Max Gautier 37f7a86014

etcd-certs: only change necessary permissions (#12908) ...

We currently **recursively** set the permissions of /etc/ssl/etcd/ssl
(default path) to 700. But this removes group permission from the files
under it, and certain composents (like calio with etcd datastore) rely
on it ; thus, the upgrade of a cluster can fail because the
calico-kube-controller can't access the certs, and thus the etcd.

This works in other case because as far as I can tell, the apiserver
which do access the etcd run as root (the owner of the files, not just
the "group owner")

We also for some reasons do this twice.

Only create the etcd cert directory with the correct permissions once,
not recursively.

2026-01-27 20:25:52 +05:30

..

handlers

refact ip stack (#11953)

2025-02-11 03:37:58 -08:00

meta

Decouple etcd defaults in a separate role

2025-05-16 14:51:29 +02:00

tasks

etcd-certs: only change necessary permissions (#12908)

2026-01-27 20:25:52 +05:30

templates

Do not use apiserver LB in etcd certificates

2026-01-15 16:50:45 +01:00