An efficient generation and synchronization method of multi-node Kubernetes cluster self-sign root certificate based on Etcd distributed lock

Abstract

The application relates to the field of cloud native technology, in particular to a multi-node Kubernetes cluster self-signed root certificate efficient generation and synchronization method and system based on an Etcd distributed lock, which comprises the following steps: an Etcd service, a certificate synchronization component service, certificate generation and synchronization, generating certificate content according to configuration and storing the certificate content in an Etcd database in an encrypted mode, and listening to Etcd database changes, synchronously updating certificate data and storing the certificate data in a local mode in a decrypted mode; beneficial effects are that through the introduction of the Etcd distributed lock technology, the generation and synchronization of the multi-node concurrent self-signed root certificate are realized. Multiple nodes can simultaneously generate the certificate, and the generated certificate information can be shared and synchronized in real time through the Etcd database. The parallel processing mode greatly shortens the waiting time of cluster deployment and significantly improves the deployment efficiency.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of cloud native technology, in particular to a multi-node Kubernetes cluster self-signed root certificate efficient generation and synchronization method and system based on Etcd distributed lock. BACKGROUND

[0002] In the booming development of cloud native technology, Kubernetes, as the leader in the field of container orchestration, its cluster deployment efficiency and security have always been the focus of the industry. In the deployment process of Kubernetes cluster, the generation and synchronization of self-signed root certificates is an indispensable part. Self-signed root certificates are mainly used for identity authentication and communication encryption between components in the cluster, and are an important guarantee for the safe and stable operation of the cluster.

[0003] However, the traditional Kubernetes cluster deployment method has many shortcomings in certificate generation and synchronization. The traditional deployment method usually generates self-signed root certificates required by the cluster on a specific deployment node. Then, these certificates need to be manually synchronized to other nodes through commands such as scp and rsync. This method not only depends on the ssh-related commands and protocols of the operating system, but also is easily affected by the network environment and operating system configuration, resulting in low deployment efficiency. Moreover, the traditional certificate synchronization method adopts a serial deployment strategy, i.e. synchronizing the certificates to each node in a fixed order. This method not only increases the time cost of deployment, but also its efficiency problem is more prominent in large-scale cluster deployment. In addition, serial deployment may also cause delays and errors in certificate synchronization, further affecting the stability and availability of the cluster. In addition, the traditional certificate synchronization method has a high security risk. In the certificate synchronization process, it needs to rely on the ssh protocol and related authentication information. However, the ssh protocol itself has certain security risks, such as password leakage, man-in-the-middle attacks, etc. If the ssh key management is not well managed, it may also lead to the leakage of system login information, posing a potential security threat to the cluster.

[0004] The traditional certificate generation and synchronization method in the Kubernetes cluster deployment process has been unable to meet the needs of efficient, secure and automated deployment in the modern cloud native environment. In order to solve these problems, the industry has been exploring new technical solutions. SUMMARY

[0005] The purpose of the present application is to provide a multi-node Kubernetes cluster self-signed root certificate efficient generation and synchronization method and system based on Etcd distributed lock, to solve the problems raised in the background art.

[0006] To achieve the above object, the application provides the following technical scheme: a multi-node Kubernetes cluster self-sign root certificate efficient generation and synchronization method based on Etcd distributed lock, the method comprises the following steps:

[0007] Etcd service, deploying Etcd service in the operating system, generating and synchronizing certificates based on Etcd distributed lock;

[0008] Configure the certificate synchronization component, set the parameters by calling the http service interface of the certificate synchronization component;

[0009] Certificate synchronization component service, used for deployment in each node of the cluster, running in each node in the form of resident process service, listening to the key value change of the Etcd service, and providing Http service to hot update component configuration information;

[0010] Certificate generation and synchronization, generating certificate content according to the configuration and encrypting and storing it in the Etcd database, and listening to the Etcd database change, synchronously updating the certificate data and decrypting and storing it locally.

[0011] Preferably, the specific operation of the Etcd service comprises:

[0012] For each node, the storage service for generating and synchronizing the self-signed certificate required by the Kubernetes cluster and the distributed lock service for coordinating the certificate component service of each node are provided, so that only one node obtains the distributed lock and performs the certificate generation operation at any time, thereby ensuring the consistency and security of the certificate generation.

[0013] Preferably, the specific operation of configuring the certificate synchronization component comprises:

[0014] Used for declaring the name of the self-signed certificate for generating the Kubernetes cluster, the encryption algorithm for generating the certificate private key, the certificate validity start and end date, the certificate issuing agency name, the CN information generation and synchronization information required for generating the self-signed certificate.

[0015] Preferably, the specific operation of the certificate synchronization component service comprises:

[0016] Configure the certificate information to be generated, and each certificate configuration includes private key encryption algorithm, start and end date, CN, agency, issuing agency, storage file name and local storage path.

[0017] Preferably, the specific operation of the certificate generation and synchronization comprises:

[0018] Try to get the certificate resource distributed lock provided by the Etcd service module, and once the lock is successfully acquired, generate the content of the self-signed root certificate according to the configuration information; after the generation is completed, the certificate generation module saves the certificate content to the local, and encrypts the certificate content in the memory according to the configured Etcd data encryption algorithm, and saves the certificate key value information in the Etcd database by calling the grpc service of Etcd;

[0019] Synchronize the certificate generated on the master node to the current node to ensure the consistency of the certificate data among multiple nodes. The certificate synchronization module synchronizes the certificate by listening to the changes of the Etcd service module. Once new certificate data is added or updated, the certificate synchronization module will trigger the synchronization process immediately. First, get the encrypted certificate content from Etcd, then decrypt it using the same decryption algorithm as the certificate generation module. After successful decryption, the certificate synchronization module will store the certificate content to the local according to the specified storage path, realizing the synchronization of the certificate among multiple nodes.

[0020] An efficient self-signed root certificate generation and synchronization system for a multi-node Kubernetes cluster based on Etcd distributed lock, the system comprises an Etcd service module, a configuration certificate synchronization component module, a certificate synchronization component service module, and a certificate generation and synchronization module;

[0021] The Etcd service module deploys the certificate synchronization component service in the operating system, and generates and synchronizes the certificate based on the Etcd distributed lock;

[0022] The configuration certificate synchronization component module sets parameters by calling the http service interface of the certificate synchronization component;

[0023] The certificate synchronization component service module is used to be deployed on each node of the cluster and run in each node as a resident process service, listen to the key value changes of the Etcd service, and provide Http service to update the component configuration information hotly;

[0024] The certificate generation and synchronization module generates certificate content according to the configuration and encrypts it to store in the Etcd database, and listens to the changes of the Etcd database, synchronously updates the certificate data and decrypts it to store locally.

[0025] Preferably, the Etcd service module provides storage services for generating and synchronizing self-signed certificates required by the Kubernetes cluster for each node, and provides distributed lock services for coordinating certificate component services for each node, ensuring that only one node acquires the distributed lock and performs certificate generation at any time, thereby ensuring the consistency and security of certificate generation.

[0026] Preferably, the configuration certificate synchronization component module is configured to declare the name of the self-signed certificate for generating the Kubernetes cluster, the encryption algorithm for generating the certificate private key, the certificate validity start and end date, the certificate issuing authority name, the CN information generation and the information required for synchronizing the self-signed certificate.

[0027] Preferably, the certificate synchronization component service module configures the certificate information to be generated, and each certificate configuration includes a private key encryption algorithm, a start and end date, a CN, an agency, an issuing agency, a storage file name and a local storage path.

[0028] Preferably, the certificate generation and synchronization module attempts to obtain a certificate resource distributed lock provided by the Etcd service module, generates the content of the self-signed root certificate according to the configuration information once the lock is successfully obtained, saves the certificate content to the local after the generation is completed, encrypts the certificate content in the memory according to the configured Etcd data encryption algorithm, and saves the certificate key value information in the Etcd database by calling the grpc service of Etcd.

[0029] The certificate generated on the master node is synchronized to the current node, ensuring the consistency of the certificate data among multiple nodes, and the certificate synchronization module realizes the synchronization of the certificate by listening to the changes of the Etcd service module, and once new certificate data is detected to be added or updated, the certificate synchronization module will immediately trigger the synchronization process; first, the encrypted certificate content is obtained from Etcd, and then the same decryption algorithm as the certificate generation module is used for decryption; after successful decryption, the certificate synchronization module will store the certificate content to the local according to the specified storage path, realizing the synchronization of the certificate among multiple nodes.

[0030] Compared with the prior art, the beneficial effects of the present application are:

[0031] The multi-node Kubernetes cluster self-signed root certificate efficient generation and synchronization method based on the Etcd distributed lock of the present application is a system, which realizes the generation and synchronization of the multi-node concurrent self-signed root certificate by introducing the Etcd distributed lock technology. Multiple nodes can simultaneously generate certificates, and the generated certificate information can be shared and synchronized in real time through the Etcd database. This parallel processing method greatly shortens the waiting time of cluster deployment and significantly improves the deployment efficiency.

[0032] By using the Etcd database for storing and synchronizing certificates, the security of the cluster is effectively improved. The Etcd database has high security and reliability, which can prevent the certificate information from being illegally obtained or tampered with. By using the distributed lock mechanism of Etcd, the consistency and correctness of certificate generation are ensured, and the security risks caused by certificate conflicts and errors are avoided; through security mechanisms such as encrypted communication and access control, the security line of the cluster is further strengthened. By encrypting the transmission of certificate information, the information is prevented from being intercepted and leaked during transmission; through strict access control, only authorized nodes can access and modify certificate information, ensuring the security and integrity of the certificate.

[0033] The process of certificate generation and synchronization is simplified in an automated and intelligent manner, reducing the dependence on human resources. Users only need to perform simple configuration and start-up operations to achieve automatic generation and synchronization of certificates. This not only reduces the possibility of manual intervention and errors, but also improves the accuracy and reliability of deployment. BRIEF DESCRIPTION OF DRAWINGS

[0034] Figure 1 The method flowchart of the present application. DETAILED DESCRIPTION

[0035] In order to make the purpose, technical solution of the present application clear, complete description, and the advantages are more clear and obvious, the following will be further described in detail by combining the embodiments of the present application with the drawings. It should be understood that the specific embodiments described here are part of the embodiments of the present application, not all embodiments, and are only used to explain the embodiments of the present application, and do not limit the embodiments of the present application. All other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0036] Embodiment one

[0037] Please refer to Figure 1 The present application provides a technical solution: a multi-node Kubernetes cluster self-signed root certificate efficient generation and synchronization method based on Etcd distributed lock, which comprises the following steps:

[0038] Etcd service, deploy Etcd service in operating system, certificate generation and synchronization based on Etcd distributed lock; provide storage service for generating and synchronizing self-signed certificate required by Kubernetes cluster for each node and provide distributed lock service for coordinating certificate component service of each node, ensure that only one node obtains distributed lock and executes certificate generation operation at any time, so as to ensure the consistency and security of certificate generation.

[0039] The configuration certificate synchronization component sets parameters by calling an http service interface of the certificate synchronization component; and is used for declaring a name of a self-signed certificate generated for a Kubernetes cluster, an encryption algorithm used for generating a certificate private key, certificate validity start and end dates, a certificate issuing authority name, CN information generation, and information required for synchronizing the self-signed certificate.

[0040] The certificate synchronization component service is deployed on each node of the cluster, runs in a resident process service mode on each node, listens to key value changes of the Etcd service, and provides an Http service to hot update component configuration information; and configures certificate information to be generated, each certificate configuration including a private key encryption algorithm, start and end dates, CN, an authority, an issuing authority, a storage file name, and a local storage path.

[0041] Certificate generation and synchronization: generating certificate content according to configuration and encrypting and storing the certificate content into the Etcd database, and listening to Etcd database changes to synchronize and update certificate data and decrypt and store the certificate data locally; attempting to acquire a certificate resource distributed lock provided by the Etcd service module, generating self-signed root certificate content according to configuration information once the lock is successfully acquired; after generation is completed, the certificate generation module saves the certificate content locally, encrypts the certificate content in the memory according to a configured Etcd data encryption algorithm, and saves the certificate key value information in the Etcd database by calling the Etcd grpc service;

[0042] Synchronizing the certificate generated on the master node to the current node to ensure consistency of certificate data among multiple nodes; the certificate synchronization module synchronizes the certificate by listening to changes of the Etcd service module, and triggers a synchronization process immediately once new certificate data is added or updated; first, the encrypted certificate content is acquired from the Etcd, and then the same decryption algorithm as that of the certificate generation module is used for decryption; after successful decryption, the certificate synchronization module stores the certificate content locally according to a specified storage path, thereby realizing synchronization of the certificate among multiple nodes.

[0043] Embodiment Two

[0044] On the basis of Embodiment One, a distributed lock mechanism is used to optimize the certificate generation process and ensure data consistency in a multi-node environment, including the following steps: initializing the Etcd service outside the deployment node or cluster, deploying the certificate component service, configuring certificate generation parameters, initializing the certificate component service of each node of the cluster, acquiring the Etcd certificate distributed lock and generating and synchronizing the certificate, and listening to Etcd certificate prefix key value changes and synchronizing key value information.

[0045] The application first initializes the Etcd service outside the deployment node or cluster. By deploying the Etcd service and based on the distributed lock mechanism thereof, the certificate generation operation between different nodes can be effectively coordinated, thereby avoiding the problems of data conflict and inconsistency.

[0046] The deployment certificate component service refers to deploying the certificate component service based on the Etcd distributed lock on the operating system of each node of the cluster. The service is built into the operating system image in the form of an agent or is deployed on each node by installing a tool or script before deploying the cluster.

[0047] The configuration certificate generation parameter refers to declaring the private key encryption algorithm, start and end date, issuing authority information, CN information, certificate public and private key storage file name and local storage path information of the self-signed Kubernetes cluster root certificate, front-proxy, Etcd cluster root certificate and other certificates required by the Kubernetes cluster before deploying the cluster.

[0048] Initializing the certificate component service of each node of the cluster refers to initializing the certificate component service by calling the configuration interface of the certificate component Http service of each node according to the ip address information of each node of the cluster and the above-mentioned configuration certificate generation parameter information. The configuration parameters mainly include the Etcd service address, certificate resource lock name, generated and synchronized certificate list items, pre-hook and post-hook methods for generating and synchronizing certificates, and Etcd data storage encryption and decryption algorithm.

[0049] Obtaining the Etcd certificate distributed lock and generating and synchronizing the certificate refers to, after initializing the certificate component service, each node certificate service retrieving whether the local certificate resource has been generated according to the configured generated and synchronized certificate list items. When it is not generated, the certificate resource lock is obtained. Preferably, after obtaining the resource lock, if the certificate generation pre-hook method is configured, the pre-action is performed, the certificate private key is generated according to the configured generated certificate list items, and the certificate is issued. According to the configured synchronization certificate list items, the generated certificate is generated key according to the agreed certificate naming rule, and the certificate data is encrypted and stored according to the configured Etcd data storage encryption and decryption algorithm. If the certificate generation post-hook method is configured, the post-action is performed. Optimally, before the certificate component service abnormally or exits, the certificate lock resource is released.

[0050] Listening to the Etcd certificate prefix key value change and synchronizing the key value information refers to that, after initialization, each node certificate component service of each node that has not obtained the certificate resource lock enters the Etcd key value change listening state.

[0051] When the node certificate component service observes that the Etcd key prefix rule is met, the Etcd database corresponding key value is accessed through the integrated Etcd-client to obtain value information, and the configured Etcd data storage encryption and decryption algorithm is used to decode the encrypted value information. The configured certificate list item information is compared. If the corresponding certificate file does not exist in the local storage path, the certificate information is written into the corresponding file in the local storage path. If the corresponding certificate file exists in the local storage path, the file contents are compared. If they are inconsistent, the local file contents are updated.

[0052] If the certificate synchronization pre-hook and post-hook methods are configured, the hook methods are executed before and after the certificate synchronization. The pre-hook method can perform some preprocessing operations before the certificate generation, such as verifying the validity of the certificate generation parameters, preparing necessary resources, or performing environment checks, etc. These preprocessing operations help to ensure the smooth progress of certificate generation and avoid generation failure due to parameter errors or environment problems. The post-hook method can perform some subsequent operations after the certificate generation or synchronization is completed, such as sending notifications, recording logs, triggering other related tasks, or performing verifications, etc.

[0053] Embodiment three

[0054] On the basis of embodiment two, an efficient multi-node Kubernetes cluster self-signed root certificate generation and synchronization system based on Etcd distributed lock is proposed, which consists of an Etcd service module, a configuration certificate synchronization component module, a certificate synchronization component service module, and a certificate generation and synchronization module.

[0055] The Etcd service module is the core of the entire certificate generation and synchronization mechanism, providing storage services for generating and synchronizing self-signed certificates required by each node of the Kubernetes cluster, and providing distributed lock services for coordinating certificate component services of each node. This module ensures that only one node can obtain the distributed lock and perform certificate generation at any time, thereby ensuring the consistency and security of certificate generation.

[0056] The configuration module is used to declare information required for generating Kubernetes cluster self-signed certificates, such as certificate name, encryption algorithm for generating certificate private key, certificate validity start and end date, certificate issuing authority name, CN information, etc.

[0057] The certificate synchronization component service module is used to be deployed on each node of the cluster and run in the form of a resident process service on each node, listen to the key value changes of the Etcd service, and provide Http services to hot update component configuration information. If the certificate generation pre-hook and post-hook methods are configured, the corresponding hook methods are executed before and after the work of the certificate generation module or synchronization module is completed.

[0058] Certificate generation module, which is used to generate certificate content according to the configuration and store it in the Etcd database. This module is responsible for first trying to obtain the certificate resource distributed lock provided by the Etcd service module. Once the lock is successfully obtained, the module will generate the content of the self-signed root certificate according to the configuration information (such as certificate type, validity period, encryption algorithm, etc.). After the generation is completed, the certificate generation module saves the certificate content to the local, and encrypts the certificate content in the memory according to the configured Etcd data encryption algorithm, saves the certificate key value information in the Etcd database by calling the grpc service of Etcd.

[0059] Certificate synchronization module, which is used to listen to the changes of the Etcd database, synchronize and update the certificate data and decrypt the storage to the local. This module is responsible for synchronizing the certificates generated on the master node to the current node, ensuring the consistency of certificate data among multiple nodes. The certificate synchronization module realizes the synchronization of the certificate by listening to the changes of the Etcd service module. Once new certificate data is detected to be added or updated, the certificate synchronization module will immediately trigger the synchronization process. First, get the encrypted certificate content from Etcd, then use the same decryption algorithm as the certificate generation module to decrypt. After successful decryption, the certificate synchronization module will store the certificate content to the local according to the specified storage path, thereby realizing the synchronization of the certificate among multiple nodes.

[0060] Although the embodiments of the present application have been shown and described, it can be understood by those skilled in the art that various changes, modifications, replacements and variations can be made to these embodiments without departing from the principles and spirits of the present application, and the scope of the present application is defined by the appended claims and their equivalents.

Claims

1. A method for efficient generation and synchronization of self-signed root certificates in a multi-node Kubernetes cluster based on Etcd distributed lock, characterized in that: The method includes the following steps: The Etcd service is deployed in the operating system, and certificate generation and synchronization are based on the Etcd distributed lock. Configure the certificate synchronization component by calling its HTTP service interface to set parameters; The certificate synchronization component service is deployed on each node of the cluster, running as a resident process service on each node, listening for key-value changes in the Etcd service, and providing an HTTP service to hot update component configuration information; Certificate generation and synchronization: Generate certificate content according to configuration, encrypt and store it in the Etcd database, monitor changes in the Etcd database, synchronize and update certificate data, and decrypt and store it locally.

2. The method for efficient generation and synchronization of self-signed root certificates in a multi-node Kubernetes cluster based on Etcd distributed lock, as described in claim 1, is characterized in that: The specific operations of the Etcd service include: It provides storage services for generating and synchronizing self-signed certificates required by the Kubernetes cluster for each node, and provides distributed lock services for coordinating certificate component services for each node, ensuring that at any given time, only one node acquires the distributed lock and performs the certificate generation operation, thereby guaranteeing the consistency and security of certificate generation.

3. The method for efficient generation and synchronization of self-signed root certificates in a multi-node Kubernetes cluster based on Etcd distributed lock, as described in claim 1, is characterized in that: The specific steps for configuring the certificate synchronization component include: This is used to declare the name of the self-signed certificate for generating the Kubernetes cluster, the encryption algorithm used to generate the private key for the certificate, the certificate's effective start and end dates, the name of the certificate issuing authority, and the information required for generating and synchronizing the self-signed certificate using CN information.

4. The method for efficient generation and synchronization of self-signed root certificates in a multi-node Kubernetes cluster based on Etcd distributed lock, as described in claim 1, is characterized in that: The specific operations of the certificate synchronization component service include: Configure the certificate information to be generated. Each certificate configuration includes the private key encryption algorithm, start and end dates, CN, organization, issuing authority, storage file name, and local storage path.

5. The method for efficient generation and synchronization of self-signed root certificates in a multi-node Kubernetes cluster based on Etcd distributed lock, as described in claim 1, is characterized in that: The specific steps for certificate generation and synchronization include: Attempt to acquire the distributed lock of the certificate resource provided by the Etcd service module. Once the lock is successfully acquired, generate the content of the self-signed root certificate according to the configuration information. After generation, the certificate generation module saves the certificate content locally and encrypts the certificate content in memory according to the configured Etcd data encryption algorithm. Then, it saves the certificate key-value information in the Etcd database by calling the Etcd gRPC service. The certificate synchronization module synchronizes the certificate generated on the master node to the current node, ensuring the consistency of certificate data across multiple nodes. The certificate synchronization module achieves certificate synchronization by monitoring changes in the Etcd service module. Once new certificate data is detected to be added or updated, the certificate synchronization module will immediately trigger the synchronization process. First, it retrieves the encrypted certificate content from Etcd, and then decrypts it using the same decryption algorithm as the certificate generation module. After successful decryption, the certificate synchronization module will store the certificate content locally according to the specified storage path, thus achieving certificate synchronization across multiple nodes.

6. A system for efficient generation and synchronization of self-signed root certificates in a multi-node Kubernetes cluster based on Etcd distributed lock, according to any one of claims 1-5, characterized in that: The system consists of an Etcd service module, a configuration certificate synchronization component module, a certificate synchronization component service module, and a certificate generation and synchronization module. The Etcd service module deploys a certificate synchronization component service in the operating system, and generates and synchronizes certificates based on the Etcd distributed lock. Configure the certificate synchronization component module by calling the HTTP service interface of the certificate synchronization component to set parameters; The certificate synchronization component service module is deployed on each node of the cluster, running as a resident process service on each node, listening for key-value changes in the Etcd service, and providing an HTTP service to hot update component configuration information; The certificate generation and synchronization module generates certificate content according to the configuration, encrypts and stores it in the Etcd database, monitors changes in the Etcd database, synchronously updates the certificate data, and decrypts and stores it locally.

7. The system for efficient generation and synchronization of self-signed root certificates for multi-node Kubernetes clusters based on Etcd distributed locks as described in claim 6, characterized in that: The Etcd service module provides storage services for generating and synchronizing self-signed certificates required by the Kubernetes cluster for each node, and provides distributed lock services for coordinating certificate component services of each node. This ensures that at any given time, only one node acquires the distributed lock and performs the certificate generation operation, thereby guaranteeing the consistency and security of certificate generation.

8. The system for efficient generation and synchronization of self-signed root certificates for multi-node Kubernetes clusters based on Etcd distributed locks as described in claim 6, characterized in that: The configuration certificate synchronization component module is used to declare the name of the Kubernetes cluster self-signed certificate, the encryption algorithm for generating the certificate private key, the certificate's effective start and end dates, the certificate issuing authority's name, and the information required for generating and synchronizing the CN information for the self-signed certificate.

9. A system for efficient generation and synchronization of self-signed root certificates for multi-node Kubernetes clusters based on Etcd distributed locks, as described in claim 6, is characterized in that: The certificate synchronization component service module configures the certificate information to be generated. Each certificate configuration includes the private key encryption algorithm, start and end dates, CN, organization, issuing authority, storage file name, and local storage path.

10. A system for efficient generation and synchronization of self-signed root certificates for multi-node Kubernetes clusters based on Etcd distributed locks, as described in claim 6, is characterized in that: The certificate generation and synchronization module attempts to acquire the certificate resource distributed lock provided by the Etcd service module. Once the lock is successfully acquired, the content of the self-signed root certificate is generated according to the configuration information. After generation, the certificate generation module saves the certificate content locally and encrypts the certificate content in memory according to the configured Etcd data encryption algorithm. It then saves the certificate key-value information in the Etcd database by calling Etcd's gRPC service. The certificate synchronization module synchronizes the certificate generated on the master node to the current node to ensure the consistency of certificate data among multiple nodes. The certificate synchronization module achieves certificate synchronization by listening for changes in the Etcd service module. Once new certificate data is detected to be added or updated, the certificate synchronization module will immediately trigger the synchronization process. First, it retrieves the encrypted certificate content from Etcd, and then decrypts it using the same decryption algorithm as the certificate generation module. After successful decryption, the certificate synchronization module will store the certificate content locally according to the specified storage path, thereby achieving certificate synchronization across multiple nodes.

Images