# Etcd

> Read and write etcd keys via exec, using an etcdctl-like command syntax.

- Skill: `opskat/etcd` (Agent Skill)
- Install (CLI): `npx skillmds@latest add opskat/etcd`
- Raw SKILL.md: https://api.skillmd.com/api/skills/opskat/etcd/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: opskat (https://skillmd.com/u/opskat)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/opskat/etcd

---


# etcd assets

## Command syntax

`<op> [key] [value] [--flags]` — a subset of etcdctl.

- `get /app/config`
- `get /app/ --prefix`
- `get '' --prefix` (whole keyspace — `get --prefix` with no key errors)
- `get /app/config --limit=10 --revision=42`
- `put /app/config 'hello world'`
- `put /app/config '{"debug": true}' --lease=694d5c0f`
- `del /app/ --prefix`
- `lease grant --ttl=3600`
- `lease revoke --lease=694d5c0f`
- `lease list`
- `member list`
- `endpoint status`
- `endpoint health`

## Notes

- `get`/`del`/`put` always require a key positional — even to read the whole
  keyspace, pass an explicit empty key: `get '' --prefix`. A bare `get --prefix`
  errors because there is no key argument.
- Quote any value containing spaces or JSON: `put /k '{"a": 1}'`. An unquoted
  multi-word value is rejoined with spaces (`put /k hello world` sets the value
  to `hello world`), so quote it whenever the intent should be unambiguous.
- `--lease` is hexadecimal, matching etcdctl.
- Two-word ops (`lease grant`, `member list`, `endpoint status`) are written with
  a space, exactly as shown.
- Unknown flags are rejected rather than ignored.
- A key/value token starting with `--` is parsed as a flag, not as data: if it
  matches a known flag name it is consumed as that flag instead (`put /k
  --limit=5` fails with "requires key and value" because `--limit=5` becomes
  the `--limit` flag, not the value); if it doesn't, the whole command is
  rejected ("unknown flag"). A single leading `-` is ordinary data and is not
  affected (`get -foo` reads key `-foo`).
- The command line is shell-tokenized but not shell-executed: `$`, `|`, `>`, `&`
  and similar shell metacharacters produce an error rather than expanding or
  redirecting. `put /k "$HOME"` fails; wrap values containing such characters in
  single quotes so they are taken literally.
- This is a narrower subset of etcdctl than it looks: range syntax (`get /a /b`
  meaning "everything from /a to /b") is not supported. Extra positionals are
  silently dropped for `get`/`del` (`get /a /b` reads only `/a`) and joined into
  the value for `put`. Use `--prefix` for range-like reads.
- The `scope` parameter is not used by etcd assets.

## Asset config (for put_asset)

| field | type | required | notes |
|---|---|---|---|
| `endpoints` | string | yes | Comma/semicolon/newline separated `host:port` list, no scheme prefix — each entry must parse as `host:port`, so `http://`/`https://` is rejected with `etcd endpoint必须为host:port格式`: e.g. `"10.0.1.5:2379,10.0.1.6:2379"` |
| `username` | string | no | etcd account name |
| `password` | string | no | **Write-only.** Encrypted in the asset; does not create a credential |
| `credential_id` | number | no | Existing managed password credential ID |
| `tls` | bool | no | `true` to enable TLS |
| `tls_insecure` | bool | no | `true` to skip TLS certificate verification |
| `tls_server_name` | string | no | TLS SNI / server name override |
| `tls_ca_file` | string | no | Path to a CA certificate file |
| `tls_cert_file` | string | no | Path to a client certificate file (mTLS) |
| `tls_key_file` | string | no | Path to a client key file (mTLS) |
| `dial_timeout_seconds` | number | no | Connection dial timeout override, in seconds |
| `command_timeout_seconds` | number | no | Per-command timeout override, in seconds |
| `ssh_asset_id` | number | no | SSH asset to tunnel through; 0 detaches |

`password` and `credential_id` are mutually exclusive. Plaintext is never returned, is
encrypted in the asset, and never creates a managed credential.