I'll pile on: I'm working through Marko Luksa's "Kubernetes in Action", where he introduces this quaint line of code: etcdctl ls /registry He notes in an as

I'll pile on: I'm working through Marko Luksa's "Kubernetes in Action", where he introduces this quaint line of code: etcdctl ls /registry He notes in an aside that you may have to do etcdctl get /registry --prefix=true for later versions of the protocol. But here I am with k8s 1.16, and etcd has been locked in a pod (seriously, why?) so before you contact it you need to "kubectl exec ..." We're not finished. Apparently the pod was insufficiently secure, because now we need to decorate the etcdctl with a couple certificates, a key, and do SSL encryption to make contact, so in the end I have this wrapper (names changed to protect the guilty): $ cat ~/bin/etcdctl #!/bin/bash declare -A EtcdHost=( [clust_prodA]=clust1-leader [clust_prodB]=clust2-leader [clust_qualA]=clust3-leader [clust_testA]=clust4-leader ) if [ ! -z ${EtcdHost[$cluster]:-} ]; then export KUBECONFIG=$HOME/.kube/$cluster exec kubectl exec etcd-${EtcdHost[$cluster]} -n kube-system -- sh -c "ETCDCTL_API=3 etcdctl --endpoints https://${EtcdHost[$cluster]}:2379 --cacert /etc/kubernetes/pki/etcd/ca.crt --key /etc/kubernetes/pki/etcd/server.key --cert /etc/kubernetes/pki/etcd/server.crt $*" exit 0 else echo "No known etcd host for cluster $cluster"; exit 1; fi The entry points for beginners have been nearly barricaded, and the ladders charred and dangling high.