Create separate certificate for etcd peer authentication #6112
Conversation
This works around the (very unusual) etcd changes for validation of peer certificates by DNS lookup, which were introduced in etcd 3.2. Issue kubernetes#6024
k8s-ci-robot
added
cncf-cla: yes
|
This is pretty important as otherwise etcd 3.2 is broken with TLS, see #6024 (etcd 3.2 introduced some breaking changes around client cert validation). Technically we aren't defaulting to etcd3 yet, so we could get away with it, but it's not great. cc @gambol99 as I think you're most familiar with this code |
| Lifecycle: b.Lifecycle, | ||
| Name: fi.String("etcd"), | ||
| Subject: "cn=etcd", | ||
| // TODO: Can this be "server" now that we're not using it for peer connectivity? |
There was a problem hiding this comment.
Probably ... but it might prove difficult to roll out .. as the new node won't connect to the peers due to the cert usage
There was a problem hiding this comment.
Actually forget what i just send ... it's fine :-)
|
/lgtm |
k8s-ci-robot
added
the
lgtm
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: gambol99, justinsb The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
This works around the (very unusual) etcd changes for validation of
peer certificates by DNS lookup, which were introduced in etcd 3.2.
Issue #6024