← All reportsPublic report

etcd-io/etcd

Distributed reliable key-value store for the most critical data of a distributed system

52k stars Go View on GitHubprofiled 11d ago
Try GitZoid
141PRs this week
21Contributors
0Deps scanned
0Issues found
01 · Repo overview

How etcd is put together

This is the etcd distributed key-value store, a Go monorepo organized as multiple Go modules wired together by a root go.work workspace (api, client/pkg, client/v3, cache, etcdctl, etcdutl, pkg, server, tests). The server binary (server/main.go delegating to etcdmain) exposes a gRPC API defined by protos under api/, persists data via bbolt, and replicates writes through the Raft consensus library. Clients interact via client/v3 or the etcdctl CLI (cobra-based), while etcdutl operates directly on etcd data files. A newer 'cache' module provides an in-memory watch-event cache (B-tree store, ring buffer history, demuxer) that replays events to lagging watchers of an upstream etcd watch stream.

Languages

Go

Frameworks

google.golang.org/grpcgrpc-gateway/v2spf13/cobrauber-go/zapprometheus/client_golangOpenTelemetry (otelgrpc, otlptrace)go-grpc-middleware/v2golang-jwt/jwt/v5

Datastores

bbolt (embedded B+tree KV store)

Infrastructure

DockerfileProcfileMakefileProw CI jobs (Documentation/contributor-guide/prow_jobs.md)codecov.ymlgolangci-lint (tools/.golangci.yaml)

Major components

api (go.etcd.io/etcd/api/v3)

Defines the wire protocol: protobuf/gRPC definitions for KV, Watch, Lease, Cluster, Maintenance, and Auth services plus membership/version messages.

client/v3

Official Go client library providing typed KV, lease, cluster, auth, maintenance, and watch operations against the etcd gRPC API.

client/pkg

Shared client-side transport/TLS utilities used by both client/v3 and other modules.

server (go.etcd.io/etcd/server/v3)

The etcd daemon implementation (entrypoint package etcdmain): Raft replication, MVCC storage over bbolt, gRPC serving, and auth.

cache (go.etcd.io/etcd/cache/v3)

In-memory caching layer that watches an upstream etcd stream, keeps a bounded event history (ring buffer) and B-tree store, and demultiplexes/replays events to local watchers.

etcdctl

Command-line client for controlling etcd (cobra-based), including interactive password entry via speakeasy and progress bars.

etcdutl

Command-line tool for administrative operations on etcd data files (backup/snapshot/defrag-style file operations), built against the server module.

pkg

Internal shared helpers, including cobrautl exit-code/error handling used by the CLI binaries.

Over the past five weeks, the etcd team has been steadily modernizing the codebase: retiring legacy v2 data-store features and flags, migrating more tests into a common framework, and keeping dependencies and Go toolchains up to date. Alongside this cleanup, they shipped user-visible improvements like a new bbolt subcommand in etcdutl, richer runtime metrics, and fixes to etcdctl output, while also investing in security documentation and more reliable (less flaky) tests.

Week by week

2026-08-24A quiet week focused on making a timing-sensitive consistency test less flaky.latest1 change

Chore

Deflaked linearizable timeout test

A test that checks operations respect their timeout limits was stabilized so it no longer fails randomly.

2026-08-17The team removed long-deprecated v2 storage options and refreshed dependencies and tooling across the board.6 changes

Refactor

Removed legacy v2 flags and settings

Dropped the '--v2-deprecation' and '--max-snapshots' configuration flags along with related code, continuing the retirement of the old v2 storage engine.

Chore

Completed downgrade auth tests

Added tests covering authentication behavior when downgrading etcd versions within the shared test framework.

Chore

Bumped Go to 1.26.7

Updated the programming-language toolchain to pick up the latest security and stability patches.

Chore

Updated security reporting info

Refreshed documentation describing how to responsibly report security vulnerabilities.

Chore

Snapshot auth tests completed

Finished porting snapshot-related authentication tests to the new common testing framework.

Chore

Dependency refresh wave

Upgraded numerous libraries including gRPC-gateway, protobuf, OpenTelemetry, and CodeQL analysis tooling to current versions.

2026-08-10Infrastructure moved forward with an alpha version bump for the next release plus new runtime metrics and v2 cleanup.6 changes

Feature

Exposed all Go runtime metrics

When running with '--metrics=extensive', the server now reports detailed internal performance statistics from the Go language runtime.

Refactor

Stopped purging v2 snapshot files

Removed automatic deletion of old-format v2 backup files as part of winding down v2 support.

Chore

Bumped etcd to v3.8.0-alpha.0

Internal references were updated to point at the first alpha build of the upcoming 3.8 release.

Chore

Bumped Go to 1.26.6

Updated the development toolchain to the latest patch release.

Chore

Snapshot auth tests migrated

Began moving snapshot authentication tests into the unified test framework used across releases.

Chore

CodeQL action updated

Refreshed the automated security-scanning tool to its latest version.

2026-08-03A busy week of test migration, dependency upgrades, and cleanup of legacy v2 tooling.6 changes

Fix

Reduced flakiness in compaction hash test

Fixed a test around data compaction verification that was failing intermittently.

Refactor

Cleaned up legacy v2 snapshot usage in log dumping

The 'etcd-dump-logs' diagnostic tool no longer relies on the outdated v2 snapshot code path.

Chore

Member list test migrated

Ported the member-list test into the common cross-version test framework.

Feature

bbolt subcommand added to etcdutl

Merged work adding database-inspection commands to the etcdutl maintenance utility.

Chore

Broad dependency upgrades

Updated gRPC, Prometheus client, zap logging, progress bar, and other libraries to newer versions.

Chore

Antithesis test client randomness replaced

Swapped standard random number generation for Antithesis's SDK in the fault-injection test client for better reproducibility.

2026-07-27Security documentation, a new etcdutl subcommand, and an etcdctl output fix headlined a large week of 37 commits.6 changes

Docs

Expanded threat model documentation

Added explanations of trust assumptions and rules for handling security issues to THREAT_MODEL.md.

Feature

bbolt subcommand added to etcdutl

Introduced new commands for inspecting etcd's on-disk database directly from the maintenance tool.

Fix

Removed duplicate RaftTerm in etcdctl output

Fixed the endpoint status display so it no longer prints the RaftTerm field twice, with changelog entries backported to three release lines.

Fix

Improved compare panic messages

Client-side transaction comparisons now include value details when they fail unexpectedly, making errors easier to diagnose.

Refactor

Removed legacy raftexample

Deleted the outdated sample Raft implementation project from the repository.

Chore

Antithesis integration and dependency bumps

Added a random-number wrapper for deterministic testing, enabled image building in the verify job, and upgraded many libraries including gRPC and Prometheus client.

03 · Security check

Dependencies and code review

0 dependencies scanned

Dependency advisories

Security Watch

No known advisories across 0 scanned dependencies.

No known advisories in the scanned dependencies.

Code review

No concrete code-level issues confirmed.

Get this report every week for your repos.

GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.

$19 a month, flat · First 10 outputs free · No card required