Document defining ciphers in example etcd config file

[jmhbnz]

This pull request proposes to update our etcd.conf.yml with an example for setting cipher-suites.

This topic has come up in discussions and issues and it appears there has been some confusion about how it should be done, so let's provide a concrete example.

Relates to:

• How to enables cipher suite in etcd config #15547
• How to disable weak cipher suites in etcd config #15476
• Crash when specifying cipher-suites in config file #12461
• cipher-suites not honored from configuration file #11587

[serathius]

This is great suggestion for users of config files. Have we seen similar problem for command line flags? or the help message is enough for users.

[jmhbnz]

This is great suggestion for users of config files. Have we seen similar problem for command line flags? or the help message is enough for users.

There has been a couple references in discussions and issues for cli config but I think for command line we are better off as we have nice examples in the docs to show how it needs to be done https://etcd.io/docs/v3.6/op-guide/security/#example-2-client-to-server-authentication-with-https-client-certificates

[ahrtr]

Thanks @jmhbnz for the PR, which looks good to me.

The workflow failures are not caused by this PR. Recently the workflow are more flaky. Can we focus on fixing the flaky test, at least can we spend more time on them? thx cc @ptabor @serathius @chaochn47 @fuweid @jmhbnz

FYI. I am still focusing on the bboltDB critical issue etcd-io/bbolt#402. I may have got some clues

[chaochn47]

The PR itself looks good to me. I suggest the failed tests can be retried. For example, an empty line in the end of etcd.conf.yml.sample

The failed test is tracked in #15581 and proposed fix PR will be sent.

[fuweid]

can we spend more time on them?

Sure. I will focus on deflaking cases recently.

[chaochn47]

The workflow failures are not caused by this PR.

@ahrtr

No, I think the workflow failures help identify breaking changes. Please see the explanation in #15581 (comment).

And thanks to it, the PR was modified to remove the breaking change then all the tests passed eventually.