{"action":"created","issue":{"url":"https://api.github.com/repos/kelseyhightower/confd/issues/364","labels_url":"https://api.github.com/repos/kelseyhightower/confd/issues/364/labels{/name}","comments_url":"https://api.github.com/repos/kelseyhightower/confd/issues/364/comments","events_url":"https://api.github.com/repos/kelseyhightower/confd/issues/364/events","html_url":"https://github.com/kelseyhightower/confd/issues/364","id":119839276,"number":364,"title":"No support for etcd TLS server-only authentication","user":{"login":"TrimBiggs","id":1302077,"avatar_url":"https://avatars.githubusercontent.com/u/1302077?v=3","gravatar_id":"","url":"https://api.github.com/users/TrimBiggs","html_url":"https://github.com/TrimBiggs","followers_url":"https://api.github.com/users/TrimBiggs/followers","following_url":"https://api.github.com/users/TrimBiggs/following{/other_user}","gists_url":"https://api.github.com/users/TrimBiggs/gists{/gist_id}","starred_url":"https://api.github.com/users/TrimBiggs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TrimBiggs/subscriptions","organizations_url":"https://api.github.com/users/TrimBiggs/orgs","repos_url":"https://api.github.com/users/TrimBiggs/repos","events_url":"https://api.github.com/users/TrimBiggs/events{/privacy}","received_events_url":"https://api.github.com/users/TrimBiggs/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-12-02T00:21:04Z","updated_at":"2015-12-03T00:26:15Z","closed_at":null,"body":"There is support for creating an etcd client object that can access a TLS etcd server with client certificate authentication.  However, there does not seem to be support for accessing a TLS etcd server with JUST server CA authentication (eg. [Etcd Security Model Example 1](https://github.com/coreos/etcd/blob/master/Documentation/security.md#example-1-client-to-server-transport-security-with-https)).\r\n\r\nI found this by running an etcd server, passing in `--cert-file \"/etc/certs/server.crt\"  --key-file \"/etc/certs/server.key\"`.  I can access the server just fine using `curl` or `etcdctl` by passing in the CA certificate for the CA that signed the server's key pair.  With confd, I see an error saying that it cannot access etcd.\r\n\r\nI can see in [`client.go`](https://github.com/kelseyhightower/confd/blob/bec0b60ec4331f3a3ee1db104f46983a6f035798/src/github.com/kelseyhightower/confd/backends/etcd/client.go#L18) that a NewEtcdClient can be creating with `caCert`, but this also requires a `key` and `cert` for TLS.  There should be a way to just specify the CA certificate without key/cert, as referenced in the main etcd documentation.\r\n\r\nI've also raised an issue with coreos/goetcd, https://github.com/coreos/go-etcd/issues/248, since I imagine this is partly due to goetcd not supporting this yet."},"comment":{"url":"https://api.github.com/repos/kelseyhightower/confd/issues/comments/161475597","html_url":"https://github.com/kelseyhightower/confd/issues/364#issuecomment-161475597","issue_url":"https://api.github.com/repos/kelseyhightower/confd/issues/364","id":161475597,"user":{"login":"bacongobbler","id":1360539,"avatar_url":"https://avatars.githubusercontent.com/u/1360539?v=3","gravatar_id":"","url":"https://api.github.com/users/bacongobbler","html_url":"https://github.com/bacongobbler","followers_url":"https://api.github.com/users/bacongobbler/followers","following_url":"https://api.github.com/users/bacongobbler/following{/other_user}","gists_url":"https://api.github.com/users/bacongobbler/gists{/gist_id}","starred_url":"https://api.github.com/users/bacongobbler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bacongobbler/subscriptions","organizations_url":"https://api.github.com/users/bacongobbler/orgs","repos_url":"https://api.github.com/users/bacongobbler/repos","events_url":"https://api.github.com/users/bacongobbler/events{/privacy}","received_events_url":"https://api.github.com/users/bacongobbler/received_events","type":"User","site_admin":false},"created_at":"2015-12-03T00:26:14Z","updated_at":"2015-12-03T00:26:14Z","body":"related: https://github.com/kelseyhightower/confd/issues/345"}}