Allow to use own certificate for metrics endpoint #10504
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -77,6 +77,13 @@ var ( | |
| grpcProxyListenAutoTLS bool | ||
| grpcProxyListenCRL string | ||
|
|
||
| // tls for clients connecting to proxy for metrics | ||
|
|
||
| grpcProxyMetricsListenCA string | ||
| grpcProxyMetricsListenCert string | ||
| grpcProxyMetricsListenKey string | ||
| grpcProxyMetricsListenCRL string | ||
|
|
||
| grpcProxyAdvertiseClientURL string | ||
| grpcProxyResolverPrefix string | ||
| grpcProxyResolverTTL int | ||
|
|
@@ -150,6 +157,11 @@ func newGRPCProxyStartCommand() *cobra.Command { | |
| cmd.Flags().BoolVar(&grpcProxyListenAutoTLS, "auto-tls", false, "proxy TLS using generated certificates") | ||
| cmd.Flags().StringVar(&grpcProxyListenCRL, "client-crl-file", "", "proxy client certificate revocation list file.") | ||
|
|
||
| cmd.Flags().StringVar(&grpcProxyMetricsListenCert, "metrics-cert-file", "", "identify secure connections to the /metrics endpoint using this TLS certificate file") | ||
| cmd.Flags().StringVar(&grpcProxyMetricsListenKey, "metrics-key-file", "", "identify secure connections to the /metrics endpoint using this TLS key file") | ||
| cmd.Flags().StringVar(&grpcProxyMetricsListenCA, "metrics-trusted-ca-file", "", "verify certificates of TLS-enabled secure /metrics endpoint using this CA bundle") | ||
| cmd.Flags().StringVar(&grpcProxyMetricsListenCRL, "metrics-client-crl-file", "", "/metrics endpoint client certificate revocation list file.") | ||
|
|
||
| // experimental flags | ||
| cmd.Flags().BoolVar(&grpcProxyEnableOrdering, "experimental-serializable-ordering", false, "Ensure serializable reads have monotonically increasing store revisions across endpoints.") | ||
| cmd.Flags().StringVar(&grpcProxyLeasing, "experimental-leasing-prefix", "", "leasing metadata prefix for disconnected linearized reads.") | ||
|
|
@@ -211,6 +223,12 @@ func startGRPCProxy(cmd *cobra.Command, args []string) { | |
| go func() { errc <- srvhttp.Serve(httpl) }() | ||
| go func() { errc <- m.Serve() }() | ||
| if len(grpcProxyMetricsListenAddr) > 0 { | ||
| if grpcProxyMetricsListenCert != "" && grpcProxyMetricsListenKey != "" { | ||
| tlsinfo = newTLS(grpcProxyMetricsListenCA, grpcProxyMetricsListenCert, grpcProxyMetricsListenKey) | ||
|
There was a problem hiding this comment. pr #12114 adds health handler for grpcproxy self, if grpcProxyMetricsListenAddr uses own certificate for metrics endpoint, we should also update healthcheck client certs, otherwise, it is failed to access '/proxy/health' handle. There was a problem hiding this comment. @ironcladlou said There was a problem hiding this comment.
I already mentioned this before. Therefore, when using separate certificates for metrics, a warning is displayed.
Do you want the server to serve some endpoints without certificates? Theoretically, this is possible, but will require rewriting the server. To do this, you will need to make authorization optional and do it not at the TLS level. This is out of scope of this proposal. There was a problem hiding this comment. ok. thanks. I will try to add --health-client-cert-auth flag in another PR. thanks. There was a problem hiding this comment. @tangcong Can this PR be merged? There was a problem hiding this comment. lgtm. can you add changelog and doc in another pr? thanks. @hexfusion can you take a final look? thanks. There was a problem hiding this comment. @tangcong sorry for delay yes I will take a look. |
||
| if tlsinfo != nil { | ||
| tlsinfo.CRLFile = grpcProxyMetricsListenCRL | ||
| } | ||
| } | ||
| mhttpl := mustMetricsListener(lg, tlsinfo) | ||
| go func() { | ||
| mux := http.NewServeMux() | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,22 +1,22 @@ | ||
| -----BEGIN CERTIFICATE----- | ||
| MIIDrjCCApagAwIBAgIUBI65ni82ZhKAq9U5g/7l+wKRhJ4wDQYJKoZIhvcNAQEL | ||
| BQAwbzEMMAoGA1UEBhMDVVNBMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQH | ||
| Ew1TYW4gRnJhbmNpc2NvMQ0wCwYDVQQKEwRldGNkMRYwFAYDVQQLEw1ldGNkIFNl | ||
| Y3VyaXR5MQswCQYDVQQDEwJjYTAeFw0yMDA3MTMxNTM0MDBaFw0zMDA3MTExNTM0 | ||
| MDBaMG8xDDAKBgNVBAYTA1VTQTETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UE | ||
| BxMNU2FuIEZyYW5jaXNjbzENMAsGA1UEChMEZXRjZDEWMBQGA1UECxMNZXRjZCBT | ||
| ZWN1cml0eTELMAkGA1UEAxMCY2EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK | ||
| AoIBAQCm7MIc+Ji2KZKkm4yCxg211uWBxLXt3Pqcz7LpPh4Nl9Pujr+hhSbVmm/8 | ||
| E2wl09MHQtWgxDFqrkStNI8iGAMdqodovZW5ltW+qHIcKhp8Uivoo6uJRfcC6AR8 | ||
| UjFWPQV0HyT6aCwzHrGN9zIS6xwxfC4nRIGSvVezWzfVq6llJVAZ2O5h23gRztxy | ||
| eV7AtaA6HktUwiIfiyVrW8CZS6fWTWQYZLSZ5/BgJ2zt5VX0LK52bbKY9MbAr6Q2 | ||
| OlMXvkhOwOIbtt1PJDbjhnNVMbUbiqsAQRQsGseP1CziW9CaYzhKZFIftg9fUFvf | ||
| 7KlEMxRagr9aCXP5fkypMfm2L+q5AgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAP | ||
| BgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBQfqp72LQd3jK+cJOHwIUW6+Nps7TAN | ||
| BgkqhkiG9w0BAQsFAAOCAQEAey4m3OtUzdH8MHlprpcSNCdDdKKOlJyYYjYDebKQ | ||
| WzIr+7N11LwRzpLztgWAw+3ayoHwbfOlQv0KUagO5yQSByMiCwiy0CeJWow0qxri | ||
| 5lLRt8Ln3E9YsOcyccRpyWMfLURt17wSnikHxUVQ0l7uDLhq5E3YPAhivjPIwBGj | ||
| pca1lO+gQZWHeiLu3npHdSAFHqNuD6v/dbcFf7ypxUUt/1IQqr+/cKeMGX0ak6RH | ||
| X7Zd8xJ89j8heYc4mlmdWH/RSYuGEUl1FSmJV9O1OIz0z07PlGWFuQd44HKrbnYG | ||
| CdtSQGWF7jwf0+U5Eix1X+m05/2gj8rXAFlk9tTu+fBK3g== | ||
| -----END CERTIFICATE----- |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| { | ||
| "key": { | ||
| "algo": "rsa", | ||
| "size": 2048 | ||
| }, | ||
| "names": [ | ||
| { | ||
| "O": "etcd", | ||
| "OU": "etcd Monitoring", | ||
| "L": "San Francisco", | ||
| "ST": "California", | ||
| "C": "USA" | ||
| } | ||
| ], | ||
| "CN": "ca", | ||
| "hosts": [ | ||
| "127.0.0.1", | ||
| "localhost" | ||
| ] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,20 +1,20 @@ | ||
| -----BEGIN CERTIFICATE----- | ||
| MIIDRzCCAi+gAwIBAgIUG6bU78IkoRkkdGL00WW1JtC3OQEwDQYJKoZIhvcNAQEL | ||
| BQAwbzEMMAoGA1UEBhMDVVNBMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQH | ||
| Ew1TYW4gRnJhbmNpc2NvMQ0wCwYDVQQKEwRldGNkMRYwFAYDVQQLEw1ldGNkIFNl | ||
| Y3VyaXR5MQswCQYDVQQDEwJjYTAeFw0yMDA3MTMxNTM0MDBaFw0zMDA3MTExNTM0 | ||
| MDBaMHgxDDAKBgNVBAYTA1VTQTETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UE | ||
| BxMNU2FuIEZyYW5jaXNjbzENMAsGA1UEChMEZXRjZDEWMBQGA1UECxMNZXRjZCBT | ||
| ZWN1cml0eTEUMBIGA1UEAxMLZXhhbXBsZS5jb20wWTATBgcqhkjOPQIBBggqhkjO | ||
| PQMBBwNCAARhtj79iJdLGf6RHvKnd8GM3lmWjucG2frYduUf19aMWKoZ/huoYnlB | ||
| ztZI8SQrTJ3rQ5Lq/PeIT/IwtUsgITAXo4GcMIGZMA4GA1UdDwEB/wQEAwIFoDAd | ||
| BgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNV | ||
| HQ4EFgQUNBFaOeg3mNnzj9D7BcKBvpqjGo4wHwYDVR0jBBgwFoAUH6qe9i0Hd4yv | ||
| nCTh8CFFuvjabO0wGgYDVR0RBBMwEYIJbG9jYWxob3N0hwR/AAABMA0GCSqGSIb3 | ||
| DQEBCwUAA4IBAQCmYOxZCuRnbROlT2rVYFe89cBk73tf6zrft8YMx1Mc2upRzMG3 | ||
| rLEZf52J40qsUJ++Vnt/62pMetlcdjhqNb3RyKlbQJ//RXRf3+zLmdqQq/E9N4LE | ||
| m3MeRUQivkESdBBujVXXZfrSSrtN1i8TvkndrueELE8sWpI+8mWfW9tyGexE624x | ||
| dvrnJZRGZzTxM3CoioAoHnF1b/QP3EhwjRtF7RJOY4Rt8OKhHaTQW0J5DNWRISNz | ||
| hd0oDPj9kcrpXrYJhqcqQSnSXsFzo+nTs3Hfm5xSZYLnO+Ma9bw9XwR4+dK08acd | ||
| gIQ/F8/Svn70fAIuuS61IGEleADKQnpq8CVl | ||
| -----END CERTIFICATE----- |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,5 @@ | ||
| -----BEGIN EC PRIVATE KEY----- | ||
| MHcCAQEEIE8QEd6fkx4u6/P4ytaMlLJ9EFbQXAxl9TQy8Dc4U+8yoAoGCCqGSM49 | ||
| AwEHoUQDQgAEYbY+/YiXSxn+kR7yp3fBjN5Zlo7nBtn62HblH9fWjFiqGf4bqGJ5 | ||
| Qc7WSPEkK0yd60OS6vz3iE/yMLVLICEwFw== | ||
| -----END EC PRIVATE KEY----- |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,24 +1,24 @@ | ||
| -----BEGIN CERTIFICATE----- | ||
| MIIEBzCCAu+gAwIBAgIUTjMlToCeTFkQ7iUbBLtHo6uU64gwDQYJKoZIhvcNAQEL | ||
| BQAwbzEMMAoGA1UEBhMDVVNBMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQH | ||
| Ew1TYW4gRnJhbmNpc2NvMQ0wCwYDVQQKEwRldGNkMRYwFAYDVQQLEw1ldGNkIFNl | ||
| Y3VyaXR5MQswCQYDVQQDEwJjYTAeFw0yMDA3MTMxNTM0MDBaFw0zMDA3MTExNTM0 | ||
| MDBaMHgxDDAKBgNVBAYTA1VTQTETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UE | ||
| BxMNU2FuIEZyYW5jaXNjbzENMAsGA1UEChMEZXRjZDEWMBQGA1UECxMNZXRjZCBT | ||
| ZWN1cml0eTEUMBIGA1UEAxMLZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUA | ||
| A4IBDwAwggEKAoIBAQCzjkEXKLgJERWJzUxpcDxIHiz/lUolLWoMKH58wKMc6Uw8 | ||
| WlhI71HY22GuKcPpZeowyz3bScNENZwDJ1T1BSk6TEmRTYiepun2C/pU9Svn9f39 | ||
| R3RQYKQRm83Wzz/IhjMW1mda6hB5VngcWZAyyrDTreTOFOxlUvCPSZKShc5jWISM | ||
| 082eP5woVDETszXKWMPhqsw4kNle293hAP3R3H1MpdyMJ/WofKIcQs+tDap0w/bH | ||
| v51u9vEunqf41A1q/BgZHfPmPYIR3VKQuR7Vzy2ANuALUM00z8VlgCsUFHNWDf7x | ||
| xKOV7sMhr9iobcPvaklvbQZgTZ5oKmGgFTTsQkaJAgMBAAGjgZEwgY4wDgYDVR0P | ||
| AQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMB | ||
| Af8EAjAAMB0GA1UdDgQWBBQd2pf4a58u3WQmvQo890STZY+kXzAfBgNVHSMEGDAW | ||
| gBQfqp72LQd3jK+cJOHwIUW6+Nps7TAPBgNVHREECDAGhwR/AAABMA0GCSqGSIb3 | ||
| DQEBCwUAA4IBAQBOUznmyAgmURyDP/NF4XG+xLku9+pdqwxOIIZJdkyGL12IiurS | ||
| jeQ6fr3zldoYYmfxvnbYVOFz0KKmK58zj+gT+kRXJKoWoCp5NMzgP9g3GV2+KDaL | ||
| KvDNr9gHaF7R7RLsx6w28b7SgTa4Io49z3LcC4a4NCsjKghVeGIlrgr7htqkOO03 | ||
| UlbnIsHkKYHqMR4Xo0plgMLP/IuK+b9S2K7/wqbrg1i1s227tt+Yc+osiAZfZPyg | ||
| p7i98/+U4itp2iQUb2rYU1cWyTTQywR2OpVFvqW64uxUq0ejar8yxIMKgjEEGDRt | ||
| pSh9TkXFTaMVHAA+pnQiZHkrVQBWKGIPJZXi | ||
| -----END CERTIFICATE----- |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,27 +1,27 @@ | ||
| -----BEGIN RSA PRIVATE KEY----- | ||
| MIIEowIBAAKCAQEAs45BFyi4CREVic1MaXA8SB4s/5VKJS1qDCh+fMCjHOlMPFpY | ||
| SO9R2NthrinD6WXqMMs920nDRDWcAydU9QUpOkxJkU2Inqbp9gv6VPUr5/X9/Ud0 | ||
| UGCkEZvN1s8/yIYzFtZnWuoQeVZ4HFmQMsqw063kzhTsZVLwj0mSkoXOY1iEjNPN | ||
| nj+cKFQxE7M1yljD4arMOJDZXtvd4QD90dx9TKXcjCf1qHyiHELPrQ2qdMP2x7+d | ||
| bvbxLp6n+NQNavwYGR3z5j2CEd1SkLke1c8tgDbgC1DNNM/FZYArFBRzVg3+8cSj | ||
| le7DIa/YqG3D72pJb20GYE2eaCphoBU07EJGiQIDAQABAoIBAGAo/R8EBZuFdL16 | ||
| H0QQgZg14O936l+CtNqSDTuOh0yCfPuNft6AnJrA0s1NPMiQdh1vm08Hb/XlqAng | ||
| VJVsECpSlMumdFZTGdVVkNlS/BKcIUw1qksplnR/tnsmPwiLJm1CodOEqxHwhx7X | ||
| sGwjNRQIexMLDZcuFfsG8eJamq+E4Jp+UYTx4xk10szAm2MVK7YW1xBslh2lkPId | ||
| UoMMRKGn4riFJ8VddFvx+mwupuOhCnV1stAo2fdhXCzW74QA0x5GhiYsS1NpYD/u | ||
| d5OIoL1hpUv98XOSqaKM5No9v3TQYTJ4TIzb7lFUOTKf6V6lUbBBAtNw3NW65QPN | ||
| cmlM5QECgYEA3o6OfRABQtIGIarWGXsv7/X1L0M1Yujc9nLgI+WylXacWMYU4P2I | ||
| FHoRgbl0PzRk4/XNMO9DxJSbWTbwLpWQKfiE9LhDWkcAU3vmm5koSDlHZ9JVNUmg | ||
| hU8A6tCVQ/eo9zhoQs/vJtHnlUCFGcxvsBl+zZzoTdIbSORfCFNwRrECgYEAzomA | ||
| /jLe0ErCYfUV057viTjuzZ0l2VH7HxlqWq+ICuQU1QKDK7KxQxg76Dcw49xYBumx | ||
| 089lJMBxIJX1WA0DUDyBrrkkDhdMPrBZ9pi+JX4AU/1EJGqmusbBt5GB8b7+6n+n | ||
| zb/4YY7EpEbcC9dWJisu9EVFxixqqIix6bxno1kCgYA+W91K54Ai8+wp5M9GpoCh | ||
| EN6ZVpCP3UWEfF2XUVX/kRNvwFi7Te6iJi3fllIfH5QhV48d5fysCSOaFM2pj9is | ||
| GelPFI4yrnBF9BKCiKCD1CDQ01tyqeWjVKaiJL2eJLegRZrZFaAh1XC5HjHtL54f | ||
| zpT8Ebn5jCR/ARYrpA1ykQKBgHYMHZAs3zFKKYP3ovwLcXmK8uLOmR13QALscd9X | ||
| SHiBGG8POo21Wp+wsDzvnp/+BsoctCkN9w9kdsRbMZmcBnLLwottAnCTXF7QSPsr | ||
| HjMrq2BV96ag1p8Wjw4uuojD08uQHwb4XCzWfwot/gM+ltzF/dZb6Z91L5kYWCfy | ||
| KYIxAoGBAM4kZQGFMBzK4ceA1lyM3n4XEWs2Hiexpf+TObQ1m3xvCe72SwHg/Ehe | ||
| ilk2F666t0E2we+JjX91asLSv8XUJ4YE4zc397tjqZn+LQy11fzezSv9BBgFqQsU | ||
| E0wFBZeOLbl6dhStF88egpy8YpYnlcK8vLfZGni/XjBmQBVNDZXD | ||
| -----END RSA PRIVATE KEY----- |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,24 +1,24 @@ | ||
| -----BEGIN CERTIFICATE----- | ||
| MIIEEzCCAvugAwIBAgIUCCE37G6OMKVizSg9PRTMtsaqLKswDQYJKoZIhvcNAQEL | ||
| BQAwbzEMMAoGA1UEBhMDVVNBMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQH | ||
| Ew1TYW4gRnJhbmNpc2NvMQ0wCwYDVQQKEwRldGNkMRYwFAYDVQQLEw1ldGNkIFNl | ||
| Y3VyaXR5MQswCQYDVQQDEwJjYTAeFw0yMDA3MTMxNTM0MDBaFw0zMDA3MTExNTM0 | ||
| MDBaMHgxDDAKBgNVBAYTA1VTQTETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UE | ||
| BxMNU2FuIEZyYW5jaXNjbzENMAsGA1UEChMEZXRjZDEWMBQGA1UECxMNZXRjZCBT | ||
| ZWN1cml0eTEUMBIGA1UEAxMLZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUA | ||
| A4IBDwAwggEKAoIBAQDAgWO6K49pQI/DENL2n+da03IjgfZM81ySsngisT58BOjB | ||
| doit2zNiEn80d8X7HSMIY2sluRSSX3SLw9hS9cNHU937kJFKfUiquBnUDXaUTah8 | ||
| I+gUC0QvSqcvE49z4bWhTkunR9vFhZLPtDmsykngpztlDDvuLplpAGZcmgozil/E | ||
| dZav96jivLOPzed+FOJuob4YtM/RsOHoiWFDcPvh+ClVFolHaZ/6AbBpRTBo8x/u | ||
| J9+ebIhwPzTjf/GdLaPHPBkxRRws9I0/0SDFqg3oxXGRA+SqeUFgvhZ0KP9s1sD0 | ||
| UW0F0IIw2xZ3FpDOaJwT1NlsFWV2XdUpYntMrjbZAgMBAAGjgZ0wgZowDgYDVR0P | ||
| AQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMB | ||
| Af8EAjAAMB0GA1UdDgQWBBRGqti3FTnDa3fXUE0wyBSl04Eu+TAfBgNVHSMEGDAW | ||
| gBQfqp72LQd3jK+cJOHwIUW6+Nps7TAbBgNVHREEFDAShxAAAAAAAAAAAAAAAAAA | ||
| AAABMA0GCSqGSIb3DQEBCwUAA4IBAQCRz/OX3ZsYwv1npsnxo77kwGGl6O+Vy8rL | ||
| XANfJTXU7OOKTzBV0fpEgAQyIukqfZ4Cfp72/8nWbwipckPjwhUEoU/LRZhmOuY7 | ||
| vUB52ZHtD+THM5YJO090gpcU1tAzDwATR50Q0upMvcthxJM7tNVRXYsPmNnF/s3N | ||
| sLj5lsdzdWXLwqYxy+N5zcx5NYXpGznPDDm2aRrpxxll6ubMPoqH1c4an0OIuO6C | ||
| l7kfAs7RjnOnZxdLlyCImuTNa/CKz7d4m8M51WNZhkTqrCa0nlGMlxqQf94rpGN5 | ||
| wkcJj4hRVxHHFkspWy6cM12xBCi6gMS5uctHhTTrJOhYYFNnLIqC | ||
| -----END CERTIFICATE----- |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If we override tlsInfo, should we add a warning to log?
When MetricsTLSInfo is provided, client who has access to other APIs will not be able to access '/metrics' and '/health'?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes. Theoretically, we can make both work (add them to
tls.Config.RootCAsand totls.Config.ClientCAs), but it will be much more difficult solution because it requires to extendtransport.TLSInfo.This is not a hidden behavior (the admin must pass the options explicitly). I am not sure what message do I need to write to log ?
You specified other certificates for metrics. Access by client certificates will not be possible?There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I was thinking about the scenario where etcd clients with clientTLS (not metricsTLS) might try to access the metrics and health endpoint. Adding something like 'ignoring client certificates since metrics certificates given' would help them understand why the connection is rejected. I am not an expert in this area, please feel free to let me know if you think this is reasonable.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@jingyih That's reasonable. I added the message.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
For better or worse, warning messages are often noted by administrators and automated systems which analyze log output for anomalies. The proposed metrics TLS configuration when used in conjunction with client TLS configuration is a valid state. So in that regard it's not clear to me a preemptive warning makes sense. It seems possible that when using both TLS configurations (again, a valid state), this warning might be interpreted as a false negative alert of some kind.
So, I would suggest we consider changing this to INFO level or omitting it entirely.