AUTH-296: work out etcd certificates

[stlaz]

I was not yet able to learn what's important for etcd serving/peer certs so I'm going with minimal config where client certificates only follow the kube CN and O schemes, and serving certificates get their hostnames in DNS/IPs SANs.

The PR is rebased on top of #970 and can only merge once this one merges.

It's very likely that we may not see any failures in etcd because no peer communication is likely to happen with just one etcd instance. I'll need to test the cert setup with at least 2 etcds or ask someone with the necessary knowledge about how the peer certs should look like.

[stlaz]

This PR now follows the certificate configuration from https://github.com/stlaz/etcd-certs.

[stlaz]

/test e2e-openshift-conformance-sig-node

[oglok]

What's the purpose of the .image_references empty file? What do we gain in terms of security by making this repo unimportable?

[stlaz]

What's the purpose of the .image_references empty file? What do we gain in terms of security by making this repo unimportable?

I do not know its purpose. The repository is currently unimportable because the filename is malformed, the commit is fixing it.

[pmtk]

/retest

[oglok]

/lgtm

[stlaz]

somehow a lonely ultimateTrustBundle variable appeared in the code, removed now, all tests should hopefully pass again 🙂

[stlaz]

/test periodic-ocp-4.13-images

[openshift-ci]

@stlaz: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/periodic-ocp-4.13-images	f147665	link	true	/test periodic-ocp-4.13-images

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[stlaz]

/retest

[stlaz]

@oglok I think this might be good for re-tagging 🙂

[oglok]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: oglok, stlaz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [oglok,stlaz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment