Deprecate providing Hubble TLS secrets in helm values #34114
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
5737504 to
0dfd20d
Compare
|
/test |
nebril
approved these changes
Aug 1, 2024
ghost
suggested changes
Aug 1, 2024
joamaki
approved these changes
Aug 5, 2024
Also deprecate specifying Hubble TLS key/cert values directly in Helm values. Signed-off-by: Chance Zibolski <chance.zibolski@gmail.com>
Signed-off-by: Chance Zibolski <chance.zibolski@gmail.com>
Instead of suggesting users put TLS private keys into their helm values, instruct them to create secrets themselves and configure their helm values to use these pre-existing secrets. Signed-off-by: Chance Zibolski <chance.zibolski@gmail.com>
0dfd20d to
2fa742f
Compare
|
/test |
|
/test |
rolinh
approved these changes
Aug 7, 2024
15 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is the first step in a few changes to improve our documentation around configuring and using Hubble with TLS. The next PR #34115 will build upon this to make some improvements on the Hubble TLS documentation.
The primary goal with this PR is to add support for using existing secrets for Hubble TLS certificates and private keys to discourage storing private keys in helm values, and to better support users who wish to manage TLS certificates using other methods. While introducing support for using existing secrets, we should deprecate the previous method of directly providing certificates via helm values.
In the same vein, we want to encourage users to use one of the automated TLS methods rather than provide their own certificates in most cases, so let's move the documentation for user provided certificates to the end of the section.
I've got a number of other TLS related improvements coming, mostly in the form of documentation updates, and would like to get all of those improvements in to the stable/v1.16 documentation, so I'm setting the
needs-backport/1.16label on this PR. If the deprecation, and/or helm changes are an issue to backport, then we could skip the backport on this PR, and I'll just have to deal with conflicts when back porting the rest of my upcoming PRs to v1.16. Let me know what you think.