PWX-31462: use caFile option if trustedCAFile is not provided

portworx / kvdb

Generic Key-Value interface

Apache License 2.0

40 stars 13 forks source link

Closed pureneelesh closed 1 year ago

pureneelesh commented 1 year ago

What this PR does / why we need it: caFile option has been removed in etcd 3.4. So, pass caFile as trustedCAFile to avoid breaking clients.

Which issue(s) this PR fixes (optional) PWX-31462

Special notes for your reviewer: no testing done yet

zoxpx commented 1 year ago

Sorry for the late feedback --

note that there is also a "global CA" available, and implemented a while back (done by passing -CA /host/dir/CA.crt to the px-runc)
when we introduce CA-cert globally, it'll automatically fix SSL-certificates evaluation for the whole container (i.e. not just px and kvdb but also curl/wget and shell-scripts, etc)