Use Ansible to install a pinned etcd release, distribute separate peer and client certificates from a private CA, run each member under systemd, and enable RBAC only after authenticated TLS works. etcd has no transport authentication or RBAC enabled by default, so an untouched cluster can expose its data to any client that can reach its ports.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What you are building
This guide describes a three-member etcd cluster on Ubuntu, managed by Ansible. The same design can be adapted to five members, but an odd number is preferred so the cluster can form a quorum after a failure. Each host runs one etcd member. Client applications connect through the client URL, while members communicate over separate peer URLs.
As an Amazon Associate I earn from qualifying purchases.
The security boundary has three layers:
- Transport encryption: TLS protects client-to-server and member-to-member traffic.
- Certificate authentication: etcd can require every HTTPS client to present a certificate signed by the trusted CA. With authentication enabled, the certificate Common Name is used as the etcd user name.
- RBAC: roles and user or service-account bindings restrict which authenticated identities can read or write keys.
Configure TLS before RBAC. If you enable authorization first and discover that your certificates or endpoints are wrong, recovery is more complicated.
Choose versions and define the support boundary
Write the etcd version, Ubuntu release, Ansible version, and certificate-tool version into the project README before you automate anything. Official etcd security documentation is published for the v3.6 and v3.7 documentation lines; command-line flags can change, so compare the flags in this article with the documentation for the exact release you pin.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
No single Ubuntu release is established by the available material as the tested target for this procedure. Select a supported Ubuntu LTS yourself, record it in inventory, and test the complete playbook on a disposable three-node environment. Do not copy guides that target Ubuntu 18.04 as current instructions: Ubuntu 18.04 is end-of-life.
Minimum planning checklist
- Three Ubuntu hosts with stable DNS names or fixed addresses.
- An Ansible control machine that can SSH to every host with privilege escalation.
- A pinned etcd version and matching etcdctl binary.
- A private CA whose key is kept off the etcd nodes after signing.
- Unique names for the members and a complete initial cluster map.
- Firewall rules that allow client traffic only from approved clients and peer traffic only between etcd members.
- Backups of the etcd data directory and the CA material.
Design the inventory and network policy
Use a dedicated inventory group for etcd members. The names in etcd_initial_cluster must match each member’s configured name exactly. The following is an illustrative inventory; replace addresses and names with values from your environment.
[etcd]
etcd-1 ansible_host=10.0.10.11 etcd_name=etcd-1
etcd-2 ansible_host=10.0.10.12 etcd_name=etcd-2
etcd-3 ansible_host=10.0.10.13 etcd_name=etcd-3
[etcd:vars]
ansible_user=ubuntu
ansible_become=true
etcd_client_port=2379
etcd_peer_port=2380Keep client and peer listeners distinct in your variables. A typical policy permits TCP 2379 from the Kubernetes control plane or other approved clients, and TCP 2380 only between the etcd members. Restrict SSH to the administration network. TLS does not replace firewalling: it authenticates traffic, but an exposed service still invites password, certificate, and denial-of-service attacks.
Build a certificate hierarchy before installing etcd
Create one CA and issue identities for each member. Kubernetes guidance recommends separate key pairs for peer traffic and client traffic. Follow that model even when the same host performs both functions.
Certificates to issue
- Per-member server certificate: used when that member serves client HTTPS requests.
- Per-member peer certificate: used for the member-to-member listener and connections.
- Client certificate for administrators: used by etcdctl for health checks and administration.
- Client certificates for applications: issue one identity per service or operational role where practical, rather than sharing an administrator key.
The CA certificate must be present on every member and on every machine that runs an authenticated etcdctl command. Keep private keys readable only by the etcd service account or the operator that needs them. Do not commit keys to the Ansible repository.
Subject names and certificate extensions
The supplied material does not establish a universal SAN, key-usage, or extended-key-usage recipe for every etcd release. Your certificate authority tool must nevertheless create certificates whose names match the DNS names or IP addresses used in the URLs, and whose usages permit the intended server, peer, or client role. Validate the generated certificates with your chosen tool and then confirm the requirements in the documentation for your pinned etcd version.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Two ways to handle PKI in Ansible
| Approach | How it works | Operational trade-off |
|---|---|---|
| Pre-created certificates | Ansible receives a directory of CA, server, peer, and client files and copies only the required files to each host. | Simple deployment playbooks and a smaller automation scope, but renewal and secure key distribution remain your responsibility. |
| Certificate generation in the role | The role creates a CA and signs certificates during provisioning. | Convenient for a new lab or controlled environment; protect the generated CA key and review where temporary files are stored. |
| Dedicated certificate role | A separate role generates and synchronizes peer, client, and server certificates, while another role installs etcd. | Clear separation of concerns, but you must verify compatibility among both roles and the pinned etcd release. |
Examples of third-party approaches include githubixx/ansible-role-etcd, which expects certificates already created on the controller and has a companion CA role that requires CFSSL binaries; sergelogvinov/ansible-role-etcd, which can create the CA and certificates; and ant31/etcd-ansible, which includes certificate generation and systemd management. These projects differ in supported Ubuntu and etcd versions, so inspect their current defaults and test them rather than assuming the repository’s latest commit matches your target.
Organize the Ansible project
A small, explicit project is easier to audit than a role with hidden defaults. One workable layout is:
ansible/
inventory/production/hosts.ini
group_vars/etcd.yml
playbooks/etcd.yml
roles/etcd/
tasks/main.yml
templates/etcd.service.j2
templates/etcd.conf.j2
handlers/main.yml
files/pki/Store only public certificates and encrypted private material in the repository. Use Ansible Vault for any key that must be transported by the playbook, and decrypt it only at runtime. A safer production pattern is to sign certificates outside the playbook and provide them through a protected artifact or secret-management system.
Variables that should be explicit
etcd_version: 3.x.y
etcd_data_dir: /var/lib/etcd
etcd_config_dir: /etc/etcd
etcd_user: etcd
etcd_group: etcd
etcd_client_url: https://0.0.0.0:2379
etcd_peer_url: https://0.0.0.0:2380
etcd_initial_cluster: etcd-1=https://10.0.10.11:2380,etcd-2=https://10.0.10.12:2380,etcd-3=https://10.0.10.13:2380
etcd_initial_cluster_state: new
etcd_initial_cluster_token: replace-with-a-unique-tokenThe version above is intentionally a variable, not a recommendation for a particular release. Set it to the version you have approved and use the matching etcdctl binary.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Install the binary and create the service account
Your role should create the unprivileged etcd user and group, install the pinned etcd and etcdctl binaries, create the data and configuration directories, and set ownership before starting the service. Download artifacts over a verified channel, check their checksums or signatures, and never execute a binary merely because its filename contains the expected version.
Make directory permissions restrictive. The data directory contains the key-value database and may contain sensitive application data. The configuration directory contains private keys when TLS is enabled. A typical target is ownership by etcd:etcd and mode 0700 for private-key directories, but confirm the exact permissions required by your distribution and service hardening policy.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Render the TLS configuration
Each member needs client TLS flags and peer TLS flags. The client side controls requests arriving on the client URL; the peer side controls raft and replication traffic.
--cert-file=/etc/etcd/pki/server.crt
--key-file=/etc/etcd/pki/server.key
--trusted-ca-file=/etc/etcd/pki/ca.crt
--client-cert-auth=true
--peer-cert-file=/etc/etcd/pki/peer.crt
--peer-key-file=/etc/etcd/pki/peer.key
--peer-trusted-ca-file=/etc/etcd/pki/ca.crt
--peer-client-cert-auth=trueThe first four options configure the client-facing listener. The peer options configure member-to-member authentication. Use separate server and peer key pairs even if both certificates are signed by the same CA. A certificate copied to the wrong member or used with the wrong private key will prevent startup or cause peer handshake failures.
Systemd unit template
Render the unit from Ansible so every node has the same hardening and only the member-specific values differ. The exact flag set must match your etcd release.
[Unit]
Description=etcd distributed key-value store
After=network-online.target
Wants=network-online.target
[Service]
Type=notify
User=etcd
Group=etcd
ExecStart=/usr/local/bin/etcd
--name={{ etcd_name }}
--data-dir={{ etcd_data_dir }}
--listen-client-urls=https://0.0.0.0:{{ etcd_client_port }}
--advertise-client-urls=https://{{ ansible_host }}:{{ etcd_client_port }}
--listen-peer-urls=https://0.0.0.0:{{ etcd_peer_port }}
--initial-advertise-peer-urls=https://{{ ansible_host }}:{{ etcd_peer_port }}
--initial-cluster={{ etcd_initial_cluster }}
--initial-cluster-state={{ etcd_initial_cluster_state }}
--initial-cluster-token={{ etcd_initial_cluster_token }}
--cert-file=/etc/etcd/pki/server.crt
--key-file=/etc/etcd/pki/server.key
--trusted-ca-file=/etc/etcd/pki/ca.crt
--client-cert-auth=true
--peer-cert-file=/etc/etcd/pki/peer.crt
--peer-key-file=/etc/etcd/pki/peer.key
--peer-trusted-ca-file=/etc/etcd/pki/ca.crt
--peer-client-cert-auth=true
Restart=on-failure
RestartSec=5
[Install]
WantedBy=multi-user.targetUse a handler to run systemctl daemon-reload and restart etcd when the unit or configuration changes. A certificate renewal should trigger a controlled restart, one member at a time, while preserving quorum.
Bootstrap the cluster safely
- Stop accidental old members. Confirm that no host is running an unplanned etcd process and that the data directory is empty on a new cluster. Never delete a data directory on an existing cluster without a backup and a recovery plan.
- Distribute certificates. Copy the CA, the member’s server certificate and key, and its peer certificate and key. Copy client certificates only to hosts that need administrative access.
- Deploy the unit to all members. Run the Ansible play with handlers suppressed until every node has the same initial cluster map and correct file ownership.
- Start members in a controlled window. Start all new members close together so they can discover one another. Watch
journalctl -u etcdfor certificate, URL, or cluster-token errors. - Confirm quorum before application traffic. Do not point Kubernetes or another client at the cluster until authenticated health checks succeed against the intended endpoints.
For a replacement member joining an established cluster, do not reuse the new-cluster bootstrap settings blindly. Follow the etcd membership procedure for your release, add the member through an authenticated client, and use a new data directory. Treat membership changes and initial bootstrap as different operations.
Verify TLS and health with an authenticated client
An unauthenticated curl or etcdctl request is not a valid production check when client-certificate authentication is enabled. Set the etcdctl endpoint and certificate variables explicitly:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
export ETCDCTL_API=3
export ENDPOINTS=https://10.0.10.11:2379,https://10.0.10.12:2379,https://10.0.10.13:2379
export CACERT=/path/to/ca.crt
export CERT=/path/to/admin-client.crt
export KEY=/path/to/admin-client.key
etcdctl --endpoints=${ENDPOINTS} --cacert=${CACERT} --cert=${CERT} --key=${KEY} endpoint health
etcdctl --endpoints=${ENDPOINTS} --cacert=${CACERT} --cert=${CERT} --key=${KEY} endpoint statusRun the commands with an etcdctl version compatible with the server. A healthy response from every endpoint confirms connectivity, certificate validation, and quorum from the client’s point of view. If one endpoint fails, test it individually and inspect that member’s logs before changing the cluster.
Common verification failures
- Certificate signed by unknown authority: the client is using the wrong CA file, or the member is not serving the CA chain you intended.
- Client certificate required: the TLS listener is enforcing
--client-cert-auth; supply a client certificate and matching key. - Hostname mismatch: the URL name or address is absent from the certificate’s permitted names. Use a name covered by the certificate and regenerate it if necessary.
- Connection refused: the service is stopped, listening on a different address or port, or blocked by a firewall.
- Peer handshake errors: inspect the peer certificate, peer key, peer CA, advertised peer URL, and clock synchronization on both members.
- Unhealthy or unavailable endpoint: check quorum, disk space, data-directory permissions, and whether a member was started with an incorrect initial cluster map.
Enable RBAC after TLS works
Transport authentication proves which certificate identity is connecting; it does not automatically limit that identity’s access to keys. Enable RBAC only after the authenticated health check succeeds.
The safe sequence is roles first, then users or service-account bindings:
- Connect with a protected administrative client certificate.
- Create narrowly scoped roles for the operations your applications require.
- Grant read, write, or read-write ranges to those roles.
- Create users or service identities whose names match the Common Names in their client certificates.
- Bind each identity to the minimum role it needs.
- Enable authentication and test both an allowed operation and a deliberately denied operation.
A third-party walkthrough describes this role-first sequence with etcdctl RBAC commands, but verify command names and authentication settings against the official documentation for your release. Keep the administrator identity separate from application identities, and store its private key like a root credential.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Make the Ansible rollout repeatable
Use idempotent tasks and explicit handlers. A useful play order is:
- Gather facts and assert the approved Ubuntu release, architecture, and etcd version variables.
- Create the service account and directories.
- Install or verify the pinned binaries and checksums.
- Install the CA and node-specific certificates with restrictive modes.
- Render the systemd unit and any environment or configuration file.
- Run syntax and certificate checks before notifying the restart handler.
- Reload systemd, enable the service, and start or restart one member at a time for an existing cluster.
- Run authenticated endpoint health and status checks from the control machine.
Add Ansible assertions that fail when a certificate file is missing, when a member name is duplicated, or when an advertised URL is not in the inventory. Failing before a restart is safer than discovering a typo after quorum is lost.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Choose an Ansible role without outsourcing the security decision
| Question | Why it matters | What to verify |
|---|---|---|
| Does it generate certificates? | PKI automation changes where the CA key exists and how renewal is handled. | Whether it expects pre-made files, requires CFSSL, or creates and synchronizes certificates itself. |
| Which etcd release does it target? | Flags, defaults, and repository URLs can become stale. | Variables, templates, and release notes for your pinned version. |
| Which Ubuntu releases are supported? | Package names, service behavior, and system libraries differ. | Test on the exact Ubuntu image you will operate. |
| Does it configure RBAC? | TLS alone authenticates clients but does not provide least privilege. | Whether the role stops at transport security or creates roles and bindings. |
| How does it handle membership changes? | Replacing a member is not the same as bootstrapping a new cluster. | Documented add, remove, and recovery procedures. |
Use a role as an implementation component, not as proof that the resulting cluster is secure. Read its rendered unit, inspect file permissions, and run the authenticated checks yourself.
Backups, upgrades, and certificate renewal
TLS does not protect you from accidental deletion or disk failure. Schedule authenticated etcd snapshots according to the recovery point your application can tolerate, copy snapshots to protected storage, and periodically test restoration in an isolated environment. Keep the CA private key and snapshot encryption keys under separate access controls.
Recommended Free Tools
Before upgrading etcd, read the upgrade guidance for the exact source and target versions. Upgrade members one at a time while preserving quorum, and verify endpoint status after each restart. Do not combine an etcd version upgrade, a certificate authority replacement, and an Ubuntu migration in one untested change.
Renew certificates before they expire. Issue the replacement certificate with the same required names and usages, deploy it to one member, restart that member, verify health, and continue sequentially. Renew client certificates before the first restart so operators do not lose access during the maintenance window.
Security checklist before production
- Version and Ubuntu release are pinned, documented, and tested.
- Every client and peer listener uses HTTPS and the appropriate trusted CA.
- Client-certificate authentication is enabled for client traffic and peer traffic.
- Peer and client key pairs are separate.
- Private keys are not in Git, world-readable directories, or routine log output.
- Firewall rules limit client and peer ports to the required sources.
- RBAC roles grant only the key ranges and verbs each identity needs.
- Administrative and application certificates are different identities.
- Health and status checks use CA, client certificate, and key files.
- Snapshots, restoration tests, certificate renewal, and member replacement are documented.
- Monitoring alerts on endpoint health, quorum loss, disk pressure, certificate expiry, and repeated restart loops.
Bottom line
Ansible makes an etcd cluster repeatable, but it does not make insecure defaults safe. Pin the release, establish a protected CA, issue separate server, peer, and client certificates, render the TLS flags into a systemd-managed service, verify every endpoint with an authenticated etcdctl client, and only then apply RBAC. Treat Ubuntu compatibility, role behavior, certificate renewal, and membership changes as explicit items to test rather than assumptions hidden inside a playbook.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →
