[I] help request: Apisix uses self signed certificates to access the etcd cluster, Prometheus plugin fails to obtain the metric apisix_etcd_reachable [apisix]

["arbor-95 (via GitHub)" <gi...@apache.org>]

arbor-95 opened a new issue, #11790:
URL: https://github.com/apache/apisix/issues/11790

   ### Description
   
   - The etcd cluster has three nodes , generated server.pem and client.pem . By specifying the server/client certificate through etcdtl, the etcd cluster can be accessed successfully .
   - The apisix configuration is as follows
    ```
   apisix:
     node_listen: 9080 
     enable_admin: false          
     ssl:
       enable: true
       ssl_trusted_certificate: /pki/ca.pem
   ... ...
     etcd:
       tls:
         cert: /pki/client.pem      
         key: /pki/client-key.pem  
         verify: true 
   ... ... 
   ```
   - By using etcd java client, data can be successfully written, and apisix automatically generates a route
   - However, when the prometheus plugin is enabled, apisix generates the following error message
   ```
   2024/11/28 12:43:38 [warn] 53#53: *15223 [lua] v3.lua:247: server_version(): https://10.186.44.42:2379: certificate host mismatch. Retrying, client: 10.10.123.6, server: , request: "GET /apisix/prometheus/metrics HTTP/1.1", host: "10.186.44.42:9099", referrer: "http://10.186.44.42:9090/"
   ```
   
   What Should I Do
   
   ### Environment
   
   - APISIX version (run `apisix version`): docker image (apache/apisix:3.11.0-redha)
   - Operating system (run `uname -a`): centos7 3.10.0-1160.el7.x86_64
   - etcd version, if relevant (run `curl http://127.0.0.1:9090/v1/server_info`): 3.5.17
   - Plugin runner version, for issues related to plugin runners:
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] help request: Apisix uses self signed certificates to access the etcd cluster, Prometheus plugin fails to obtain the metric apisix_etcd_reachable [apisix]

["arbor-95 (via GitHub)" <gi...@apache.org>]

arbor-95 commented on issue #11790:
URL: https://github.com/apache/apisix/issues/11790#issuecomment-2507050872

   The problem has been solved。
   
   - When generating the server certificate, add 'etcd-node-1' to hosts
   ```
   # server-csr.json
   {
    ... ...
       "hosts": [
            ... ... 
   	"etcd-node-1",
   	"etcd-node-2",
   	"etcd-node-3"
       ],
      ... ...
   }
   ```
   
   - Apisix add SNI
   ```
   deployment:        
     etcd:
       tls:
         cert: /pki/client.pem      
         key: /pki/client-key.pem       
         sni: etcd-node-1
         verify: true   
   ```


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] help request: Apisix uses self signed certificates to access the etcd cluster, Prometheus plugin fails to obtain the metric apisix_etcd_reachable [apisix]

["arbor-95 (via GitHub)" <gi...@apache.org>]

arbor-95 closed issue #11790: help request:  Apisix uses self signed certificates to access the etcd cluster, Prometheus plugin fails to obtain the metric apisix_etcd_reachable
URL: https://github.com/apache/apisix/issues/11790


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org