etcd

Installs and configures etcd
Cristian Falcas

Cristian Falcas

cristifalcas

79,503 downloads

31,394 latest version

4.3 quality score

Version information

  • 1.12.2 (latest)
  • 1.12.1
  • 1.12.0
  • 1.11.0
  • 1.10.1
  • 1.10.0
  • 1.9.0
  • 1.8.0
  • 1.7.0
  • 1.6.0
  • 1.5.0
  • 1.3.0
  • 1.2.1
  • 1.2.0
  • 1.1.2
  • 1.1.1
  • 1.1.0
  • 1.0.1
  • 1.0.0
  • 0.9.0
  • 0.8.0
  • 0.1.1
  • 0.1.0
released Jul 3rd 2019
This version is compatible with:
  • Puppet Enterprise 2017.2.x, 2017.1.x, 2016.5.x, 2016.4.x
  • Puppet >=3.4.0 <5.0.0
  • RedHat
    ,
    CentOS
    ,
    OracleLinux
    ,
    Scientific
    ,
    Fedora
    ,
    Debian

Start using this module

Tags: etcd

Documentation

cristifalcas/etcd — version 1.12.2 Jul 3rd 2019

etcd

Build Status

This module installs and configures etcd.

A basic provider is also implemented that can add/update/delete node keys

Because of the way etcd is working, you can't change any of the initial cluster variables after first run:

initial_advertise_peer_urls
initial_cluster
initial_cluster_state
initial_cluster_token

This is annoying if you first bootstraped the cluster in http mode and you want to add ssl after that to initial_cluster parameter.

Solution:

  • Don't care. Even if the protocol is http, the communication will be over ssl
  • redeploy the cluster (rm -rf /var/lib/etcd/$data_dir)

##Usage:

Basic usage:

include etcd

or

class { 'etcd':
  ensure                     => 'latest',
  etcd_listen_client_urls    => 'http://0.0.0.0:2379',
}

Add a key/value pair to etcd:

etcd_key { '/coreos.com/network/config': value => '{ "Network": "10.1.0.0/16" }' }

Remove a key:

etcd_key { '/coreos.com/network1/config': ensure => absent }

Deploy a cluster:

class { 'etcd':
    listen_client_urls          => 'http://0.0.0.0:2379',
    advertise_client_urls       => "http://${::fqdn}:2379,http://127.0.0.1:2379",
    listen_peer_urls            => 'http://0.0.0.0:2380',
    initial_advertise_peer_urls => "http://${::fqdn}:2380,http://127.0.0.1:2379",
    initial_cluster             => [
      "${::hostname}=http://${::fqdn}:2380",
      'infra1=http://infra1.domain.net:2380',
      'infra2=http://infra2.domain.net:2380'],
}

Enable ssl for client communication:

class { 'etcd':
  ensure                      => 'latest',
  etcd_name                   => $::hostname,
  listen_client_urls          => 'https://0.0.0.0:2379',
  advertise_client_urls       => "https://${::fqdn}:2379",
  # clients should speak over ssl
  cert_file                   => "${::settings::ssldir}/certs/${::clientcert}.pem",
  key_file                    => "${::settings::ssldir}/private_keys/${::clientcert}.pem",
  # authorize clients
  client_cert_auth            => true,
  # and verify clients certificates
  trusted_ca_file             => "${::settings::ssldir}/certs/ca.pem",
  initial_cluster             => [
      "${::hostname}=http://${::fqdn}:2380",
      'infra1=http://infra1.domain.net:2380',
      'infra2=http://infra2.domain.net:2380'],
}

Use the etcd provider with ssl certificates:

etcd_key { '/coreos.com/network/config':
  value     => '{ "Network": "10.1.0.0/18" }',
  peers     => "https://${::fqdn}:2379",
  cert_file => "${::settings::ssldir}/certs/${::clientcert}.pem",
  key_file  => "${::settings::ssldir}/private_keys/${::clientcert}.pem",
  # verify server ceretificate
  ca_file   => "${::settings::ssldir}/certs/ca.pem",
}

Deploy a cluster with full ssl for both clients and peers

class { 'etcd':
  ensure                      => 'latest',
  etcd_name                   => $::hostname,
  # clients
  listen_client_urls          => 'https://0.0.0.0:2379',
  advertise_client_urls       => "https://${::fqdn}:2379",
  # clients ssl
  cert_file => '/etc/pki/puppet_certs/etcd/public_cert.pem',
  key_file  => '/etc/pki/puppet_certs/etcd/private_cert.pem',
  # authorize clients
  client_cert_auth            => true,
  # verify clients certificates
  trusted_ca_file             => '/etc/pki/puppet_certs/etcd/ca_cert.pem',
  # cluster
  listen_peer_urls            => 'https://0.0.0.0:2380',
  initial_advertise_peer_urls => "https://${::fqdn}:2380",
  initial_cluster             => [
      "${::hostname}=http://${::fqdn}:2380",
      'infra1=http://infra1.domain.net:2380',
      'infra2=http://infra2.domain.net:2380'],
  # peers ssl
  peer_cert_file              => '/etc/pki/puppet_certs/etcd/public_cert.pem',
  peer_key_file               => '/etc/pki/puppet_certs/etcd/private_cert.pem',
  # authorize peers
  peer_client_cert_auth       => true,
  # verify peers certificates
  peer_trusted_ca_file        => '/etc/pki/puppet_certs/etcd/ca_cert.pem',
  debug     => true,
}

Deploy a proxy

If the $proxy parameter is undef, we will try to guess if the node should be a proxy by checking if $::fqdn or $::ipaddress appears in initial_cluster parameter.

class { 'etcd':
  ensure                      => 'latest',
  etcd_name                   => $::hostname,
  proxy                       => 'on',
  # clients
  listen_client_urls          => 'https://0.0.0.0:2379',
  advertise_client_urls       => "https://${::fqdn}:2379",
  # clients ssl
  cert_file => '/etc/pki/puppet_certs/etcd/public_cert.pem',
  key_file  => '/etc/pki/puppet_certs/etcd/private_cert.pem',
  # authorize clients
  client_cert_auth            => true,
  # verify clients certificates
  trusted_ca_file             => '/etc/pki/puppet_certs/etcd/ca_cert.pem',
  # cluster
  listen_peer_urls            => 'https://0.0.0.0:2380',
  initial_cluster             => [
      'infra0=http://infra0.domain.net:2380',
      'infra1=http://infra1.domain.net:2380',
      'infra2=http://infra2.domain.net:2380'],
  # peers ssl
  peer_cert_file              => '/etc/pki/puppet_certs/etcd/public_cert.pem',
  peer_key_file               => '/etc/pki/puppet_certs/etcd/private_cert.pem',
  # authorize peers
  peer_client_cert_auth       => true,
  # verify peers certificates
  peer_trusted_ca_file        => '/etc/pki/puppet_certs/etcd/ca_cert.pem',
  debug     => true,
}

Journald forward:

The class support a parameter called journald_forward_enable.

This was added because of the PIPE signal that is sent to go programs when systemd-journald dies.

For more information read here: https://github.com/projectatomic/forward-journald

Usage:

  include ::forward_journald
  Class['forward_journald'] -> Class['etcd']