Skip to content

10. A member neither source of truth can classify#

Symptom. VerifyEtcdState fails with etcd members with unknown verdict and a finding per member reading "cannot be classified against either source of truth", verdict unknown (VerdictUnknown).

What it means. MKE classifies every member by crossing the raw etcd member list with the EtcdMember CRs, and every combination it expects has a verdict — see the table at the top of cli/pkg/etcd/ops/verdict_finding.go. unknown means the pair fell through all of them. It is a sign of an abnormal cluster state, or of a bug in the classification, and it is a hard fail precisely because nothing downstream can reason about it.

The usual real-world cause is two rows that should have been one: a CR that could not be joined to its etcd member, because its status.peerAddress is empty and its name does not match any member's name. Discovery then emits the CR as a row of its own with no etcd member behind it.

Diagnose. Compare the two sources by hand — this is exactly what the phase could not do:

sudo k0s etcd member-list --data-dir=<dataDir>   # on a healthy controller
kubectl get etcdmembers -o wide
kubectl get etcdmember <name> -o yaml            # status.peerAddress and status.memberID especially

Look for a CR with an empty status.peerAddress or an empty status.memberID. That CR is the row that could not be matched.

Repair.

  • A CR with no status.peerAddress/status.memberID and no matching member — its host never got far enough to write its own status. If the host is a live control plane, restart k0scontroller on it so k0s rewrites the CR (§7 is the same repair). If the host is gone, the CR is a leftover: confirm no etcd member matches it, then kubectl delete etcdmember <name>.
  • Anything else — collect the output of the three commands above and open a support case. Do not run k0s etcd leave to "clean up" a member you cannot classify: if the classification is wrong, the member you remove may be a healthy voter.

Once the unclassifiable row is resolved, re-run the original command.