# ID 为 104
[root@etcd1 ~]# etcdctl member update dd2947c31edb0d2 --peer-urls=http://192.168.93.105:2380
Member dd2947c31edb0d2 updated in cluster b59d820ff8caf3f4
# dd2947c31edb0d2 为 etcd5 的 ID
[root@etcd1 ~]# etcdctl member remove dd2947c31edb0d2
Member dd2947c31edb0d2 removed from cluster b59d820ff8caf3f4
[root@etcd1 ~]# etcdctl endpoint status --cluster -w table
+----------------------------+------------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+
| ENDPOINT | ID | VERSION | DB SIZE | IS LEADER | IS LEARNER | RAFT TERM | RAFT INDEX | RAFT APPLIED INDEX | ERRORS |
+----------------------------+------------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+
| http://192.168.93.103:2379 | 3d33f92152eaee46 | 3.4.23 | 20 kB | false | false | 4 | 21 | 21 | |
| http://192.168.93.102:2379 | 5abc4e842d3ab1d6 | 3.4.23 | 20 kB | false | false | 4 | 21 | 21 | |
| http://192.168.93.101:2379 | f416c4d7e7853c3a | 3.4.23 | 20 kB | true | false | 4 | 21 | 21 | |
+----------------------------+------------------+---------+---------+-----------+------------+-----------+------------+--------------------+--------+
四、数据库操作命令
4.1、增加(put)
添加一个键值对，基本用法如下所示
bash复制代码
etcdctl put [options] <key> <value> [flags]
常用参数如下所示：
参数
功能描述
--perv-kv
输出修改前的键值
注意事项：
其中value接受从stdin的输入内容
如果value是以横线-开始，将会被视为flag，如果不希望出现这种情况，可以使用两个横线代替--
若键已经存在，则进行更新并覆盖原有值，若不存在，则进行添加
bash复制代码
[root@etcd1 ~]# etcdctl put name wzh
OK
[root@etcd1 ~]# etcdctl put location -- -shanghai
OK
[root@etcd1 ~]# etcdctl put foo1 bar1
OK
[root@etcd1 ~]# etcdctl put foo2 bar2
OK
[root@etcd1 ~]# etcdctl put foo3 bar3
OK
4.2、查询(get)
查询键值对，基本用法如下所示
bash复制代码
etcdctl get [options] <key> [range_end] [flags]
常用参数如下所示
参数
功能描述
--hex
以十六进制形式输出
--limit number
设置是输出结果的最大值
--prefix
根据prefix进行匹配key
--order
对输出结果进行排序，ASCEND或DESCEND
--sort-by
按给定字段排序，CREATE,KEYMODIFY,VALUE,VERSION
--print-value-only
仅输出value值
--from-key
按byte进行比较，获取大于等于指定key的结果
--keys-only
仅获取keys
示例
bash复制代码
# 获取键值
[root@etcd1 ~]# etcdctl get name
name
wzh
# 只获取值
[root@etcd1 ~]# etcdctl get location --print-value-only
-shanghai
# 批量取从 foo1-foo3 的值， 不包括 foo3
[root@etcd1 ~]# etcdctl get foo1 foo3 --print-value-only
bar1
bar2
# 批量获取前缀为 foo 的值
[root@etcd1 ~]# etcdctl get --prefix foo --print-value-only
bar1
bar2
bar3
# 批量获取符合前缀的两个值
[root@etcd1 ~]# etcdctl get --prefix --limit=2 foo --print-value-only
bar1
bar2
# 批量获取前缀为 foo 的值， 并排序
[root@etcd1 ~]# etcdctl get --prefix foo --print-value-only --order DESCEND
bar3
bar2
bar1
4.3、删除(del)
删除键值，基本用法如下所示
bash复制代码
etcdctl del [options] <key> [range_end] [flags]
常用参数如下所示
参数
功能描述
--prefix
根据prefix进行匹配删除
--prev-kv
输出删除的键值
--form-key
按byte进行比较，删除大于指定key的结果
示例
bash复制代码
# 删除name的键值
[root@etcd1 ~]# etcdctl del name
1
# 删除从foo1到foo3且不包含foo3的键值
[root@etcd1 ~]# etcdctl del foo1 foo3
2
# 删除前缀为foo的所有键值
[root@etcd1 ~]# etcdctl del --prefix foo
1
# 对某个 key 监听操作, 当 key1 发生改变时, 会返回最新值
[root@etcd1 ~]# etcdctl watch name
# 监听 key 前缀
[root@etcd1 ~]# etcdctl watch name --prefix
# 监听到改变后执行相关操作
[root@etcd1 ~]# etcdctl watch name -- etcdctl get age
4.6、监听单个建
bash复制代码
# 启动监听命令
[root@etcd1 ~]# etcdctl watch foo
# 另一个控制台执行新增命令
[root@etcd1 ~]# etcdctl put foo bar
OK
# 观察控制台监听输出
[root@etcd1 ~]# etcdctl watch foo
PUT
foo
bar
# 另一个控制台执行删除命令
[root@etcd1 ~]# etcdctl del foo
1
# 观察控制台监听输出
[root@etcd1 ~]# etcdctl watch foo
PUT
foo
bar
DELETE
foo
4.7、同时监听多个建
bash复制代码
# 监听前缀为 foo 的建
[root@etcd1 ~]# etcdctl watch --prefix foo
# 另一个控制台执行操作
[root@etcd1 ~]# etcdctl put foo1 bar1
OK
[root@etcd1 ~]# etcdctl put foo2 bar2
OK
[root@etcd1 ~]# etcdctl del foo1
1
# 观察控制台输出
[root@etcd1 ~]# etcdctl watch --prefix foo
PUT
foo1
bar1
PUT
foo2
bar2
DELETE
foo1
# 监听指定的多个建
[root@etcd1 ~]# etcdctl watch -i
watch name
watch location
# 另一个控制台执行操作
[root@etcd1 ~]# etcdctl put name wzh
OK
[root@etcd1 ~]# etcdctl del name
1
[root@etcd1 ~]# etcdctl put location shanghai
OK
# 观察控制台输出
[root@etcd1 ~]# etcdctl watch -i
watch name
watch location
PUT
name
wzh
DELETE
name
PUT
location
shanghai
etcdctl user add < user name or user:password > [options] [flags]
添加新用户
delete
etcdctl user delete < user name > [flags]
删除用户
list
etcdctl user list [flags]
列出所有用户
get
etcdctl user get < user name [options] [flags]
获取用户详细信息
passwd
etcdctl user passwd < user name > [options] [flags]
修改密码
grant-role
etcdctl user grant-role < user name > < role name > [flags]
赋予用户角色
revoke-role
etcdctl user revoke-role < user name > < role name > [flags]
7.2、角色管理
其主要用法如下所示：
bash复制代码
etcdctl role <subcommand> [flags]
其主要子命令主要如下所示：
子命令
常用用法
功能描述
add
etcdctl role add < role name [flags]
添加角色
delete
etcdctl role delete [flags]
删除角色
list
etcdctl role list [flags]
列出所有角色
get
etcdctl role get [flags]
获取角色详情
grant-permission
etcdctl role grant-permission [options] < role name > < permission tye > < < key > > [endkey] [flags]
把key操作权限授予一个角色
revoke-permission
etcdctl role revoke-permission < role name > < key > [endkey] [flags]
7.3、开启root身份验证
在开启身份验证后，注意事项如下所示：
开启身份验证：所有etcdctl命令操作都需要指定用户参数--user，参数值为用户名:密码
开启证书验证：所有etcdctl命令操作都需要添加证书参数--cacert
开启root身份验证的步骤如下所示：
bash复制代码
# 添加 root 用户, 密码为 123456
[root@etcd1 ~]# etcdctl user add root:123456
User root created
# 开启身份验证, 开启为 enable, 取消为 disable
[root@etcd1 ~]# etcdctl auth enable --user=root:123456
{"level":"warn","ts":"2025-11-04T15:45:30.570+0800","caller":"clientv3/retry_interceptor.go:62","msg":"retrying of unary invoker failed","target":"endpoint://client-a1a91c15-df9d-4e6f-80d3-7f388e9188f4/127.0.0.1:2379","attempt":0,"error":"rpc error: code = FailedPrecondition desc = etcdserver: authentication is not enabled"}
{"level":"warn","ts":"2025-11-04T15:45:30.575+0800","caller":"clientv3/retry_interceptor.go:62","msg":"retrying of unary invoker failed","target":"endpoint://client-a1a91c15-df9d-4e6f-80d3-7f388e9188f4/127.0.0.1:2379","attempt":0,"error":"rpc error: code = FailedPrecondition desc = etcdserver: root user does not have root role"}
Authentication Enabled
# 开启身份验证后, 直接获取键值报错
[root@etcd1 ~]# etcdctl get name
{"level":"warn","ts":"2025-11-04T15:47:25.710+0800","caller":"clientv3/retry_interceptor.go:62","msg":"retrying of unary invoker failed","target":"endpoint://client-09b2c5c3-3be4-45f9-8465-cb85c80dfc80/127.0.0.1:2379","attempt":0,"error":"rpc error: code = InvalidArgument desc = etcdserver: user name is empty"}
Error: etcdserver: user name is empty
# 添加用户信息访问
[root@etcd1 ~]# etcdctl get name --user=root:123456
name
wzh
7.4、角色授权
在开启了root身份验证后，就可以对普通用户和角色操作了
7.4.1、用户增删改查
bash复制代码
# 添加普通
[root@etcd1 ~]# etcdctl user add test:123 --user=root:123456
User test created
# 用户用户信息
[root@etcd1 ~]# etcdctl user get test --user=root:123456
User: test
Roles:
# 查看所有用户
[root@etcd1 ~]# etcdctl user list --user=root:123456
root
test
# 修改用户密码
[root@etcd1 ~]# etcdctl user passwd test --user=root:123456
Password of test:
Type password of test again for confirmation:
Password updated
# 删除用户
[root@etcd1 ~]# etcdctl user delete test --user=root:123456
User test deleted
7.4.2、用户角色绑定
bash复制代码
# 增加普通用户
[root@etcd1 ~]# etcdctl user add test:123 --user=root:123456
User test created
# 添加角色
[root@etcd1 ~]# etcdctl role add test-role --user=root:123456
Role test-role created
# 将角色绑定给指定用户
[root@etcd1 ~]# etcdctl user grant-role test test-role --user=root:123456
Role test-role is granted to user test
# 查看用户信息
[root@etcd1 ~]# etcdctl user get test --user=root:123456
User: test
Roles: test-role
7.4.3、角色授权
权限分为：只读（read），只写（write）和读写（readwrite）权限
bash复制代码
# 使用 test 用户获取 name 值会报错, 权限拒绝
[root@etcd1 ~]# etcdctl get name --user=test:123
{"level":"warn","ts":"2025-11-04T16:00:59.605+0800","caller":"clientv3/retry_interceptor.go:62","msg":"retrying of unary invoker failed","target":"endpoint://client-af949a12-8f25-4070-8fef-b7bad516d71b/127.0.0.1:2379","attempt":0,"error":"rpc error: code = PermissionDenied desc = etcdserver: permission denied"}
Error: etcdserver: permission denied
# 按 key 进行授权, test-role 角色可以读写 name
[root@etcd1 ~]# etcdctl role grant-permission test-role readwrite name --user=root:123456
Role test-role updated
# 查看角色权限详情
[root@etcd1 ~]# etcdctl role get test-role --user=root:123456
Role test-role
KV Read:
name
KV Write:
name
# 撤销角色权限
[root@etcd1 ~]# etcdctl role revoke-permission test-role name --user=root:123456
Permission of key name is revoked from role test-role
# 查看角色权限详情
[root@etcd1 ~]# etcdctl role get test-role --user=root:123456
Role test-role
KV Read:
KV Write: