From https://kubernetes.io/docs/tasks/administer-cluster/configure-upgrade-etcd/, "The minimum recommended version of etcd to run in production is 3.2.10+".

It looks like Wikimedia's stretch/main repo has etcd-3.2.16. That should do!

For building the two clusters we need, we require:

• A revisit of the current etcd config in puppet with attention to any new ideas around certificate management. -- note T144153, T169287 and T215553. There's a lot entangled in these tasks.
• Documentation of the build and configuration -- making sure etcdctl actually functions on the servers in a way that is documented and perhaps consistent with upstream docs (currently, it might work, but it is so old that upstream docs are totally different).