blob: 831d3ebc17c8816f433973476e1ff93ae99bf8cd (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
|
[Unit]
Description=etcd key-value store
Documentation=https://etcd.io/docs/
After=network.target cluster-detect.service
Before=kube-apiserver.service
[Service]
Type=notify
EnvironmentFile=/etc/cluster-config/environment/etcd.env
ExecStartPre=/usr/local/bin/etcd-config-generator.sh
ExecStart=/usr/bin/etcd \
--name=${ETCD_NAME} \
--data-dir=/var/lib/etcd \
--listen-client-urls=https://${NODE_IP}:2379,https://127.0.0.1:2379 \
--advertise-client-urls=https://${NODE_IP}:2379 \
--listen-peer-urls=https://${NODE_IP}:2380 \
--initial-advertise-peer-urls=https://${NODE_IP}:2380 \
--initial-cluster=${ETCD_INITIAL_CLUSTER} \
--initial-cluster-token=etcd-cluster \
--initial-cluster-state=new \
--cert-file=/etc/kubernetes/pki/etcd/server.crt \
--key-file=/etc/kubernetes/pki/etcd/server.key \
--peer-cert-file=/etc/kubernetes/pki/etcd/peer.crt \
--peer-key-file=/etc/kubernetes/pki/etcd/peer.key \
--trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt \
--peer-trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt \
--peer-client-cert-auth \
--client-cert-auth \
--snapshot-count=10000 \
--heartbeat-interval=100 \
--election-timeout=1000
Restart=always
RestartSec=10
# Security
NoNewPrivileges=true
ProtectHome=true
ProtectSystem=strict
ReadWritePaths=/var/lib/etcd
LimitNOFILE=65536
[Install]
WantedBy=kubernetes-master.target
|
