{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/36577","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/36577/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/36577/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/36577/events","html_url":"https://github.com/kubernetes/kubernetes/issues/36577","id":188493971,"number":36577,"title":"Evaluate usage of system certificates in client component.","user":{"login":"kad","id":41858,"avatar_url":"https://avatars.githubusercontent.com/u/41858?v=3","gravatar_id":"","url":"https://api.github.com/users/kad","html_url":"https://github.com/kad","followers_url":"https://api.github.com/users/kad/followers","following_url":"https://api.github.com/users/kad/following{/other_user}","gists_url":"https://api.github.com/users/kad/gists{/gist_id}","starred_url":"https://api.github.com/users/kad/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kad/subscriptions","organizations_url":"https://api.github.com/users/kad/orgs","repos_url":"https://api.github.com/users/kad/repos","events_url":"https://api.github.com/users/kad/events{/privacy}","received_events_url":"https://api.github.com/users/kad/received_events","type":"User","site_admin":false},"labels":[{"id":138247961,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/component/kubectl","name":"component/kubectl","color":"0052cc","default":false},{"id":173493835,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/team/CSI-API%20Machinery%20SIG","name":"team/CSI-API Machinery SIG","color":"d2b48c","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-11-10T12:19:20Z","updated_at":"2016-11-10T12:33:33Z","closed_at":null,"body":"**Is this a request for help?** (If yes, you should use our troubleshooting guide and community support channels, see http://kubernetes.io/docs/troubleshooting/.): no.\r\n\r\n\r\n**What keywords did you search in Kubernetes issues before filing this one?** (If you have found any duplicates, you should instead reply there.): certs, client, system, pki\r\n\r\n---\r\n\r\n**Is this a BUG REPORT or FEATURE REQUEST?** (choose one): feature request/code refactoring.\r\n\r\n**Kubernetes version** (use `kubectl version`): master branch, after 1.5 branch of.\r\n\r\n\r\n**Environment**:\r\n- **Cloud provider or hardware configuration**: none\r\n- **OS** (e.g. from /etc/os-release): centos\r\n- **Kernel** (e.g. `uname -a`):\r\n- **Install tools**:\r\n- **Others**:\r\n\r\n\r\n**What happened**:\r\npkg/client/transport/transport.go has function rootCertPool which populates rootCAs for client TLS configuration. Since a093ea34c3168c085c949e292108b4ae9be15784 there is in this function comment:\r\n```go\r\n// What we really want is a copy of x509.systemRootsPool, but that isn't exposed.  It's difficult to build (see the go\r\n// code for a look at the platform specific insanity), so we'll use the fact that RootCAs == nil gives us the system values\r\n// It doesn't allow trusting either/or, but hopefully that won't be an issue\r\n```\r\nNowadays, with Go 1.7 it is possible to get same system CAs via function in crypto/x509: SystemCertPool(). If we want explicitly initialize rootCAs with system defaults, we can do it now.\r\nHowever, current code which sets rootCAs to nil gives practically same effect, just relaying on defaults in standard library.\r\n\r\n**What you expected to happen**:\r\nI'd like to either remove this comment about \"isn't exposed\", or make it explicitly equal to x509.SystemCertPool(). And want to discuss which would be more appropriate.\r\n\r\n**How to reproduce it** (as minimally and precisely as possible):\r\n```console\r\n$ vi pkg/client/transport/transport.go +128\r\n```\r\n\r\n**Anything else do we need to know**:\r\nPotentially, we might want to have combination of defined CA in tls.Config + system default CAs,\r\nbut not sure if that is intended behaviour or would be valuable generic case.\r\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/259678869","html_url":"https://github.com/kubernetes/kubernetes/issues/36577#issuecomment-259678869","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/36577","id":259678869,"user":{"login":"deads2k","id":8225098,"avatar_url":"https://avatars.githubusercontent.com/u/8225098?v=3","gravatar_id":"","url":"https://api.github.com/users/deads2k","html_url":"https://github.com/deads2k","followers_url":"https://api.github.com/users/deads2k/followers","following_url":"https://api.github.com/users/deads2k/following{/other_user}","gists_url":"https://api.github.com/users/deads2k/gists{/gist_id}","starred_url":"https://api.github.com/users/deads2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deads2k/subscriptions","organizations_url":"https://api.github.com/users/deads2k/orgs","repos_url":"https://api.github.com/users/deads2k/repos","events_url":"https://api.github.com/users/deads2k/events{/privacy}","received_events_url":"https://api.github.com/users/deads2k/received_events","type":"User","site_admin":false},"created_at":"2016-11-10T12:33:33Z","updated_at":"2016-11-10T12:33:33Z","body":"Allowing systemcerts + a specified CA bundle seems like a good idea for trusting serving certs (not client certs).\r\n\r\n@kubernetes/sig-auth "}}
{"actor":{"display_login":"deads2k"}}