fix(tls): support auto and cert-manager TLS configs for customized controller

[silentred]

Summary

This PR wires up TLS support on the customized controller so that TLS-enabled etcd clusters can be created successfully. It targets the customized-controller branch and addresses #409.

I tested both the auto and cert-manager TLS configuration types, and both can create a TLS-enabled etcd cluster correctly.

Notes

1. validityDuration cannot use the d suffix (e.g. 365d)

time.ParseDuration cannot parse strings like 365d; v0.2.0 produces the same error. This is by design in the Go standard library — see golang/go#17767.

To make the sample YAML work out of the box, I changed validityDuration to 8760h (= 365 × 24h). With this value, the sample YAML creates an etcd cluster successfully.

If support for parsing the d suffix is desired, it can be addressed in a follow-up PR.

2. Client TLS does not yet handshake with the etcd server

Currently the controller uses the server TLS certificate as the etcd client certificate to talk to the etcd server; it does not use client TLS.

Because the client ca.crt is issued by an independent CA and is not included in the etcd server's --trusted-ca-file, client TLS cannot complete a handshake with the etcd server today.

Future work: bundle the client CA together with the server CA and add the bundle to the etcd server's trust chain (--trusted-ca-file). Once that is in place, client TLS will be able to communicate with the etcd server normally.

/cc @ahrtr @nwnt

[kubernetes-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: silentred
Once this PR has been reviewed and has the lgtm label, please assign ahrtr for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ahrtr]

@silentred I haven't reviewed this PR yet. Please consider breaking down such a huge PR into smaller ones as much as you can. Pls try to fix each relatively independent thing in a separate smaller PR. thx

[silentred]

@silentred I haven't reviewed this PR yet. Please consider breaking down such a huge PR into smaller ones as much as you can. Pls try to fix each relatively independent thing in a separate smaller PR. thx

OK, I will try to break it down after making e2e test passed.

[kubernetes-prow]

@silentred: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-etcd-operator-test-e2e	b97c0cb	link	true	/test pull-etcd-operator-test-e2e

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[silentred]

seperated to 5 sub-tasks:

• tls-step1-sample-and-cert: chore(tls): cleanup sample yaml + auto cert for client auth #430
• tls-step2-etcdutils-options: add TLS options of etcd client used by operator. refactor(etcdutils): encapsulate client settings in ClientConfig struct #431
• tls-step3-mutual-tls: feat(tls): support TLS-aware pods and operator mTLS client identity #434