Improve tls notes documentation

[qu1queee]

Hi,

Currently both database and cell jobs are having similar certificate paths. With path I mean something like properties.tls.cert. This is confusing, because in theory you could have under the properties block the same path(properties.tls.cert) and I´m not sure which job will take it(database or cell). Seems the best way to define them, its always inside the job itself.

Therefore I modified the description to be more explicit in relation to where those certs should be defined, and in which spec file their description can be found.

Regards,
Enrique Encalada

[cfdreddbot]

Hey qu1queee!

Thanks for submitting this pull request! I'm here to inform the recipients of the pull request that you and the commit authors have already signed the CLA.

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/150800547

The labels on this github issue will be updated when the story is started.

[qu1queee]

Any updates on this?

[emalm]

Hi, @qu1queee,

The CF community is moving towards BOSH deployment manifests that specify properties on each individual BOSH job in an instance group, as BOSH has deprecated properties with manifest or instance-group scope. That shift is best reflected in the cf-deployment manifests. As a result, we're generally not including the previous diego.$COMPONENT name-spacing prefix on most new properties we add to diego-release, including these recent TLS properties.

So for the Locket certs, I think it is most accurate to say that they should be set on the locket job in any manifest or, secondarily, on the database_zN instance groups in the diego-release-generated manifest. We used the latter option in the diego-release templates to reduce the amount of spiff-based complexity in the templates. Similarly, for the cell rep TLS properties, it would be most accurate to say they should be set on the rep and rep_windows jobs or on the cell_zN and cell_windows_zN instance groups in the diego-release-generated manifest. Would you be willing to revise the PR to explain those nuances?

Thanks,
Eric, CF Diego PM

[qu1queee]

Hi, @emalm

I was not aware this documentation was very cf-deployment specific(not using it yet). In any case the changes were based on BOSH v2 schema, so that covers it.

Regarding your question, the current state of the documentation was confusing for me(tls part). Because, first it makes a reference to locket, which is an element of the job array inside the database instance_group. But when you speak about the tls for cells, the documentation makes a reference to the cell instance_group, and not to any job inside it, therefore this confused me.

You need to keep both(database and cell) tls documentation consistent.

Regards,

Enrique Encalada