{"action":"created","issue":{"url":"https://api.github.com/repos/projectcalico/calico/issues/1058","repository_url":"https://api.github.com/repos/projectcalico/calico","labels_url":"https://api.github.com/repos/projectcalico/calico/issues/1058/labels{/name}","comments_url":"https://api.github.com/repos/projectcalico/calico/issues/1058/comments","events_url":"https://api.github.com/repos/projectcalico/calico/issues/1058/events","html_url":"https://github.com/projectcalico/calico/issues/1058","id":164022168,"number":1058,"title":"If Felix can't authenticate etcd cert, it keeps going","user":{"login":"fasaxc","id":469264,"avatar_url":"https://avatars.githubusercontent.com/u/469264?v=3","gravatar_id":"","url":"https://api.github.com/users/fasaxc","html_url":"https://github.com/fasaxc","followers_url":"https://api.github.com/users/fasaxc/followers","following_url":"https://api.github.com/users/fasaxc/following{/other_user}","gists_url":"https://api.github.com/users/fasaxc/gists{/gist_id}","starred_url":"https://api.github.com/users/fasaxc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fasaxc/subscriptions","organizations_url":"https://api.github.com/users/fasaxc/orgs","repos_url":"https://api.github.com/users/fasaxc/repos","events_url":"https://api.github.com/users/fasaxc/events{/privacy}","received_events_url":"https://api.github.com/users/fasaxc/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/projectcalico/calico/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/projectcalico/calico/labels/felix","name":"felix","color":"5319e7"},{"url":"https://api.github.com/repos/projectcalico/calico/labels/priority:medium","name":"priority:medium","color":"fef2c0"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-07-06T08:15:39Z","updated_at":"2016-07-06T08:17:52Z","closed_at":null,"body":"Customer hit the following:\r\n\r\n> Interestingly, if felix can’t authenticate a certificate (because we haven’t given it the CA cert yet), it still pulls its config down from etcd. It warns that there’s an error:\r\n\r\n```\r\n/usr/local/calico-felix/urllib3/connectionpool.py:838: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/security.html\r\n```\r\n\r\n> Also, that only gets logged to the console, not either of felix.log or felix-etcd.log\r\n\r\nI think when we do have the CA certificate configured we do check it but we should probably fail in the above case."},"comment":{"url":"https://api.github.com/repos/projectcalico/calico/issues/comments/230707884","html_url":"https://github.com/projectcalico/calico/issues/1058#issuecomment-230707884","issue_url":"https://api.github.com/repos/projectcalico/calico/issues/1058","id":230707884,"user":{"login":"Lukasa","id":1382556,"avatar_url":"https://avatars.githubusercontent.com/u/1382556?v=3","gravatar_id":"","url":"https://api.github.com/users/Lukasa","html_url":"https://github.com/Lukasa","followers_url":"https://api.github.com/users/Lukasa/followers","following_url":"https://api.github.com/users/Lukasa/following{/other_user}","gists_url":"https://api.github.com/users/Lukasa/gists{/gist_id}","starred_url":"https://api.github.com/users/Lukasa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Lukasa/subscriptions","organizations_url":"https://api.github.com/users/Lukasa/orgs","repos_url":"https://api.github.com/users/Lukasa/repos","events_url":"https://api.github.com/users/Lukasa/events{/privacy}","received_events_url":"https://api.github.com/users/Lukasa/received_events","type":"User","site_admin":false},"created_at":"2016-07-06T08:17:52Z","updated_at":"2016-07-06T08:17:52Z","body":"You have two issues there.\r\n\r\nFirstly, that's a warning. You'll need to intercept where Python warnings go.\r\n\r\nThe second issue is probably in python-etcd, specifically [here](https://github.com/projectcalico/python-etcd/blob/master/src/etcd/client.py#L171-L173): you only set `cert_reqs=CERT_REQUIRED` if you've provided a CA certificate to validate. That means that python-etcd defaults to not checking the TLS certificate."}}
{"actor":{"display_login":"Lukasa"}}