标签：连接 根据 时间同步 tno discovery 开启 str rest 部署
#[Member] #ETCD_CORS="" ETCD_DATA_DIR="/var/lib/etcd/default.etcd" #ETCD_WAL_DIR="" #ETCD_LISTEN_PEER_URLS="http://localhost:2380" ETCD_LISTEN_CLIENT_URLS="http://0.0.0.0:2379" #ETCD_MAX_SNAPSHOTS="5" #ETCD_MAX_WALS="5" ETCD_NAME="default" #ETCD_SNAPSHOT_COUNT="100000" #ETCD_HEARTBEAT_INTERVAL="100" #ETCD_ELECTION_TIMEOUT="1000" #ETCD_QUOTA_BACKEND_BYTES="0" #ETCD_MAX_REQUEST_BYTES="1572864" #ETCD_GRPC_KEEPALIVE_MIN_TIME="5s" #ETCD_GRPC_KEEPALIVE_INTERVAL="2h0m0s" #ETCD_GRPC_KEEPALIVE_TIMEOUT="20s" # #[Clustering] #ETCD_INITIAL_ADVERTISE_PEER_URLS="http://localhost:2380" ETCD_ADVERTISE_CLIENT_URLS="http://192.168.2.155:2379" #ETCD_DISCOVERY="" #ETCD_DISCOVERY_FALLBACK="proxy" #ETCD_DISCOVERY_PROXY="" #ETCD_DISCOVERY_SRV="" #ETCD_INITIAL_CLUSTER="default=http://localhost:2380" #ETCD_INITIAL_CLUSTER_TOKEN="etcd-cluster" #ETCD_INITIAL_CLUSTER_STATE="new" #ETCD_STRICT_RECONFIG_CHECK="true" #ETCD_ENABLE_V2="true" # #[Proxy] #ETCD_PROXY="off" #ETCD_PROXY_FAILURE_WAIT="5000" #ETCD_PROXY_REFRESH_INTERVAL="30000" #ETCD_PROXY_DIAL_TIMEOUT="1000" #ETCD_PROXY_WRITE_TIMEOUT="5000" #ETCD_PROXY_READ_TIMEOUT="0" # #[Security] ETCD_CERT_FILE="/ssl/server.pem" ETCD_KEY_FILE="/ssl/server-key.pem" #ETCD_CLIENT_CERT_AUTH="false" #ETCD_TRUSTED_CA_FILE="" #ETCD_AUTO_TLS="false" #ETCD_PEER_CERT_FILE="" #ETCD_PEER_KEY_FILE="" #ETCD_PEER_CLIENT_CERT_AUTH="false" #ETCD_PEER_TRUSTED_CA_FILE="" #ETCD_PEER_AUTO_TLS="false" # #[Logging] #ETCD_DEBUG="false" #ETCD_LOG_PACKAGE_LEVELS="" #ETCD_LOG_OUTPUT="default" # #[Unsafe] #ETCD_FORCE_NEW_CLUSTER="false" # #[Version] #ETCD_VERSION="false" #ETCD_AUTO_COMPACTION_RETENTION="0" # #[Profiling] #ETCD_ENABLE_PPROF="false" #ETCD_METRICS="basic" # #[Auth] #ETCD_AUTH_TOKEN="simple"
export ETCDCTL_API=3
[Unit]
Description=Etcd Server
After=network.target
After=network-online.target
Wants=network-online.target
[Service]
Type=notify
WorkingDirectory=/var/lib/etcd/
EnvironmentFile=-/etc/etcd/etcd.conf
User=etcd
# set GOMAXPROCS to number of processors
ExecStart=/bin/bash -c "GOMAXPROCS=$(nproc) /usr/bin/etcd --name=\"${ETCD_NAME}\" --data-dir=\"${ETCD_DATA_DIR}\" --listen-client-urls=\"${ETCD_LISTEN_CLIENT_URLS}\" --cert-file=\"${ETCD_CERT_FILE}\" --key-file=\"${ETCD_KEY_FILE}\" --advertise-client-urls=\"${ETCD_ADVERTISE_CLIENT_URLS}\""
Restart=on-failure
LimitNOFILE=65536
[Install]
WantedBy=multi-user.target
.:53 {
health # 监听tcp和udp的53端口
etcd { # 配置启用etcd插件,后面可以指定域名,例如 etcd test.com {
stubzones # 启用存根区域功能。 stubzone仅在位于指定的第一个区域下方的etcd树中完成
path /coredns # etcd里面的路径 默认为/skydns，以后所有的dns记录就是存储在该存根路径底下
endpoint http://localhost:2379 # etcd访问地址，多个空格分开
# upstream设置要使用的上游解析程序解决指向外部域名的在etcd（认为CNAME）中找到的外部域名。
upstream 114.114.114.114:53 8.8.8.8:53 /etc/resolv.conf
fallthrough # 如果区域匹配但不能生成记录，则将请求传递给下一个插件
# tls CERT KEY CACERT # 可选参数，etcd认证证书设置
tls /ssl/server.pem /ssl/server-key.pem /ssl/ca.pem
# 指定访问etcd用户名和密码（根据实际情况使用）
credentials USERNAME PASSWORD
}
prometheus # 监控插件
cache 160 # 缓存时间
loop #
reload 6s # 自动加载时间间隔
loadbalance # 负载均衡，开启DNS记录轮询策略
forward . /etc/resolv.conf # 上面etcd未查询到的请求转发给设置的DNS服务器解析
log # 打印日志
errors # 输出错误
}
[Unit] Description=CoreDNS DNS server Documentation=https://coredns.io After=network.target [Service] PermissionsStartOnly=true LimitNOFILE=1048576 LimitNPROC=512 CapabilityBoundingSet=CAP_NET_BIND_SERVICE AmbientCapabilities=CAP_NET_BIND_SERVICE NoNewPrivileges=true User=coredns WorkingDirectory=~ ExecStart=/usr/bin/coredns -conf=/etc/coredns/Corefile ExecReload=/bin/kill -SIGUSR1 $MAINPID Restart=on-failure [Install] WantedBy=multi-user.target
A记录
% etcdctl put /coredns/com/leffss/www ‘{"host":"1.1.1.1","ttl":10}‘
OK
* etcd的目录结构和域名是相反的，即上面表示域名：www.leffss.com
* ttl值设置60s后，coredns每60s才会到etcd读取这个域名的记录一次
查询结果：
% dig @localhost +short www.leffss.com
1.1.1.1
如果想添加多条记录，让coredns轮询，方法如下：
% etcdctl put /coredns/com/leffss/www/x1 ‘{"host":"1.1.1.2","ttl":10}‘
OK
% etcdctl put /coredns/com/leffss/www/x2 ‘{"host":"1.1.1.3","ttl":10}‘
OK
* x1和x2可以自定义，比如a、b、c等
* 设置多个AAAA、CNAME等方法类似
* 添加/coredns/com/leffss/www/x1、x2后，请求www.leffss.com就不会再读取/coredns/com/leffss/www，可以使用etcdctl del /coredns/com/leffss/www删除值
查询结果：
% dig @localhost +short www.leffss.com
1.1.1.21.1.1.3
**注意：**如果想让取消设置的轮询值，需要删除/coredns/com/leffss/www/x1与/coredns/com/leffss/www/x2
AAAA记录
% etcdctl put /coredns/com/leffss/www ‘{"host":"1002::4:2","ttl":10}‘
OK
查询结果：
% dig -t AAAA @localhost +short www.leffss.com
1002::4:2
CNAME记录
% etcdctl put /coredns/com/leffss/www ‘{"host":"www.baidu.com","ttl":10}‘
OK
查询结果：
% dig -t CNAME @localhost +short www.leffss.com
www.baidu.com.
* 这里cname设置成外部百度域名，按理说coredns应该也把这个cname记录继续解析成www.baidu.cm的IP地址，但是经过测试发现请求www.leffss.com只能解析到CNAME：www.baidu.com，无法继续解析，原因未知，以后研究
SRV记录
% etcdctl put /coredns/com/leffss/www ‘{"host":"www.baidu.com","port":80,"ttl":10}‘
OK
* SRV记录和CNAME记录类似，只是多了port，它们的添加方法其实可以通用
查询结果：
% dig -t SRV @localhost +short www.leffss.com
10 100 80 www.baidu.com.
TXT记录
% etcdctl put /coredns/com/leffss/www ‘{"text":"This is text!","ttl":10}‘
OK
查询结果：
% dig -t TXT @localhost +short www.leffss.com
"This is text!"
public static void main(String[] args) throws Exception {
// create client
Client client = Client.builder().endpoints("http://192.168.2.155:2379").build();
KV kvClient = client.getKVClient();
ByteSequence key = ByteSequence.from(formatKey("www.leffss.com"), Charset.forName("UTF-8"));
ByteSequence value = ByteSequence.from(formatValue("192.168.2.133", 53), Charset.forName("UTF-8"));
// put the key-value
kvClient.put(key, value).get();
// get the CompletableFuture
CompletableFuture<GetResponse> getFuture = kvClient.get(key);
// get the value from CompletableFuture
GetResponse response = getFuture.get();
List<KeyValue> keyValues = response.getKvs();
for (KeyValue kv : keyValues) {
System.out.println("key :" + kv.getKey().toString(Charset.forName("UTF-8")) + " val :" + kv.getValue().toString(Charset.forName("UTF-8")));
}
<dependency>
<groupId>dnsjava</groupId>
<artifactId>dnsjava</artifactId>
<version>2.1.8</version>
</dependency>
<dependency>
<groupId>io.etcd</groupId>
<artifactId>jetcd-core</artifactId>
<version>0.3.0</version>
</dependency>
cat > ca-config.json <<EOF
{
"signing": {
"default": {
"expiry": "87600h"
},
"profiles": {
"www": {
"expiry": "87600h",
"usages": [
"signing",
"key encipherment",
"server auth",
"client auth"
]
}
}
}
}
EOF
cat > ca-csr.json <<EOF
{
"CN": "etcd CA",
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"L": "hunan",
"ST": "changsha"
}
]
}
EOF
cfssl gencert -initca ca-csr.json | cfssljson -bare ca -
#-----------------------
cat > server-csr.json <<EOF
{
"CN": "etcd",
"hosts": [
"192.168.2.155",
"127.0.0.1"
],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"L": "hunan",
"ST": "changsha"
}
]
}
EOF
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=www server-csr.json | cfssljson -bare server
// 单机模式tls
cat > ca-config.json <<EOF
{
"signing": {
"default": {
"expiry": "87600h"
},
"profiles": {
"server": {
"expiry": "87600h",
"usages": [
"signing",
"key encipherment",
"server auth",
"client auth"
]
},
"client": {
"expiry": "87600h",
"usages": [
"signing",
"key encipherment",
"server auth",
"client auth"
]
}
}
}
}
EOF
cat > ca-csr.json <<EOF
{
"CN": "etcd CA",
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"L": "hunan",
"O": "thyc",
"ST": "changsha"
}
]
}
EOF
# 使用定义好的签名生成证书
cfssl gencert -initca ca-csr.json | cfssljson -bare ca -
# 生成服务器证书
# -----------------------
cat > server-csr.json <<EOF
{
"CN": "etcd",
"hosts": [
"192.168.2.155",
"127.0.0.1"
],
"key": {
"algo": "rsa",
"size": 2048
},
"names": [
{
"C": "CN",
"L": "hunan",
"O": "thyc",
"ST": "changsha"
}
]
}
EOF
# 生成服务器证书
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=server server-csr.json | cfssljson -bare server
注意：
本博文中涉及到的ip请根据自己部署的服务器ip进行调整。
如启用tls后，你需要用java去连接etcd做域名解析记录的添加修改等，你需要引入ca.pem到你的java项目目录中。
Centos 7.5私有域名服务器部署（coredns+etcd）
标签：连接 根据 时间同步 tno discovery 开启 str rest 部署
原文地址：https://www.cnblogs.com/jockming/p/12051517.html
