whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Improve --requestheader-client-ca-file warning (#10093)

Browse Source 
It's important to use a distinct CA (unless you exactly know what you
are doing) but not clear from the current documentation and warning.
This commit is contained in:
Michael Schubert
2018-09-06 08:55:13 +02:00
committed by k8s-ci-robot
parent 9ff4313339
commit 949a1ff541
3 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/reference/command-line-tools-reference/kube-apiserver.md
+1 -1
View File
@@ -759,7 +759,7 @@ kube-apiserver [flags]
<td colspan="2">--requestheader-client-ca-file string</td>
</tr>
<tr>
<td></td><td style="line-height: 130%; word-wrap: break-word;">Root certificate bundle to use to verify client certificates on incoming requests before trusting usernames in headers specified by --requestheader-username-headers. WARNING: generally do not depend on authorization being already done for incoming requests.</td>
<td></td><td style="line-height: 130%; word-wrap: break-word;">Root certificate bundle to use to verify client certificates on incoming requests before trusting usernames in headers specified by --requestheader-username-headers. WARNING: do **not** reuse a CA that is used in a different context (for example with --client-ca-file) unless you understand the risks and the mechanisms to protect the CA's usage. Generally it is recommended to not depend on authorization being already done for incoming requests.</td>
</tr>
<tr>