Description of problem: openshift/kubecsr repo is the canonical home for etcd cert signer. PR #22 added client usage and was merged upstream and is part of master downstream.[1] [1]: https://github.com/openshift/kubecsr/commit/aad75d333646da657e788db93f2ff75da850b542#diff-654ba8df3be94fe94c9404a7727d1fa2 But this was never backported to the openshift-4.1, openshift-4.2 or openshift-4.3. With etcd 3.3.10 the result is an error message during startup > 2019-11-07 14:18:08.592903 I | embed: rejected connection from "127.0.0.1:32972" (error "tls: failed to verify client's certificate: x509: certificate specifies an incompatible key usage", ServerName "") In 3.3.17 we see many more of these errors and the result will be unnecessary bugs and spammy logs. Version-Release number of selected component (if applicable): How reproducible: always Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Backport is complete Additional info:
Verified on 4.3.0-0.nightly-2019-11-13-233341 Server certs work well for command line client: sh-4.2# etcdctl --endpoints 10.0.0.6:2379,10.0.0.3:2379 --cacert=/etc/ssl/etcd/ca.crt --cert=/etc/ssl/etcd/system:etcd-server:etcd-0.mffiedler1114.qe.gcp.devcluster.openshift.com.crt --key=/etc/ssl/etcd/system:etcd-server:etcd-0.mffiedler1114.qe.gcp.devcluster.openshift.com.key endpoint status 10.0.0.6:2379, 414b83dc8591f685, 3.3.17, 255 MB, false, 125, 634130 10.0.0.3:2379, 596ac98681085db0, 3.3.17, 257 MB, true, 125, 634130
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:0062