Skip to content

Commit 1377bd7

Browse files
authored
Merge pull request #346 from vdice/docs/update-charts-mention
docs(README): update charts link/reference
2 parents efc158f + 7cc5a82 commit 1377bd7

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

README.md

+3-2
Original file line numberDiff line numberDiff line change
@@ -487,13 +487,13 @@ __This configuration is not suitable for production.__ The primary use case for
487487

488488
### Customizing the charts
489489

490-
The Helm Classic charts available for installing router (either with or without the rest of Deis Workflow) are intended to get users up and running as quickly as possible. As such, the charts do not strictly require any editing prior to installation in order to successfully bootstrap a cluster. However, there are some useful customizations that should be applied for use in production environments:
490+
The Helm [chart][] available for installing router (either with or without the rest of Deis Workflow) is intended to get users up and running as quickly as possible. As such, the chart does not strictly require any editing prior to installation in order to successfully bootstrap a cluster. However, there are some useful customizations that should be applied for use in production environments:
491491

492492
* __Specify a [platform domain](#platform-domain).__ Without a platform domain specified, any routable service specifying one or more non-fully-qualified domain names (not containing any `.` character) among its `router.deis.io/domains` will be matched using a regular expression of the form `^{{ $domain }}\.(?<domain>.+)$` where `{{ $domain }}` resolves to the non-fully-qualified domain name. By way of example, the idiosyncrasy that this exposes is that traffic bound for the `foo` subdomain of _any_ domain would be routed to an application that lists the non-fully-qualified domain name `foo` among its `router.deis.io/domains`. While this behavior is not innately wrong, it may not be desirable. To circumvent this, specify a [platform domain](#platform-domain). This will cause routable services specifying one or more non-fully-qualified domain names to be matched, explicitly, as subdomains of the platform domain. Apart from remediating this minor idiosyncrasy, this is required in order to properly utilize a wildcard SSL certificate and may also result in a very modest performance improvement.
493493

494494
* __Do you need to use SSL to [secure the platform domain](#platform-cert)?__
495495

496-
* __If using SSL, generate and provide your own dhparam.__ A dhparam is a secret key used in [Diffie Hellman key exchange](https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange) during the SSL handshake in order to help ensure [perfect forward secrecy](https://en.wikipedia.org/wiki/Forward_secrecy). The Helm Classic charts available for installing router (either with or without the rest of Deis Workflow) already include a dhparam, but recall that dhparams are intended to be secret. The dhparam included in the charts is marginally preferable to using Nginx's default dhparam only because it is lesser-known, but it is _still_ publicly available in the [deis/charts](https://github.com/deis/charts) repository. As such, users wishing to run the router in production _and_ use SSL are best off generating their own dhparam. After being generated, it should be base64 encoded and included as the value of the `dhparam` key in a Kubernetes secret named `deis-router-dhparam` in the same namespace as the router itself.
496+
* __If using SSL, generate and provide your own dhparam.__ A dhparam is a secret key used in [Diffie Hellman key exchange](https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange) during the SSL handshake in order to help ensure [perfect forward secrecy](https://en.wikipedia.org/wiki/Forward_secrecy). The Helm [chart][] available for installing router (either with or without the rest of Deis Workflow) already includes a dhparam, but recall that dhparams are intended to be secret. The dhparam included in the chart is marginally preferable to using Nginx's default dhparam only because it is lesser-known, but it is _still_ publicly available in the [chart][]. As such, users wishing to run the router in production _and_ use SSL are best off generating their own dhparam. After being generated, it should be base64 encoded and included as the value of the `dhparam` key in a Kubernetes secret named `deis-router-dhparam` in the same namespace as the router itself.
497497

498498
For example, to generate and base64 encode the dhparam on a Mac:
499499

@@ -539,3 +539,4 @@ Unless required by applicable law or agreed to in writing, software distributed
539539

540540
[issues]: https://github.com/deis/router/issues
541541
[prs]: https://github.com/deis/router/pulls
542+
[chart]: https://github.com/deis/router/tree/master/charts/router

0 commit comments

Comments
 (0)