[11:21:15] <cezmunsta>	 federico3: did you manage to find out what was the root cause of  the issue with Zarcillo accessing etcd?
[19:14:53] * swfrench-wmf switches to the wrong channel and happens to see etcd mentioned
[19:16:40] <swfrench-wmf>	 from a quick chat with f.ederico3 yesterday, this looks like a change in behavior in the trixie version of urllib3 vs. that in bookworm. in effect, when you don't provide a CA certificate to the python-etcd client (the ca_cert kwarg), it attempts to disable cert validation in urllib3.
[19:16:59] <swfrench-wmf>	 the specific way it does that, though, seems to no longer be effective on the newer urllib3
[19:18:43] <swfrench-wmf>	 we don't see this failure in conftool (e.g., dbctl) on production trixie hosts, because we always configure ca_cert: /etc/ssl/certs/wmf-ca-certificates.crt