etcd黄色标志，是不是代表没有起来。应该如何处理

yay

redscholar
root@kk-master1-41:/# ETCDCTL_API=3 etcdctl –endpoints=http://127.0.0.1:2379 –cacert=/etc/ssl/etcd/ssl/ca.pem –cert=/etc/ssl/etcd/ssl/admin-kk-master1-41.pem –key=/etc/ssl/etcd/ssl/admin-kk-master1-41-key.pem endpoint health

{“level”:“warn”,“ts”:“2025-05-20T12:23:56.447465+0800”,“logger”:“client”,“caller”:“v3@v3.5.13/retry_interceptor.go:62”,“msg”:“retrying of unary invoker failed”,“target”:“etcd-endpoints://0xc00015e000/127.0.0.1:2379”,“attempt”:0,“error”:"rpc error: code = DeadlineExceeded desc = latest balancer error: last connection error: connection error: desc = \“error reading server preface: read tcp 127.0.0.1:47868->127.0.0.1:2379: read: connection reset by peer\”"}

http://127.0.0.1:2379 is unhealthy: failed to commit proposal: context deadline exceeded

Error: unhealthy cluster

root@kk-master1-41:/#

现在提示这个错误。

yay

谢谢指导

yay

root@kk-master1-41:/var/lib/etcd/member# ETCDCTL_API=3 etcdctl –endpoints=https://127.0.0.1:2379 \

–cacert=/etc/ssl/etcd/ssl/ca.pem \

–cert=/etc/ssl/etcd/ssl/admin-kk-master1-41.pem \

–key=/etc/ssl/etcd/ssl/admin-kk-master1-41-key.pem \

endpoint health

https://127.0.0.1:2379 is healthy: successfully committed proposal: took = 16.209597ms

root@kk-master1-41:/var/lib/etcd/member#

我用上面的这个命令，就可以访问，是不是要https才可以啊，我应该如何修改呢，谢谢。

yay

两个问题，第一个，你给我的代码，两个横杠，被过滤了一个，所以，有问题，第二个问题，http不可以，https就可以了。

redscholar

yay 三个节点都看一下

yay

但是通过kubesphere后台看到etcd还是黄色的，应该是不正常的状态。

yay

redscholar
https://127.0.0.1:2379 is healthy: successfully committed proposal: took = 14.778182ms
三个节点都提示这个，

root@kk-master1-41:/var/lib/etcd/member# ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 \ --cacert=/etc/ssl/etcd/ssl/ca.pem \ --cert=/etc/ssl/etcd/ssl/admin-kk-master1-41.pem \ --key=/etc/ssl/etcd/ssl/admin-kk-master1-41-key.pem \ endpoint health https://127.0.0.1:2379 is healthy: successfully committed proposal: took = 14.778182ms root@kk-master1-41:/var/lib/etcd/member#

root@kk-master2-42:/# ETCDCTL_API=3 etcdctl –endpoints=https://127.0.0.1:2379 \

–cacert=/etc/ssl/etcd/ssl/ca.pem \

–cert=/etc/ssl/etcd/ssl/admin-kk-master2-42.pem \

–key=/etc/ssl/etcd/ssl/admin-kk-master2-42-key.pem \

endpoint health

https://127.0.0.1:2379 is healthy: successfully committed proposal: took = 5.56972ms

root@kk-master2-42:/#

root@kk-master3-43:/# ETCDCTL_API=3 etcdctl –endpoints=https://127.0.0.1:2379 \

–cacert=/etc/ssl/etcd/ssl/ca.pem \

–cert=/etc/ssl/etcd/ssl/admin-kk-master3-43.pem \

–key=/etc/ssl/etcd/ssl/admin-kk-master3-43-key.pem \

endpoint health

https://127.0.0.1:2379 is healthy: successfully committed proposal: took = 15.389317ms

root@kk-master3-43:/#

redscholar

你的etcd集群是好的。外部etcd默认是不会被监控的。
你可以在kubesphere-monitoring-system 命名空间下创建一个名为etcd 的 servicemonitors 来监控外部etcd
或者启用cc中的etcd监控
https://github.com/kubesphere/ks-installer/blob/cdd3d677f2bbdcd8c97186bf569cbc9c1deda82d/deploy/cluster-configuration.yaml#L17-L21

yay

redscholar 你的意思是，默认kubesphere不会监控用过kk默认安装的etcd吗？

yay

我这样子的配置，他也不会监控啊。

redscholar

yay 把monitoring改成true, endpointIps改成实际ip

yay

如何kk安装etcd和传统安装一样，放在kube-system空间里面，而不是以系统服务的形式出现呢？

yay

redscholar

谢谢，搞定了，感谢支持。

redscholar

三个地址都填上去吧。
ip地址使用英文逗号分隔：
https://github.com/kubesphere/ks-installer/blob/38055b318b8f805af65aedfa5ad4508128b5eb2c/roles/ks-monitor/templates/prometheus-endpointsEtcd.yaml.j2#L12-L14
实际生成的servicemonitor文件:
https://github.com/kubesphere/ks-installer/blob/38055b318b8f805af65aedfa5ad4508128b5eb2c/roles/ks-monitor/templates/prometheus-serviceMonitorEtcd.yaml.j2
如果证书认证不通过需要把证书放到对应的secret中：
https://github.com/kubesphere/ks-installer/blob/38055b318b8f805af65aedfa5ad4508128b5eb2c/roles/ks-monitor/templates/prometheus-prometheus.yaml.j2#L103-L106

yay

redscholar 感谢大佬，搞定了，。谢谢。

redscholar

yay 不，你没搞定，你去看一下prometheus的pod日志，是不是有报错