etcd

Connect to etcd v3 clusters with prefix-based key browsing and an etcdctl-style command editor

etcd 3.2 and later need nothing configured beyond a host and the client port, 2379. The peer port on 2380 serves no HTTP/JSON gateway, so a connection aimed there never opens.

The driver is not in the app. Picking in the Choose a Database sheet offers the download before the form opens, and opening a saved connection installs it without asking. Settings > Plugins > Browse > installs it up front. See Plugins.

Quick setup

Click Create Connection…, select etcd, enter host and port, then click Save & Connect. etcd has no databases, so there is no Database field and nothing to switch between.

Connection settings

Field	Description
Host	etcd server hostname or IP. localhost by default
Port	Client port, 2379 by default
Username / Password	Only when etcd authentication is enabled

Advanced fields

Field	Description
Key Prefix Root	Scope browsing to a subtree, /app. Empty browses the whole keyspace
TLS Mode	Disabled, Required (skip verify), Verify CA, or Verify Identity
CA Certificate	Path to ca.pem, for Verify CA and Verify Identity
Client Certificate / Client Key	Paths to the client certificate and private key, for mutual TLS

Connection URL

etcd://127.0.0.1:2379
etcds://127.0.0.1:2379

Both schemes import. Neither switches TLS on by itself; set TLS Mode in the Advanced fields.

Browsing keys

The sidebar groups keys by their first path segment under the Key Prefix Root, with segment-less keys under (root). The grid gives one row per key: Key, Value, Version, ModRevision, CreateRevision and Lease. Key is the primary key and the three revision columns are read-only.

Saving edits generates commands. Changing Value or Lease re-puts the key. Changing Key is a put at the new name and a del of the old one, so the old key is deleted rather than moved. A new row whose key does not start with / gets the Key Prefix Root prepended.

Command editor

The editor takes etcdctl-style commands, with autocomplete over both commands and flags.

etcdctl-style commands in the editor

get /app/config --prefix --limit=50 --keys-only
put /app/session/abc hello --lease=694d77aa1e775e08
del /app/cache --prefix
watch /app/config --prefix --timeout=60
lease grant 300
compaction 1000 --physical

The whole vocabulary is get, put, del (or delete), watch, lease grant|revoke|timetolive|list|keep-alive, member list, endpoint status|health, compaction, auth enable|disable, user add|delete|list|grant-role|revoke-role, and role add|delete|list. Anything else, an etcdctl command with no entry here included, comes back as Unknown command: … without reaching the server.

Command	Flags
get	--prefix, --limit=N, --keys-only, --order=ASCEND or DESCEND, --sort-by=KEY, VERSION, CREATE, MOD or VALUE. Leave the last two out and the server’s own ordering applies
put	--lease=ID
del	--prefix
watch	--prefix, --timeout=SECONDS, 30 by default. Events collect for that long, then arrive as a grid
lease timetolive	--keys

Lease IDs take decimal or hex, and hex is detected by its letters. Prefix an all-digit hex ID with 0x (--lease=0x69407712) or it reads as decimal and resolves to another lease.

SSL/TLS

TLS here is set by TLS Mode in the Advanced fields, not by the connection’s SSL mode, and it starts Disabled. Required (skip verify) encrypts without checking the certificate, Verify CA checks it against the CA Certificate you name, and Verify Identity adds the hostname check. Client Certificate and Client Key cover mutual TLS under either verifying mode. See SSL/TLS for the concepts.

Limitations

• No transactions. Each command, and each row you save, is its own gateway request.
• The form takes one endpoint and does not fail over to another member. Point it at a member that is up; member list shows the rest.
• A value that is not valid UTF-8 shows in the grid as <b64:…> wrapping its base64, and text you type is sent as UTF-8. Write binary values with etcdctl.
• No schema editing and no import.

Troubleshooting

No supported etcd API found

The HTTP/JSON gateway answered on none of the v3 paths. Point the connection at the client port, 2379 by default, and not the peer port on 2380.

Authentication failed

The username and password were rejected, or the user holds no role covering the key. Check both, and that auth enable has been run.

Related

• SSH Tunneling, for reaching a cluster through a bastion host
• Import & Export