baalajimaestro/traefik
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

docs: uniformize client TLS config documentation

Browse source
This commit is contained in:
Kevin Pollet 2021-12-02 15:42:06 +01:00 committed by GitHub
parent 82fdc569c2
commit f69982aa9d
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
9 changed files with 209 additions and 103 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

38
docs/content/middlewares/http/forwardauth.md
View file

@ -349,12 +349,16 @@ http:
### `tls` ### `tls`
The `tls` option is the TLS configuration from Traefik to the authentication server. _Optional_
#### `tls.ca` Defines the TLS configuration used for the secure connection to the authentication server.
Certificate Authority used for the secured connection to the authentication server, #### `ca`
defaults to the system bundle.
_Optional_
`ca` is the path to the certificate authority used for the secured connection to the authentication server,
it defaults to the system bundle.
```yaml tab="Docker" ```yaml tab="Docker"
labels: labels:
@ -417,13 +421,15 @@ http:
ca = "path/to/local.crt" ca = "path/to/local.crt"
``` ```
#### `tls.caOptional` #### `caOptional`
The value of `tls.caOptional` defines which policy should be used for the secure connection with TLS Client Authentication to the authentication server. _Optional_
The value of `caOptional` defines which policy should be used for the secure connection with TLS Client Authentication to the authentication server.
!!! warning "" !!! warning ""
If `tls.ca` is undefined, this option will be ignored, and no client certificate will be requested during the handshake. Any provided certificate will thus never be verified. If `ca` is undefined, this option will be ignored, and no client certificate will be requested during the handshake. Any provided certificate will thus never be verified.
When this option is set to `true`, a client certificate is requested during the handshake but is not required. If a certificate is sent, it is required to be valid. When this option is set to `true`, a client certificate is requested during the handshake but is not required. If a certificate is sent, it is required to be valid.
@ -479,9 +485,12 @@ http:
caOptional = true caOptional = true
``` ```
#### `tls.cert` #### `cert`
The public certificate used for the secure connection to the authentication server. _Optional_
`cert` is the path to the public certificate used for the secure connection to the authentication server.
When using this option, setting the `key` option is required.
```yaml tab="Docker" ```yaml tab="Docker"
labels: labels:
@ -554,9 +563,12 @@ http:
For security reasons, the field does not exist for Kubernetes IngressRoute, and one should use the `secret` field instead. For security reasons, the field does not exist for Kubernetes IngressRoute, and one should use the `secret` field instead.
#### `tls.key` #### `key`
The private certificate used for the secure connection to the authentication server. _Optional_
`key` is the path to the private key used for the secure connection to the authentication server.
When using this option, setting the `cert` option is required.
```yaml tab="Docker" ```yaml tab="Docker"
labels: labels:
@ -629,7 +641,9 @@ http:
For security reasons, the field does not exist for Kubernetes IngressRoute, and one should use the `secret` field instead. For security reasons, the field does not exist for Kubernetes IngressRoute, and one should use the `secret` field instead.
#### `tls.insecureSkipVerify` #### `insecureSkipVerify`
_Optional, Default=false_
If `insecureSkipVerify` is `true`, the TLS connection to the authentication server accepts any certificate presented by the server regardless of the hostnames it covers. If `insecureSkipVerify` is `true`, the TLS connection to the authentication server accepts any certificate presented by the server regardless of the hostnames it covers.

18
docs/content/providers/consul-catalog.md
View file

@ -362,14 +362,14 @@ providers:
_Optional_ _Optional_
Defines TLS options for Consul server endpoint. Defines the TLS configuration used for the secure connection to Consul Catalog.
##### `ca` ##### `ca`
_Optional_ _Optional_
Certificate Authority used for the secure connection to Consul, `ca` is the path to the certificate authority used for the secure connection to Consul Catalog,
defaults to the system bundle. it defaults to the system bundle.
```yaml tab="File (YAML)" ```yaml tab="File (YAML)"
providers: providers:
@ -392,11 +392,11 @@ providers:
_Optional_ _Optional_
The value of `tls.caOptional` defines which policy should be used for the secure connection with TLS Client Authentication to Consul. The value of `caOptional` defines which policy should be used for the secure connection with TLS Client Authentication to Consul Catalog.
!!! warning "" !!! warning ""
If `tls.ca` is undefined, this option will be ignored, and no client certificate will be requested during the handshake. Any provided certificate will thus never be verified. If `ca` is undefined, this option will be ignored, and no client certificate will be requested during the handshake. Any provided certificate will thus never be verified.
When this option is set to `true`, a client certificate is requested during the handshake but is not required. If a certificate is sent, it is required to be valid. When this option is set to `true`, a client certificate is requested during the handshake but is not required. If a certificate is sent, it is required to be valid.
@ -423,8 +423,7 @@ providers:
_Optional_ _Optional_
`cert` is the path to the public certificate to use for Consul communication. `cert` is the path to the public certificate used for the secure connection to Consul Catalog.
When using this option, setting the `key` option is required. When using this option, setting the `key` option is required.
```yaml tab="File (YAML)" ```yaml tab="File (YAML)"
@ -451,8 +450,7 @@ providers:
_Optional_ _Optional_
`key` is the path to the private key for Consul communication. `key` is the path to the private key used for the secure connection to Consul Catalog.
When using this option, setting the `cert` option is required. When using this option, setting the `cert` option is required.
```yaml tab="File (YAML)" ```yaml tab="File (YAML)"
@ -477,7 +475,7 @@ providers:
##### `insecureSkipVerify` ##### `insecureSkipVerify`
_Optional_ _Optional, Default=false_
If `insecureSkipVerify` is `true`, the TLS connection to Consul accepts any certificate presented by the server regardless of the hostnames it covers. If `insecureSkipVerify` is `true`, the TLS connection to Consul accepts any certificate presented by the server regardless of the hostnames it covers.

36
docs/content/providers/consul.md
View file

@ -104,10 +104,14 @@ providers:
_Optional_ _Optional_
#### `tls.ca` Defines the TLS configuration used for the secure connection to Consul.
Certificate Authority used for the secure connection to Consul, #### `ca`
defaults to the system bundle.
_Optional_
`ca` is the path to the certificate authority used for the secure connection to Consul,
it defaults to the system bundle.
```yaml tab="File (YAML)" ```yaml tab="File (YAML)"
providers: providers:
@ -125,13 +129,15 @@ providers:
--providers.consul.tls.ca=path/to/ca.crt --providers.consul.tls.ca=path/to/ca.crt
``` ```
#### `tls.caOptional` #### `caOptional`
The value of `tls.caOptional` defines which policy should be used for the secure connection with TLS Client Authentication to Consul. _Optional_
The value of `caOptional` defines which policy should be used for the secure connection with TLS Client Authentication to Consul.
!!! warning "" !!! warning ""
If `tls.ca` is undefined, this option will be ignored, and no client certificate will be requested during the handshake. Any provided certificate will thus never be verified. If `ca` is undefined, this option will be ignored, and no client certificate will be requested during the handshake. Any provided certificate will thus never be verified.
When this option is set to `true`, a client certificate is requested during the handshake but is not required. If a certificate is sent, it is required to be valid. When this option is set to `true`, a client certificate is requested during the handshake but is not required. If a certificate is sent, it is required to be valid.
@ -153,9 +159,12 @@ providers:
--providers.consul.tls.caOptional=true --providers.consul.tls.caOptional=true
``` ```
#### `tls.cert` #### `cert`
Public certificate used for the secure connection to Consul. _Optional_
`cert` is the path to the public certificate used for the secure connection to Consul.
When using this option, setting the `key` option is required.
```yaml tab="File (YAML)" ```yaml tab="File (YAML)"
providers: providers:
@ -176,9 +185,12 @@ providers:
--providers.consul.tls.key=path/to/foo.key --providers.consul.tls.key=path/to/foo.key
``` ```
#### `tls.key` #### `key`
Private certificate used for the secure connection to Consul. _Optional_
`key` is the path to the private key used for the secure connection to Consul.
When using this option, setting the `cert` option is required.
```yaml tab="File (YAML)" ```yaml tab="File (YAML)"
providers: providers:
@ -199,7 +211,9 @@ providers:
--providers.consul.tls.key=path/to/foo.key --providers.consul.tls.key=path/to/foo.key
``` ```
#### `tls.insecureSkipVerify` #### `insecureSkipVerify`
_Optional, Default=false_
If `insecureSkipVerify` is `true`, the TLS connection to Consul accepts any certificate presented by the server regardless of the hostnames it covers. If `insecureSkipVerify` is `true`, the TLS connection to Consul accepts any certificate presented by the server regardless of the hostnames it covers.

34
docs/content/providers/docker.md
View file

@ -613,10 +613,14 @@ providers:
_Optional_ _Optional_
#### `tls.ca` Defines the TLS configuration used for the secure connection to Docker.
Certificate Authority used for the secure connection to Docker, #### `ca`
defaults to the system bundle.
_Optional_
`ca` is the path to the certificate authority used for the secure connection to Docker,
it defaults to the system bundle.
```yaml tab="File (YAML)" ```yaml tab="File (YAML)"
providers: providers:
@ -634,13 +638,15 @@ providers:
--providers.docker.tls.ca=path/to/ca.crt --providers.docker.tls.ca=path/to/ca.crt
``` ```
#### `tls.caOptional` #### `caOptional`
The value of `tls.caOptional` defines which policy should be used for the secure connection with TLS Client Authentication to Docker. _Optional_
The value of `caOptional` defines which policy should be used for the secure connection with TLS Client Authentication to Docker.
!!! warning "" !!! warning ""
If `tls.ca` is undefined, this option will be ignored, and no client certificate will be requested during the handshake. Any provided certificate will thus never be verified. If `ca` is undefined, this option will be ignored, and no client certificate will be requested during the handshake. Any provided certificate will thus never be verified.
When this option is set to `true`, a client certificate is requested during the handshake but is not required. If a certificate is sent, it is required to be valid. When this option is set to `true`, a client certificate is requested during the handshake but is not required. If a certificate is sent, it is required to be valid.
@ -662,9 +668,10 @@ providers:
--providers.docker.tls.caOptional=true --providers.docker.tls.caOptional=true
``` ```
#### `tls.cert` #### `cert`
Public certificate used for the secure connection to Docker. `cert` is the path to the public certificate used for the secure connection to Docker.
When using this option, setting the `key` option is required.
```yaml tab="File (YAML)" ```yaml tab="File (YAML)"
providers: providers:
@ -685,9 +692,12 @@ providers:
--providers.docker.tls.key=path/to/foo.key --providers.docker.tls.key=path/to/foo.key
``` ```
#### `tls.key` #### `key`
Private certificate used for the secure connection to Docker. _Optional_
`key` is the path to the private key used for the secure connection Docker.
When using this option, setting the `cert` option is required.
```yaml tab="File (YAML)" ```yaml tab="File (YAML)"
providers: providers:
@ -708,7 +718,9 @@ providers:
--providers.docker.tls.key=path/to/foo.key --providers.docker.tls.key=path/to/foo.key
``` ```
#### `tls.insecureSkipVerify` #### `insecureSkipVerify`
_Optional, Default=false_
If `insecureSkipVerify` is `true`, the TLS connection to Docker accepts any certificate presented by the server regardless of the hostnames it covers. If `insecureSkipVerify` is `true`, the TLS connection to Docker accepts any certificate presented by the server regardless of the hostnames it covers.

36
docs/content/providers/etcd.md
View file

@ -104,10 +104,14 @@ providers:
_Optional_ _Optional_
#### `tls.ca` Defines the TLS configuration used for the secure connection to etcd.
Certificate Authority used for the secure connection to etcd, #### `ca`
defaults to the system bundle.
_Optional_
`ca` is the path to the certificate authority used for the secure connection to etcd,
it defaults to the system bundle.
```yaml tab="File (YAML)" ```yaml tab="File (YAML)"
providers: providers:
@ -125,13 +129,15 @@ providers:
--providers.etcd.tls.ca=path/to/ca.crt --providers.etcd.tls.ca=path/to/ca.crt
``` ```
#### `tls.caOptional` #### `caOptional`
The value of `tls.caOptional` defines which policy should be used for the secure connection with TLS Client Authentication to etcd. _Optional_
The value of `caOptional` defines which policy should be used for the secure connection with TLS Client Authentication to etcd.
!!! warning "" !!! warning ""
If `tls.ca` is undefined, this option will be ignored, and no client certificate will be requested during the handshake. Any provided certificate will thus never be verified. If `ca` is undefined, this option will be ignored, and no client certificate will be requested during the handshake. Any provided certificate will thus never be verified.
When this option is set to `true`, a client certificate is requested during the handshake but is not required. If a certificate is sent, it is required to be valid. When this option is set to `true`, a client certificate is requested during the handshake but is not required. If a certificate is sent, it is required to be valid.
@ -153,9 +159,12 @@ providers:
--providers.etcd.tls.caOptional=true --providers.etcd.tls.caOptional=true
``` ```
#### `tls.cert` #### `cert`
Public certificate used for the secure connection to etcd. _Optional_
`cert` is the path to the public certificate used for the secure connection to etcd.
When using this option, setting the `key` option is required.
```yaml tab="File (YAML)" ```yaml tab="File (YAML)"
providers: providers:
@ -176,9 +185,12 @@ providers:
--providers.etcd.tls.key=path/to/foo.key --providers.etcd.tls.key=path/to/foo.key
``` ```
#### `tls.key` #### `key`
Private certificate used for the secure connection to etcd. _Optional_
`key` is the path to the private key used for the secure connection to etcd.
When using this option, setting the `cert` option is required.
```yaml tab="File (YAML)" ```yaml tab="File (YAML)"
providers: providers:
@ -199,7 +211,9 @@ providers:
--providers.etcd.tls.key=path/to/foo.key --providers.etcd.tls.key=path/to/foo.key
``` ```
#### `tls.insecureSkipVerify` #### `insecureSkipVerify`
_Optional, Default=false_
If `insecureSkipVerify` is `true`, the TLS connection to etcd accepts any certificate presented by the server regardless of the hostnames it covers. If `insecureSkipVerify` is `true`, the TLS connection to etcd accepts any certificate presented by the server regardless of the hostnames it covers.

38
docs/content/providers/http.md
View file

@ -55,7 +55,7 @@ providers:
_Optional, Default="5s"_ _Optional, Default="5s"_
Defines the polling timeout when connecting to the configured endpoint. Defines the polling timeout when connecting to the endpoint.
```yaml tab="File (YAML)" ```yaml tab="File (YAML)"
providers: providers:
@ -76,10 +76,14 @@ providers:
_Optional_ _Optional_
#### `tls.ca` Defines the TLS configuration used for the secure connection to the endpoint.
Certificate Authority used for the secure connection to the configured endpoint, #### `ca`
defaults to the system bundle.
_Optional_
`ca` is the path to the certificate authority used for the secure connection to the endpoint,
it defaults to the system bundle.
```yaml tab="File (YAML)" ```yaml tab="File (YAML)"
providers: providers:
@ -97,13 +101,15 @@ providers:
--providers.http.tls.ca=path/to/ca.crt --providers.http.tls.ca=path/to/ca.crt
``` ```
#### `tls.caOptional` #### `caOptional`
The value of `tls.caOptional` defines which policy should be used for the secure connection with TLS Client Authentication to the configured endpoint. _Optional_
The value of `caOptional` defines which policy should be used for the secure connection with TLS Client Authentication to the endpoint.
!!! warning "" !!! warning ""
If `tls.ca` is undefined, this option will be ignored, and no client certificate will be requested during the handshake. Any provided certificate will thus never be verified. If `ca` is undefined, this option will be ignored, and no client certificate will be requested during the handshake. Any provided certificate will thus never be verified.
When this option is set to `true`, a client certificate is requested during the handshake but is not required. If a certificate is sent, it is required to be valid. When this option is set to `true`, a client certificate is requested during the handshake but is not required. If a certificate is sent, it is required to be valid.
@ -125,9 +131,12 @@ providers:
--providers.http.tls.caOptional=true --providers.http.tls.caOptional=true
``` ```
#### `tls.cert` #### `cert`
Public certificate used for the secure connection to the configured endpoint. _Optional_
`cert` is the path to the public certificate used for the secure connection to the endpoint.
When using this option, setting the `key` option is required.
```yaml tab="File (YAML)" ```yaml tab="File (YAML)"
providers: providers:
@ -148,9 +157,12 @@ providers:
--providers.http.tls.key=path/to/foo.key --providers.http.tls.key=path/to/foo.key
``` ```
#### `tls.key` #### `key`
Private certificate used for the secure connection to the configured endpoint. _Optional_
`key` is the path to the private key used for the secure connection to the endpoint.
When using this option, setting the `cert` option is required.
```yaml tab="File (YAML)" ```yaml tab="File (YAML)"
providers: providers:
@ -171,7 +183,9 @@ providers:
--providers.http.tls.key=path/to/foo.key --providers.http.tls.key=path/to/foo.key
``` ```
#### `tls.insecureSkipVerify` #### `insecureSkipVerify`
_Optional, Default=false_
If `insecureSkipVerify` is `true`, the TLS connection to the endpoint accepts any certificate presented by the server regardless of the hostnames it covers. If `insecureSkipVerify` is `true`, the TLS connection to the endpoint accepts any certificate presented by the server regardless of the hostnames it covers.

40
docs/content/providers/marathon.md
View file

@ -404,10 +404,12 @@ providers:
_Optional_ _Optional_
#### `tls.ca` Defines the TLS configuration used for the secure connection to Marathon.
Certificate Authority used for the secure connection to Marathon, #### `ca`
defaults to the system bundle.
`ca` is the path to the certificate authority used for the secure connection to Marathon,
it defaults to the system bundle.
```yaml tab="File (YAML)" ```yaml tab="File (YAML)"
providers: providers:
@ -425,13 +427,15 @@ providers:
--providers.marathon.tls.ca=path/to/ca.crt --providers.marathon.tls.ca=path/to/ca.crt
``` ```
#### `tls.caOptional` #### `caOptional`
The value of `tls.caOptional` defines which policy should be used for the secure connection with TLS Client Authentication to Marathon. _Optional_
The value of `caOptional` defines which policy should be used for the secure connection with TLS Client Authentication to Marathon.
!!! warning "" !!! warning ""
If `tls.ca` is undefined, this option will be ignored, and no client certificate will be requested during the handshake. Any provided certificate will thus never be verified. If `ca` is undefined, this option will be ignored, and no client certificate will be requested during the handshake. Any provided certificate will thus never be verified.
When this option is set to `true`, a client certificate is requested during the handshake but is not required. If a certificate is sent, it is required to be valid. When this option is set to `true`, a client certificate is requested during the handshake but is not required. If a certificate is sent, it is required to be valid.
@ -453,9 +457,12 @@ providers:
--providers.marathon.tls.caOptional=true --providers.marathon.tls.caOptional=true
``` ```
#### `tls.cert` #### `cert`
Public certificate used for the secure connection to Marathon. _Optional_
`cert` is the path to the public certificate used for the secure connection to Marathon.
When using this option, setting the `key` option is required.
```yaml tab="File (YAML)" ```yaml tab="File (YAML)"
providers: providers:
@ -476,9 +483,12 @@ providers:
--providers.marathon.tls.key=path/to/foo.key --providers.marathon.tls.key=path/to/foo.key
``` ```
#### `tls.key` #### `key`
Private certificate used for the secure connection to Marathon. _Optional_
`key` is the path to the private key used for the secure connection to Marathon.
When using this option, setting the `cert` option is required.
```yaml tab="File (YAML)" ```yaml tab="File (YAML)"
providers: providers:
@ -499,7 +509,9 @@ providers:
--providers.marathon.tls.key=path/to/foo.key --providers.marathon.tls.key=path/to/foo.key
``` ```
#### `tls.insecureSkipVerify` #### `insecureSkipVerify`
_Optional, Default=false_
If `insecureSkipVerify` is `true`, the TLS connection to Marathon accepts any certificate presented by the server regardless of the hostnames it covers. If `insecureSkipVerify` is `true`, the TLS connection to Marathon accepts any certificate presented by the server regardless of the hostnames it covers.
@ -532,18 +544,18 @@ see [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration).
```yaml tab="File (YAML)" ```yaml tab="File (YAML)"
providers: providers:
marathon: marathon:
responseHeaderTimeout: "10s" tlsHandshakeTimeout: "10s"
# ... # ...
``` ```
```toml tab="File (TOML)" ```toml tab="File (TOML)"
[providers.marathon] [providers.marathon]
responseHeaderTimeout = "10s" tlsHandshakeTimeout = "10s"
# ... # ...
``` ```
```bash tab="CLI" ```bash tab="CLI"
--providers.marathon.responseHeaderTimeout=10s --providers.marathon.tlsHandshakeTimeout=10s
# ... # ...
``` ```

36
docs/content/providers/redis.md
View file

@ -104,10 +104,14 @@ providers:
_Optional_ _Optional_
#### `tls.ca` Defines the TLS configuration used for the secure connection to Redis.
Certificate Authority used for the secure connection to Redis, #### `ca`
defaults to the system bundle.
_Optional_
`ca` is the path to the certificate authority used for the secure connection to Redis,
it defaults to the system bundle.
```yaml tab="File (YAML)" ```yaml tab="File (YAML)"
providers: providers:
@ -125,13 +129,15 @@ providers:
--providers.redis.tls.ca=path/to/ca.crt --providers.redis.tls.ca=path/to/ca.crt
``` ```
#### `tls.caOptional` #### `caOptional`
The value of `tls.caOptional` defines which policy should be used for the secure connection with TLS Client Authentication to Redis. _Optional_
The value of `caOptional` defines which policy should be used for the secure connection with TLS Client Authentication to Redis.
!!! warning "" !!! warning ""
If `tls.ca` is undefined, this option will be ignored, and no client certificate will be requested during the handshake. Any provided certificate will thus never be verified. If `ca` is undefined, this option will be ignored, and no client certificate will be requested during the handshake. Any provided certificate will thus never be verified.
When this option is set to `true`, a client certificate is requested during the handshake but is not required. If a certificate is sent, it is required to be valid. When this option is set to `true`, a client certificate is requested during the handshake but is not required. If a certificate is sent, it is required to be valid.
@ -153,9 +159,12 @@ providers:
--providers.redis.tls.caOptional=true --providers.redis.tls.caOptional=true
``` ```
#### `tls.cert` #### `cert`
Public certificate used for the secure connection to Redis. _Optional_
`cert` is the path to the public certificate used for the secure connection to Redis.
When using this option, setting the `key` option is required.
```yaml tab="File (YAML)" ```yaml tab="File (YAML)"
providers: providers:
@ -176,9 +185,12 @@ providers:
--providers.redis.tls.key=path/to/foo.key --providers.redis.tls.key=path/to/foo.key
``` ```
#### `tls.key` #### `key`
Private certificate used for the secure connection to Redis. _Optional_
`key` is the path to the private key used for the secure connection to Redis.
When using this option, setting the `cert` option is required.
```yaml tab="File (YAML)" ```yaml tab="File (YAML)"
providers: providers:
@ -199,7 +211,9 @@ providers:
--providers.redis.tls.key=path/to/foo.key --providers.redis.tls.key=path/to/foo.key
``` ```
#### `tls.insecureSkipVerify` #### `insecureSkipVerify`
_Optional, Default=false_
If `insecureSkipVerify` is `true`, the TLS connection to Redis accepts any certificate presented by the server regardless of the hostnames it covers. If `insecureSkipVerify` is `true`, the TLS connection to Redis accepts any certificate presented by the server regardless of the hostnames it covers.

36
docs/content/providers/zookeeper.md
View file

@ -104,10 +104,14 @@ providers:
_Optional_ _Optional_
#### `tls.ca` Defines the TLS configuration used for the secure connection to ZooKeeper.
Certificate Authority used for the secure connection to ZooKeeper, #### `ca`
defaults to the system bundle.
_Optional_
`ca` is the path to the certificate authority used for the secure connection to ZooKeeper,
it defaults to the system bundle.
```yaml tab="File (YAML)" ```yaml tab="File (YAML)"
providers: providers:
@ -125,13 +129,15 @@ providers:
--providers.zookeeper.tls.ca=path/to/ca.crt --providers.zookeeper.tls.ca=path/to/ca.crt
``` ```
#### `tls.caOptional` #### `caOptional`
The value of `tls.caOptional` defines which policy should be used for the secure connection with TLS Client Authentication to Zookeeper. _Optional_
The value of `caOptional` defines which policy should be used for the secure connection with TLS Client Authentication to Zookeeper.
!!! warning "" !!! warning ""
If `tls.ca` is undefined, this option will be ignored, and no client certificate will be requested during the handshake. Any provided certificate will thus never be verified. If `ca` is undefined, this option will be ignored, and no client certificate will be requested during the handshake. Any provided certificate will thus never be verified.
When this option is set to `true`, a client certificate is requested during the handshake but is not required. If a certificate is sent, it is required to be valid. When this option is set to `true`, a client certificate is requested during the handshake but is not required. If a certificate is sent, it is required to be valid.
@ -153,9 +159,12 @@ providers:
--providers.zookeeper.tls.caOptional=true --providers.zookeeper.tls.caOptional=true
``` ```
#### `tls.cert` #### `cert`
Public certificate used for the secure connection to ZooKeeper. _Optional_
`cert` is the path to the public certificate used for the secure connection to ZooKeeper.
When using this option, setting the `key` option is required.
```yaml tab="File (YAML)" ```yaml tab="File (YAML)"
providers: providers:
@ -176,9 +185,12 @@ providers:
--providers.zookeeper.tls.key=path/to/foo.key --providers.zookeeper.tls.key=path/to/foo.key
``` ```
#### `tls.key` #### `key`
Private certificate used for the secure connection to ZooKeeper. _Optional_
`key` is the path to the private key used for the secure connection to ZooKeeper.
When using this option, setting the `cert` option is required.
```yaml tab="File (YAML)" ```yaml tab="File (YAML)"
providers: providers:
@ -199,7 +211,9 @@ providers:
--providers.zookeeper.tls.key=path/to/foo.key --providers.zookeeper.tls.key=path/to/foo.key
``` ```
#### `tls.insecureSkipVerify` #### `insecureSkipVerify`
_Optional, Default=false_
If `insecureSkipVerify` is `true`, the TLS connection to Zookeeper accepts any certificate presented by the server regardless of the hostnames it covers. If `insecureSkipVerify` is `true`, the TLS connection to Zookeeper accepts any certificate presented by the server regardless of the hostnames it covers.