This repository has been archived by the owner on Aug 25, 2021. It is now read-only.
Add ability to manual specify a server-cert #1046
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…secret containing server-cert
|
|
barrymars
changed the title
|
Hi @barrymars out of curiosity are you potentially using Vault for minting your server certs? How do you envision rotating them? We are looking into further integrations with Vault to support retrieving server certs from Vault for TLS. |
|
we're actually moving away from vault in favour of AWS secrets manager. hadn't got as far as working out certificate rotation, still at the proof of concept stage |
ishustava
suggested changes
Jul 22, 2021
…k that caCert is set if serverCert is
|
good call @ishustava I am using the helm chart via Tanka (which doesn't support hooks), so hadn't thought of that I've also added a sanity check so that if setting serverCert you have to have caCert set too |
ishustava
reviewed
Jul 22, 2021
Co-authored-by: Iryna Shustava <ishustava@users.noreply.github.com>
Co-authored-by: Iryna Shustava <ishustava@users.noreply.github.com>
…erverCert specified
ishustava
approved these changes
Jul 26, 2021
ndhanushkodi
approved these changes
Jul 26, 2021
2 tasks
This was referenced Feb 22, 2023
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Changes proposed in this PR:
-This coupled with the autoEncrypt feature, removes the need for the tls-init job and so can be run in a gitops way without having to rely on helm hooks etc.
How I've tested this PR:
Used to deploy consul into both local 'kind' cluster and AWS EKS cluster.
Checklist: