Turn on TLS feature on existing PD cluster

[overvenus]

Bug Report

PD currently does not support enabling TLS feature on existing PD cluster, because it requires the "https" schema on client URL and peer URL that changes PD nodes address and it causes PD no leader.

[2020-09-21T05:10:43.408Z] [2020/09/21 13:09:35.425 +08:00] [INFO] [etcd.go:465] ["starting with peer TLS"] [tls-info="cert = tests/br_tls/certificates/server.pem, key = tests/br_tls/certificates/server-key.pem, trusted-ca = tests/br_tls/certificates/ca.pem, client-cert-auth = true, crl-file = "] [cipher-suites="[]"]
[2020-09-21T05:10:43.408Z] [2020/09/21 13:09:35.425 +08:00] [WARN] [etcd.go:502] ["scheme is HTTP while key and cert files are present; ignoring key and cert files"] [peer-url=http://127.0.0.1:2380]
[2020-09-21T05:10:43.408Z] [2020/09/21 13:09:35.425 +08:00] [WARN] [etcd.go:509] ["scheme is HTTP while --peer-client-cert-auth is enabled; ignoring client cert auth for this URL"] [peer-url=http://127.0.0.1:2380]
...
[2020-09-21T05:10:43.409Z] [2020/09/21 13:09:38.945 +08:00] [INFO] [history_buffer.go:147] ["start from history index"] [start-index=0]
[2020-09-21T05:10:43.409Z] [2020/09/21 13:09:38.946 +08:00] [WARN] [member.go:180] ["the pd leader has not changed, delete and campaign again"] [old-pd-leader="name:\"pd-br-test-go1130-nr3gr-1fvw2\" member_id:3474484975246189105 peer_urls:\"http://127.0.0.1:2380\" client_urls:\"http://127.0.0.1:2379\" "]
[2020-09-21T05:10:43.409Z] [2020/09/21 13:09:38.947 +08:00] [ERROR] [member.go:182] ["deleting pd leader key meets error"] [error="[PD:etcd:ErrEtcdTxn]etcd Txn failed"]
[2020-09-21T05:10:43.409Z] [2020/09/21 13:09:39.148 +08:00] [WARN] [member.go:180] ["the pd leader has not changed, delete and campaign again"] [old-pd-leader="name:\"pd-br-test-go1130-nr3gr-1fvw2\" member_id:3474484975246189105 peer_urls:\"http://127.0.0.1:2380\" client_urls:\"http://127.0.0.1:2379\" "]
...

What did you do?

Turn on TLS feature on existing PD cluster

What did you expect to see?

It works fine.

What did you see instead?

No leader.

What version of PD are you using (pd-server -V)?

master.

[nolouch]

It should be a feature

[bufferflies]

scale in single node to replace with pd-recover.

[rleungx]

Related to pingcap/tiup#1598