Flannel client should use certificate for etcd connection about kvm-operator HOT 13 CLOSED

I see that the flannel clients that are created by the flannel operator still do not use the etcd certificates. See https://github.com/giantswarm/flannel-operator/blob/d2677bc5dcf9353d0a45336df9a7b4ecae634253/service/flannel/daemonset.go#L62. I think we could just use the certificates here that the flannel operator uses already.

from kvm-operator.

This is not solved yet.

from kvm-operator.

Is this still valid?

from kvm-operator.

I think so, flannel-operator should request certifcates for etcd access.

from kvm-operator.

Did you do anything? AFAIK you enabled some cert auth option. So in case some client that does not fulfil this requirement will not work at all. Right now it looks like everything still works. This either means we fixed it and all is good or nothing happened so far. Which case is it?

from kvm-operator.

we don't have enabled client cert auth on host cluster because of this so that is the reason why it works

from kvm-operator.

I think we had it but had to rollback because it did not work.

from kvm-operator.

This should be part of the host cluster lockdown then.

from kvm-operator.

It is in SIG operator. Can you take over in SIG host cluster?

from kvm-operator.

but this is still related to flannel-operator as that is the part that needs to be updated and use client auth in order to connect to etcd, after this is configured we can enable client-auth on etcd. (host cluster issue)

from kvm-operator.

I see.

from kvm-operator.

FYI flannel operator already uses certificates to authenticate against etcd.

from kvm-operator.

good catch, that's the one that should be updated i guess

from kvm-operator.