Skip to content
This repository was archived by the owner on Feb 5, 2020. It is now read-only.

Conversation

@coresolve
Copy link
Contributor

This adds support for specifying the scheme that will be used for the
external etcd cluster. it retains the default https

I have tested bare metal azure and aws. @squat @kyoto

@coreosbot
Copy link

Can one of the admins verify this patch?

Copy link
Contributor

@squat squat left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This will suffice as a temporary fix. We really need to infer the scheme from the certs but we cannot do this until we allow certificates for external etcd clusters. Please also add configuration for openstack clusters.

config.tf Outdated
default = "https"

description = <<EOF
(optional) Can be either "http" or "https" When set this scheme will be used for all provided etcd endpoints.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add a “.” between the two sentences and add a “,” after “When set” so it reads better.

master_subnetwork_name = "${module.network.master_subnetwork_name}"
external_endpoints = ["${compact(var.tectonic_etcd_servers)}"]

etcd_scheme = "${var.tectonic_etcd_scheme}"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need to declare “etcd” in platforms/gcp/etcd otherwise GCP will fail to build.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fixed

container_image = "${var.tectonic_container_images["etcd"]}"
base_domain = "${var.tectonic_base_domain}"
external_endpoints = ["${compact(var.tectonic_etcd_servers)}"]
etcd_scheme = "${var.tectonic_etcd_scheme}"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here, let’s declare etcd in platforms/vmware/etcd so as to not break this platform.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fixed

@mxinden
Copy link
Contributor

mxinden commented Nov 1, 2017

We did some changes (#2082) to the testing process. Please rebase on to current master, so that the basic-tests PR status is reported correctly.

This adds support for specifying the scheme that will be used for the
external etcd cluster. it retains the default `https`

I have tested bare metal azure and aws.
@coresolve coresolve force-pushed the support_etcd_schema branch from 5c21492 to 970e463 Compare November 1, 2017 15:19
@coresolve
Copy link
Contributor Author

We can't infer https only from certs. There are a few ways to configure etcd.

  1. etcd non tls.
  2. etcd tls but no client certs and no ca crt.
    This means that we the apiservers will be able to trust the etcd endpoints with the ca cert bundle they already have (/usr/share/ca-certificates)
  3. etcd tls with etcd ca crt but not mtls
    This means the etcd cluster is signed by a CA that isn't represented in /usr/share/ca-certificates
    For example an Corp CA.
  4. etcd with mtls
    This means that we provide client cert, key and optionally ca cert. In this case it's expected that the etcd servers are configured for mtls (and will assert that the client is signed by a cert that it knows)

@coresolve
Copy link
Contributor Author

closed in favor of #2288

@coresolve coresolve closed this Nov 1, 2017
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants