ContainerImage.Pinniped/pkg/config/testdata/happy.yaml

---
discovery:
  url: https://some.discovery/url
api:
  servingCertificate:
    durationSeconds: 3600
    renewBeforeSeconds: 2400
Define initial config file format - Users may want to consume pkg/config to generate configuration files. - This also involved putting config-related utilities in the config package for ease of consumption. - We did not add in versioning into the Config type for now...this is something we will likely do in the future, but it is not deemed necessary this early in the project. - The config file format tries to follow the patterns of Kube. One such example of this is requiring the use of base64-encoded CA bundle PEM bytes instead of a file path. This also slightly simplifies the config file handling because we don't have to 1) read in a file or 2) deal with the error case of the file not being there. - The webhook code from k8s.io/apiserver is really exactly what we want here. If this dependency gets too burdensome, we can always drop it, but the pros outweigh the cons at the moment. - Writing out a kubeconfig to disk to configure the webhook is a little janky, but hopefully this won't hurt performance too much in the year 2020. - Also bonus: call the right Serve() function when starting our servers. Signed-off-by: Andrew Keesler <akeesler@vmware.com> 2020-07-14 11:50:14 -04:00			`---`
Allow override of discovery URL via ConfigMap Signed-off-by: Andrew Keesler <akeesler@vmware.com> - Seems like the next step is to allow override of the CA bundle; I didn't do that here for simplicity of the commit, but seems like it is the right thing to do in the future. 2020-08-03 10:17:11 -04:00			`discovery:`
			`url: https://some.discovery/url`
Use duration and renewBefore to control API cert rotation These configuration knobs are much more human-understandable than the previous percentage-based threshold flag. We now allow users to set the lifetime of the serving cert via a ConfigMap. Previously this was hardcoded to 1 year. Signed-off-by: Andrew Keesler <akeesler@vmware.com> 2020-08-20 15:17:18 -04:00			`api:`
			`servingCertificate:`
			`durationSeconds: 3600`
			`renewBeforeSeconds: 2400`