Skip to content
This repository was archived by the owner on Jul 30, 2021. It is now read-only.

Commit 4a87785

Browse files
hongchaodenghongchaodeng
committed
TLS: converge asset naming of SH and non-SH etcd
1 parent e833c28 commit 4a87785

File tree

14 files changed

+153
-141
lines changed

14 files changed

+153
-141
lines changed

‎hack/multi-node/Vagrantfile‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,8 @@ CONTROLLER_USER_DATA_PATH = File.expand_path("./cluster/user-data-controller")
2222
WORKER_USER_DATA_PATH = File.expand_path("./cluster/user-data-worker")
2323
KUBECONFIG_PATH = File.expand_path("cluster/auth/kubeconfig")
2424
CA_CERT_PATH = File.expand_path("cluster/tls/ca.crt")
25-
ETCD_CERT_GLOB = File.expand_path("cluster/tls/etcd-*")
25+
ETCD_CLI_CERT_GLOB = File.expand_path("cluster/tls/etcd-*")
26+
ETCD_CERT_GLOB = File.expand_path("cluster/tls/etcd/*")
2627

2728
def etcdIP(num)
2829
return "172.17.4.#{num+50}"
@@ -112,10 +113,15 @@ Vagrant.configure("2") do |config|
112113
etcd.vm.provision :shell, inline: "mv /tmp/vagrantfile-user-data /var/lib/coreos-vagrant/", privileged: true
113114

114115
etcd.vm.provision :shell, :inline => "mkdir -p /etc/etcd/tls", :privileged => true
115-
Dir.glob(ETCD_CERT_GLOB) do |etcd_cert_file|
116+
Dir.glob(ETCD_CLI_CERT_GLOB) do |etcd_cert_file|
116117
etcd.vm.provision :file, :source => etcd_cert_file, :destination => "/tmp/#{File.basename(etcd_cert_file)}"
117118
etcd.vm.provision :shell, :inline => "mv /tmp/#{File.basename(etcd_cert_file)} /etc/etcd/tls/", :privileged => true
118119
end
120+
etcd.vm.provision :shell, :inline => "mkdir -p /etc/etcd/tls/etcd", :privileged => true
121+
Dir.glob(ETCD_CERT_GLOB) do |etcd_cert_file|
122+
etcd.vm.provision :file, :source => etcd_cert_file, :destination => "/tmp/#{File.basename(etcd_cert_file)}"
123+
etcd.vm.provision :shell, :inline => "mv /tmp/#{File.basename(etcd_cert_file)} /etc/etcd/tls/etcd/", :privileged => true
124+
end
119125
etcd.vm.provision :shell, :inline => "chown -R etcd:etcd /etc/etcd", :privileged => true
120126
etcd.vm.provision :shell, :inline => "chmod -R u=rX,g=,o= /etc/etcd", :privileged => true
121127
end

‎hack/multi-node/bootkube-test-recovery‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ echo
3636
scp -q -F ssh_config ../../_output/bin/linux/bootkube cluster/auth/kubeconfig cluster/tls/etcd-* core@$HOST:/home/core
3737
ssh -q -F ssh_config core@$HOST "GLOG_v=${GLOG_v} /home/core/bootkube recover \
3838
--recovery-dir=/home/core/recovered \
39-
--etcd-ca-path=/home/core/etcd-ca.crt \
39+
--etcd-ca-path=/home/core/etcd-client-ca.crt \
4040
--etcd-certificate-path=/home/core/etcd-client.crt \
4141
--etcd-private-key-path=/home/core/etcd-client.key \
4242
--etcd-servers=https://172.17.4.51:2379 \

‎hack/multi-node/etcd-cloud-config.yaml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,10 @@ coreos:
2121
Environment="ETCD_LISTEN_PEER_URLS=https://$private_ipv4:2380"
2222
Environment="ETCD_INITIAL_CLUSTER={{ETCD_INITIAL_CLUSTER}}"
2323
Environment="ETCD_SSL_DIR=/etc/etcd/tls"
24-
Environment="ETCD_TRUSTED_CA_FILE=/etc/ssl/certs/etcd-ca.crt"
25-
Environment="ETCD_CERT_FILE=/etc/ssl/certs/etcd-client.crt"
26-
Environment="ETCD_KEY_FILE=/etc/ssl/certs/etcd-client.key"
24+
Environment="ETCD_TRUSTED_CA_FILE=/etc/ssl/certs/etcd/server-ca.crt"
25+
Environment="ETCD_CERT_FILE=/etc/ssl/certs/etcd/server.crt"
26+
Environment="ETCD_KEY_FILE=/etc/ssl/certs/etcd/server.key"
2727
Environment="ETCD_CLIENT_CERT_AUTH=true"
28-
Environment="ETCD_PEER_TRUSTED_CA_FILE=/etc/ssl/certs/etcd-ca.crt"
29-
Environment="ETCD_PEER_CERT_FILE=/etc/ssl/certs/etcd-peer.crt"
30-
Environment="ETCD_PEER_KEY_FILE=/etc/ssl/certs/etcd-peer.key"
28+
Environment="ETCD_PEER_TRUSTED_CA_FILE=/etc/ssl/certs/etcd/peer-ca.crt"
29+
Environment="ETCD_PEER_CERT_FILE=/etc/ssl/certs/etcd/peer.crt"
30+
Environment="ETCD_PEER_KEY_FILE=/etc/ssl/certs/etcd/peer.key"

‎hack/quickstart/init-master.sh‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,9 @@ function usage() {
2020
function configure_etcd() {
2121
[ -f "/etc/systemd/system/etcd-member.service.d/10-etcd-member.conf" ] || {
2222
mkdir -p /etc/etcd/tls
23-
cp /home/${REMOTE_USER}/assets/tls/etcd* /etc/etcd/tls
23+
cp /home/${REMOTE_USER}/assets/tls/etcd-* /etc/etcd/tls
24+
mkdir -p /etc/etcd/tls/etcd
25+
cp /home/${REMOTE_USER}/assets/tls/etcd/* /etc/etcd/tls/etcd
2426
chown -R etcd:etcd /etc/etcd
2527
chmod -R u=rX,g=,o= /etc/etcd
2628
mkdir -p /etc/systemd/system/etcd-member.service.d
@@ -34,13 +36,13 @@ Environment="ETCD_ADVERTISE_CLIENT_URLS=https://${COREOS_PRIVATE_IPV4}:2379"
3436
Environment="ETCD_LISTEN_CLIENT_URLS=https://0.0.0.0:2379"
3537
Environment="ETCD_LISTEN_PEER_URLS=https://0.0.0.0:2380"
3638
Environment="ETCD_SSL_DIR=/etc/etcd/tls"
37-
Environment="ETCD_TRUSTED_CA_FILE=/etc/ssl/certs/etcd-ca.crt"
38-
Environment="ETCD_CERT_FILE=/etc/ssl/certs/etcd-client.crt"
39-
Environment="ETCD_KEY_FILE=/etc/ssl/certs/etcd-client.key"
39+
Environment="ETCD_TRUSTED_CA_FILE=/etc/ssl/certs/etcd/server-ca.crt"
40+
Environment="ETCD_CERT_FILE=/etc/ssl/certs/etcd/server.crt"
41+
Environment="ETCD_KEY_FILE=/etc/ssl/certs/etcd/server.key"
4042
Environment="ETCD_CLIENT_CERT_AUTH=true"
41-
Environment="ETCD_PEER_TRUSTED_CA_FILE=/etc/ssl/certs/etcd-ca.crt"
42-
Environment="ETCD_PEER_CERT_FILE=/etc/ssl/certs/etcd-peer.crt"
43-
Environment="ETCD_PEER_KEY_FILE=/etc/ssl/certs/etcd-peer.key"
43+
Environment="ETCD_PEER_TRUSTED_CA_FILE=/etc/ssl/certs/etcd/peer-ca.crt"
44+
Environment="ETCD_PEER_CERT_FILE=/etc/ssl/certs/etcd/peer.crt"
45+
Environment="ETCD_PEER_KEY_FILE=/etc/ssl/certs/etcd/peer.key"
4446
EOF
4547
}
4648
}

‎hack/single-node/Vagrantfile‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,8 @@ NODE_IP = "172.17.4.100"
1414
USER_DATA_PATH = File.expand_path("cluster/user-data")
1515
KUBECONFIG_PATH = File.expand_path("cluster/auth/kubeconfig")
1616
CA_CERT_PATH = File.expand_path("cluster/tls/ca.crt")
17-
ETCD_CERT_GLOB = File.expand_path("cluster/tls/etcd-*")
17+
ETCD_CLI_CERT_GLOB = File.expand_path("cluster/tls/etcd-*")
18+
ETCD_CERT_GLOB = File.expand_path("cluster/tls/etcd/*")
1819

1920
Vagrant.configure("2") do |config|
2021
# always use Vagrant's insecure key
@@ -64,10 +65,15 @@ Vagrant.configure("2") do |config|
6465
config.vm.provision :shell, :inline => "mv /tmp/ca.crt /etc/kubernetes/ca.crt", :privileged => true
6566

6667
config.vm.provision :shell, :inline => "mkdir -p /etc/etcd/tls", :privileged => true
67-
Dir.glob(ETCD_CERT_GLOB) do |etcd_cert_file|
68+
Dir.glob(ETCD_CLI_CERT_GLOB) do |etcd_cert_file|
6869
config.vm.provision :file, :source => etcd_cert_file, :destination => "/tmp/#{File.basename(etcd_cert_file)}"
6970
config.vm.provision :shell, :inline => "mv /tmp/#{File.basename(etcd_cert_file)} /etc/etcd/tls/", :privileged => true
7071
end
72+
config.vm.provision :shell, :inline => "mkdir -p /etc/etcd/tls/etcd", :privileged => true
73+
Dir.glob(ETCD_CERT_GLOB) do |etcd_cert_file|
74+
config.vm.provision :file, :source => etcd_cert_file, :destination => "/tmp/#{File.basename(etcd_cert_file)}"
75+
config.vm.provision :shell, :inline => "mv /tmp/#{File.basename(etcd_cert_file)} /etc/etcd/tls/etcd/", :privileged => true
76+
end
7177
config.vm.provision :shell, :inline => "chown -R etcd:etcd /etc/etcd", :privileged => true
7278
config.vm.provision :shell, :inline => "chmod -R u=rX,g=,o= /etc/etcd", :privileged => true
7379
end

‎hack/single-node/user-data-etcd.sample‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,11 @@
1212
Environment="ETCD_LISTEN_CLIENT_URLS=https://0.0.0.0:2379"
1313
Environment="ETCD_LISTEN_PEER_URLS=https://0.0.0.0:2380"
1414
Environment="ETCD_SSL_DIR=/etc/etcd/tls"
15-
Environment="ETCD_TRUSTED_CA_FILE=/etc/ssl/certs/etcd-ca.crt"
16-
Environment="ETCD_CERT_FILE=/etc/ssl/certs/etcd-client.crt"
17-
Environment="ETCD_KEY_FILE=/etc/ssl/certs/etcd-client.key"
15+
Environment="ETCD_TRUSTED_CA_FILE=/etc/ssl/certs/etcd/server-ca.crt"
16+
Environment="ETCD_CERT_FILE=/etc/ssl/certs/etcd/server.crt"
17+
Environment="ETCD_KEY_FILE=/etc/ssl/certs/etcd/server.key"
1818
Environment="ETCD_CLIENT_CERT_AUTH=true"
19-
Environment="ETCD_PEER_TRUSTED_CA_FILE=/etc/ssl/certs/etcd-ca.crt"
20-
Environment="ETCD_PEER_CERT_FILE=/etc/ssl/certs/etcd-peer.crt"
21-
Environment="ETCD_PEER_KEY_FILE=/etc/ssl/certs/etcd-peer.key"
19+
Environment="ETCD_PEER_TRUSTED_CA_FILE=/etc/ssl/certs/etcd/peer-ca.crt"
20+
Environment="ETCD_PEER_CERT_FILE=/etc/ssl/certs/etcd/peer.crt"
21+
Environment="ETCD_PEER_KEY_FILE=/etc/ssl/certs/etcd/peer.key"
2222
command: start

‎pkg/asset/asset.go‎

Lines changed: 54 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -15,65 +15,60 @@ import (
1515
)
1616

1717
const (
18-
AssetPathSecrets = "tls"
19-
AssetPathCAKey = "tls/ca.key"
20-
AssetPathCACert = "tls/ca.crt"
21-
AssetPathAPIServerKey = "tls/apiserver.key"
22-
AssetPathAPIServerCert = "tls/apiserver.crt"
23-
AssetPathEtcdCA = "tls/etcd-ca.crt"
24-
AssetPathEtcdClientCert = "tls/etcd-client.crt"
25-
AssetPathEtcdClientKey = "tls/etcd-client.key"
26-
AssetPathEtcdPeerCert = "tls/etcd-peer.crt"
27-
AssetPathEtcdPeerKey = "tls/etcd-peer.key"
28-
AssetPathSelfHostedOperatorEtcdCA = "tls/operator/etcd-client-ca.crt"
29-
AssetPathSelfHostedOperatorEtcdCert = "tls/operator/etcd-client.crt"
30-
AssetPathSelfHostedOperatorEtcdKey = "tls/operator/etcd-client.key"
31-
AssetPathSelfHostedEtcdMemberClientCA = "tls/etcdMember/server-ca.crt"
32-
AssetPathSelfHostedEtcdMemberClientCert = "tls/etcdMember/server.crt"
33-
AssetPathSelfHostedEtcdMemberClientKey = "tls/etcdMember/server.key"
34-
AssetPathSelfHostedEtcdMemberPeerCA = "tls/etcdMember/peer-ca.crt"
35-
AssetPathSelfHostedEtcdMemberPeerCert = "tls/etcdMember/peer.crt"
36-
AssetPathSelfHostedEtcdMemberPeerKey = "tls/etcdMember/peer.key"
37-
AssetPathServiceAccountPrivKey = "tls/service-account.key"
38-
AssetPathServiceAccountPubKey = "tls/service-account.pub"
39-
AssetPathKubeletKey = "tls/kubelet.key"
40-
AssetPathKubeletCert = "tls/kubelet.crt"
41-
AssetPathKubeConfig = "auth/kubeconfig"
42-
AssetPathManifests = "manifests"
43-
AssetPathKubelet = "manifests/kubelet.yaml"
44-
AssetPathProxy = "manifests/kube-proxy.yaml"
45-
AssetPathKubeFlannel = "manifests/kube-flannel.yaml"
46-
AssetPathKubeFlannelCfg = "manifests/kube-flannel-cfg.yaml"
47-
AssetPathKubeCalico = "manifests/kube-calico.yaml"
48-
AssetPathKubeCalicoCfg = "manifests/kube-calico-cfg.yaml"
49-
AssetPathKubeCalcioSA = "manifests/kube-calico-sa.yaml"
50-
AssetPathKubeCalcioRole = "manifests/kube-calico-role.yaml"
51-
AssetPathKubeCalcioRoleBinding = "manifests/kube-calico-role-binding.yaml"
52-
AssetPathAPIServerSecret = "manifests/kube-apiserver-secret.yaml"
53-
AssetPathAPIServer = "manifests/kube-apiserver.yaml"
54-
AssetPathControllerManager = "manifests/kube-controller-manager.yaml"
55-
AssetPathControllerManagerSecret = "manifests/kube-controller-manager-secret.yaml"
56-
AssetPathControllerManagerDisruption = "manifests/kube-controller-manager-disruption.yaml"
57-
AssetPathScheduler = "manifests/kube-scheduler.yaml"
58-
AssetPathSchedulerDisruption = "manifests/kube-scheduler-disruption.yaml"
59-
AssetPathKubeDNSDeployment = "manifests/kube-dns-deployment.yaml"
60-
AssetPathKubeDNSSvc = "manifests/kube-dns-svc.yaml"
61-
AssetPathSystemNamespace = "manifests/kube-system-ns.yaml"
62-
AssetPathCheckpointer = "manifests/pod-checkpointer.yaml"
63-
AssetPathEtcdOperator = "manifests/etcd-operator.yaml"
64-
AssetPathSelfHostedEtcdOperatorSecret = "manifests/etcd-operator-client-tls.yaml"
65-
AssetPathSelfHostedEtcdMemberPeerSecret = "manifests/etcd-member-peer-tls.yaml"
66-
AssetPathSelfHostedEtcdMemberCliSecret = "manifests/etcd-member-client-tls.yaml"
67-
AssetPathEtcdSvc = "manifests/etcd-service.yaml"
68-
AssetPathKenc = "manifests/kube-etcd-network-checkpointer.yaml"
69-
AssetPathKubeSystemSARoleBinding = "manifests/kube-system-rbac-role-binding.yaml"
70-
AssetPathBootstrapManifests = "bootstrap-manifests"
71-
AssetPathBootstrapAPIServer = "bootstrap-manifests/bootstrap-apiserver.yaml"
72-
AssetPathBootstrapControllerManager = "bootstrap-manifests/bootstrap-controller-manager.yaml"
73-
AssetPathBootstrapScheduler = "bootstrap-manifests/bootstrap-scheduler.yaml"
74-
AssetPathBootstrapEtcd = "bootstrap-manifests/bootstrap-etcd.yaml"
75-
AssetPathBootstrapEtcdService = "etcd/bootstrap-etcd-service.json"
76-
AssetPathMigrateEtcdCluster = "etcd/migrate-etcd-cluster.json"
18+
AssetPathSecrets = "tls"
19+
AssetPathCAKey = "tls/ca.key"
20+
AssetPathCACert = "tls/ca.crt"
21+
AssetPathAPIServerKey = "tls/apiserver.key"
22+
AssetPathAPIServerCert = "tls/apiserver.crt"
23+
AssetPathEtcdClientCA = "tls/etcd-client-ca.crt"
24+
AssetPathEtcdClientCert = "tls/etcd-client.crt"
25+
AssetPathEtcdClientKey = "tls/etcd-client.key"
26+
AssetPathEtcdServerCA = "tls/etcd/server-ca.crt"
27+
AssetPathEtcdServerCert = "tls/etcd/server.crt"
28+
AssetPathEtcdServerKey = "tls/etcd/server.key"
29+
AssetPathEtcdPeerCA = "tls/etcd/peer-ca.crt"
30+
AssetPathEtcdPeerCert = "tls/etcd/peer.crt"
31+
AssetPathEtcdPeerKey = "tls/etcd/peer.key"
32+
AssetPathServiceAccountPrivKey = "tls/service-account.key"
33+
AssetPathServiceAccountPubKey = "tls/service-account.pub"
34+
AssetPathKubeletKey = "tls/kubelet.key"
35+
AssetPathKubeletCert = "tls/kubelet.crt"
36+
AssetPathKubeConfig = "auth/kubeconfig"
37+
AssetPathManifests = "manifests"
38+
AssetPathKubelet = "manifests/kubelet.yaml"
39+
AssetPathProxy = "manifests/kube-proxy.yaml"
40+
AssetPathKubeFlannel = "manifests/kube-flannel.yaml"
41+
AssetPathKubeFlannelCfg = "manifests/kube-flannel-cfg.yaml"
42+
AssetPathKubeCalico = "manifests/kube-calico.yaml"
43+
AssetPathKubeCalicoCfg = "manifests/kube-calico-cfg.yaml"
44+
AssetPathKubeCalcioSA = "manifests/kube-calico-sa.yaml"
45+
AssetPathKubeCalcioRole = "manifests/kube-calico-role.yaml"
46+
AssetPathKubeCalcioRoleBinding = "manifests/kube-calico-role-binding.yaml"
47+
AssetPathAPIServerSecret = "manifests/kube-apiserver-secret.yaml"
48+
AssetPathAPIServer = "manifests/kube-apiserver.yaml"
49+
AssetPathControllerManager = "manifests/kube-controller-manager.yaml"
50+
AssetPathControllerManagerSecret = "manifests/kube-controller-manager-secret.yaml"
51+
AssetPathControllerManagerDisruption = "manifests/kube-controller-manager-disruption.yaml"
52+
AssetPathScheduler = "manifests/kube-scheduler.yaml"
53+
AssetPathSchedulerDisruption = "manifests/kube-scheduler-disruption.yaml"
54+
AssetPathKubeDNSDeployment = "manifests/kube-dns-deployment.yaml"
55+
AssetPathKubeDNSSvc = "manifests/kube-dns-svc.yaml"
56+
AssetPathSystemNamespace = "manifests/kube-system-ns.yaml"
57+
AssetPathCheckpointer = "manifests/pod-checkpointer.yaml"
58+
AssetPathEtcdOperator = "manifests/etcd-operator.yaml"
59+
AssetPathEtcdSvc = "manifests/etcd-service.yaml"
60+
AssetPathEtcdClientSecret = "manifests/etcd-client-tls.yaml"
61+
AssetPathEtcdPeerSecret = "manifests/etcd-peer-tls.yaml"
62+
AssetPathEtcdServerSecret = "manifests/etcd-server-tls.yaml"
63+
AssetPathKenc = "manifests/kube-etcd-network-checkpointer.yaml"
64+
AssetPathKubeSystemSARoleBinding = "manifests/kube-system-rbac-role-binding.yaml"
65+
AssetPathBootstrapManifests = "bootstrap-manifests"
66+
AssetPathBootstrapAPIServer = "bootstrap-manifests/bootstrap-apiserver.yaml"
67+
AssetPathBootstrapControllerManager = "bootstrap-manifests/bootstrap-controller-manager.yaml"
68+
AssetPathBootstrapScheduler = "bootstrap-manifests/bootstrap-scheduler.yaml"
69+
AssetPathBootstrapEtcd = "bootstrap-manifests/bootstrap-etcd.yaml"
70+
AssetPathBootstrapEtcdService = "etcd/bootstrap-etcd-service.json"
71+
AssetPathMigrateEtcdCluster = "etcd/migrate-etcd-cluster.json"
7772
)
7873

7974
var (

‎pkg/asset/internal/templates.go‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -170,7 +170,7 @@ spec:
170170
- --client-ca-file=/etc/kubernetes/secrets/ca.crt
171171
- --cloud-provider={{ .CloudProvider }}
172172
{{- if .EtcdUseTLS }}
173-
- --etcd-cafile=/etc/kubernetes/secrets/etcd-ca.crt
173+
- --etcd-cafile=/etc/kubernetes/secrets/etcd-client-ca.crt
174174
- --etcd-certfile=/etc/kubernetes/secrets/etcd-client.crt
175175
- --etcd-keyfile=/etc/kubernetes/secrets/etcd-client.key
176176
{{- end }}
@@ -246,7 +246,7 @@ spec:
246246
- --bind-address=0.0.0.0
247247
- --client-ca-file=/etc/kubernetes/secrets/ca.crt
248248
{{- if .EtcdUseTLS }}
249-
- --etcd-cafile=/etc/kubernetes/secrets/etcd-ca.crt
249+
- --etcd-cafile=/etc/kubernetes/secrets/etcd-client-ca.crt
250250
- --etcd-certfile=/etc/kubernetes/secrets/etcd-client.crt
251251
- --etcd-keyfile=/etc/kubernetes/secrets/etcd-client.key
252252
{{- end }}
@@ -964,13 +964,13 @@ spec:
964964
- --initial-cluster-state=new
965965
- --data-dir=/var/etcd/data
966966
- --peer-client-cert-auth=true
967-
- --peer-trusted-ca-file=/etc/kubernetes/secrets/etcdMember/peer-ca.crt
968-
- --peer-cert-file=/etc/kubernetes/secrets/etcdMember/peer.crt
969-
- --peer-key-file=/etc/kubernetes/secrets/etcdMember/peer.key
967+
- --peer-trusted-ca-file=/etc/kubernetes/secrets/etcd/peer-ca.crt
968+
- --peer-cert-file=/etc/kubernetes/secrets/etcd/peer.crt
969+
- --peer-key-file=/etc/kubernetes/secrets/etcd/peer.key
970970
- --client-cert-auth=true
971-
- --trusted-ca-file=/etc/kubernetes/secrets/etcdMember/server-ca.crt
972-
- --cert-file=/etc/kubernetes/secrets/etcdMember/server.crt
973-
- --key-file=/etc/kubernetes/secrets/etcdMember/server.key
971+
- --trusted-ca-file=/etc/kubernetes/secrets/etcd/server-ca.crt
972+
- --cert-file=/etc/kubernetes/secrets/etcd/server.crt
973+
- --key-file=/etc/kubernetes/secrets/etcd/server.key
974974
volumeMounts:
975975
- mountPath: /etc/kubernetes/secrets
976976
name: secrets
@@ -1039,10 +1039,10 @@ var EtcdTPRTemplate = []byte(`{
10391039
"TLS": {
10401040
"static": {
10411041
"member": {
1042-
"peerSecret": "etcd-member-peer-tls",
1043-
"serverSecret": "etcd-member-client-tls"
1042+
"peerSecret": "etcd-peer-tls",
1043+
"serverSecret": "etcd-server-tls"
10441044
},
1045-
"operatorSecret": "etcd-operator-client-tls"
1045+
"operatorSecret": "etcd-client-tls"
10461046
}
10471047
}
10481048
}

0 commit comments

Comments
 (0)