fix: ensure consistent etcd certificate permissions on first etcd node#13367
fix: ensure consistent etcd certificate permissions on first etcd node#13367Dasmat13 wants to merge 1 commit into
Conversation
kubernetes-prow
Bot
added
release-note
|
Hi @Dasmat13. Thanks for your PR. I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with Tip We noticed you've done this a few times! Consider joining the org to skip this step and gain Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: Dasmat13 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
3c1f4ee to
5e36fa6
Compare
kubernetes-prow
Bot
removed
the
do-not-merge/invalid-commit-message
|
/ok-to-test |
kubernetes-prow
Bot
added
ok-to-test
The etcd certificate generation script runs on the first etcd node and creates certs with default ownership and permissions. Subsequent copy tasks set explicit ownership and permissions on the remaining etcd nodes, resulting in inconsistent permissions across the cluster. This can cause issues such as etcd backup jobs failing on the first node due to missing read access to certificate files. Add an ansible.builtin.file task after cert generation to explicitly set the correct ownership and permissions on the first etcd node.
5e36fa6 to
ba0837d
Compare
There was a problem hiding this comment.
Pull request overview
This PR aims to fix inconsistent ownership/permissions of etcd TLS certificates on the first etcd node by explicitly applying the same owner/group/mode that Kubespray already enforces when copying certs to the remaining etcd nodes (addressing #13250).
Changes:
- Adds a new task to chmod/chown etcd certificate PEM files on the first etcd node to
{{ etcd_owner }}:{{ etcd_cert_group }}with mode0640.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - name: Gen_certs | Ensure consistent etcd certificate permissions on first etcd node | ||
| ansible.builtin.file: | ||
| path: "{{ item }}" | ||
| owner: "{{ etcd_owner }}" | ||
| group: "{{ etcd_cert_group }}" |
|
Hi @yankay, all CI checks have passed. Could you please take another look when you have time? Also, let me know if you'd like me to address the Copilot suggestion. Thanks! |
|
Hi @yankay, @VannTen, and @tico88612, Just a friendly follow-up. All CI checks have passed, and the PR is ready for review. If you think the Copilot suggestion should be addressed before merging, I'm happy to update the implementation. Thanks for your time! |
Fixes #13250
The etcd certificate generation script runs on the first etcd node and creates certs with default ownership/permissions (root:root, umask-based), while the subsequent copy task sets explicit ownership/permissions (etcd:root, 0640) on the remaining etcd nodes. This leads to inconsistent permissions that can cause issues such as etcd backup jobs failing on the first node due to missing read access.
Add a task after cert generation to explicitly set ownership and permissions on the first etcd node to match what the copy task applies to other nodes.