Problem: etcdctl connect to etcd with tls

[vasilytray]

Hi! Thank you for the great work done!
The project has changed so dramatically in a few years!
I deployed a test cluster with gray IP on VM and a white IP for VIP, but I couldn't deploy this option from the user console.
I started deploying from the command line, and came across the following in the example file that you suggest downloading and fixing all.yml, the tls_cert_generate variable: "{{ tls_enable | default(true) }}" - defaulted to true, and etcd - deployed with TLS, but in /automation/roles/etcd/tasks/start.yml this condition is not fulfilled and is taken by default - false.

--endpoints={{ patroni_etcd_protocol | default('**http**', true) }}://{{ etcd_bind_address }}:2379
        {% if etcd_tls_enable | default(**false**) | bool %}
        --cacert={{ etcd_tls_dir | default('/etc/etcd/tls') }}/{{ etcd_tls_ca_crt | default('ca.crt') }}
        --cert={{ etcd_tls_dir | default('/etc/etcd/tls') }}/{{ etcd_tls_server_crt | default('server.crt') }}
        --key={{ etcd_tls_dir | default('/etc/etcd/tls') }}/{{ etcd_tls_server_key | default('server.key') }}
        {% endif %}

As a result, etcd uses TLS, but etcdctl does not, and for example, we get this result:

etcdctl endpoint health --cluster
{"level":"warn","ts":"2025-12-19T07:07:24.017635+0300","logger":"etcd-client","caller":"v3@v3.5.25/retry_interceptor.go:63","msg":"retrying of unary invoker failed","target":"etcd-endpoints://0xc0002feb40/127.0.0.1:2379","attempt":0,"error":"rpc error: code = DeadlineExceeded desc = latest balancer error: connection error: desc = \"error reading server preface: EOF\""}
Error: failed to fetch endpoints from etcd cluster member list: context deadline exceeded

if I set tls_cert_generate: false, etcdctl connects to etcd without problems and executes commands like etcdctl member list -w table without problems.

Where should I make adjustments so that etcdctl connects to etcd with tls?

[vitabaks]

Try this command

sudo etcdctl endpoint health --cluster \
  --cacert=/etc/etcd/tls/ca.crt \
  --cert=/etc/etcd/tls/server.crt \
  --key=/etc/etcd/tls/server.key

Doc: https://autobase.tech/docs/management/basic-commands#etcd

[vasilytray]

Thank you!