Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Revert "Include every IP address into a cert's SAN field" #39

Merged
merged 2 commits into from
Apr 13, 2023

Conversation

ananace
Copy link
Member

@ananace ananace commented Apr 13, 2023

Reverts #32

To copy what I said there;
It's causing issues as it's changing the SAN list - and therefore also triggering a recreation of the serving certs - every time a container starts or stops on the Kubernetes master nodes.

Additionally, it's also including link-local bindings as well as IPVS entries from kube-proxy into the certificates, which causes the SAN list to grow in size far too quickly. A simple test cluster with no active load is already up to 50 SANs, while our production cluster would have SAN lists with almost a thousand entries for each master.

ananace and others added 2 commits April 13, 2023 13:45
Should hopefully offer a different path to perform the same task as the
reverted changes, until a better solution can be made
@ananace
Copy link
Member Author

ananace commented Apr 13, 2023

I've also added an $addn_names parameter to k8s::server::etcd, so that additional IP addresses can be specified for the non-default address use-case. It's slightly less optimal than automatically generating the list, but at least it won't cause issues for the common use-case.

@ananace ananace merged commit 7f26557 into master Apr 13, 2023
@ananace ananace deleted the revert-32-more_sans branch April 13, 2023 12:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants