Merge pull request #3159 from coverprice/tls_fix

modules: force etcd TLS client auth
coreos · Apr 5, 2018 · 4e4d3d0 · 4e4d3d0
2 parents a997a2a + 1ab94f6
commit 4e4d3d0
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/contrib/internal-cluster/vpn.tf b/contrib/internal-cluster/vpn.tf
@@ -19,7 +19,7 @@ data "aws_ami" "openvpn_ami" {
 
   filter {
     name   = "owner-id"
-    values = ["573553919781"]
+    values = ["679593333241"]
   }
 }
 

diff --git a/modules/ignition/etcd.tf b/modules/ignition/etcd.tf
@@ -13,11 +13,13 @@ EOF
 
   cert_options = <<EOF
 --cert-file=/etc/ssl/etcd/server.crt \
+  --client-cert-auth=true \
   --key-file=/etc/ssl/etcd/server.key \
   --peer-cert-file=/etc/ssl/etcd/peer.crt \
   --peer-key-file=/etc/ssl/etcd/peer.key \
   --peer-trusted-ca-file=/etc/ssl/etcd/ca.crt \
-  --peer-client-cert-auth=trueEOF
+  --peer-client-cert-auth=true \
+  --trusted-ca-file=/etc/ssl/etcd/ca.crtEOF
 }
 
 data "template_file" "etcd_names" {