config: support AllowedCN and AllowedHostname through config file

[clwluvw]

Allow setting AllowedCN and AllowedHostname tls fields through the config file for peer transport security.

Closes: #17867

[k8s-ci-robot]

Hi @clwluvw. Thanks for your PR.

I'm waiting for a etcd-io member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[ahrtr]

Note there are already two flags,

• --peer-cert-allowed-hostname
• --host-whitelist

Please raise an issue to clarify your use case(s) if you still think it's necessary.

[clwluvw]

through config file

Caution: If you mix-and-match configuration options, then the following rules apply.
Command-line flags take precedence over environment variables.
If you provide a configuration file all command-line flags and environment variables are ignored.

[ahrtr]

through config file

Sorry, I missed that.

[serathius]

/retest

[clwluvw]

The failure on apt update might be related to the current inc 🤔 https://www.githubstatus.com/incidents/7txcg0j03kkg

[ivanvc]

/retest

[ivanvc]

/ok-to-test

[jmhbnz]

LGTM - Thanks @clwluvw

Note: If you have time please add a commented out example to the sample config file showing how these fields can be supplied: https://github.com/etcd-io/etcd/blob/main/etcd.conf.yml.sample

[clwluvw]

Note: If you have time please add a commented out example to the sample config file showing how these fields can be supplied: https://github.com/etcd-io/etcd/blob/main/etcd.conf.yml.sample

Done.

[ahrtr]

LGTM

Thanks for your first contribution.

[jmhbnz]

@ahrtr, @serathius - I am considering marking this pr as a backport to release-3.5 for inclusion in upcoming v3.5.14 as I see this more as a fix to existing functionality than a new feature. Do you have any objections to this?

[ahrtr]

@ahrtr, @serathius - I am considering marking this pr as a backport to release-3.5 for inclusion in upcoming v3.5.14 as I see this more as a fix to existing functionality than a new feature. Do you have any objections to this?

No objection & thx.

[jmhbnz]

Discussed at sig-etcd triage meeting. @ArkaSaha30 to backport to release-3.5.