Configure etcd (Hardened)

Configuration files

systemd unit /etc/systemd/system/etcd.service (flags-based configuration)

Credential rotation

No application credential exists; rotate your SSH keys through your cloud's own key management.

Monitoring & logging

• Logs: journalctl -u etcd -f
• Health: etcdctl endpoint health → 127.0.0.1:2379 is healthy — wire this into your cloud's monitoring agent or an external probe.
• Cloud-native agents (CloudWatch agent, Google Cloud Ops Agent) install normally on this image if you want metrics/log shipping — none is pre-installed or phoning home by default.

Upgrades

Replace with the newest image version; etcd data migrates via snapshot/restore.

Backup & restore

etcdctl snapshot save /path/backup.db (then copy off-box); restore with etcdctl snapshot restore.