From a9c2b73d3123c1effd002d72ae1e82f598e2f296 Mon Sep 17 00:00:00 2001
From: Dasmat Hansda <164524276+Dasmat13@users.noreply.github.com>
Date: Mon, 28 Sep 2026 13:02:33 +0530
Subject: [PATCH] fix: ensure consistent etcd certificate permissions on first
 etcd node (#13367)

* fix(etcd): ensure consistent certificate permissions on first etcd node

The etcd certificate generation script runs on the first etcd node and
creates certs with default ownership and permissions. Subsequent copy
tasks set explicit ownership and permissions on the remaining etcd
nodes, resulting in inconsistent permissions across the cluster.

This can cause issues such as etcd backup jobs failing on the first
node due to missing read access to certificate files.

Add an ansible.builtin.file task after cert generation to explicitly
set the correct ownership and permissions on the first etcd node.

* fix(etcd): guard client certificate permissions

* fix(etcd): set certificate permissions during installation
---
 roles/etcd/templates/make-ssl-etcd.sh.j2 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/etcd/templates/make-ssl-etcd.sh.j2 b/roles/etcd/templates/make-ssl-etcd.sh.j2
index 11d555bd2..f2aa02c30 100644
--- a/roles/etcd/templates/make-ssl-etcd.sh.j2
+++ b/roles/etcd/templates/make-ssl-etcd.sh.j2
@@ -101,5 +101,5 @@ if [ -e "$SSLDIR/ca-key.pem" ]; then
 fi
 
 if [ -n "$(ls -A *.pem)" ]; then
-    mv *.pem ${SSLDIR}/
+    install -o {{ etcd_owner | quote }} -g {{ etcd_cert_group | quote }} -m 0640 -- *.pem "${SSLDIR}/"
 fi