Problems with mTLS for Decoupled mode

[hirey-dzhemiliev]

Hello.

I would like to configure apisix decoupled mode but I encountered a problem that data plane cannot verify the certificate.

2023-09-17 09:37:00 request etcd endpoint 'https://apisix-cp.***********:9280/version' error, certificate verify failed
2023-09-17 09:37:00 all etcd nodes are unavailable
2023-09-17 09:37:04 request etcd endpoint 'https://apisix-cp.***********:9280/version' error, certificate verify failed
2023-09-17 09:37:04 all etcd nodes are unavailable
2023-09-17 09:37:11 request etcd endpoint 'https://apisix-cp.***********:9280/version' error, certificate verify failed
2023-09-17 09:37:11 all etcd nodes are unavailable
2023-09-05 13:16:32 Warning! Request etcd endpoint 'https://apisix-cp.***********:9280/version' error, certificate verify failed, retry time=1
2023-09-05 13:16:32 Warning! Request etcd endpoint 'https://apisix-cp.***********:9280/version' error, certificate verify failed, retry time=2
2023-09-17 09:36:50 /usr/local/openresty//luajit/bin/luajit ./apisix/cli/apisix.lua init
2023-09-17 09:36:50 /usr/local/openresty//luajit/bin/luajit ./apisix/cli/apisix.lua init_etcd
2023-09-17 09:36:51 Warning! Request etcd endpoint 'https://apisix-cp.***********:9280/version' error, certificate verify failed, retry time=1
2023-09-17 09:36:51 Warning! Request etcd endpoint 'https://apisix-cp.***********:9280/version' error, certificate verify failed, retry time=2
2023-09-17 09:36:52 /usr/local/openresty//luajit/bin/luajit ./apisix/cli/apisix.lua init
2023-09-17 09:36:52 /usr/local/openresty//luajit/bin/luajit ./apisix/cli/apisix.lua init_etcd

Certificates were generated according to these instructions

Example configuration file for control plane:

deployment:
  role: control_plane
  role_control_plane:
    config_provider: etcd
    conf_server:
      listen: 0.0.0.0:9280
      cert: /usr/local/apisix/conf/mtls/server.crt
      cert_key: /usr/local/apisix/conf/mtls/server.key
  etcd:
    host:
      - "http://localhost:2379"
    prefix: /apisix
    timeout: 30
    use_grpc: false
    startup_retry: 60
  certs:
    cert: /usr/local/apisix/conf/mtls/server.crt
    cert_key: /usr/local/apisix/conf/mtls/server.key
    client_ca_cert: /usr/local/apisix/conf/mtls/ca.crt

Example configuration file for data plane:

deployment:
  role: data_plane
  role_data_plane:
    config_provider: control_plane
    control_plane:
      host:
        - https://apisix-cp.***********:9280
      prefix: /apisix
      timeout: 30
    certs:
      cert: /usr/local/apisix/conf/mtls/client.crt
      cert_key: /usr/local/apisix/conf/mtls/client.key
      client_ca_cert: /usr/local/apisix/conf/mtls/ca.crt

Tell me what is my mistake or is there perhaps more detailed instructions for setting up decoupled mode?

Thank you.

Regards.

[jonforero]

Hi, could you resolve the issue?