Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enhanced ops script #18

Merged
merged 6 commits into from
Dec 6, 2023
Merged

Enhanced ops script #18

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
db586d1
removed print-etcd-cert-paths and introduced print-etcd-cheatsheet.sh
unmarshall Dec 1, 2023
49a97fd
Added command to script and minor changes to script
aaronfern Dec 1, 2023
e3b1cb8
Updated ops/Dockerfile and docs
aaronfern Dec 1, 2023
75d495f
Added license headers
aaronfern Dec 1, 2023
2dbd06a
Added check to script for empty variables
aaronfern Dec 1, 2023
a9cce54
Addressed review comment
aaronfern Dec 4, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
103 changes: 98 additions & 5 deletions docs/deployment/ops.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,17 +50,110 @@ There are two options to upload the docker image:

Now you have a new container as a part of the pod. You can exec into this newly created container and freely run any bash command or any etcdctl command.

### Get ETCD PKI resource paths
### Get ETCD PKI resource paths and common commands

If TLS has been enabled then you will need to provide paths to CA-Cert, Server-Cert and Server-Key to connect to etcd process via `etcdctl`. To get the paths a convenience script is provided which will print all required PKI resource paths.
This script also doubles up as a cheatsheet that contains some of the most common `etcdctl` commands that an operator might use along with their PKI resource paths

```bash
> print-etcd-cert-paths
> print-etcd-cheatsheet
📌 ETCD PKI resource paths:
--------------------------------------------------
--cacert=proc/<etcd-wrapper-process-id>/root/var/etcd/ssl/client/ca/bundle.crt
--cert=proc/<etcd-wrapper-process-id>/root/var/etcd/ssl/client/client/tls.crt
--key=proc/<etcd-wrapper-process-id>/root/var/etcd/ssl/client/client/tls.key
--cacert=proc/13/root/var/etcd/ssl/client/ca/bundle.crt
shreyas-s-rao marked this conversation as resolved.
Show resolved Hide resolved
--cert=proc/13/root/var/etcd/ssl/client/client/tls.crt
--key=proc/13/root/var/etcd/ssl/client/client/tls.key

📌 ETCD configuration path:
--------------------------------------------------
In etcd-wrapper: proc/13/root/home/nonroot/etcd.conf.yaml
In etcd-backup-restore: proc/28/root/home/nonroot/etcd.conf.yaml

📌 ETCD data directory:
--------------------------------------------------
proc/13/root/var/etcd/data

📌 ETCD maintenance commands:
--------------------------------------------------
List all etcd members:
etcdctl member list -w table \
--cacert=proc/13/root/var/etcd/ssl/client/ca/bundle.crt \
--cert=proc/13/root/var/etcd/ssl/client/client/tls.crt \
--key=proc/13/root/var/etcd/ssl/client/client/tls.key \
--endpoints=https://etcd-main-local:2379

Update etcd member peer URL:
etcdctl member update <member-id> \
--peer-urls=<new-peer-url-to-set> \
--cacert=proc/13/root/var/etcd/ssl/client/ca/bundle.crt \
--cert=proc/13/root/var/etcd/ssl/client/client/tls.crt \
--key=proc/13/root/var/etcd/ssl/client/client/tls.key \
--endpoints=https://etcd-main-local:2379

Get endpoint status for the etcd cluster:
etcdctl endpoint -w table --cluster status \
--cacert=proc/13/root/var/etcd/ssl/client/ca/bundle.crt \
--cert=proc/13/root/var/etcd/ssl/client/client/tls.crt \
--key=proc/13/root/var/etcd/ssl/client/client/tls.key \
--endpoints=https://etcd-main-local:2379

List all alarms:
etcdctl alarm list \
--cacert=proc/13/root/var/etcd/ssl/client/ca/bundle.crt \
--cert=proc/13/root/var/etcd/ssl/client/client/tls.crt \
--key=proc/13/root/var/etcd/ssl/client/client/tls.key \
--endpoints=https://etcd-main-local:2379

Disarm all alarms:
etcdctl alarm disarm \
--cacert=proc/13/root/var/etcd/ssl/client/ca/bundle.crt \
--cert=proc/13/root/var/etcd/ssl/client/client/tls.crt \
--key=proc/13/root/var/etcd/ssl/client/client/tls.key \
--endpoints=https://etcd-main-local:2379

Defragment etcd:
etcdctl defrag \
--cacert=proc/13/root/var/etcd/ssl/client/ca/bundle.crt \
--cert=proc/13/root/var/etcd/ssl/client/client/tls.crt \
--key=proc/13/root/var/etcd/ssl/client/client/tls.key \
--endpoints=https://etcd-main-local:2379

Change leadership:
etcdctl move-leader <new-leader-member-id> \
--cacert=proc/13/root/var/etcd/ssl/client/ca/bundle.crt \
--cert=proc/13/root/var/etcd/ssl/client/client/tls.crt \
--key=proc/13/root/var/etcd/ssl/client/client/tls.key \
--endpoints=https://etcd-main-local:2379

📌 ETCD Key-Value commands:
--------------------------------------------------

Get key details:
etcdctl get <key> \
--cacert=proc/13/root/var/etcd/ssl/client/ca/bundle.crt \
--cert=proc/13/root/var/etcd/ssl/client/client/tls.crt \
--key=proc/13/root/var/etcd/ssl/client/client/tls.key \
--endpoints=https://etcd-main-local:2379

Get only value for a given key:
etcdctl get <key> --print-value-only \
--cacert=proc/13/root/var/etcd/ssl/client/ca/bundle.crt \
--cert=proc/13/root/var/etcd/ssl/client/client/tls.crt \
--key=proc/13/root/var/etcd/ssl/client/client/tls.key \
--endpoints=https://etcd-main-local:2379

List all keys:
etcdctl get "" --prefix --keys-only \
--cacert=proc/13/root/var/etcd/ssl/client/ca/bundle.crt \
--cert=proc/13/root/var/etcd/ssl/client/client/tls.crt \
--key=proc/13/root/var/etcd/ssl/client/client/tls.key \
--endpoints=https://etcd-main-local:2379

Put a value against a key:
etcdctl put <key> <value> \
--cacert=proc/13/root/var/etcd/ssl/client/ca/bundle.crt \
--cert=proc/13/root/var/etcd/ssl/client/client/tls.crt \
--key=proc/13/root/var/etcd/ssl/client/client/tls.key \
--endpoints=https://etcd-main-local:2379
```

### Work directory
Expand Down
2 changes: 1 addition & 1 deletion ops/Dockerfile
View file
Open in desktop
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@aaronfern can you also please update the alpine image version in a separate PR?

Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ RUN apk update \
&& mkdir -p work \
&& chown -R 65532:65532 work

COPY --chown=65532:65532 --chmod=744 ops/print-etcd-cert-paths.sh /usr/local/bin/print-etcd-cert-paths
COPY --chown=65532:65532 --chmod=744 ops/print-etcd-cheatsheet.sh /usr/local/bin/print-etcd-cheatsheet
COPY --from=source /usr/local/bin/etcdctl /usr/local/bin

ENTRYPOINT ["/bin/bash"]
17 changes: 0 additions & 17 deletions ops/print-etcd-cert-paths.sh
View file
Open in desktop

This file was deleted.

115 changes: 115 additions & 0 deletions ops/print-etcd-cheatsheet.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,115 @@
#!/usr/bin/env bash
shreyas-s-rao marked this conversation as resolved.
Show resolved Hide resolved

function get_wrapper_process_id() {
process_id=$(pgrep wrapper)
echo "${process_id}"
}

function get_backup_restore_process_id() {
process_id=$(pgrep etcdbrctl)
echo "${process_id}"
}

wrapper_pid=$(get_wrapper_process_id)
backup_restore_pid=$(get_backup_restore_process_id)
shreyas-s-rao marked this conversation as resolved.
Show resolved Hide resolved

cat <<EOF
📌 ETCD PKI resource paths:
--------------------------------------------------
--cacert=proc/${wrapper_pid}/root/var/etcd/ssl/client/ca/bundle.crt
--cert=proc/${wrapper_pid}/root/var/etcd/ssl/client/client/tls.crt
--key=proc/${wrapper_pid}/root/var/etcd/ssl/client/client/tls.key

📌 ETCD configuration path:
--------------------------------------------------
In etcd-wrapper: proc/${wrapper_pid}/root/home/nonroot/etcd.conf.yaml
In etcd-backup-restore: proc/${backup_restore_pid}/root/home/nonroot/etcd.conf.yaml

📌 ETCD data directory:
--------------------------------------------------
proc/${wrapper_pid}/root/var/etcd/data

📌 ETCD maintenance commands:
--------------------------------------------------
List all etcd members:
etcdctl member list -w table \\
--cacert=proc/${wrapper_pid}/root/var/etcd/ssl/client/ca/bundle.crt \\
--cert=proc/${wrapper_pid}/root/var/etcd/ssl/client/client/tls.crt \\
--key=proc/${wrapper_pid}/root/var/etcd/ssl/client/client/tls.key \\
--endpoints=https://etcd-main-local:2379

Update etcd member peer URL:
etcdctl member update <member-id> \\
--peer-urls=<new-peer-url-to-set> \\
--cacert=proc/${wrapper_pid}/root/var/etcd/ssl/client/ca/bundle.crt \\
--cert=proc/${wrapper_pid}/root/var/etcd/ssl/client/client/tls.crt \\
--key=proc/${wrapper_pid}/root/var/etcd/ssl/client/client/tls.key \\
--endpoints=https://etcd-main-local:2379

Get endpoint status for the etcd cluster:
etcdctl endpoint -w table --cluster status \\
--cacert=proc/${wrapper_pid}/root/var/etcd/ssl/client/ca/bundle.crt \\
--cert=proc/${wrapper_pid}/root/var/etcd/ssl/client/client/tls.crt \\
--key=proc/${wrapper_pid}/root/var/etcd/ssl/client/client/tls.key \\
--endpoints=https://etcd-main-local:2379

List all alarms:
etcdctl alarm list \\
--cacert=proc/${wrapper_pid}/root/var/etcd/ssl/client/ca/bundle.crt \\
--cert=proc/${wrapper_pid}/root/var/etcd/ssl/client/client/tls.crt \\
--key=proc/${wrapper_pid}/root/var/etcd/ssl/client/client/tls.key \\
--endpoints=https://etcd-main-local:2379

Disarm all alarms:
etcdctl alarm disarm \\
--cacert=proc/${wrapper_pid}/root/var/etcd/ssl/client/ca/bundle.crt \\
--cert=proc/${wrapper_pid}/root/var/etcd/ssl/client/client/tls.crt \\
--key=proc/${wrapper_pid}/root/var/etcd/ssl/client/client/tls.key \\
--endpoints=https://etcd-main-local:2379

Defragment etcd:
etcdctl defrag \\
--cacert=proc/${wrapper_pid}/root/var/etcd/ssl/client/ca/bundle.crt \\
--cert=proc/${wrapper_pid}/root/var/etcd/ssl/client/client/tls.crt \\
--key=proc/${wrapper_pid}/root/var/etcd/ssl/client/client/tls.key \\
--endpoints=https://etcd-main-local:2379

Change leadership:
etcdctl move-leader <new-leader-member-id> \\
--cacert=proc/${wrapper_pid}/root/var/etcd/ssl/client/ca/bundle.crt \\
--cert=proc/${wrapper_pid}/root/var/etcd/ssl/client/client/tls.crt \\
--key=proc/${wrapper_pid}/root/var/etcd/ssl/client/client/tls.key \\
--endpoints=https://etcd-main-local:2379

📌 ETCD Key-Value commands:
--------------------------------------------------

Get key details:
etcdctl get <key> \\
--cacert=proc/${wrapper_pid}/root/var/etcd/ssl/client/ca/bundle.crt \\
--cert=proc/${wrapper_pid}/root/var/etcd/ssl/client/client/tls.crt \\
--key=proc/${wrapper_pid}/root/var/etcd/ssl/client/client/tls.key \\
--endpoints=https://etcd-main-local:2379

Get only value for a given key:
etcdctl get <key> --print-value-only \\
--cacert=proc/${wrapper_pid}/root/var/etcd/ssl/client/ca/bundle.crt \\
--cert=proc/${wrapper_pid}/root/var/etcd/ssl/client/client/tls.crt \\
--key=proc/${wrapper_pid}/root/var/etcd/ssl/client/client/tls.key \\
--endpoints=https://etcd-main-local:2379

List all keys:
etcdctl get "" --prefix --keys-only \\
--cacert=proc/${wrapper_pid}/root/var/etcd/ssl/client/ca/bundle.crt \\
--cert=proc/${wrapper_pid}/root/var/etcd/ssl/client/client/tls.crt \\
--key=proc/${wrapper_pid}/root/var/etcd/ssl/client/client/tls.key \\
--endpoints=https://etcd-main-local:2379

Put a value against a key:
etcdctl put <key> <value> \\
--cacert=proc/${wrapper_pid}/root/var/etcd/ssl/client/ca/bundle.crt \\
--cert=proc/${wrapper_pid}/root/var/etcd/ssl/client/client/tls.crt \\
--key=proc/${wrapper_pid}/root/var/etcd/ssl/client/client/tls.key \\
--endpoints=https://etcd-main-local:2379

EOF