{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes-incubator/bootkube/issues/611","repository_url":"https://api.github.com/repos/kubernetes-incubator/bootkube","labels_url":"https://api.github.com/repos/kubernetes-incubator/bootkube/issues/611/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes-incubator/bootkube/issues/611/comments","events_url":"https://api.github.com/repos/kubernetes-incubator/bootkube/issues/611/events","html_url":"https://github.com/kubernetes-incubator/bootkube/issues/611","id":238277700,"number":611,"title":"etcd TLS paths are inconsistent or disorganized","user":{"login":"dghubble","id":2253428,"avatar_url":"https://avatars1.githubusercontent.com/u/2253428?v=3","gravatar_id":"","url":"https://api.github.com/users/dghubble","html_url":"https://github.com/dghubble","followers_url":"https://api.github.com/users/dghubble/followers","following_url":"https://api.github.com/users/dghubble/following{/other_user}","gists_url":"https://api.github.com/users/dghubble/gists{/gist_id}","starred_url":"https://api.github.com/users/dghubble/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dghubble/subscriptions","organizations_url":"https://api.github.com/users/dghubble/orgs","repos_url":"https://api.github.com/users/dghubble/repos","events_url":"https://api.github.com/users/dghubble/events{/privacy}","received_events_url":"https://api.github.com/users/dghubble/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-06-23T23:51:09Z","updated_at":"2017-06-24T01:38:54Z","closed_at":null,"body":"When experimental self-hosted etcd is enabled, there are some particular expectations about the naming and structure of various etcd certificates and keys in code. For downstreams doing their own rendering (like Tectonic) this could be inconvenient:\r\n\r\n- Inconsistent suffix \".crt\" or \".key\" vs \".pem\"\r\n- Undocumented uses of each certificate pair type\r\n- Some of these paths are hard requirements (coded into bootkube start), some are not\r\n\r\nIn practice, downstreams seem to be creating a CA pair, peer pair, and client pair and copying them into the various different paths. That seems less than ideal for all involved.\r\n\r\n```\r\nAssetPathEtcdCA                         = \"tls/etcd-ca.crt\"\r\nAssetPathEtcdClientCert                 = \"tls/etcd-client.crt\"\r\nAssetPathEtcdClientKey                  = \"tls/etcd-client.key\"\r\nAssetPathEtcdPeerCert                   = \"tls/etcd-peer.crt\"\r\nAssetPathEtcdPeerKey                    = \"tls/etcd-peer.key\"\r\nAssetPathSelfHostedOperatorEtcdCA       = \"tls/operator/etcd-ca-crt.pem\"\r\nAssetPathSelfHostedOperatorEtcdCert     = \"tls/operator/etcd-crt.pem\"\r\nAssetPathSelfHostedOperatorEtcdKey      = \"tls/operator/etcd-key.pem\"\r\nAssetPathSelfHostedEtcdMemberClientCA   = \"tls/etcdMember/client-ca-crt.pem\"\r\nAssetPathSelfHostedEtcdMemberClientCert = \"tls/etcdMember/client-crt.pem\"\r\nAssetPathSelfHostedEtcdMemberClientKey  = \"tls/etcdMember/client-key.pem\"\r\nAssetPathSelfHostedEtcdMemberPeerCA     = \"tls/etcdMember/peer-ca-crt.pem\"\r\nAssetPathSelfHostedEtcdMemberPeerCert   = \"tls/etcdMember/peer-crt.pem\"\r\nAssetPathSelfHostedEtcdMemberPeerKey    = \"tls/etcdMember/peer-key.pem\"\r\n```\r\n\r\ncc @hongchaodeng per earlier slack discussion and @s-urbaniak"},"comment":{"url":"https://api.github.com/repos/kubernetes-incubator/bootkube/issues/comments/310805410","html_url":"https://github.com/kubernetes-incubator/bootkube/issues/611#issuecomment-310805410","issue_url":"https://api.github.com/repos/kubernetes-incubator/bootkube/issues/611","id":310805410,"user":{"login":"aaronlevy","id":374924,"avatar_url":"https://avatars0.githubusercontent.com/u/374924?v=3","gravatar_id":"","url":"https://api.github.com/users/aaronlevy","html_url":"https://github.com/aaronlevy","followers_url":"https://api.github.com/users/aaronlevy/followers","following_url":"https://api.github.com/users/aaronlevy/following{/other_user}","gists_url":"https://api.github.com/users/aaronlevy/gists{/gist_id}","starred_url":"https://api.github.com/users/aaronlevy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aaronlevy/subscriptions","organizations_url":"https://api.github.com/users/aaronlevy/orgs","repos_url":"https://api.github.com/users/aaronlevy/repos","events_url":"https://api.github.com/users/aaronlevy/events{/privacy}","received_events_url":"https://api.github.com/users/aaronlevy/received_events","type":"User","site_admin":false},"created_at":"2017-06-24T01:38:54Z","updated_at":"2017-06-24T01:38:54Z","body":"Agree we should get this more consistent.\r\n\r\nAlso a little confused by all the certs. Is there a reason that the operator gets its own set of certs (is it not just a client of etcd?) and why do we generate etcd client/peer certs, then generate different etcd/peer certs for an etcd member?"}}
{"actor":{"display_login":"aaronlevy"}}