Add explanation on how to get the servers short name and FQDN into the SANs of the server.crt for ETCD

[Martin-Weiss]

At the moment ETCD is using a server.crt which per default only has the IP address of the master node it is running on.

In case we want to scrape or backup etc. it would be better if we could target etcd with the FQDN and/or short name of the master instead of using the IP address.

Could we add the information to the documentation on how to do this?

[innobead]

@jenting please help with this. Thanks.

ref: kubeadm provides InitConfiguration to configure ServerCertSANs and PeerCertSANs of builtin local etcd.

[jenting]

Thanks @innobead pointing out 🙇

@Martin-Weiss I'm wondering if the user would like to change ETCD server SAN to FQDN at day-2 operation.

[Martin-Weiss]

Thanks @innobead pointing out 🙇

@Martin-Weiss I'm wondering if the user would like to change ETCD server SAN to FQDN at day-2 operation.

Hopefully not - servers should get static names (short, FQDN) and also static IP addresses. IMO any server rename should require a reinstall - similar to master remove; reinstall; re-add.

It would be nice to support server rename and IP changes but with all the dependencies we have at the moment I am not sure if the effort is worth the value..

[jenting]

@Martin-Weiss Question: would it be possible that different etcd server with different FQDN? Like

• etcd-server-1: FQDN=etcd-server1
• etcd-server-2: FQDN=etcd-server2
• etcd-server-3: FQDN=etcd-server3

Currently evaluation is it's doable by

• etcd-server-1: FQDN=etcd-server1,etcd-server-2,etcd-server3
• etcd-server-2: FQDN=etcd-server1,etcd-server-2,etcd-server3
• etcd-server-3: FQDN=etcd-server1,etcd-server-2,etcd-server3

[Martin-Weiss]

FQDN = the FQDN of the server .. (hostname -f)
"etcd-server1" is a short name. etcd-server1.. wound be a FQDN.

A single ETCD would not have multiple FQDNs.

IMO the etcd SAN needs to have the FQDN of the server ETCD is running on - so a different SAN on each ETCD host.

[jenting]

@Martin-Weiss
Thanks for the explanation, so the expected etcd SAN should be like this:

etcd-server-1: FQDN=etcd-server1..
etcd-server-2: FQDN=etcd-server2..
etcd-server-3: FQDN=etcd-server3...

Correct me if I’m wrong.

[Martin-Weiss]

Yes

So the best would be to have the short and full qualified domain name as SAN and also the IP addresses of the host:

etcd-server-1: SANs: DNS.1.etcd-server1.; DNS.2.etcd-server1; IP.1: IPv4; IP.2: IPv6

[jenting]

I can't find a way to fulfills each ETCD server's have its short/FDQN as SAN.

All I could find now is all ETCD servers use the same short/FQDN as SAN. So adding a blocked label.

[Martin-Weiss]

An other option would be to use a wildcard certificate.. Am 06.07.2020 um 04:34 schrieb JenTing Hsiao <[email protected]>:  I can't find a way to fulfills each ETCD server's have its short/FDQN as SAN. All I could find now is all ETCD servers use the same short/FQDN as SAN. So adding a blocked label. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub<#844 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/ADF6LDIV6DVXP37EDVZWO3TR2EZ3LANCNFSM4NKN6OTA>.

[jenting]

Ref to coreos/etcd-operator#901

[jenting]

At the moment ETCD is using a server.crt which per default only has the IP address of the master node it is running on.

In case we want to scrape or backup etc. it would be better if we could target etcd with the FQDN and/or short name of the master instead of using the IP address.

Could we add the information to the documentation on how to do this?

@Martin-Weiss Could you elaborate more on your user cases? What commands did your execute? This would make us know more about field/customer user case/feedback. Thanks in advance.

[Martin-Weiss]

Not sure what commands you are asking for - basically I just checked the certificates with openssl.

openssl s_client -connect .... |openssl x509 -noout -text..

[jenting]

Not sure what commands you are asking for - basically I just checked the certificates with openssl.

openssl s_client -connect .... |openssl x509 -noout -text..

I think the command would begin with etcdctl.

I was wondering you mentioned in description scrape or backup etcd cluster. I had read the ETCD backup documentation, but I can't imagine a scenario the admins have to change ETCD server SAN with a short name/FQDN.

From now, I could think the scenario to support SAN with short name/FQDN is the ETCD server externally (not insides Kubernetes cluster), and the users would use etcdctl to requests the ETCD cluster servers or do server back up.
However, if I remember correctly, CaaSP does not support uses external ETCD cluster servers yet.

[Martin-Weiss]

Ah - now I get the question! The problem is the Prometheus configuration for the scraping!

  - job_name: etcd
    static_configs:
      - targets: ['10.1.1.152:2379','10.1.1.153:2379','10.1.1.154:2379']

--> we should NEVER use IP addresses - and use FQDNs instead. BUT the usage of FQDN with the certificates used for ETCD does not work as the SANs are not correct / do not have the FQDNs.

[jenting]

I encountered into a problem, my cluster is bootstrap by IP address and I'd like to access ETCD servers by its hostname so my Prometheus scrape config would like this:

  - job_name: etcd
    static_configs:
      - targets: ['etcd-master-0:2379','etcd-master-1:2379','etcd-master-0:2379']

However, due to the etcd Pod does not have Service so the coredns can't resolve the etcd server's record.
Does anybody have better idea of this 🤔 ?

Ref to https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pods

[jenting]

I encountered into a problem, my cluster is bootstrap by IP address and I'd like to access ETCD servers by its hostname so my Prometheus scrape config would like this:

  - job_name: etcd
    static_configs:
      - targets: ['etcd-master-0:2379','etcd-master-1:2379','etcd-master-0:2379']

However, due to the etcd Pod does not have Service so the coredns can't resolve the etcd server's record.
Does anybody have better idea of this ?

Ref to https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pods

Does anybody know how to solve this problem?