Quick setup
Click New Connection…, select etcd, enter host and port, then click Save & Connect. etcd has no databases, so there is no Database field and nothing to switch between.Connection settings
Advanced fields
Authentication
Fill in Username and Password once the server has runauth enable. Credentials against a server that has authentication off still connect, unauthenticated, the way etcdctl --user does.
The user does not need the root role. A user whose roles cover part of the keyspace connects and browses what those roles allow. endpoint status and the user and role commands do need root, and answer etcdserver: permission denied without it. On etcd 3.6.0 through 3.6.11 that also leaves the database size blank.
Running auth enable from the command editor turns authentication on for the whole cluster. A connection that already holds a username and password keeps working; one that holds neither cannot, and has to be reopened with credentials.
Connection URL
Browsing keys
The sidebar groups keys by their first path segment under the Key Prefix Root, with segment-less keys under (root). The grid gives one row per key: Key, Value, Version, ModRevision, CreateRevision and Lease. Key is the primary key and the three revision columns are read-only. Saving edits generates commands. Changing Value or Lease re-puts the key. Changing Key is a put at the new name and a del of the old one, so the old key is deleted rather than moved. A new row whose key does not start with / gets the Key Prefix Root prepended.
Command editor
The editor takes etcdctl-style commands, with autocomplete over both commands and flags.
etcdctl-style commands in the editor
get, put, del (or delete), watch, lease grant|revoke|timetolive|list|keep-alive, member list, endpoint status|health, compaction, auth enable|disable, user add|delete|list|grant-role|revoke-role, and role add|delete|list. Anything else, an etcdctl command with no entry here included, comes back as Unknown command: … without reaching the server.
Lease IDs take decimal or hex, and hex is detected by its letters. Prefix an all-digit hex ID with
0x (--lease=0x69407712) or it reads as decimal and resolves to another lease.
SSL/TLS
TLS here is set by TLS Mode in the Advanced fields, not by the connection’s SSL mode, and it starts Disabled. Required (skip verify) encrypts without checking the certificate, Verify CA checks it against the CA Certificate you name, and Verify Identity adds the hostname check. Client Certificate and Client Key cover mutual TLS under either verifying mode. See SSL/TLS for the concepts.Limitations
- No transactions. Each command, and each row you save, is its own gateway request.
- The form takes one endpoint and does not fail over to another member. Point it at a member that is up;
member listshows the rest. - A value that is not valid UTF-8 shows in the grid as
<b64:…>wrapping its base64, and text you type is sent as UTF-8. Write binary values withetcdctl. - No schema editing and no import.
Troubleshooting
No etcd v3 API found
The gateway answered 404 on/v3, /v3beta and /v3alpha. Point the connection at the client port, 2379 by default, and not the peer port on 2380.
The server answered but is not an etcd v3 JSON gateway
Something is listening on that port and it is not etcd. A reverse proxy that rewrites 404 into a branded page does this too.This etcd server has authentication enabled
The server wants a token and the connection carries no credentials. Add a Username and Password and connect again.etcdserver: authentication failed, invalid user ID or password
etcd rejected the credentials. Check them withetcdctl --user=name:password endpoint health.
etcdserver: permission denied
The credentials were accepted and the user’s roles do not cover that key or command.endpoint status, user and role need the root role.
Related
- SSH Tunneling, for reaching a cluster through a bastion host
- Import & Export