From 583b162f906dc55c1c4d34695441844e0305f06c Mon Sep 17 00:00:00 2001 From: Tony Grosinger Date: Thu, 20 Apr 2017 08:04:18 -0700 Subject: [PATCH] pkg/transport: reload TLS certificates for every client requests This changes the baseConfig used when creating tls Configs to utilize the GetCertificate and GetClientCertificate functions to always reload the certificates from disk whenever they are needed. Always reloading the certificates allows changing the certificates via an external process without interrupting etcd. Fixes #7576 Cherry-picked by Gyu-Ho Lee Original commit can be found at https://github.com/coreos/etcd/pull/7784 --- pkg/transport/listener.go | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/pkg/transport/listener.go b/pkg/transport/listener.go index e024f3c6bf4c..76b36d944287 100644 --- a/pkg/transport/listener.go +++ b/pkg/transport/listener.go @@ -172,6 +172,14 @@ func (info TLSInfo) baseConfig() (*tls.Config, error) { MinVersion: tls.VersionTLS12, ServerName: info.ServerName, } + // this only reloads certs when there's a client request + // TODO: support server-side refresh (e.g. inotify, SIGHUP), caching + cfg.GetCertificate = func(clientHello *tls.ClientHelloInfo) (*tls.Certificate, error) { + return tlsutil.NewCert(info.CertFile, info.KeyFile, info.parseFunc) + } + cfg.GetClientCertificate = func(unused *tls.CertificateRequestInfo) (*tls.Certificate, error) { + return tlsutil.NewCert(info.CertFile, info.KeyFile, info.parseFunc) + } return cfg, nil }