AlinsRan commented on issue #970:
URL:
https://github.com/apache/apisix-helm-chart/issues/970#issuecomment-6619667628
Hi @liangbeirong-byron,
Your `externalEtcd.host` entries are IP addresses, and `etcd.auth.tls.sni`
isn't set. When APISIX connects to etcd, it checks the server certificate
against the SNI name. That check only matches DNS names in the certificate, not
IP SANs. So every etcd endpoint gets marked unhealthy, and you see `has no
healthy etcd endpoint available`.
To fix it, set `sni` to one of the DNS names in the server certificate's
SANs. All three nodes share the same certificate, so one name is enough:
```yaml
etcd:
auth:
tls:
sni: "etcd-01"
```
Alternatively, change `externalEtcd.host` to DNS names from the certificate,
as long as they resolve inside the cluster.
Two of the settings in your values have no effect, and you can remove them:
- `etcd.auth.tls.caFilename`: the chart doesn't have this field. The CA is
loaded from `apisix.ssl.existingCASecret` / `apisix.ssl.certCAFilename`, which
you already set correctly.
- `externalEtcd.existingSecret`: it's only used to read the password when
`externalEtcd.user` is set. It has nothing to do with the TLS certificates.
Also, when `sni` is empty, the chart currently renders `sni: ""`. That
breaks connections even when the hosts are DNS names. This is fixed in #1029.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
