Etcdctl Command Fails if --cert, --cacert, --key flags Are Not Passed

Problem

Etcdctl commands shows cluster unhealthy status, if --cert,--cacert,--key flags are not passed.

Javascript

# /opt/pf9/pf9-kube/bin/etcdctl endpoint health
{"level":"warn","ts":"2023-10-11T22:54:04.271+0200","caller":"clientv3/retry_interceptor.go:62","msg":"retrying of unary invoker failed","target":"endpoint://client-affd3e80-17a7-4cf4-9273-b22edf2f04dd/127.0.0.1:2379","attempt":0,"error":"rpc error: code = DeadlineExceeded desc = latest balancer error: all SubConns are in TransientFailure, latest connection error: connection closed"}
127.0.0.1:2379 is unhealthy: failed to commit proposal: context deadline exceeded
Error: unhealthy cluster

Environment

• Platform9 Managed Kubernetes

• Kubernetes v1.22

Answer

Starting Kubernetes v1.22, the ETCD insecure port (4001) is disabled. Going forward, need to pass the --cert, --cacert, and the --key flags to all etcdctl commands.

Here is an example below:

Sample Command

# /opt/pf9/pf9-kube/bin/etcdctl member list --cert /etc/pf9/kube.d/certs/etcdctl/etcd/request.crt --cacert /etc/pf9/kube.d/certs/etcdctl/etcd/ca.crt --key /etc/pf9/kube.d/certs/etcdctl/etcd/request.key