{"action":"created","issue":{"url":"https://api.github.com/repos/coreos/tectonic-forum/issues/217","repository_url":"https://api.github.com/repos/coreos/tectonic-forum","labels_url":"https://api.github.com/repos/coreos/tectonic-forum/issues/217/labels{/name}","comments_url":"https://api.github.com/repos/coreos/tectonic-forum/issues/217/comments","events_url":"https://api.github.com/repos/coreos/tectonic-forum/issues/217/events","html_url":"https://github.com/coreos/tectonic-forum/issues/217","id":270082204,"number":217,"title":"tectonic-cluo-operator Crashes when using Custom Intermediate CA Certificate","user":{"login":"seglberg","id":799727,"avatar_url":"https://avatars3.githubusercontent.com/u/799727?v=4","gravatar_id":"","url":"https://api.github.com/users/seglberg","html_url":"https://github.com/seglberg","followers_url":"https://api.github.com/users/seglberg/followers","following_url":"https://api.github.com/users/seglberg/following{/other_user}","gists_url":"https://api.github.com/users/seglberg/gists{/gist_id}","starred_url":"https://api.github.com/users/seglberg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/seglberg/subscriptions","organizations_url":"https://api.github.com/users/seglberg/orgs","repos_url":"https://api.github.com/users/seglberg/repos","events_url":"https://api.github.com/users/seglberg/events{/privacy}","received_events_url":"https://api.github.com/users/seglberg/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2017-10-31T19:01:38Z","updated_at":"2017-12-31T03:26:56Z","closed_at":null,"author_association":"NONE","body":"### Tectonic Version \r\n1.7.5-tectonic.1 \r\n\r\n### Environment\r\n\r\nBare Metal\r\n\r\n### Expected Behavior\r\n\r\nI am testing using an intermediate CA certificate for tectonic. During installation, I provided both the root CA and intermediate CA certificate + key to use. I expect the tectonic components to be able to use the certificate bundle to contact the api, etc.\r\n\r\n### Actual Behavior\r\n\r\nAll services seem to work fine except for the `tectonic-cluo-operator`, which keeps crashing:\r\n\r\n```\r\nI1031 18:42:43.541169       1 main.go:35] tectonic-cluo-operator starting\r\nE1031 18:42:54.840254       1 reflector.go:199] github.com/coreos-inc/tectonic-x-operator/vendor/k8s.io/client-go/informers/factory.go:73: Failed to list *v1.ConfigMap: Get https://10.128.0.1:443/api/v1/configmaps?resourceVersion=0: net/http: TLS handshake timeout\r\nE1031 18:42:54.840951       1 reflector.go:199] github.com/coreos-inc/tectonic-x-operator/vendor/k8s.io/client-go/informers/factory.go:73: Failed to list *v1.Service: Get https://10.128.0.1:443/api/v1/services?resourceVersion=0: net/http: TLS handshake timeout\r\nE1031 18:42:55.839960       1 reflector.go:199] github.com/coreos-inc/tectonic-x-operator/vendor/k8s.io/client-go/informers/factory.go:73: Failed to list *v1beta1.DaemonSet: Get https://10.128.0.1:443/apis/extensions/v1beta1/daemonsets?resourceVersion=0: net/http: TLS handshake timeout\r\nE1031 18:42:56.039862       1 reflector.go:199] github.com/coreos-inc/tectonic-x-operator/vendor/k8s.io/client-go/informers/factory.go:73: Failed to list *v1beta1.Deployment: Get https://10.128.0.1:443/apis/extensions/v1beta1/deployments?resourceVersion=0: net/http: TLS handshake timeout\r\nE1031 18:43:08.339713       1 reflector.go:199] github.com/coreos-inc/tectonic-x-operator/vendor/k8s.io/client-go/informers/factory.go:73: Failed to list *v1.ConfigMap: Get https://10.128.0.1:443/api/v1/configmaps?resourceVersion=0: net/http: TLS handshake timeout\r\nE1031 18:43:08.439621       1 reflector.go:199] github.com/coreos-inc/tectonic-x-operator/vendor/k8s.io/client-go/informers/factory.go:73: Failed to list *v1beta1.Deployment: Get https://10.128.0.1:443/apis/extensions/v1beta1/deployments?resourceVersion=0: net/http: TLS handshake timeout\r\nE1031 18:43:08.341890       1 reflector.go:199] github.com/coreos-inc/tectonic-x-operator/vendor/k8s.io/client-go/informers/factory.go:73: Failed to list *v1beta1.DaemonSet: Get https://10.128.0.1:443/apis/extensions/v1beta1/daemonsets?resourceVersion=0: net/http: TLS handshake timeout\r\nE1031 18:43:08.739570       1 reflector.go:199] github.com/coreos-inc/tectonic-x-operator/vendor/k8s.io/client-go/informers/factory.go:73: Failed to list *v1.Service: Get https://10.128.0.1:443/api/v1/services?resourceVersion=0: net/http: TLS handshake timeout\r\nE1031 18:43:20.840097       1 reflector.go:199] github.com/coreos-inc/tectonic-x-operator/vendor/k8s.io/client-go/informers/factory.go:73: Failed to list *v1.ConfigMap: Get https://10.128.0.1:443/api/v1/configmaps?resourceVersion=0: net/http: TLS handshake timeout\r\nE1031 18:43:21.340185       1 reflector.go:199] github.com/coreos-inc/tectonic-x-operator/vendor/k8s.io/client-go/informers/factory.go:73: Failed to list *v1beta1.DaemonSet: Get https://10.128.0.1:443/apis/extensions/v1beta1/daemonsets?resourceVersion=0: net/http: TLS handshake timeout\r\nE1031 18:43:21.340368       1 reflector.go:199] github.com/coreos-inc/tectonic-x-operator/vendor/k8s.io/client-go/informers/factory.go:73: Failed to list *v1beta1.Deployment: Get https://10.128.0.1:443/apis/extensions/v1beta1/deployments?resourceVersion=0: net/http: TLS handshake timeout\r\nE1031 18:43:23.439944       1 reflector.go:199] github.com/coreos-inc/tectonic-x-operator/vendor/k8s.io/client-go/informers/factory.go:73: Failed to list *v1.Service: Get https://10.128.0.1:443/api/v1/services?resourceVersion=0: net/http: TLS handshake timeout\r\nE1031 18:43:34.339693       1 reflector.go:199] github.com/coreos-inc/tectonic-x-operator/vendor/k8s.io/client-go/informers/factory.go:73: Failed to list *v1.ConfigMap: Get https://10.128.0.1:443/api/v1/configmaps?resourceVersion=0: net/http: TLS handshake timeout\r\nE1031 18:43:34.539839       1 reflector.go:199] github.com/coreos-inc/tectonic-x-operator/vendor/k8s.io/client-go/informers/factory.go:73: Failed to list *v1beta1.Deployment: Get https://10.128.0.1:443/apis/extensions/v1beta1/deployments?resourceVersion=0: net/http: TLS handshake timeout\r\nE1031 18:43:35.839968       1 reflector.go:199] github.com/coreos-inc/tectonic-x-operator/vendor/k8s.io/client-go/informers/factory.go:73: Failed to list *v1beta1.DaemonSet: Get https://10.128.0.1:443/apis/extensions/v1beta1/daemonsets?resourceVersion=0: net/http: TLS handshake timeout\r\nE1031 18:43:36.041255       1 reflector.go:199] github.com/coreos-inc/tectonic-x-operator/vendor/k8s.io/client-go/informers/factory.go:73: Failed to list *v1.Service: Get https://10.128.0.1:443/api/v1/services?resourceVersion=0: net/http: TLS handshake timeout\r\nF1031 18:43:46.139566       1 xoperator.go:131] timeout waiting for caches to sync: timed out waiting for the condition\r\nE1031 18:43:49.640420       1 reflector.go:199] github.com/coreos-inc/tectonic-x-operator/vendor/k8s.io/client-go/informers/factory.go:73: Failed to list *v1beta1.Deployment: Get https://10.128.0.1:443/apis/extensions/v1beta1/deployments?resourceVersion=0: net/http: TLS handshake timeout\r\n```\r\n\r\n### Reproduction Steps\r\n\r\n1. Create a New Cluster via Tectonic Installer with Provided CA (Instead of Automatically Generated)\r\n2. Generate and Provide an Intermediate CA\r\n\r\nHere are the relevant variables from my `terraform.tfvars` for my test environment:\r\n\r\n```\r\n  \"tectonic_ca_cert\": \"-----BEGIN CERTIFICATE-----\\nMIICMjCCAZSgAwIBAgIUdr+lB9+DOesqiOA7vI6ewUi5Y8wwCgYIKoZIzj0EAwIw\\nNzEbMBkGA1UEAwwSQXJyb3lvIE1hc3RlciBDQSAxMRgwFgYDVQQKDA9BcnJveW8g\\nTmV0d2\r\n9ya3MwHhcNMTcxMDA1MTk1OTQxWhcNMTkxMDA1MTk1OTQxWjBUMSMwIQYD\\nVQQDDBpLdWJlcm5ldGVzIEludGVybWVkaWF0ZSBDQTEYMBYGA1UECgwPQXJyb3lv\\nIE5ldHdvcmtzMRMwEQYDVQQLDApLdWJlcm5ldGVzMIGbMBAGByqGSM49AgEGBSuB\r\n\\nBAAjA4GGAAQBIAeIP9gu/ZN9z2V8Hdwz8/rLym7P4IqrSAK47TC3B+jZgKMDGIKI\\n4zCyVpdmfpWkW0FP3dvroeOmS0LBRHU+12QBXVkEHH9vw6rYYb/skOOARQHZOYrv\\nzjuZ2Z1GkNcg41udJMyjg73Vq0WwJhGmcWThgZy6vCCmF/BejFu41tYc\r\nFDGjHjAc\\nMAkGA1UdEQQCMAAwDwYDVR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAgOBiwAwgYcC\\nQWHBUSQQvkmTpERBvzk0RBvSW9Z0hGr+AkFUEqITqECyqKhDIDGeHylfsN9DiU6v\\nULPwjlq4lv+A6cQvUXSYdckbAkIBf/HUsGPLL8IyiR2nvl3s\r\nEVIsndr6iJfvVxtu\\noX5NJq5K7znWcfiom+1Yak5p5wK5431aAeH+Uqpz5T3TL/dT2PQ=\\n-----END CERTIFICATE-----\\n-----BEGIN CERTIFICATE-----\\nMIICFTCCAXegAwIBAgIUf4WGqN8hMrqFJlJUa5WGI3g25i0wCgYIKoZIzj0EAw\r\nIw\\nNzEbMBkGA1UEAwwSQXJyb3lvIE1hc3RlciBDQSAxMRgwFgYDVQQKDA9BcnJveW8g\\nTmV0d29ya3MwHhcNMTcxMDA1MTk1MDA4WhcNMjcxMDAzMTk1MDA4WjA3MRswGQYD\\nVQQDDBJBcnJveW8gTWFzdGVyIENBIDExGDAWBgNVBAoMD0Fycm95by\r\nBOZXR3b3Jr\\nczCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAEACeLJpDtv09PbPXTniv9Iy9mMoxB\\nRJq5GojVUgW9tdPSjHRdHpS8cOZuhV1Gu3s6CZfrb4KxMCmNUlT2AylI9mWiAFbF\\nmsaXLrS5i6Qp+DcCzuO9Uyjlg5ssG8LvSAUHrMk6K5pwXO\r\nfB0j+cCNVp6HYdePiu\\n6nFXLlNYgXbFsMLe/qT4ox4wHDAJBgNVHREEAjAAMA8GA1UdEwEB/wQFMAMBAf8w\\nCgYIKoZIzj0EAwIDgYsAMIGHAkIBXtr8kMJULDpovwy0MgIDW7TTje+UlRwjD0Fz\\nsQhiHhE1MTdKJZFlgu5eAIHS/6tWjBCsl9cg+h\r\nqGInz9sYq0MwwCQUit3uuk5jzB\\n4e2J1oFDKcaVFo0LDe5NJqoFTxaCqOBXdCNQbeBtFVZdrJkCx62XzejLZXkNwxm2\\n8NtrPrxY0Gst\\n-----END CERTIFICATE-----\\n\",                                                     \r\n  \"tectonic_ca_key\": \"-----BEGIN EC PRIVATE KEY-----\\n[OMITTED]\\n-----END EC PRIV\r\nATE KEY-----\",                                                                                                                                                                                \r\n  \"tectonic_ca_key_alg\": \"ECDSA\", \r\n```\r\n\r\n3. Continue with Cluster Installation\r\n\r\n### Other Information\r\n\r\n- The secret mounted into the Pod contains both the root CA and intermediate CA in the `ca.crt` field.\r\n- This issue prevents the \"Cluster Settings\" page from loading.\r\n- Everything seems to work fine when using a root CA directly (either provided or generated by the installer)."},"comment":{"url":"https://api.github.com/repos/coreos/tectonic-forum/issues/comments/354582979","html_url":"https://github.com/coreos/tectonic-forum/issues/217#issuecomment-354582979","issue_url":"https://api.github.com/repos/coreos/tectonic-forum/issues/217","id":354582979,"user":{"login":"seglberg","id":799727,"avatar_url":"https://avatars3.githubusercontent.com/u/799727?v=4","gravatar_id":"","url":"https://api.github.com/users/seglberg","html_url":"https://github.com/seglberg","followers_url":"https://api.github.com/users/seglberg/followers","following_url":"https://api.github.com/users/seglberg/following{/other_user}","gists_url":"https://api.github.com/users/seglberg/gists{/gist_id}","starred_url":"https://api.github.com/users/seglberg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/seglberg/subscriptions","organizations_url":"https://api.github.com/users/seglberg/orgs","repos_url":"https://api.github.com/users/seglberg/repos","events_url":"https://api.github.com/users/seglberg/events{/privacy}","received_events_url":"https://api.github.com/users/seglberg/received_events","type":"User","site_admin":false},"created_at":"2017-12-31T03:26:56Z","updated_at":"2017-12-31T03:26:56Z","author_association":"NONE","body":"After some more digging, it appears the problem is that the cluo-operator does not work with ECDSA certificates. \r\n\r\nRSA intermediate certificates work just fine."}}
{"actor":{"display_login":"seglberg"}}