etcd Single Member, Compaction On, Data Dir 0700

etcd

etcd from the upstream release tarball (sha256-verified), as a single-member hardened system service on loopback with hourly auto-compaction and a data directory only the service can read. etcdctl and etcdutl are installed beside it. Original role for EL 10, live-tested with podman on Rocky Linux 10.

No package, so the checksum is the whole story. EL 10 carries no etcd; etcd ships a release with a checksum file beside it. The role downloads both and has Ansible's get_url refuse the asset unless its SHA-256 is the one in the vendor's file, then installs the binaries as root's in /usr/local/bin, pinned by etcd_version.

A service account, a hardened unit, a loopback listener. etcd is a system user with no shell that owns the data directory and nothing else; the unit runs with NoNewPrivileges, PrivateTmp, ProtectHome and ProtectSystem=strict. The listener is 127.0.0.1:2379 by default, for a proxy that authenticates or a client on the same host; the live test reads the listening sockets and expects loopback only.

A single member, deliberately. The role runs one member with its client and peer listeners on loopback: a store for one host (a Kubernetes control plane, a Patroni cluster's DCS, a service registry), not a cluster. Clustering is a list of peers and TLS between them, which is a different role; the peer port is opened on loopback only so nothing can join. The live test writes a key with etcdctl, reads it back, asks the member for its health and deletes the key.

0700, as etcd asks. etcd warns when its data directory is readable by anyone but its owner; the role creates it 0700. The history is compacted hourly (etcd_auto_compaction_retention), the upstream default being never, which grows the store with every write until it stops.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.