{"action":"created","issue":{"url":"https://api.github.com/repos/coreos/flannel/issues/365","repository_url":"https://api.github.com/repos/coreos/flannel","labels_url":"https://api.github.com/repos/coreos/flannel/issues/365/labels{/name}","comments_url":"https://api.github.com/repos/coreos/flannel/issues/365/comments","events_url":"https://api.github.com/repos/coreos/flannel/issues/365/events","html_url":"https://github.com/coreos/flannel/issues/365","id":116552011,"number":365,"title":"Change ca-certificate folder, or make it at least changeable","user":{"login":"xoss","id":1513433,"avatar_url":"https://avatars.githubusercontent.com/u/1513433?v=3","gravatar_id":"","url":"https://api.github.com/users/xoss","html_url":"https://github.com/xoss","followers_url":"https://api.github.com/users/xoss/followers","following_url":"https://api.github.com/users/xoss/following{/other_user}","gists_url":"https://api.github.com/users/xoss/gists{/gist_id}","starred_url":"https://api.github.com/users/xoss/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xoss/subscriptions","organizations_url":"https://api.github.com/users/xoss/orgs","repos_url":"https://api.github.com/users/xoss/repos","events_url":"https://api.github.com/users/xoss/events{/privacy}","received_events_url":"https://api.github.com/users/xoss/received_events","type":"User","site_admin":false},"labels":[{"id":264375589,"url":"https://api.github.com/repos/coreos/flannel/labels/area/configuration","name":"area/configuration","color":"bfe5bf","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2015-11-12T13:49:39Z","updated_at":"2016-12-21T19:13:04Z","closed_at":null,"body":"The entire documentation of coreos says, that ca.pem should be  put to `/etc/ssl/certs`, as this folder consists of the trusted ca.\n Strange enough, the flanneld service maps following volumes into the docker container:\n\n``` bash\nExecStart=/usr/libexec/sdnotify-proxy /run/flannel/sd.sock \\\n  /usr/bin/docker run --net=host --privileged=true --rm \\\n  --volume=/run/flannel:/run/flannel \\\n  --env=NOTIFY_SOCKET=/run/flannel/sd.sock \\\n  --env=AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} \\\n  --env=AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} \\\n  --env-file=${FLANNEL_ENV_FILE} \\\n  --volume=/usr/share/ca-certificates:/etc/ssl/certs:ro \\\n  --volume=${ETCD_SSL_DIR}:/etc/ssl/etcd:ro \\\n  quay.io/coreos/flannel:${FLANNEL_VER} /opt/bin/flanneld --ip-masq=true\n```\n1. `/usr/share/ca-certificates` is the read-only coreos partition\n2. `${ETCD_SSL_DIR}` should contain the `client.pem` and `client-key.pem` files,  but not the `ca.pem`. This should be stored in `/etc/ssl/certs`.\n   Within the container, `ca.pem` file is not found, since the path `/etc/ssl/certs/ca.pem` does not exists because of obvious reasons.\n\nEither add a ${OPTIONS_VOLUME_ENV} variable to make this behavior changeable,\nor map hosts `/etc/ssl/certs:/etc/ssl/certs:ro` into the container instead of `/usr/share/ca-certificates`\n"},"comment":{"url":"https://api.github.com/repos/coreos/flannel/issues/comments/268613313","html_url":"https://github.com/coreos/flannel/issues/365#issuecomment-268613313","issue_url":"https://api.github.com/repos/coreos/flannel/issues/365","id":268613313,"user":{"login":"vboginskey","id":6887135,"avatar_url":"https://avatars.githubusercontent.com/u/6887135?v=3","gravatar_id":"","url":"https://api.github.com/users/vboginskey","html_url":"https://github.com/vboginskey","followers_url":"https://api.github.com/users/vboginskey/followers","following_url":"https://api.github.com/users/vboginskey/following{/other_user}","gists_url":"https://api.github.com/users/vboginskey/gists{/gist_id}","starred_url":"https://api.github.com/users/vboginskey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vboginskey/subscriptions","organizations_url":"https://api.github.com/users/vboginskey/orgs","repos_url":"https://api.github.com/users/vboginskey/repos","events_url":"https://api.github.com/users/vboginskey/events{/privacy}","received_events_url":"https://api.github.com/users/vboginskey/received_events","type":"User","site_admin":false},"created_at":"2016-12-21T19:13:04Z","updated_at":"2016-12-21T19:13:04Z","body":"This doesn't appear to be the case anymore:\r\n\r\n```\r\ncore@ip-10-88-20-186 /etc/ssl/certs $ ls -l *.pem | head -5\r\n-rw-r--r--. 1 root root 1383 Dec  7 09:11 A-Trust-nQual-03.pem\r\n-rw-r--r--. 1 root root 2772 Dec  7 09:11 ACCVRAIZ1.pem\r\n-rw-r--r--. 1 root root 2041 Dec  7 09:11 ACEDICOM_Root.pem\r\n-rw-r--r--. 1 root root 2281 Dec  7 09:11 AC_Raíz_Certicámara_S.A..pem\r\n-rw-r--r--. 1 root root 2049 Dec  7 09:11 Actalis_Authentication_Root_CA.pem\r\n```\r\n\r\nflanneld shouldn't enforce a separate SSL directory for certs and keys that work just fine when placed in the standard locations `/etc/ssl/certs` and `/etc/ssl/private`."}}
{"actor":{"display_login":"vboginskey"}}