Unable to start ETCD and failing with error 'tls: failed to find any PEM data in key input' #16024
Replies: 4 comments 14 replies
-
Hi @ahrtr Thanks and Regards, |
Beta Was this translation helpful? Give feedback.
-
I'd recommend that you check that your PEM files all can be properly loaded. You can also use openssl for that, it should give similar error messages. |
Beta Was this translation helpful? Give feedback.
-
Hi @jmhbnz This issue is coming 2 times out of 10. Thanks, |
Beta Was this translation helpful? Give feedback.
-
Hi, Thanks, |
Beta Was this translation helpful? Give feedback.
-
Bug report criteria
What happened?
We have 3 members cluster of ETCD service. ETCD service is not running and throwing the error 'tls: failed to find any PEM data in key input'.
As per our prilimarliy investigation , Key files which is being used for peer communication which might be corrupted. But we are not sure about the root cause.
We are using the ETCD-3.5.7 and self sign certificates are being used for peer communication. Could you please help us to know the exact root cause of the issue.
Sharing below the log snippet with the error coming in the logs.
2023-06-02T14:58:00.721849815Z {"caller":"embed/etcd.go:484","cipher-suites":[],"message":"starting with peer TLS","metadata":{"container_name":"etcd","namespace":"spider3","pod_name":"etcd-0"},"service_id":"etcd","severity":"info","timestamp":"2023-06-02T14:58:00.721+00:00","tls-info":"cert = /data/fixtures/peer/cert.pem, key = /data/fixtures/peer/key.pem, client-cert=/data/fixtures/peer/cert.pem, client-key=/data/fixtures/peer/key.pem, trusted-ca = , client-cert-auth = false, crl-file = ","version":"1.2.0"}
2023-06-02T14:58:00.721912667Z {"advertise-client-urls":["https://etcd-0.etcd.spider3:2379"],"advertise-peer-urls":["https://etcd-0.etcd-peer.spider3.svc.cluster.local:2380"],"caller":"embed/etcd.go:373","data-dir":"/data","message":"closing etcd server","metadata":{"container_name":"etcd","namespace":"spider3","pod_name":"etcd-0"},"name":"etcd-0","service_id":"etcd","severity":"info","timestamp":"2023-06-02T14:58:00.721+00:00","version":"1.2.0"}
2023-06-02T14:58:00.721960692Z {"advertise-client-urls":["https://etcd-0.etcd.spider3:2379"],"advertise-peer-urls":["https://etcd-0.etcd-peer.spider3.svc.cluster.local:2380"],"caller":"embed/etcd.go:375","data-dir":"/data","message":"closed etcd server","metadata":{"container_name":"etcd","namespace":"spider3","pod_name":"etcd-0"},"name":"etcd-0","service_id":"etcd","severity":"info","timestamp":"2023-06-02T14:58:00.721+00:00","version":"1.2.0"}
2023-06-02T14:58:00.722031174Z {"caller":"etcdmain/etcd.go:204","error":"tls: failed to find any PEM data in key input","message":"discovery failed","metadata":{"container_name":"etcd","namespace":"spider3","pod_name":"etcd-0"},"service_id":"etcd","severity":"critical","stacktrace":"go.etcd.io/etcd/server/v3/etcdmain.startEtcdOrProxyV2\n\tgo.etcd.io/etcd/server/v3/etcdmain/etcd.go:204\ngo.etcd.io/etcd/server/v3/etcdmain.Main\n\tgo.etcd.io/etcd/server/v3/etcdmain/main.go:40\nmain.main\n\tgo.etcd.io/etcd/server/v3/main.go:32\nruntime.main\n\truntime/proc.go:255","timestamp":"2023-06-02T14:58:00.721+00:00","version":"1.2.0"}
What did you expect to happen?
We want ETCD up and running without any error.
How can we reproduce it (as minimally and precisely as possible)?
It's kind of intermittent and not reproducible. always
Anything else we need to know?
No response
Etcd version (please run commands below)
Etcd configuration (command line flags or environment variables)
paste your configuration here
bash-4.4$ env
ETCD_INITIAL_CLUSTER_TOKEN=etcd
TLS_ENABLED=true
ETCD_MAX_SNAPSHOTS=3
CLIENT_PORTS=2379
TZ=UTC
HOSTNAME=etcd-0
COMPONENT_VERSION=v3.5.7
HTTP_PROBE_CMD_DIR=/usr/local/bin/health
HTTP_PROBE_READINESS_CMD_TIMEOUT_SEC=15
ETCD_LISTEN_CLIENT_URLS=https://0.0.0.0:2379
ETCD_HEARTBEAT_INTERVAL=100
ETCD_AUTO_COMPACTION_RETENTION=100
DISARM_ALARM_PEER_INTERVAL=6
ETCD_TRUSTED_CA_FILE=/data/combinedca/cacertbundle.pem
DB_THRESHOLD_PERCENTAGE=70
MONITOR_ALARM_INTERVAL=5
PEER_CERT_AUTH_ENABLED=true
TRUSTED_CA=/data/combinedca/cacertbundle.pem
PEER_CLIENTS_CERTS=/run/sec/certs/peer/srvcert.pem
FIFO_DIR=/fifo
KUBERNETES_PORT_443_TCP_PROTO=tcp
ENTRYPOINT_RESTART_ETCD=true
HTTP_PROBE_NAMESPACE=ztissan
KUBERNETES_PORT_443_TCP_ADDR=
ETCDCTL_CERT=/run/sec/certs/client/clicert.pem
ENTRYPOINT_DCED_PROCESS_INTERVAL=5
ETCD_LOG_LEVEL=debug
ENTRYPOINT_CHECKSNUMBER=60
8889
KUBERNETES_PORT=tcp://:443
POD_NAME=etcd-0
ERIC_PM_SERVER_PORT_9089_TCP_PORT=9089
ERIC_ETCD_SERVICE_PORT=2379
PWD=/
ETCD_LISTEN_PEER_URLS=https://0.0.0.0:2380
HOME=/home/dced
ERIC_ETCD_SERVICE_PORT_CLIENT_PORT_TLS=2379
ETCD_AUTO_COMPACTION_MODE=revision
KUBERNETES_SERVICE_PORT_HTTPS=443
ERIC_ETCD_PORT_2379_TCP_ADDR=
KUBERNETES_PORT_443_TCP_PORT=443
ETCD_LOGGER=zap
PEER_AUTO_TLS_ENABLED=true
ETCD_CERT_FILE=/run/sec/certs/server/srvcert.pem
ETCD_PEER_AUTO_TLS=true
ERIC_ETCD_PORT_2379_TCP_PORT=2379
KUBERNETES_PORT_443_TCP=tcp://:443
ERIC_ETCD_PORT_2379_TCP=tcp://:2379
LISTEN_PEER_URLS=https://0.0.0.0:2380
DEFRAGMENT_PERIODIC_INTERVAL=60
CONTAINER_NAME=etcd
COMPONENT=etcd
ETCD_DATA_DIR=/data
ETCD_CLIENT_CERT_AUTH=true
TERM=xterm
ETCDCTL_ENDPOINTS=etcd.ztissan:2379
HTTP_PROBE_LIVENESS_CMD_TIMEOUT_SEC=15
ETCD_METRICS=basic
PEER_CLIENT_KEY_FILE=/run/sec/certs/peer/srvprivkey.pem
HTTP_PROBE_CONTAINER_NAME=etcd
GODEBUG=tls13=1
ETCDCTL_API=3
ERIC_ETCD_PORT=tcp://:2379
ETCD_SNAPSHOT_COUNT=5000
ETCD_MAX_WALS=3
SHLVL=1
HTTP_PROBE_POD_NAME=etcd-0
KUBERNETES_SERVICE_PORT=443
ETCD_INITIAL_ADVERTISE_PEER_URLS=https://etcd-0.etcd-peer.ztissan.svc.cluster.local:2380
HTTP_PROBE_STARTUP_CMD_TIMEOUT_SEC=15
ETCD_KEY_FILE=/run/sec/certs/server/srvprivkey.pem
ETCD_ELECTION_TIMEOUT=1000
HTTP_PROBE_SERVICE_NAME=etcd
ETCDCTL_CACERT=/data/combinedca/cacertbundle.pem
ETCD_NAME=etcd-0
ETCD_QUOTA_BACKEND_BYTES=268435456
ENTRYPOINT_PIPE_TIMEOUT=5
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
ETCD_ADVERTISE_CLIENT_URLS=https://etcd-0.etcd.ztissan:2379
DCED_PORT=2379
KUBERNETES_SERVICE_HOST=
FLAVOUR=etcd-v3.5.7-linux-amd64
ETCDCTL_KEY=/run/sec/certs/client/cliprivkey.pem
_=/usr/bin/env
Etcd debug information (please run commands below, feel free to obfuscate the IP address or FQDN in the output)
Relevant log output
Beta Was this translation helpful? Give feedback.
All reactions