Use unix socket for etcd listen address

[jnummelin]

No need to listen on external address, each api server can connect to local etcd only. We can use local unix sockets too if that works for both etcd and api-server. (it should but there's a history of issues related)

[jnummelin]

Seems there's some missing bits and pieces in etcd side to really be able to use unix sockets: etcd-io/etcd#11747

Let's move this bit further and re-visit once things are better supported in upstream etcd.

[mikhail-sakhnov]

Hm, but based on the code, it's already listens on 127.0.0.1 only?

	args := []string{
		fmt.Sprintf("--data-dir=%s", e.etcdDataDir),
		"--listen-client-urls=https://127.0.0.1:2379",
		"--advertise-client-urls=https://127.0.0.1:2379",
		"--client-cert-auth=true",
		fmt.Sprintf("--listen-peer-urls=%s", peerURL),
		fmt.Sprintf("--initial-advertise-peer-urls=%s", peerURL),
		fmt.Sprintf("--name=%s", name),
		fmt.Sprintf("--trusted-ca-file=%s", path.Join(e.certDir, "ca.crt")),
		fmt.Sprintf("--cert-file=%s", path.Join(e.certDir, "server.crt")),
		fmt.Sprintf("--key-file=%s", path.Join(e.certDir, "server.key")),
		fmt.Sprintf("--peer-trusted-ca-file=%s", path.Join(e.certDir, "ca.crt")),
		fmt.Sprintf("--peer-key-file=%s", path.Join(e.certDir, "peer.key")),
		fmt.Sprintf("--peer-cert-file=%s", path.Join(e.certDir, "peer.crt")),
		"--peer-client-cert-auth=true",
	}

[jnummelin]

Hm, but based on the code, it's already listens on 127.0.0.1 only?

yes, but our intention is to make it listen only a unix socket. need to update the issue title... :)