{"action":"created","issue":{"url":"https://api.github.com/repos/coreos/etcd-operator/issues/1384","repository_url":"https://api.github.com/repos/coreos/etcd-operator","labels_url":"https://api.github.com/repos/coreos/etcd-operator/issues/1384/labels{/name}","comments_url":"https://api.github.com/repos/coreos/etcd-operator/issues/1384/comments","events_url":"https://api.github.com/repos/coreos/etcd-operator/issues/1384/events","html_url":"https://github.com/coreos/etcd-operator/issues/1384","id":256312291,"number":1384,"title":"tls failure in cluster set up, v0.5.1, etcd 3.2","user":{"login":"raoofm","id":12846989,"avatar_url":"https://avatars2.githubusercontent.com/u/12846989?v=4","gravatar_id":"","url":"https://api.github.com/users/raoofm","html_url":"https://github.com/raoofm","followers_url":"https://api.github.com/users/raoofm/followers","following_url":"https://api.github.com/users/raoofm/following{/other_user}","gists_url":"https://api.github.com/users/raoofm/gists{/gist_id}","starred_url":"https://api.github.com/users/raoofm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/raoofm/subscriptions","organizations_url":"https://api.github.com/users/raoofm/orgs","repos_url":"https://api.github.com/users/raoofm/repos","events_url":"https://api.github.com/users/raoofm/events{/privacy}","received_events_url":"https://api.github.com/users/raoofm/received_events","type":"User","site_admin":false},"labels":[{"id":474142880,"url":"https://api.github.com/repos/coreos/etcd-operator/labels/dependency/external","name":"dependency/external","color":"fbfa04","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":15,"created_at":"2017-09-08T16:51:18Z","updated_at":"2017-10-02T15:30:38Z","closed_at":null,"author_association":"NONE","body":"Used below to generate self signed certs and create k8s secrets\r\nhttps://coreos.com/os/docs/latest/generate-self-signed-certificates.html \r\nhttps://github.com/coreos/etcd-operator/blob/master/doc/user/cluster_tls.md\r\n\r\n**Logs from etcd-operator**\r\ntime=\"2017-09-08T16:18:05Z\" level=info msg=\"etcd-operator Version: 0.5.1\" \r\ntime=\"2017-09-08T16:18:05Z\" level=info msg=\"Git SHA: cf7d8d5\" \r\ntime=\"2017-09-08T16:18:05Z\" level=info msg=\"Go Version: go1.8.3\" \r\ntime=\"2017-09-08T16:18:05Z\" level=info msg=\"Go OS/Arch: linux/amd64\" \r\ntime=\"2017-09-08T16:18:23Z\" level=info msg=\"Event(v1.ObjectReference{Kind:\"Endpoints\", Namespace:\"etcd-operator\", Name:\"etcd-operator\", UID:\"073b648c-8da3-11e7-8ce6-0637473fabae\", APIVersion:\"v1\", ResourceVersion:\"32276337\", FieldPath:\"\"}): type: 'Normal' reason: 'LeaderElection' etcd-operator-3603461089-jd754 became leader\" \r\ntime=\"2017-09-08T16:18:23Z\" level=info msg=\"finding existing clusters...\" pkg=controller \r\n**time=\"2017-09-08T16:18:23Z\" level=error msg=\"cluster failed to setup: tls: failed to find any PEM data in certificate input\" cluster-name=etcd-dev-cluster pkg=cluster** \r\ntime=\"2017-09-08T16:18:23Z\" level=info msg=\"starts running from watch version: 32276337\" pkg=controller \r\ntime=\"2017-09-08T16:18:23Z\" level=info msg=\"start watching at 32276337\" pkg=controller \r\ntime=\"2017-09-08T16:18:23Z\" level=warning msg=\"fail to handle event: ignore failed cluster (etcd-dev-cluster). Please delete its CR\" pkg=controller \r\ntime=\"2017-09-08T16:20:00Z\" level=info msg=\"apiserver closed watch stream, retrying after 5s...\" pkg=controller \r\ntime=\"2017-09-08T16:20:05Z\" level=info msg=\"start watching at 32276338\" pkg=controller \r\n\r\n**ca-config.json**\r\n{\r\n    \"signing\": {\r\n        \"default\": {\r\n            \"expiry\": \"87600h\"\r\n        },\r\n        \"profiles\": {\r\n            \"server\": {\r\n                \"expiry\": \"87600h\",\r\n                \"usages\": [\r\n                    \"signing\",\r\n                    \"key encipherment\",\r\n                    \"server auth\"\r\n                ]\r\n            },\r\n            \"client\": {\r\n                \"expiry\": \"87600h\",\r\n                \"usages\": [\r\n                    \"signing\",\r\n                    \"key encipherment\",\r\n                    \"client auth\"\r\n                ]\r\n            },\r\n            \"peer\": {\r\n                \"expiry\": \"87600h\",\r\n                \"usages\": [\r\n                    \"signing\",\r\n                    \"key encipherment\",\r\n                    \"server auth\",\r\n                    \"client auth\"\r\n                ]\r\n            }\r\n        }\r\n    }\r\n}\r\n\r\n**ca-csr.json**\r\n{\r\n    \"CN\": \"Company CA for etcd-operator\",\r\n    \"key\": {\r\n        \"algo\": \"rsa\",\r\n        \"size\": 2048\r\n    },\r\n    \"names\": [\r\n        {\r\n            \"C\": \"US\",\r\n            \"L\": \"Some City\",\r\n            \"ST\": \"Some State\",\r\n            \"O\": \"Some Company\",\r\n            \"OU\": \"Security\",\r\n            \"OU\": \"Development\"\r\n        }\r\n    ]\r\n}\r\n\r\n**server.json**\r\n{\r\n    \"CN\": \"etcdServer\",\r\n    \"hosts\": [\r\n        \"*.etcd-dev-cluster.etcd-operator.svc\",\r\n        \"etcd-dev-cluster-client.etcd-operator.svc\",\r\n        \"localhost\"\r\n    ],\r\n    \"key\": {\r\n        \"algo\": \"rsa\",\r\n        \"size\": 2048\r\n    },\r\n    \"names\": [\r\n        {\r\n            \"C\": \"US\",\r\n            \"L\": \"Some City\",\r\n            \"ST\": \"Some State\",\r\n            \"O\": \"Some Company\",\r\n            \"OU\": \"Security\",\r\n            \"OU\": \"Development\"\r\n        }\r\n    ]\r\n}\r\n\r\n**peer.json**\r\n{\r\n    \"CN\": \"etcdPeer\",\r\n    \"hosts\": [\r\n        \"*.etcd-dev-cluster.etcd-operator.svc\"\r\n    ],\r\n    \"key\": {\r\n        \"algo\": \"rsa\",\r\n        \"size\": 2048\r\n    },\r\n    \"names\": [\r\n        {\r\n            \"C\": \"US\",\r\n            \"L\": \"Some City\",\r\n            \"ST\": \"Some State\",\r\n            \"O\": \"Some Company\",\r\n            \"OU\": \"Security\",\r\n            \"OU\": \"Development\"\r\n        }\r\n    ]\r\n}\r\n\r\n**client.json**\r\n{\r\n    \"CN\": \"client\",\r\n    \"hosts\": [],\r\n    \"key\": {\r\n        \"algo\": \"rsa\",\r\n        \"size\": 2048\r\n    },\r\n    \"names\": [\r\n        {\r\n            \"C\": \"US\",\r\n            \"L\": \"Some City\",\r\n            \"ST\": \"Some State\",\r\n            \"O\": \"Some Company\",\r\n            \"OU\": \"Security\",\r\n            \"OU\": \"Development\"\r\n        }\r\n    ]\r\n}\r\n\r\n**Commands used**\r\nkubectl create secret generic etcd-peer-tls --from-file=ca.pem --from-file=peer.pem --from-file=peer-key.pem\r\n kubectl create secret generic etcd-server-tls --from-file=ca.pem --from-file=server.pem --from-file=server-key.pem\r\nkubectl create secret generic etcd-client-tls --from-file=ca.pem --from-file=client.pem --from-file=client-key.pem\r\n\r\nThe only difference that I could see is cfssl spits out pem encoded and the example in etcd-operator cluster_tls setup have .crt and .key file extension (it shouldn't matter as the [doc ](https://github.com/coreos/etcd-operator/blob/master/doc/user/cluster_tls.md#memberpeersecret)says they should be pem-encoded)"},"comment":{"url":"https://api.github.com/repos/coreos/etcd-operator/issues/comments/333570672","html_url":"https://github.com/coreos/etcd-operator/issues/1384#issuecomment-333570672","issue_url":"https://api.github.com/repos/coreos/etcd-operator/issues/1384","id":333570672,"user":{"login":"raoofm","id":12846989,"avatar_url":"https://avatars2.githubusercontent.com/u/12846989?v=4","gravatar_id":"","url":"https://api.github.com/users/raoofm","html_url":"https://github.com/raoofm","followers_url":"https://api.github.com/users/raoofm/followers","following_url":"https://api.github.com/users/raoofm/following{/other_user}","gists_url":"https://api.github.com/users/raoofm/gists{/gist_id}","starred_url":"https://api.github.com/users/raoofm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/raoofm/subscriptions","organizations_url":"https://api.github.com/users/raoofm/orgs","repos_url":"https://api.github.com/users/raoofm/repos","events_url":"https://api.github.com/users/raoofm/events{/privacy}","received_events_url":"https://api.github.com/users/raoofm/received_events","type":"User","site_admin":false},"created_at":"2017-10-02T15:30:38Z","updated_at":"2017-10-02T15:30:38Z","author_association":"NONE","body":"@hongchaodeng any update on making etcd-operator compatible with v3.2"}}
{"actor":{"display_login":"raoofm"}}