K8S部署带认证的etcd集群

apiVersion: v1
kind: Service
metadata:
  name: etcd-service
  namespace: arts-system
  labels:
    app: etcd
spec:
  ports:
  - name: client
    port: 2379
    protocol: TCP
    targetPort: 2379
  - name: peer
    port: 2380
    protocol: TCP
    targetPort: 2380
  type: NodePort
  selector:
    app: etcd

---

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: etcd
  namespace: arts-system
spec:
  serviceName: "etcd-service"
  replicas: 3
  selector:
    matchLabels:
      app: etcd
  template:
    metadata:
      labels:
        app: etcd
    spec:
      containers:
      - name: etcd
        image: quay.io/coreos/etcd:v3.4.13
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 2379
          name: client
        - containerPort: 2380
          name: peer
        volumeMounts:
        - name: etcddata
          mountPath: /var/run/etcd
          subPath: artsdata/etcd
        command:
          - /usr/local/bin/etcd
        args:
          - --data-dir=/var/run/etcd/$(ETCD_NAMES)data
          - --name=$(ETCD_NAMES)
          - --initial-advertise-peer-urls=http://$(ETCD_NAMES).etcd-service.arts-system.svc.cluster.local:2380
          - --listen-peer-urls=http://0.0.0.0:2380
          - --listen-client-urls=http://0.0.0.0:2379
          - --advertise-client-urls=http://$(ETCD_NAMES).etcd-service.arts-system.svc.cluster.local:2379
          - --initial-cluster-token=etcd-cluster
          - --initial-cluster=etcd-0=http://etcd-0.etcd-service.arts-system.svc.cluster.local:2380,etcd-1=http://etcd-1.etcd-service.arts-system.svc.cluster.local:2380,etcd-2=http://etcd-2.etcd-service.arts-system.svc.cluster.local:2380
          - --initial-cluster-state=new
        env:
        - name: ETCD_NAMES
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
      volumes:
      - name: etcddata
        persistentVolumeClaim:
          #claimName: artspvc
          claimName: arts-pvc



# 使用job给etcd集群设置账密
---
apiVersion: batch/v1
kind: Job
metadata:
  labels:
    job-name: etcd-auth-init
  name: etcd-auth-init
  namespace: arts-system
spec:
  template:
    metadata:
      labels:
        job-name: etcd-auth-init
    spec:
      containers:
      - command:
        - /bin/sh
        - -ec
        - |
          # Wait for etcd to become ready
          for i in $(seq 1 60); do
            etcdctl put foo bar && break || sleep 1
          done
          # Add root user and enable authentication
          etcdctl user add root:"123456"
          etcdctl user grant-role root root
          etcdctl auth enable
        env:
        - name: ETCDCTL_API
          value: "3"
        - name: ETCDCTL_ENDPOINTS
          value: http://etcd-service.arts-system.svc.cluster.local:2379
        image: quay.io/coreos/etcd:v3.4.13
        imagePullPolicy: IfNotPresent
        name: etcd-auth-init
        resources: {}
      restartPolicy: OnFailure



# 集群测试
# ./etcdctl --user='root' --password='123456' --endpoints http://192.168.73.100:37737 put hello world