Bug 1720770: remove broken default serving cert setting#372
Bug 1720770: remove broken default serving cert setting#372openshift-merge-robot merged 1 commit intoopenshift:masterfrom
Conversation
|
@deads2k: This pull request references a valid Bugzilla bug. The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
openshift-ci-robot
added
the
bugzilla/valid-bug
openshift-ci-robot
added
the
size/XS
|
/cherrypick release-4.1 |
|
@deads2k: once the present PR merges, I will cherry-pick it on top of release-4.1 in a new PR and assign it to you. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
openshift-ci-robot
added
the
approved
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: deads2k, sttts The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
@deads2k: new pull request created: #375 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
What's our field deprecation process? |
|
Looks like you missed this reference. Where does the default come from now? Or, if there is no longer a default, do we want the docs to talk about what happens when a requested name is not matched? |
8 participants
This setting is inherently dangerous because we rely on the default serving cert to have critical IPs included in valid names to allow the service network to continue to function. Customers should instead use the SNI capabilities we have to provide their certificates.
/assign @sttts @derekwaynecarr