Support and document persisting the Octavia CA #1988
Conversation
|
This would be good to backport too :) |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces valuable documentation and scripts for managing Octavia TLS certificates. The documentation is comprehensive but could be improved with some corrections to numbering and formatting for better clarity. The accompanying shell scripts are functional but contain some issues, such as using non-standard exit codes and suppressing error outputs, which could hinder debugging. I have provided specific suggestions to address these points and enhance the overall quality and robustness of the changes.
MoteHue
force-pushed
the
support-persisting-octavia-ca
branch
2 times, most recently
from
be8e59e to
8aa76ba
Compare
MoteHue
added
documentation
MoteHue
force-pushed
the
support-persisting-octavia-ca
branch
from
8aa76ba to
9958a80
Compare
doc/source/operations/octavia.rst
Outdated
| Octavia uses mutual TLS to secure communication between the amphorae and | ||
| Octavia services. It uses a private CA to sign both client and server | ||
| certificates. We use the kolla-ansible built-in support for generating these | ||
| certificates: |
There was a problem hiding this comment.
This should be a bit clearer about if you should do this to refresh certificates or if it's only needed for an initial deployment. It just kinda jumps into commands without saying what they're going to do and why we run them
There was a problem hiding this comment.
I've added more context
There was a problem hiding this comment.
For the record, I'd prefer these to be ansible playbooks, but I don't really want to hold this PR up to change it
There was a problem hiding this comment.
I do agree playbooks would be nice, but I don't really have the time right now to rewrite these, this is just me extracting existing scripts from a customer site.
MoteHue
force-pushed
the
support-persisting-octavia-ca
branch
from
d5406f8 to
43a0fd0
Compare
No description provided.