Repository navigation
docs(fleet-manager): the operator CA is external; migrating from operator_ca_node - #69
Merged
Merged
Conversation
…ator_ca_node A new page covers the external operator CA: where the manager takes the trust anchor from and the file-over-database precedence, the refusal of a node's CA, the denylist and CRL revocation, operatorRevocationPolicy soft and hard, the MCP rule that needs a current CRL, the new config keys, and the stored self-signed certificate with its fingerprint check. A second page walks a manager off operator_ca_node. The Helm values table marks operatorCANode as removed, the Operators section of the web UI page describes revoking through the denylist, and the overview says LINK approval no longer sends the operator CA to the node. Signed-off-by: Bugs5382 <12115015+Bugs5382@users.noreply.github.com>
Contributor
Author
|
Merging for the v0.1.0 test run: CI green and mergeable at merge time. |
2 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
Companion to CryptOS-PKI/cryptos-manager#146, which makes the operator CA always external and refuses
operator_ca_node. Merge the two together, after the lab migration (CryptOS-PKI/cryptos-lab#9).Refs CryptOS-PKI/cryptos-manager#142
operatorRevocationPolicysoft and hard, the MCP rule that needs a current CRL, the new keys (operatorCRL,operatorOCSP,operatorRevocationPolicy,firstRun), and the stored self-signed certificate with a fingerprint check.operatorCANodemarked removed. Web UI: the Operators section describes revoking through the denylist. Overview: login and LINK approval updated.Verification
How this was verified
npm run buildcompletes with no broken links, andtask licensepasses. Every statement was checked against the manager code in the companion PR.