From c915fc2b5278847dbb882bcddae2a7cb446990ca Mon Sep 17 00:00:00 2001 From: Dalton Hubble Date: Mon, 26 Jun 2017 14:36:43 -0700 Subject: [PATCH] examples: Use etcd client certs in locksmithd dropin * Fixes a regression introduced in 6f02107 which upgraded to Kubernetes v1.6.6 and added self-hosted etcd with TLS * Both on-host and self-hosted etcd now require clients to use TLS client certs so locksmithd --- .../modules/profiles/cl/bootkube-controller.yaml.tmpl | 6 +++--- .../terraform/modules/profiles/cl/bootkube-worker.yaml.tmpl | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/examples/terraform/modules/profiles/cl/bootkube-controller.yaml.tmpl b/examples/terraform/modules/profiles/cl/bootkube-controller.yaml.tmpl index 846b593a..f05439e6 100644 --- a/examples/terraform/modules/profiles/cl/bootkube-controller.yaml.tmpl +++ b/examples/terraform/modules/profiles/cl/bootkube-controller.yaml.tmpl @@ -32,12 +32,12 @@ systemd: contents: | [Service] Environment="REBOOT_STRATEGY=etcd-lock" - {{ if eq .etcd_on_host "false" -}} - Environment="LOCKSMITHD_ENDPOINT=http://{{.k8s_etcd_service_ip}}:2379" - {{ else }} Environment="LOCKSMITHD_ETCD_CAFILE=/etc/ssl/etcd/etcd-ca.crt" Environment="LOCKSMITHD_ETCD_CERTFILE=/etc/ssl/etcd/etcd-client.crt" Environment="LOCKSMITHD_ETCD_KEYFILE=/etc/ssl/etcd/etcd-client.key" + {{ if eq .etcd_on_host "false" -}} + Environment="LOCKSMITHD_ENDPOINT=http://{{.k8s_etcd_service_ip}}:2379" + {{ else }} Environment="LOCKSMITHD_ENDPOINT={{.etcd_endpoints}}" {{ end }} - name: kubelet.path diff --git a/examples/terraform/modules/profiles/cl/bootkube-worker.yaml.tmpl b/examples/terraform/modules/profiles/cl/bootkube-worker.yaml.tmpl index 7310aeae..cfdf70e8 100644 --- a/examples/terraform/modules/profiles/cl/bootkube-worker.yaml.tmpl +++ b/examples/terraform/modules/profiles/cl/bootkube-worker.yaml.tmpl @@ -9,12 +9,12 @@ systemd: contents: | [Service] Environment="REBOOT_STRATEGY=etcd-lock" - {{ if eq .etcd_on_host "false" -}} - Environment="LOCKSMITHD_ENDPOINT=http://{{.k8s_etcd_service_ip}}:2379" - {{ else }} Environment="LOCKSMITHD_ETCD_CAFILE=/etc/ssl/etcd/etcd-ca.crt" Environment="LOCKSMITHD_ETCD_CERTFILE=/etc/ssl/etcd/etcd-client.crt" Environment="LOCKSMITHD_ETCD_KEYFILE=/etc/ssl/etcd/etcd-client.key" + {{ if eq .etcd_on_host "false" -}} + Environment="LOCKSMITHD_ENDPOINT=http://{{.k8s_etcd_service_ip}}:2379" + {{ else }} Environment="LOCKSMITHD_ENDPOINT={{.etcd_endpoints}}" {{ end }} - name: kubelet.path