Enable etcd-manager / etcd3 / etcd-tls in kops 1.12

[justinsb]

In 1.12 (kops & kubenetes):

• We default etcd-manager on
• We default to etcd3
• We default to full TLS for etcd (client and peer)
• We stop allowing external access to etcd

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: justinsb

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [justinsb]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[justinsb]

cc @gambol99 heads-up on TLS changes - enabling TLS by default in 1.12, using new CA keys which are split for peers & clients.

[chrisz100]

Maybe add a few lines to the documentation that etcd-manager is a default now?

[chrisz100]

nit: Looks a little duplicated to me if the only change to line 142 is the file suffix

[justinsb]

There's also the byte slice we're writing, the file mode, and the error message :-) I think it would be hard to dedup this - though very open to suggestions!

[chrisz100]

What about

{
    path := filepath.Join(dir, name)
    {
		if err := ioutil.WriteFile(p+".crt", certBytes, 0644); err != nil {
			return fmt.Errorf("error writing certificate key file %q: %v", p+".crt", err)
		}
    }
    {
    <CODE HERE>
    }
}

Not tested but would keep the filepath consistent. Even though I hate how it's appended two times now...

[justinsb]

Sure! Done :-)

[chrisz100]

Feels like we block the option to disable tls as something fixed here? Not that insecure is a good thing but this feels like taking away customizability that was once there and some clusters might rely on.

[justinsb]

So if we specify etcdInsecure (above), etcd-manager will override the scheme in the URLs here.

We could allow users to specify etcd insecure (somehow). Currently we default the fields to on when etcd-manager is in use, and because they're bool and not *bool it is difficult to know whether the value is false or just unset, but we could create another field.

The workaround for now is to set the etcd provider back to legacy, but that option will go away in 1.13. But if there are people that need insecure, maybe we can rely on this workaround for now.

[chrisz100]

Oh, I missed this is etcdmanager only. Ignore this 👍

[justinsb]

Added a commit which updates docs to make it less alpha sounding, but still encourage backups.

I also need to get this into the release notes - I had started it ... somewhere

[justinsb]

Also added some release notes, though they mostly refer to the etcd-manager doc (rather than repeating it entirely!)

[chrisz100]

/lgtm