9e712e8a9e
When there are multiple reference-style markdown links in the same deck with the same label, they will silently clash - i.e. one will overwrite the other. The problem can become very apparent when using many links like [see the docs][docs] in different slides, where [docs] points to a different URL each time. This commit adds a crude script to detect such duplicates and display them. This script was used to detect a bunch of duplicates and fix them (by making the label unique). There are still a few duplicates left but they point to the same places, so we decided to leave them as-is for now (but might change that later).
1.6 KiB
CA injector - overview
-
The Kubernetes API server can invoke various webhooks:
-
conversion webhooks (registered in CustomResourceDefinitions)
-
mutation webhooks (registered in MutatingWebhookConfigurations)
-
validation webhooks (registered in ValidatingWebhookConfiguration)
-
-
These webhooks must be served over TLS
-
These webhooks must use valid TLS certificates
Webhook certificates
-
Option 1: certificate issued by a global CA
- doesn't work with internal services
(their CN must be<servicename>.<namespace>.svc)
- doesn't work with internal services
-
Option 2: certificate issued by private CA + CA certificate in system store
-
requires access to API server certificates tore
-
generally not doable on managed Kubernetes clusters
-
-
Option 3: certificate issued by private CA + CA certificate in
caBundle-
pass the CA certificate in
caBundlefield
(in CRD or webhook manifests) -
can be managed automatically by cert-manager
-
CA injector - details
-
Add annotation to injectable resource (CustomResouceDefinition, MutatingWebhookConfiguration, ValidatingWebhookConfiguration)
-
Annotation refers to the thing holding the certificate:
-
cert-manager.io/inject-ca-from: <namespace>/<certificate> -
cert-manager.io/inject-ca-from-secret: <namespace>/<secret> -
cert-manager.io/inject-apiserver-ca: true(use API server CA)
-
-
When injecting from a Secret, the Secret must have a special annotation:
cert-manager.io/allow-direct-injection: "true" -
See cert-manager documentation for details