Docker & Kubernetes
What is etcd?
Learn that etcd stores cluster state.
What is etcd?
etcd is a distributed, consistent key-value database holding the whole state of the cluster (the desired and actual state of every object). It ensures consistency with the Raft consensus algorithm: a write becomes final when a majority (quorum) of members confirm it. That's why etcd is run with an odd number of members (3, 5).
3 members -> quorum 2 -> survives the loss of 1 member
5 members -> quorum 3 -> survives the loss of 2 members
4 members -> quorum 3 -> still survives the loss of only 1
Only kube-apiserver connects to etcd directly; all other components talk through the API server.
Looking inside etcd
Kubernetes objects are stored in etcd under the keys /registry/<type>/<namespace>/<name>. They can be inspected with etcdctl (on a control-plane node, with certificates):
ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 \
--cacert=/etc/kubernetes/pki/etcd/ca.crt \
--cert=/etc/kubernetes/pki/etcd/server.crt \
--key=/etc/kubernetes/pki/etcd/server.key \
get /registry/deployments/default --prefix --keys-only
/registry/deployments/default/web
/registry/deployments/default/api
Values are encoded with Protobuf; Secrets are unreadable only if encryption has been configured.
Exercise etcd health
Write two commands (with the certificate flags from the card, each on one line): query the health with etcdctl ... endpoint health; list the members with etcdctl ... member list -w table. Flags: --endpoints=https://127.0.0.1:2379, --cacert=/etc/kubernetes/pki/etcd/ca.crt, --cert=/etc/kubernetes/pki/etcd/server.crt, --key=/etc/kubernetes/pki/etcd/server.key.
Show example solution
etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key endpoint health
etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key member list -w table
Test yourself
-
What happens if 2 members are lost in a 3-member etcd cluster?
- Quorum is lost; the cluster accepts no writes
- It keeps working normally
- The remaining member becomes leader and writes
- The data is deleted
Show answer
Quorum is lost; the cluster accepts no writes — Existing workloads keep running but no changes can be made.
-
List only the keys.
etcdctl get /registry/pods/default --prefix ____
Show answer
etcdctl get /registry/pods/default --prefix --keys-only
-
Match.
- etcd
- Cluster state
- Raft
- Consensus algorithm
- quorum
- Majority
- /registry/
- Key prefix
Next lesson: kube-scheduler
