From fa8a128e4905956624bec9e4d78f45a8a74c81ea Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=C3=A9bastien=20Han?= Date: Thu, 11 Jan 2018 19:07:43 +0100 Subject: [PATCH] etcd: ability to enable/disable ETCD_PEER_CLIENT_CERT_AUTH MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Some installation are failing to authenticate with peers due to etcd picking up/resoling the wrong node. By setting 'etcd_peer_client_auth' to "False" you can disable peer client cert authentication. Signed-off-by: Sébastien Han --- inventory/group_vars/all.yml | 4 ++++ roles/etcd/defaults/main.yml | 3 +++ roles/etcd/templates/etcd.env.j2 | 2 +- 3 files changed, 8 insertions(+), 1 deletion(-) diff --git a/inventory/group_vars/all.yml b/inventory/group_vars/all.yml index 6d644ceef..840c8796f 100644 --- a/inventory/group_vars/all.yml +++ b/inventory/group_vars/all.yml @@ -20,6 +20,10 @@ bin_dir: /usr/local/bin ## This may be the case if clients support and loadbalance multiple etcd servers natively. #etcd_multiaccess: true +### ETCD: disable peer client cert authentication. +# This affects ETCD_PEER_CLIENT_CERT_AUTH variable +#etcd_peer_client_auth: true + ## External LB example config ## apiserver_loadbalancer_domain_name: "elb.some.domain" #loadbalancer_apiserver: diff --git a/roles/etcd/defaults/main.yml b/roles/etcd/defaults/main.yml index 3029409af..f394e41aa 100644 --- a/roles/etcd/defaults/main.yml +++ b/roles/etcd/defaults/main.yml @@ -40,3 +40,6 @@ etcd_vault_mount_path: etcd # Force clients like etcdctl to use TLS certs (different than peer security) etcd_secure_client: true + +# Enable peer client cert authentication +etcd_peer_client_auth: true diff --git a/roles/etcd/templates/etcd.env.j2 b/roles/etcd/templates/etcd.env.j2 index 5f14d05b6..6a917d127 100644 --- a/roles/etcd/templates/etcd.env.j2 +++ b/roles/etcd/templates/etcd.env.j2 @@ -23,4 +23,4 @@ ETCD_CLIENT_CERT_AUTH={{ etcd_secure_client | lower}} ETCD_PEER_TRUSTED_CA_FILE={{ etcd_cert_dir }}/ca.pem ETCD_PEER_CERT_FILE={{ etcd_cert_dir }}/member-{{ inventory_hostname }}.pem ETCD_PEER_KEY_FILE={{ etcd_cert_dir }}/member-{{ inventory_hostname }}-key.pem -ETCD_PEER_CLIENT_CERT_AUTH=true +ETCD_PEER_CLIENT_CERT_AUTH={{ etcd_peer_client_auth }}