:2380,etcd-server-7-21=https://10.4.7.21:2380,etcd-server-7-22=https://10.4.7.22:2380 \
       --ca-file ./certs/ca.pem \
       --cert-file ./certs/etcd-peer.pem \
       --key-file ./certs/etcd-peer-key.pem \
       --client-cert-auth  \
       --trusted-ca-file ./certs/ca.pem \
       --peer-ca-file ./certs/ca.pem \
       --peer-cert-file ./certs/etcd-peer.pem \
       --peer-key-file ./certs/etcd-peer-key.pem \
       --peer-client-cert-auth \
       --peer-trusted-ca-file ./certs/ca.pem \
       --log-output stdout

不同etcd节点创建启动文件时，需要注意的事项：
--listen-peer-urls        此处填写etcd进程所在机器的ip
例如：--listen-peer-urls https://10.4.7.12:2380

--listen-client-urls    此处填写etcd进程所在机器的ip
例如：--listen-client-urls https://10.4.7.12:2379,http://127.0.0.1:2379

--initial-advertise-peer-urls     此处填写etcd进程所在机器的ip
例如：--initial-advertise-peer-urls https://10.4.7.12:2380

--advertise-client-urls     此处填写etcd进程所在机器的ip
例如：--advertise-client-urls https://10.4.7.12:2379,http://127.0.0.1:2379


# 授权工作目录
chown -R etcd.etcd /data/etcd
chown -R etcd.etcd /data/logs/etcd-server
chown -R etcd.etcd /opt/etcd/

# 安装supervisor进程管理软件
yum -y install supervisor
systemctl start supervisord
systemctl enable supervisord

# 添加etcd-supervisor启动文件
/etc/supervisord.d/etcd-server.ini

[program:etcd-server-7-12]
command=/opt/etcd/etcd-server-startup.sh                        ; the program (relative uses PATH, can take args)
numprocs=1                                                      ; number of processes copies to start (def 1)
directory=/opt/etcd                                             ; directory to cwd to before exec (def no cwd)
autostart=true                                                  ; start at supervisord start (default: true)
autorestart=true                                                ; retstart at unexpected quit (default: true)
startsecs=30                                                    ; number of secs prog must stay running (def. 1)
startretries=3                                                  ; max # of serial start failures (default 3)
exitcodes=0,2                                                   ; 'expected' exit codes for process (default 0,2)
stopsignal=QUIT                                                 ; signal used to kill process (default TERM)
stopwaitsecs=10                                                 ; max num secs to wait b4 SIGKILL (default 10)
user=etcd                                                       ; setuid to this UNIX account to run the program
redirect_stderr=true                                            ; redirect proc stderr to stdout (default false)
stdout_logfile=/data/logs/etcd-server/etcd.stdout.log           ; stdout log path, NONE for none; default AUTO
stdout_logfile_maxbytes=64MB                                    ; max # logfile bytes b4 rotation (default 50MB)
stdout_logfile_backups=4                                        ; # of stdout logfile backups (default 10)
stdout_capture_maxbytes=1MB                                     ; number of bytes in 'capturemode' (default 0)
stdout_events_enabled=false                                     ; emit events on stdout writes (default false)

# 启动supervisor管理etcd进程
supervisorctl update
supervisorctl status

# 查看进程
netstat -luntp|grep etcd

# 注意事项
2380端口为：etcd监听端口
2379端口为：多个etcd程序之间，互相通信的端口
tcp        0      0 10.4.7.12:2379          0.0.0.0:*               LISTEN      22657/./etcd        
tcp        0      0 127.0.0.1:2379          0.0.0.0:*               LISTEN      22657/./etcd        
tcp        0      0 10.4.7.12:2380          0.0.0.0:*               LISTEN      22657/./etcd