Merge pull request #1893 from dominicgunn/feature/v0.16.x-etcd-san

[v0.16.x] Fix etcd certificates when using private zones
kubernetes-retired · Aug 18, 2020 · b06335b · b06335b
2 parents 2260379 + 5720dae
commit b06335b
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 8 deletions.
diff --git a/pkg/model/etcd_cluster.go b/pkg/model/etcd_cluster.go
@@ -45,6 +45,11 @@ func (c EtcdCluster) DNSNames() []string {
 			dnsName = fmt.Sprintf("*.%s", c.region.PrivateDomainName())
 		}
 	}
+
+	privateDomainSan := fmt.Sprintf("*.%s", c.region.PrivateDomainName())
+	if dnsName != privateDomainSan && c.GetMemberIdentityProvider() == api.MemberIdentityProviderENI {
+		return []string{dnsName, privateDomainSan}
+	}
 	return []string{dnsName}
 }
 

diff --git a/pkg/model/etcd_cluster_test.go b/pkg/model/etcd_cluster_test.go
@@ -22,15 +22,15 @@ func TestEtcdClusterDNSNames(t *testing.T) {
 				actual := cluster.DNSNames()
 				expected := []string{"*.ec2.internal"}
 				if !reflect.DeepEqual(actual, expected) {
-					t.Errorf("invalid dns names: expecetd=%v, got=%v", expected, actual)
+					t.Errorf("invalid dns names: expected=%v, got=%v", expected, actual)
 				}
 			})
 			t.Run("us-west-1", func(t *testing.T) {
 				cluster := NewEtcdCluster(config, usWest1, etcdNet, etcdCount)
 				actual := cluster.DNSNames()
 				expected := []string{"*.us-west-1.compute.internal"}
 				if !reflect.DeepEqual(actual, expected) {
-					t.Errorf("invalid dns names: expecetd=%v, got=%v", expected, actual)
+					t.Errorf("invalid dns names: expected=%v, got=%v", expected, actual)
 				}
 			})
 		})
@@ -42,17 +42,17 @@ func TestEtcdClusterDNSNames(t *testing.T) {
 			t.Run("us-east-1", func(t *testing.T) {
 				cluster := NewEtcdCluster(config, usEast1, etcdNet, etcdCount)
 				actual := cluster.DNSNames()
-				expected := []string{"*.internal.example.com"}
+				expected := []string{"*.internal.example.com", "*.ec2.internal"}
 				if !reflect.DeepEqual(actual, expected) {
-					t.Errorf("invalid dns names: expecetd=%v, got=%v", expected, actual)
+					t.Errorf("invalid dns names: expected=%v, got=%v", expected, actual)
 				}
 			})
 			t.Run("us-west-1", func(t *testing.T) {
 				cluster := NewEtcdCluster(config, usWest1, etcdNet, etcdCount)
 				actual := cluster.DNSNames()
-				expected := []string{"*.internal.example.com"}
+				expected := []string{"*.internal.example.com", "*.us-west-1.compute.internal"}
 				if !reflect.DeepEqual(actual, expected) {
-					t.Errorf("invalid dns names: expecetd=%v, got=%v", expected, actual)
+					t.Errorf("invalid dns names: expected=%v, got=%v", expected, actual)
 				}
 			})
 		})
@@ -67,15 +67,15 @@ func TestEtcdClusterDNSNames(t *testing.T) {
 			actual := cluster.DNSNames()
 			expected := []string{"*.compute-1.amazonaws.com"}
 			if !reflect.DeepEqual(actual, expected) {
-				t.Errorf("invalid dns names: expecetd=%v, got=%v", expected, actual)
+				t.Errorf("invalid dns names: expected=%v, got=%v", expected, actual)
 			}
 		})
 		t.Run("us-west-1", func(t *testing.T) {
 			cluster := NewEtcdCluster(config, usWest1, etcdNet, etcdCount)
 			actual := cluster.DNSNames()
 			expected := []string{"*.us-west-1.compute.amazonaws.com"}
 			if !reflect.DeepEqual(actual, expected) {
-				t.Errorf("invalid dns names: expecetd=%v, got=%v", expected, actual)
+				t.Errorf("invalid dns names: expected=%v, got=%v", expected, actual)
 			}
 		})
 	})