-
Notifications
You must be signed in to change notification settings - Fork 189
RS: Added mtls_trusted_ca to the certificates table #1428
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@rrelledge a few comments:
- If certain certificates are not auto-generated and are later uploaded (optionally) by the customer, then they most likely won't be "self-signed" certs. The whole point of "self-signed" certs is that the system generates them so that the customer won't have to supply its own.
- Per Eng,
ldap_client
andmtls_trusted_ca
are not auto-generated by the cluster. Thus, the opening paragraph is misleading the reader into thinking that the system auto-generates self-signed certificates for the entire list.
I suggest to:
- Add a 3rd column to the certificate list, indicating auto-generated yes/no
- Explain that the list contains all the supported certificates.
-- Some are auto-generated (self-signed) to be used OOTB, and could be replaced with customer's certs
-- Some are not auto-generated which makes them optional. They must be provided by the customer for using the specific feature they are coupled with.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@rrelledge now it's clear and accurate :)
LGTM, 10x.
DOC-1574