if _, err := oldEtcdClient.WaitForClusterAvailable(retries, retryInterval); err != nil {
			fmt.Printf("[upgrade/etcd] Failed to healthcheck previous etcd: %v\n", err)
			// Nothing else left to try to recover etcd cluster
			return true, errors.Wrapf(err, "fatal error rolling back local etcd cluster manifest, the backup of etcd database is stored here:(%s)", backupEtcdDir)
		}

		curl -sSL --retry 5 https://github.com/etcd-io/etcd/releases/download/v$$version/etcd-v$$version-windows-amd64.zip -o etcd-v$$version-windows-amd64.zip; \
		unzip -q -d $$etcd_release_tmp_dir etcd-v$$version-windows-amd64.zip; \
		rm etcd-v$$version-windows-amd64.zip; \
		$(BIN_INSTALL) $$etcd_release_tmp_dir/etcd-v$$version-windows-amd64/etcd.exe $$etcd_release_tmp_dir/etcd-v$$version-windows-amd64/etcdctl.exe $(TEMP_DIR)/; \

        "go.etcd.io/etcd/client/v3",
        "go.etcd.io/etcd/server/v3",
        "k8s.io/apiserver"
      ],
      "github.com/grpc-ecosystem/grpc-gateway": [
        "go.etcd.io/etcd/api/v3",
        "go.etcd.io/etcd/server/v3"
      ],
      "github.com/json-iterator/go": [
        "github.com/prometheus/client_golang",
        "go.etcd.io/etcd/client/v2",
        "go.etcd.io/etcd/server/v3",

    runs-on: ubuntu-latest

    services:
      openldap:
        image: quay.io/minio/openldap
        ports:
          - "389:389"
          - "636:636"
        env:
          LDAP_ORGANIZATION: "MinIO Inc"
          LDAP_DOMAIN: "min.io"
          LDAP_ADMIN_PASSWORD: "admin"
      etcd:
        image: "quay.io/coreos/etcd:v3.5.1"

      match: gcr.io/etcd-development/etcd
    - path: test/utils/image/manifest.go
      match: configs\[Etcd\] = Config{list\.GcEtcdRegistry, "etcd", "\d+\.\d+.\d+(-(alpha|beta|rc).\d+)?(-\d+)?"}

  - name: "etcd-image"
    version: 3.5.14
    refPaths:
    - path: cluster/images/etcd/Makefile
      match: BUNDLED_ETCD_VERSIONS\?|LATEST_ETCD_VERSION\?
    - path: cluster/images/etcd/migrate/options.go

    return
  fi
  kube::log::status "Cleaning up etcd"
  kube::etcd::cleanup
  CLEANUP_REQUIRED=
  kube::log::status "Integration test cleanup complete"
}

runTests() {
  kube::log::status "Starting etcd instance"
  CLEANUP_REQUIRED=1
  kube::etcd::start
  # shellcheck disable=SC2034
  local ETCD_SCRAPE_PID # Set in kube::etcd::start_scraping, used in cleanup
  kube::etcd::start_scraping

				fmt.Sprintf("--etcd-servers=https://[::1]:%d", kubeadmconstants.EtcdListenClientPort),
				"--etcd-cafile=" + filepath.Join(testCertsDir, "etcd/ca.crt"),
				"--etcd-certfile=" + filepath.Join(testCertsDir, "apiserver-etcd-client.crt"),
				"--etcd-keyfile=" + filepath.Join(testCertsDir, "apiserver-etcd-client.key"),
			},
		},
		{
			name: "an external etcd with custom ca, certs and keys",

	// * be pointing to stale resource version. Use etcd KV request to get linearizable resource version.
	// * not be delivered at all. It's recommended to poll request progress periodically.
	//
	// Note: Only watches with matching context grpc metadata will be notified.
	// https://github.com/kubernetes/kubernetes/blob/9325a57125e8502941d1b0c7379c4bb80a678d5c/vendor/go.etcd.io/etcd/client/v3/watch.go#L1037-L1042
	//

	github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2 // indirect
	go.etcd.io/bbolt v1.3.9 // indirect
	go.etcd.io/etcd/api/v3 v3.5.13 // indirect
	go.etcd.io/etcd/client/v2 v2.305.13 // indirect
	go.etcd.io/etcd/pkg/v3 v3.5.13 // indirect
	go.etcd.io/etcd/raft/v3 v3.5.13 // indirect
	go.etcd.io/etcd/server/v3 v3.5.13 // indirect

func KubeadmCertEtcdServer() *KubeadmCert {
	return &KubeadmCert{
		Name:     "etcd-server",
		LongName: "certificate for serving etcd",
		BaseName: kubeadmconstants.EtcdServerCertAndKeyBaseName,
		CAName:   "etcd-ca",
		config: pkiutil.CertConfig{
			Config: certutil.Config{
				// TODO: etcd 3.2 introduced an undocumented requirement for ClientAuth usage on the