Patch etcd and Verify the Recovery Path
The 23 July etcd patch release fixed a watch authorization problem that could disclose events outside a user’s RBAC key range. The fix is available in v3.7.1, v3.6.14, and v3.5.33. This is a good reason to patch, but the release is also a useful reminder that an etcd maintenance window should prove more than a new binary starts.
This guide is for an administrator of a self-managed, TLS-enabled three-member etcd cluster. The finished result is a patched cluster with a verified endpoint health check, a recorded member view, and an off-node snapshot whose integrity has been checked. The commands are documentation-verified examples, not output from a production cluster. Replace the certificate paths, endpoint addresses, service name, package method, and backup location with values from your own installation.