<p dir="auto"><strong>Is this a request for help?</strong> (If yes, you should use our troubleshooting guide and community support channels, see <a href="http://kubernetes.io/docs/troubleshooting/" rel="nofollow">http://kubernetes.io/docs/troubleshooting/</a>.): no.</p>
<p dir="auto"><strong>What keywords did you search in Kubernetes issues before filing this one?</strong> (If you have found any duplicates, you should instead reply there.): certs, client, system, pki</p>
<hr>
<p dir="auto"><strong>Is this a BUG REPORT or FEATURE REQUEST?</strong> (choose one): feature request/code refactoring.</p>
<p dir="auto"><strong>Kubernetes version</strong> (use <code class="notranslate">kubectl version</code>): master branch, after 1.5 branch of.</p>
<p dir="auto"><strong>Environment</strong>:</p>
<ul dir="auto">
<li><strong>Cloud provider or hardware configuration</strong>: none</li>
<li><strong>OS</strong> (e.g. from /etc/os-release): centos</li>
<li><strong>Kernel</strong> (e.g. <code class="notranslate">uname -a</code>):</li>
<li><strong>Install tools</strong>:</li>
<li><strong>Others</strong>:</li>
</ul>
<p dir="auto"><strong>What happened</strong>:<br>
pkg/client/transport/transport.go has function rootCertPool which populates rootCAs for client TLS configuration. Since <a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/kubernetes/kubernetes/commit/a093ea34c3168c085c949e292108b4ae9be15784/hovercard" href="https://github.com/kubernetes/kubernetes/commit/a093ea34c3168c085c949e292108b4ae9be15784"><tt>a093ea3</tt></a> there is in this function comment:</p>
<div class="highlight highlight-source-go notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="// What we really want is a copy of x509.systemRootsPool, but that isn't exposed.  It's difficult to build (see the go
// code for a look at the platform specific insanity), so we'll use the fact that RootCAs == nil gives us the system values
// It doesn't allow trusting either/or, but hopefully that won't be an issue"><pre class="notranslate"><span class="pl-c">// What we really want is a copy of x509.systemRootsPool, but that isn't exposed.  It's difficult to build (see the go</span>
<span class="pl-c">// code for a look at the platform specific insanity), so we'll use the fact that RootCAs == nil gives us the system values</span>
<span class="pl-c">// It doesn't allow trusting either/or, but hopefully that won't be an issue</span></pre></div>
<p dir="auto">Nowadays, with Go 1.7 it is possible to get same system CAs via function in crypto/x509: SystemCertPool(). If we want explicitly initialize rootCAs with system defaults, we can do it now.<br>
However, current code which sets rootCAs to nil gives practically same effect, just relaying on defaults in standard library.</p>
<p dir="auto"><strong>What you expected to happen</strong>:<br>
I'd like to either remove this comment about "isn't exposed", or make it explicitly equal to x509.SystemCertPool(). And want to discuss which would be more appropriate.</p>
<p dir="auto"><strong>How to reproduce it</strong> (as minimally and precisely as possible):</p>
<div class="highlight highlight-text-shell-session notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="$ vi pkg/client/transport/transport.go +128"><pre class="notranslate">$ <span class="pl-s1">vi pkg/client/transport/transport.go +128</span></pre></div>
<p dir="auto"><strong>Anything else do we need to know</strong>:<br>
Potentially, we might want to have combination of defined CA in tls.Config + system default CAs,<br>
but not sure if that is intended behaviour or would be valuable generic case.</p>
<p dir="auto"><a href="https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/logs/kubernetes-e2e-gci-gke-reboot-release-1.4/356/" rel="nofollow">https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/logs/kubernetes-e2e-gci-gke-reboot-release-1.4/356/</a></p>
<p dir="auto">Failed: [k8s.io] Reboot [Disruptive] [Feature:Reboot] each node by ordering unclean reboot and ensure they function upon restart {Kubernetes e2e suite}</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/reboot.go:98
Oct  1 04:43:30.313: Test failed; at least one node failed to reboot in the time given.
/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/reboot.go:158"><pre class="notranslate"><code class="notranslate">/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/reboot.go:98
Oct  1 04:43:30.313: Test failed; at least one node failed to reboot in the time given.
/go/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/reboot.go:158
</code></pre></div>