clustering.md: SRV records in DNS SAN for TLS #9886
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Using SRV discovery with TLS, the SRV record must be in the DNS SAN or clustering will fail. This is a new requirement and may cause mysterious failures when upgrading from 3.1 to 3.2. I was only able to fix this in our configuration after reading through etcd-io#8445; and now I understand the problem it's clear the docs have a hole here.
Codecov Report
@@ Coverage Diff @@
## master #9886 +/- ##
==========================================
- Coverage 69.3% 69.16% -0.15%
==========================================
Files 385 385
Lines 35703 35703
==========================================
- Hits 24745 24694 -51
- Misses 9165 9208 +43
- Partials 1793 1801 +8
Continue to review full report at Codecov.
|
zultron
added a commit
to zultron/freeipa-cloud-prov
that referenced
this pull request
Jul 9, 2018
Upgrade to 3.2+ caused TLS connection failures because a new requirement where the SRV record must be in the SSL cert's DNS SAN. This also reverts the previous commit, "Back etcd3 version down to 3.1.5", and the default etcd version (3.3.3 at this time) is loaded. This was undocumented, so I filed a PR: etcd-io/etcd#9886
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Using SRV discovery with TLS, the SRV record must be in the DNS SAN or clustering will fail.
This is a new requirement and may cause mysterious failures when upgrading from 3.1 to 3.2. I was only able to fix this in our configuration after reading through #8445; and now I understand the problem it's clear the docs have a hole here.