embed: fix go 1.7 http issue #6463
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
@xiang90 Confirmed that this fixes the issue. LGTM. Thanks! |
|
How about setting
|
go 1.7 introduces HTTP2 compability issue. Now we need to explicitly enable HTTP2 when TLS is set.
|
@gyuho Fixed. |
|
@timothysc / @liggitt this is relevant for kube as well if we turn on H2 with client certs |
|
ack. |
|
This was fixed for me on v3.1.0-alpha.0 plus this patch (and this commit) but seems to be broken again in v3.1.0-alpha.1. I'm not 100% sure I'm not making a mistake, but the commit is still there but clients fail to connect. |
|
@smarterclayton Works fine from my side? rm -rf /tmp/certs && mkdir -p /tmp/certs
rm -f /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz && rm -rf /tmp/test-etcd && mkdir -p /tmp/test-etcd
curl -L ${DOWNLOAD_URL}/${ETCD_VER}/etcd-${ETCD_VER}-linux-amd64.tar.gz -o /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz
tar xzvf /tmp/etcd-${ETCD_VER}-linux-amd64.tar.gz -C /tmp/test-etcd --strip-components=1
/tmp/test-etcd/etcd --version
etcd Version: 3.1.0-alpha.1
Git SHA: 2469a95
Go Version: go1.7.1
Go OS/Arch: linux/amd64
echo '{
"key": {
"algo": "rsa",
"size": 4096
},
"names": [
{
"O": "etcd",
"OU": "etcd, security team",
"L": "San Francisco",
"ST": "California",
"C": "USA"
}
],
"CN": "etcd"
}
' > /tmp/certs/trusted-ca-csr.json
cfssl gencert --initca=true /tmp/certs/trusted-ca-csr.json | cfssljson --bare /tmp/certs/trusted-ca
echo '{
"signing": {
"default": {
"usages": [
"signing",
"key encipherment",
"server auth",
"client auth"
],
"expiry": "87600h"
}
}
}
' > /tmp/certs/gencert-config.json
echo '{
"key": {
"algo": "rsa",
"size": 4096
},
"names": [
{
"O": "etcd",
"OU": "etcd, security team",
"L": "San Francisco",
"ST": "California",
"C": "USA"
}
],
"CN": "etcd",
"hosts": [
"localhost"
]
}
' > /tmp/certs/request-ca-csr-test-name-1.json
cfssl gencert \
--ca /tmp/certs/trusted-ca.pem \
--ca-key /tmp/certs/trusted-ca-key.pem \
--config /tmp/certs/gencert-config.json \
/tmp/certs/request-ca-csr-test-name-1.json | cfssljson --bare /tmp/certs/test-name-1
/tmp/test-etcd/etcd --name test-name-1 --data-dir /tmp/test-name-1.data \
--listen-client-urls https://localhost:12379 --advertise-client-urls https://localhost:12379 \
--listen-peer-urls https://localhost:12380 --initial-advertise-peer-urls https://localhost:12380 \
--initial-cluster test-name-1=https://localhost:12380 \
--initial-cluster-token test-token --initial-cluster-state new \
--client-cert-auth \
--cert-file /tmp/certs/test-name-1.pem \
--key-file /tmp/certs/test-name-1-key.pem \
--trusted-ca-file /tmp/certs/trusted-ca.pem \
--peer-client-cert-auth \
--peer-cert-file /tmp/certs/test-name-1.pem \
--peer-key-file /tmp/certs/test-name-1-key.pem \
--peer-trusted-ca-file /tmp/certs/trusted-ca.pem
ETCDCTL_API=3 /tmp/test-etcd/etcdctl \
--endpoints=localhost:12379 \
--cert=/tmp/certs/test-name-1.pem \
--key=/tmp/certs/test-name-1-key.pem \
--cacert=./trusted-ca.pem \
put foo bar |
|
Couple of differences - I'm using SAN certificates where the listed IP is one of the secondaries, I'm not using pems. But I agree, everything looks like it should work. EDIT: we also use both IP and DNS to identify 192.168.1.103, because of various annoyances with Safari (or other bad browsers). |
|
Using downloaded etcd v3.1.0-alpha.1 darwin I get: Here's the cert we have generated: This is a self-signed generated cert (for simplifying setup). |
|
@smarterclayton Could you create a new issue for that? Thanks! |
|
Opened #6565, thanks |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
go 1.7 introduces HTTP2 compatibility issue. Now we
need to explicitly enable HTTP2 when TLS is set.
Fix #6455. @gyuho