Generation of certificates and keys for etcd gated if etcd is disabled. (#6998)

Problem: When support for etcd was added in 39571424, generation of certificates and keys for etcd was not gated behind use of managed etcd. Keys are generated and distributed across servers even if managed etcd is not enabled. Solution: Allow generation of certificates and keys only if managed etc is enabled. Check config.DisableETCD flag. Signed-off-by: Bartossh <lenartconsulting@gmail.com>

Generation of certificates and keys for etcd gated if etcd is disabled. (#6998)
34617390 · Bartosz Lenart · GitHub · 2eddfe6c · 34617390
Unverified Commit 34617390 authored Jul 11, 2023 by Bartosz Lenart Committed by GitHub Jul 11, 2023
Hide whitespace changes
Inline Side-by-side

Showing with 12 additions and 7 deletions

deps.go pkg/daemons/control/deps/deps.go +12 -7

No files found.
--- a/pkg/daemons/control/deps/deps.go
+++ b/pkg/daemons/control/deps/deps.go
@@ -446,6 +446,7 @@ func genServerCerts(config *config.Control) error {
 }

 func genETCDCerts(config *config.Control) error {
+
 	runtime := config.Runtime
 	regen, err := createSigningCertKey("etcd-server", runtime.ETCDServerCA, runtime.ETCDServerCAKey)
 	if err != nil {
@@ -455,13 +456,6 @@ func genETCDCerts(config *config.Control) error {
 	altNames := &certutil.AltNames{}
 	addSANs(altNames, config.SANs)

-	if _, err := createClientCertKey(regen, "etcd-server", nil,
-		altNames, []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
-		runtime.ETCDServerCA, runtime.ETCDServerCAKey,
-		runtime.ServerETCDCert, runtime.ServerETCDKey); err != nil {
-		return err
-	}
-
 	if _, err := createClientCertKey(regen, "etcd-client", nil,
 		nil, []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
 		runtime.ETCDServerCA, runtime.ETCDServerCAKey,
@@ -481,6 +475,17 @@ func genETCDCerts(config *config.Control) error {
 		return err
 	}

+	if config.DisableETCD {
+		return nil
+	}
+
+	if _, err := createClientCertKey(regen, "etcd-server", nil,
+		altNames, []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
+		runtime.ETCDServerCA, runtime.ETCDServerCAKey,
+		runtime.ServerETCDCert, runtime.ServerETCDKey); err != nil {
+		return err
+	}
+
 	return nil
 }