{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/14723","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/14723/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/14723/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/14723/events","html_url":"https://github.com/kubernetes/kubernetes/issues/14723","id":108832231,"number":14723,"title":"kube-apiserver tls cert does not work if no client-ca-file specified","user":{"login":"gouyang","id":1418734,"avatar_url":"https://avatars.githubusercontent.com/u/1418734?v=3","gravatar_id":"","url":"https://api.github.com/users/gouyang","html_url":"https://github.com/gouyang","followers_url":"https://api.github.com/users/gouyang/followers","following_url":"https://api.github.com/users/gouyang/following{/other_user}","gists_url":"https://api.github.com/users/gouyang/gists{/gist_id}","starred_url":"https://api.github.com/users/gouyang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gouyang/subscriptions","organizations_url":"https://api.github.com/users/gouyang/orgs","repos_url":"https://api.github.com/users/gouyang/repos","events_url":"https://api.github.com/users/gouyang/events{/privacy}","received_events_url":"https://api.github.com/users/gouyang/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/area/security","name":"area/security","color":"d4c5f9"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/priority/P1","name":"priority/P1","color":"eb6420"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/team/CSI","name":"team/CSI","color":"d2b48c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-09-29T09:38:07Z","updated_at":"2015-09-29T14:23:10Z","closed_at":null,"body":"Only tls cert and key file specified, which means no client cert authentication here, does not work.\r\nIt should be work.\r\n```\r\n# kube-apiserver --service-cluster-ip-range=10.254.0.0/16  --etcd-servers=http://127.0.0.1:2379 --tls-cert-file=/etc/ssl/certs/host.crt --tls-private-key-file=/etc/ssl/certs/host.key\r\nI0929 17:22:23.726220   15841 plugins.go:69] No cloud provider specified.\r\nI0929 17:22:24.063938   15841 master.go:273] Node port range unspecified. Defaulting to 30000-32767.\r\nI0929 17:22:24.065227   15841 master.go:295] Will report 172.16.2.5 as public IP address.\r\n[restful] 2015/09/29 17:22:24 log.go:30: [restful/swagger] listing is available at https://10.73.2.5:6443/swaggerapi/\r\n[restful] 2015/09/29 17:22:24 log.go:30: [restful/swagger] https://172.16.2.5:6443/swaggerui/ is mapped to folder /swagger-ui/\r\nI0929 17:22:24.098802   15841 server.go:441] Serving securely on 0.0.0.0:6443\r\nI0929 17:22:24.098820   15841 server.go:483] Serving insecurely on 127.0.0.1:8080\r\n\r\n# curl --cacert /etc/ssl/certs/rootCA.crt https://test1.redhat.com:6443\r\nUnauthorized\r\n# kubectl -s https://test1.redhat.com:6443 --certificate-authority=/etc/ssl/certs/rootCA.crt api-versions \r\nPlease enter Username:\r\n```\r\n\r\nspecified with client-ca-file, works as expected\r\n```\r\n# kube-apiserver --service-cluster-ip-range=10.254.0.0/16  --etcd-servers=http://127.0.0.1:2379 client-ca-file=/etc/ssl/certs/rootCA.crt --tls-cert-file=/etc/ssl/certs/host.crt --tls-private-key-file=/etc/ssl/certs/host.key\r\nI0929 17:33:07.420204   16349 plugins.go:69] No cloud provider specified.\r\nI0929 17:33:07.649465   16349 master.go:273] Node port range unspecified. Defaulting to 30000-32767.\r\nI0929 17:33:07.650717   16349 master.go:295] Will report 10.73.2.5 as public IP address.\r\n[restful] 2015/09/29 17:33:07 log.go:30: [restful/swagger] listing is available at https://10.73.2.5:6443/swaggerapi/\r\n[restful] 2015/09/29 17:33:07 log.go:30: [restful/swagger] https://10.73.2.5:6443/swaggerui/ is mapped to folder /swagger-ui/\r\nI0929 17:33:07.682704   16349 server.go:441] Serving securely on 0.0.0.0:6443\r\nI0929 17:33:07.682738   16349 server.go:483] Serving insecurely on 127.0.0.1:8080\r\n\r\n\r\n# curl --cacert /etc/ssl/certs/rootCA.crt --cert ^C\r\n# kubectl -s https://test1.redhat.com:6443 --certificate-authority=/etc/ssl/certs/rootCA.crt --client-certificate=/etc/ssl/certs/host.crt --client-key=/etc/ssl/certs/host.key api-versions \r\nAvailable Server Api Versions: v1\r\n# curl --cacert /etc/ssl/certs/rootCA.crt --cert /etc/ssl/certs/host.crt --key /etc/ssl/certs/host.key https://test1.redhat.com:6443\r\n{\r\n  \"paths\": [\r\n    \"/api\",\r\n    \"/api/v1\",\r\n    \"/healthz\",\r\n    \"/healthz/ping\",\r\n    \"/logs/\",\r\n    \"/metrics\",\r\n    \"/resetMetrics\",\r\n    \"/swagger-ui/\",\r\n    \"/swaggerapi/\",\r\n    \"/ui/\",\r\n    \"/version\"\r\n  ]\r\n```"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/144075772","html_url":"https://github.com/kubernetes/kubernetes/issues/14723#issuecomment-144075772","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/14723","id":144075772,"user":{"login":"liggitt","id":980082,"avatar_url":"https://avatars.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"created_at":"2015-09-29T14:23:10Z","updated_at":"2015-09-29T14:23:10Z","body":"tls cert/key just enables https serving, not client cert auth"}}