Add comprehensive custom certificates documentation#293
Conversation
pwright
commented
Jun 10, 2026
pwright
commented
- Add detailed custom certificates section to kube-yaml/site-linking.md
- Explains default Skupper CA and certificate behavior
- Documents custom server certificate setup
- Provides kubectl/yq and manual methods for Link generation
- Includes client certificate generation workflows
- Add cross-reference in kube-cli/site-linking.md directing to YAML approach
- Add detailed custom certificates section to kube-yaml/site-linking.md - Explains default Skupper CA and certificate behavior - Documents custom server certificate setup - Provides kubectl/yq and manual methods for Link generation - Includes client certificate generation workflows - Add cross-reference in kube-cli/site-linking.md directing to YAML approach - Update overview/security.md with certificate trust explanation - Fix terminology: 'Issuer' → 'signing Certificate resource' - Fix certificate description: clarify CA hierarchy (not self-signed server cert) - Fix kubectl commands: remove incorrect .items[] path for named resources
| ``` | ||
| Apply the secret: | ||
| ```shell | ||
| kubectl delete secret skupper-site-server # delete existing secret |
There was a problem hiding this comment.
If we recommend using the skupper-site-server secret (the default one used when link-access is enabled), then better to also recommend creating it before the site is created, as it needs to exist on the namespace before the skupper.io.Certificate (CR) exists, to avoid racing with the controller.
An alternative would be to suggest a custom RouterAccess CR, instead of using --enable-link-access. Then we could also explain how to define the RouterAccess CR manuall, which has the .spec.generateTlsCredentials=false and has the .spec.tlsCredentials set to a user provided Secret.
There was a problem hiding this comment.
I've updated doc with two alternative approaches.
BTW Would deleting routeraccess when user disables linkaccess automatically be a good idea?
(then user could disable linkaccess, apply secret and re-enable linkaccess)
2 participants
