Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Wrong certificate name when using cert manager and Istio #163

Open
zs-ko opened this issue Apr 18, 2023 · 1 comment
Open

Wrong certificate name when using cert manager and Istio #163

zs-ko opened this issue Apr 18, 2023 · 1 comment
Assignees

Comments

@zs-ko
Copy link

zs-ko commented Apr 18, 2023

When using cert-manager to provision node and client certificates the nodes tries to use node.0.0.0.0:7200 for their certificate names, but should rather be using node name instead of rpc address. Only when istio is enabled

if [[ $sameRootCA -eq 0 ]]; then
            echo "Refreshing tls certs at /opt/certs/yugabyte/";
            cp /home/yugabyte/cert-manager/tls.crt /opt/certs/yugabyte/node.0.0.0.0:7100.crt;
            cp /home/yugabyte/cert-manager/tls.key /opt/certs/yugabyte/node.0.0.0.0:7100.key;

this could be used instead and it would resolve the problem
$(HOSTNAME).yugabyte-yb-masters.$(NAMESPACE).svc.cluster.local:7100.crt/key

To fix this issue for now i had to add the following to values

 gflags:
  master:
    cert_node_filename: 0.0.0.0:7100
  tserver:
    cert_node_filename: 0.0.0.0:7100
@zs-ko zs-ko changed the title Wrong certificate name when using cert manager Wrong certificate name when using cert manager and Istio Apr 18, 2023
@iSignal
Copy link
Contributor

iSignal commented Apr 18, 2023

Thanks for the report @zs-ko ! cc @bhavin192 @baba230896

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants