kubespray

mirror of https://github.com/kubernetes-sigs/kubespray.git synced 2026-01-29 15:24:46 -03:30

History

etcd-certs: only change necessary permissions (#12908 )

We currently **recursively** set the permissions of /etc/ssl/etcd/ssl
(default path) to 700. But this removes group permission from the files
under it, and certain composents (like calio with etcd datastore) rely
on it ; thus, the upgrade of a cluster can fail because the
calico-kube-controller can't access the certs, and thus the etcd.

This works in other case because as far as I can tell, the apiserver
which do access the etcd run as root (the owner of the files, not just
the "group owner")

We also for some reasons do this twice.

Only create the etcd cert directory with the correct permissions once,
not recursively.

2026-01-27 20:25:52 +05:30

check_certs.yml

Move cilium_deploy_additionnaly to kubespray-default (#12191 )

2025-05-07 05:05:17 -07:00

configure.yml

refact ip stack (#11953 )

2025-02-11 03:37:58 -08:00

gen_certs_script.yml

etcd-certs: only change necessary permissions (#12908 )

2026-01-27 20:25:52 +05:30

gen_nodes_certs_script.yml

Do not use ‘yes/no’ for boolean values (#11472 )