ffb751d638
With this patch following are done:- - Configure Etcd with TLS support Configure Following to commuicate with TLS enabled Etcd:- - Swarm manager - Swarm agent - Docker - Flannel Etcd also listens at http://127.0.0.1:2379, so on master nodes etcdctl can be used without certificates. if TLS_DISABLED="True" then no TLS is enabled for etcd. Change-Id: I6cadfebcfaaaf7ac7a7660b377b7d96748f0f9f0 Partially-Implements: blueprint secure-etcd-cluster-coe
40 lines
951 B
Bash
40 lines
951 B
Bash
#!/bin/sh
|
|
|
|
. /etc/sysconfig/heat-params
|
|
|
|
myip="$SWARM_NODE_IP"
|
|
cert_dir="/etc/docker"
|
|
protocol="https"
|
|
|
|
if [ "$TLS_DISABLED" = "True" ]; then
|
|
protocol="http"
|
|
fi
|
|
|
|
cat > /etc/etcd/etcd.conf <<EOF
|
|
ETCD_NAME="$myip"
|
|
ETCD_DATA_DIR="/var/lib/etcd/default.etcd"
|
|
ETCD_LISTEN_CLIENT_URLS="$protocol://$myip:2379,http://127.0.0.1:2379"
|
|
ETCD_LISTEN_PEER_URLS="$protocol://$myip:2380"
|
|
|
|
ETCD_ADVERTISE_CLIENT_URLS="$protocol://$myip:2379,http://127.0.0.1:2379"
|
|
ETCD_INITIAL_ADVERTISE_PEER_URLS="$protocol://$myip:2380"
|
|
ETCD_DISCOVERY="$ETCD_DISCOVERY_URL"
|
|
EOF
|
|
|
|
if [ "$TLS_DISABLED" = "False" ]; then
|
|
|
|
cat >> /etc/etcd/etcd.conf <<EOF
|
|
ETCD_CA_FILE=$cert_dir/ca.crt
|
|
ETCD_CERT_FILE=$cert_dir/server.crt
|
|
ETCD_KEY_FILE=$cert_dir/server.key
|
|
ETCD_PEER_CA_FILE=$cert_dir/ca.crt
|
|
ETCD_PEER_CERT_FILE=$cert_dir/server.crt
|
|
ETCD_PEER_KEY_FILE=$cert_dir/server.key
|
|
EOF
|
|
|
|
fi
|
|
|
|
if [ -n "$HTTP_PROXY" ]; then
|
|
echo "ETCD_DISCOVERY_PROXY=$HTTP_PROXY" >> /etc/etcd/etcd.conf
|
|
fi
|