Improve cluster configuration when enableTls is true #169
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
michaeljmarshall
force-pushed
the
improve-enable-tls-flag
branch
6 times, most recently
from
2319c43
to
7bd2be7
Compare
michaeljmarshall
force-pushed
the
improve-enable-tls-flag
branch
from
7bd2be7
to
37a407e
Compare
michaeljmarshall
added a commit
that referenced
this pull request
Apr 4, 2022
…oxy (#170) # Motivation In #169, I attempted to improve the `enableTls` configuration. I realized shortly after merging that PR that the usage of `enabled` was problematic and a bit confusing. Instead, I am going to deprecate those usages in favor of a more descriptive value: `enableTlsWithBroker`. This change is backwards compatible.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motivation
Improve the basic functionality of
enabledTlsflag. Setting the flag to true means that the broker, proxy, and function worker will all enable TLS, but not use it unless configured. See the README update for more details.Changes
.Values.tls.<component>.enableHostnameVerificationflag that makes it possible to enable hostname verification for upstream connections. The default is false for now (old deployments that usekind: Deploymentfor broker would break otherwise). We will update totruein the next major version bump.dev-values-tls.yamlto deploy a broker stateful set (this is necessary for hostname verification to work)brokerStscomponent name, since statefulsets are the only way to ensure full-featured TLS connections.