AI
Why etcd Needed a Community Operator
Teams running etcd clusters on Kubernetes have historically handled cluster management on their own. A CoreOS-era project existed but was never completed, so individual users built their own operators to cover authentication, scaling, and upgrades. The etcd Operator project revives that effort as a single community-maintained solution. Its initial scope targets workload applications running on Kubernetes rather than Kubernetes itself, which keeps the problem space contained.
What v0.2 Ships and What Comes Next
Version 0.2 released the week before this talk. The headline addition is certificate support, which makes the operator viable for production-like environments. Two earlier releases established the core scaffolding. The project is not yet production-ready: backup, recovery, and a Helm chart release are still outstanding. Saha’s message to users is that v0.2 is stable enough to experiment with now, and those remaining features define the path to a production recommendation.
Deploying and Scaling an etcd Cluster
Deploying locally takes three commands: clone the repo, run a Docker build, then make and deploy. The official image at 0.2 works for anyone who just wants to try it without a local build. The CRD is named EtcdCluster. A minimal cluster object specifies two fields: the etcd version and the desired size. Setting size to seven causes the operator to add members one at a time until the count is reached. Editing the object down to three members triggers an immediate scale-in reconciliation.
TLS Options: Auto Certificates and cert-manager
The operator ships two TLS providers. The auto provider uses etcd’s built-in certificate mechanism. It requires no external dependencies, which keeps kind clusters light. Set the provider field to auto, supply a name and validation setting, and the operator creates per-member TLS secrets and mounts them to each member pod as it comes up. For production, the cert-manager provider is the recommended path. Users pass the issuer name and issuer type into the TLS section, and cert-manager handles certificate issuance and the corresponding secrets automatically.
Notable Quotes
having the city operator again as a revival project is basically uh to address that we will have one community supported and uh native uh operator which will basically uh address all these pain points that we have with authentication, scaling up and upgrades Arka Saha · ▶ 0:52
you want to keep your uh kinder light and don’t want to install search manager or any other things, this is a default one that you can use. Arka Saha · ▶ 3:34
Key Takeaways
- etcd Operator v0.2 adds certificate support, making it usable in production-like environments.
- Scaling up or down is a single field edit on the
EtcdClusterobject. - Backup, recovery, and a Helm chart are the remaining milestones before a production recommendation.
About the Speaker(s)
Arka Saha is a Software Engineer at Broadcom who leads Kubernetes releases and maintenance for VMware Cloud Foundation. He manages Broadcom’s Prow infrastructure and maintains long-term support for Kubernetes, etcd, containers, Golang, and related components. He previously managed Red Hat OpenShift and is a reviewer on the etcd Operator project.