From 6d5d61ba9efd1c406924669cdc2eb63808b95a95 Mon Sep 17 00:00:00 2001 From: Chris Lu Date: Mon, 19 Oct 2026 02:46:58 -0700 Subject: [PATCH] master: build etcd TLS config when any of ca/client cert/key is set Client certificates were ignored unless a CA file was also supplied, so an etcd server requiring client auth (with a publicly trusted CA) could never be reached. --- weed/server/master_volume_id_allocator.go | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/weed/server/master_volume_id_allocator.go b/weed/server/master_volume_id_allocator.go index 2c40ad5471..958b4ef955 100644 --- a/weed/server/master_volume_id_allocator.go +++ b/weed/server/master_volume_id_allocator.go @@ -25,10 +25,13 @@ func newVolumeIdAllocator(v *util.ViperProxy, topo *topology.Topology) (topology } var tlsConfig *tls.Config - if caFile := v.GetString("master.volume_id_etcd.tls_ca_file"); caFile != "" { + caFile := v.GetString("master.volume_id_etcd.tls_ca_file") + certFile := v.GetString("master.volume_id_etcd.tls_client_crt_file") + keyFile := v.GetString("master.volume_id_etcd.tls_client_key_file") + if caFile != "" || certFile != "" || keyFile != "" { tlsInfo := transport.TLSInfo{ - CertFile: v.GetString("master.volume_id_etcd.tls_client_crt_file"), - KeyFile: v.GetString("master.volume_id_etcd.tls_client_key_file"), + CertFile: certFile, + KeyFile: keyFile, TrustedCAFile: caFile, } if tlsConfig, err = tlsInfo.ClientConfig(); err != nil {