{"action":"created","issue":{"url":"https://api.github.com/repos/envoyproxy/envoy/issues/4162","repository_url":"https://api.github.com/repos/envoyproxy/envoy","labels_url":"https://api.github.com/repos/envoyproxy/envoy/issues/4162/labels{/name}","comments_url":"https://api.github.com/repos/envoyproxy/envoy/issues/4162/comments","events_url":"https://api.github.com/repos/envoyproxy/envoy/issues/4162/events","html_url":"https://github.com/envoyproxy/envoy/issues/4162","id":350838065,"node_id":"MDU6SXNzdWUzNTA4MzgwNjU=","number":4162,"title":"Initialization failure when TLS context is configured","user":{"login":"jmwaniki","id":12450411,"node_id":"MDQ6VXNlcjEyNDUwNDEx","avatar_url":"https://avatars1.githubusercontent.com/u/12450411?v=4","gravatar_id":"","url":"https://api.github.com/users/jmwaniki","html_url":"https://github.com/jmwaniki","followers_url":"https://api.github.com/users/jmwaniki/followers","following_url":"https://api.github.com/users/jmwaniki/following{/other_user}","gists_url":"https://api.github.com/users/jmwaniki/gists{/gist_id}","starred_url":"https://api.github.com/users/jmwaniki/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jmwaniki/subscriptions","organizations_url":"https://api.github.com/users/jmwaniki/orgs","repos_url":"https://api.github.com/users/jmwaniki/repos","events_url":"https://api.github.com/users/jmwaniki/events{/privacy}","received_events_url":"https://api.github.com/users/jmwaniki/received_events","type":"User","site_admin":false},"labels":[{"id":421403912,"node_id":"MDU6TGFiZWw0MjE0MDM5MTI=","url":"https://api.github.com/repos/envoyproxy/envoy/labels/question","name":"question","color":"cc317c","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-08-15T14:47:45Z","updated_at":"2018-08-22T22:15:11Z","closed_at":null,"author_association":"NONE","body":"*Title*: *Initialization failure when TLS context is configured*\r\n\r\n*Description*:\r\n\r\nWhen I add the TLS context as part of the configuration envoy fails to load the private key \r\nfrom the specified path. Envoy should load the private key from the path provided in the \r\nconfiguration. \r\n\r\n*Repro steps*:\r\n\r\nI'm running envoy as a docker image as follows:\r\n\r\n```\r\nFROM envoyproxy/envoy:latest\r\n\r\nCOPY cert.pem /etc/envoy/server-cert.pem\r\nCOPY cert.pem /etc/envoy/server-key.pem\r\n\r\nCOPY service-envoy.yaml /etc/envoy/service-envoy.yaml\r\nCMD /usr/local/bin/envoy -c /etc/envoy/service-envoy.yaml\r\n```\r\n\r\n*Config*:\r\n```\r\n\r\nstatic_resources:\r\n  listeners:\r\n  - address:\r\n      socket_address:\r\n        address: 0.0.0.0\r\n        port_value: 80\r\n    filter_chains:\r\n    - filters:\r\n      - name: envoy.http_connection_manager\r\n        config:\r\n          codec_type: auto\r\n          stat_prefix: ingress_http\r\n          route_config:\r\n            virtual_hosts:\r\n            - name: backend\r\n              domains:\r\n              - \"*\"\r\n              routes:\r\n              - match:\r\n                  prefix: \"/\"\r\n                redirect:\r\n                  path_redirect: \"/\"\r\n                  https_redirect: true\r\n          http_filters:\r\n          - name: envoy.router\r\n            config: {}\r\n  - address:\r\n      socket_address:\r\n        address: 0.0.0.0\r\n        port_value: 443\r\n    filter_chains:\r\n    - filters:\r\n      - name: envoy.http_connection_manager\r\n        config:\r\n          codec_type: auto\r\n          stat_prefix: ingress_http\r\n          route_config:\r\n            name: local_route\r\n            virtual_hosts:\r\n            - name: backend\r\n              domains:\r\n              - \"*\"\r\n              # ...\r\n      tls_context:\r\n        common_tls_context:\r\n          tls_certificates:\r\n            - certificate_chain: { filename: \"/etc/envoy/server-cert.pem\" }\r\n              private_key: { filename: \"/etc/envoy/server-key.pem\" }\r\n  clusters:\r\n  # ...\r\nadmin:\r\n  access_log_path: \"/dev/null\"\r\n  address:\r\n    socket_address:\r\n      address: 0.0.0.0\r\n      port_value: 8081\r\n```\r\n\r\n*Logs*:\r\n```\r\n\r\n[2018-08-15 14:40:58.814][9][info][main] source/server/server.cc:183] initializing epoch 0 (hot restart version=10.200.16384.127.options=capacity=16384, num_slots=8209 hash=228984379728933363 size=2654312)\r\n[2018-08-15 14:40:58.814][9][info][main] source/server/server.cc:185] statically linked extensions:\r\n[2018-08-15 14:40:58.814][9][info][main] source/server/server.cc:187]   access_loggers: envoy.file_access_log,envoy.http_grpc_access_log\r\n[2018-08-15 14:40:58.814][9][info][main] source/server/server.cc:190]   filters.http: envoy.buffer,envoy.cors,envoy.ext_authz,envoy.fault,envoy.filters.http.header_to_metadata,envoy.filters.http.jwt_authn,envoy.filters.http.rbac,envoy.grpc_http1_bridge,envoy.grpc_json_transcoder,envoy.grpc_web,envoy.gzip,envoy.health_check,envoy.http_dynamo_filter,envoy.ip_tagging,envoy.lua,envoy.rate_limit,envoy.router,envoy.squash\r\n[2018-08-15 14:40:58.814][9][info][main] source/server/server.cc:193]   filters.listener: envoy.listener.original_dst,envoy.listener.proxy_protocol,envoy.listener.tls_inspector\r\n[2018-08-15 14:40:58.814][9][info][main] source/server/server.cc:196]   filters.network: envoy.client_ssl_auth,envoy.echo,envoy.ext_authz,envoy.filters.network.thrift_proxy,envoy.http_connection_manager,envoy.mongo_proxy,envoy.ratelimit,envoy.redis_proxy,envoy.tcp_proxy\r\n[2018-08-15 14:40:58.814][9][info][main] source/server/server.cc:198]   stat_sinks: envoy.dog_statsd,envoy.metrics_service,envoy.stat_sinks.hystrix,envoy.statsd\r\n[2018-08-15 14:40:58.814][9][info][main] source/server/server.cc:200]   tracers: envoy.dynamic.ot,envoy.lightstep,envoy.zipkin\r\n[2018-08-15 14:40:58.814][9][info][main] source/server/server.cc:203]   transport_sockets.downstream: envoy.transport_sockets.capture,raw_buffer,tls\r\n[2018-08-15 14:40:58.814][9][info][main] source/server/server.cc:206]   transport_sockets.upstream: envoy.transport_sockets.capture,raw_buffer,tls\r\n[2018-08-15 14:40:58.820][9][info][config] source/server/configuration_impl.cc:50] loading 0 static secret(s)\r\n[2018-08-15 14:40:58.822][9][info][upstream] source/common/upstream/cluster_manager_impl.cc:134] cm init: all clusters initialized\r\n[2018-08-15 14:40:58.822][9][info][config] source/server/configuration_impl.cc:60] loading 2 listener(s)\r\n[2018-08-15 14:40:58.892][9][critical][main] source/server/server.cc:78] error initializing configuration '/etc/envoy/service-envoy.yaml': Failed to load private key from /etc/envoy/server-key.pem\r\n[2018-08-15 14:40:58.892][9][info][main] source/server/server.cc:465] exiting\r\n```"},"comment":{"url":"https://api.github.com/repos/envoyproxy/envoy/issues/comments/415199349","html_url":"https://github.com/envoyproxy/envoy/issues/4162#issuecomment-415199349","issue_url":"https://api.github.com/repos/envoyproxy/envoy/issues/4162","id":415199349,"node_id":"MDEyOklzc3VlQ29tbWVudDQxNTE5OTM0OQ==","user":{"login":"PiotrSikora","id":190297,"node_id":"MDQ6VXNlcjE5MDI5Nw==","avatar_url":"https://avatars3.githubusercontent.com/u/190297?v=4","gravatar_id":"","url":"https://api.github.com/users/PiotrSikora","html_url":"https://github.com/PiotrSikora","followers_url":"https://api.github.com/users/PiotrSikora/followers","following_url":"https://api.github.com/users/PiotrSikora/following{/other_user}","gists_url":"https://api.github.com/users/PiotrSikora/gists{/gist_id}","starred_url":"https://api.github.com/users/PiotrSikora/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/PiotrSikora/subscriptions","organizations_url":"https://api.github.com/users/PiotrSikora/orgs","repos_url":"https://api.github.com/users/PiotrSikora/repos","events_url":"https://api.github.com/users/PiotrSikora/events{/privacy}","received_events_url":"https://api.github.com/users/PiotrSikora/received_events","type":"User","site_admin":false},"created_at":"2018-08-22T22:15:11Z","updated_at":"2018-08-22T22:15:11Z","author_association":"MEMBER","body":"Sorry for the delay, I've missed you reply.\r\n\r\nCould you paste output of:\r\n```\r\n$ ls -ld /etc/ /etc/envoy/\r\n```\r\n```\r\n$ ls -l /etc/envoy/server-key.*\r\n```\r\n\r\nAlso, what user is the Envoy running as? Who's starting the process?"}}
{"actor":{"display_login":"PiotrSikora"}}