All geek questions in one place

Is it safe to use etcd in multiple data centers?

Is it safe to use etcd in multiple data centers? As it opens the etcd port to the public internet. Should I use client certificates in this case, or does etcd have some kind of authorization?

+8
source share
2 answers

Yes, but you need to solve two big problems:

  • Security. It all depends on what information you store in etcd. Using a point-to-point VPN is probably preferable to browsing the entire cluster on the Internet. Customer certificates may also be used.

  • Customization. etc. relies on replication between machines for two things, liveliness and consensus. Since successful recording must be committed to most clusters before it returns successfully, your recording performance will degrade as the distance between the machines increases. Fluid is measured by periodic beats between machines. By default, etc. It has a rather aggressive timeout of 50 ms, which is optimized for white metal servers running on a local network. Without setting this timeout value, your cluster will constantly think that the participants have disappeared and cause frequent master selections. This gets worse if both of your environments are in cloud providers that have network variables plus disk writes that cross the network, double whammy.

Additional information on configuring etcd: https://coreos.com/docs/cluster-management/debugging/etcd-tuning/

+13
source

I've got one more question. Does it support data center cross-replication with master replication?

0
source

Source: https://habr.com/ru/post/975930/

More articles:


All Articles