The number of TLS configuration flags needed to secure a backend is too high

[cwjohnston]

Expected Behavior

For simple scenarios, only one certificate, key and trusted CA need be specified in the backend configuration to secure all listening ports.

Current Behavior

Securing all listening ports with a single TLS certificate/key pair requires providing values for the following parameters:

• etcd-cert-file
• etcd-key-file
• etcd-trusted-ca-file
• etcd-peer-cert-file
• etcd-peer-key-file
• etcd-peer-trusted-ca-file
• cert-file
• key-file
• trusted-ca-file

Possible Solution

Allow cert-file, key-file and trusted-ca-file values to act as defaults for corresponding flags prefixed with etcd- and etcd-peer-.

Context

[echlebek]

Something we can address in 6.0!

[portertech]

I am concerned that setting a default value for the etcd keys could be problematic as it would force encryption when it may not be desired. Further discussion is needed, removing from the 6.0 milestone.

[portertech]

Cyril's comment: "we intentionally split these out in response to user demand"

[portertech]

@cwjohnston I would like us to discuss this one before I close it.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.