Try It Out
In this example we will deploy etcd on a Minikube cluster using the Minimus Helm chart.
We will test the deployment by storing and retrieving a key from etcd.
Step 1: Start Cluster
If you have a cluster to work with, skip this step. Otherwise, start a Minikube cluster. Deployment instructions
Step 2: Create Namespace
Create a namespace:
kubectl create ns etcd-advanced-fips
Step 3: Save Values File Locally
Go to the Values tab and save a copy of the it locally. You will need to add the flag -f values.yaml to override the defaults when you deploy the chart in the next step.
Step 4: Deploy the Helm Chart
Deploy the Minimus Helm chart with the values.yaml file you saved in the previous step:
helm install my-etcd-advanced-fips oci://helm.mini.dev/etcd-advanced-fips \
--version 0.1.1 \
-f values.yaml \
-n etcd-advanced-fips
Step 5: Verify etcd is Running
Confirms the chart deployed successfully and etcd started:
kubectl get pods -n etcd-advanced-fips
You should see output similar to:
NAME READY STATUS RESTARTS AGE
my-etcd-advanced-fips-0 1/1 Running 0 2m
Step 6: Test Key Storage and Retrieval
Set variables for your deployment (replace my-etcd-advanced-fips and etcd-advanced-fips with your actual release name and namespace):
export RELEASE_NAME=my-etcd-advanced-fips
export NAMESPACE=etcd-advanced-fips
Find the etcd service name (it may differ from the release name):
export ETCD_SERVICE=$(kubectl get svc -n $NAMESPACE -l app.kubernetes.io/name=etcd,app.kubernetes.io/component=etcd -o jsonpath='{.items[0].metadata.name}')
echo "Using etcd service: $ETCD_SERVICE"
Verify the service exists and has endpoints:
kubectl get svc $ETCD_SERVICE -n $NAMESPACE
kubectl get endpoints $ETCD_SERVICE -n $NAMESPACE
The endpoints should show the pod IP address. If endpoints are empty, wait a few seconds and check again.
Export the etcd root password:
export ETCD_ROOT_PASSWORD=$(kubectl get secret --namespace $NAMESPACE $RELEASE_NAME -o jsonpath="{.data.etcd-root-password}" | base64 -d)
Run a temporary etcd client pod:
kubectl run etcd-client --restart='Never' \
--image reg.mini.dev/etcd-advanced-fips:3.6.5 \
--env ROOT_PASSWORD=$ETCD_ROOT_PASSWORD \
--env ETCDCTL_API=3 \
--namespace $NAMESPACE \
--command -- sleep infinity
Wait for the etcd-client pod to be ready:
kubectl wait --for=condition=ready pod etcd-client -n $NAMESPACE --timeout=60s
Write and read a key (this command runs inside the etcd-client pod):
kubectl -n $NAMESPACE exec etcd-client -- bash -lc "etcdctl --endpoints=http://${ETCD_SERVICE}.${NAMESPACE}.svc.cluster.local:2379 --user root:\$ROOT_PASSWORD put /message 'Hello from Minimus FIPS' && etcdctl --endpoints=http://${ETCD_SERVICE}.${NAMESPACE}.svc.cluster.local:2379 --user root:\$ROOT_PASSWORD get /message"
Alternatively, you can run the commands separately:
kubectl -n $NAMESPACE exec etcd-client -- bash -lc "etcdctl --endpoints=http://${ETCD_SERVICE}.${NAMESPACE}.svc.cluster.local:2379 --user root:\$ROOT_PASSWORD put /message 'Hello from Minimus FIPS'"
kubectl -n $NAMESPACE exec etcd-client -- bash -lc "etcdctl --endpoints=http://${ETCD_SERVICE}.${NAMESPACE}.svc.cluster.local:2379 --user root:\$ROOT_PASSWORD get /message"
Expected output:
OK
/message
Hello from Minimus FIPS
Step 7: Access etcd Locally
You can interact with your etcd cluster directly from your local machine through kubectl port-forward.
kubectl port-forward -n etcd-advanced-fips svc/my-etcd-advanced-fips 2379:2379
You should see:
Forwarding from 127.0.0.1:2379 -> 2379
Forwarding from [::1]:2379 -> 2379
Keep this terminal open
Open a second terminal and export the password:
export ETCD_ROOT_PASSWORD=$(kubectl -n etcd-advanced-fips get secret my-etcd-advanced-fips \
-o jsonpath='{.data.etcd-root-password}' | base64 -d)
Verify connectivity and read the key:
curl -s localhost:2379/health
ETCDCTL_API=3 etcdctl \
--endpoints=http://127.0.0.1:2379 \
--user "root:$ETCD_ROOT_PASSWORD" \
get /message
Expected output:
{"health":"true","reason":""}
/message
Hello from Minimus FIPS
Step 8: Cleanup (Optional)
If you're done testing:
helm uninstall my-etcd-advanced-fips -n etcd-advanced-fips
kubectl delete namespace etcd-advanced-fips
os-shell-advanced-fips 1.0