Fix for: (#315)

[marvkis]

Hi,
this is a fix for #315 😉

It separates the server certificates for the management api and the prometheus metrics.

I'm currently wondering:

• Does the init container (ziti controller edge init) need to have access to the certificates?
• Are the identity.[cert|key] options required / Is the client certificate required for the management api and prometheus metrics endpoints?

Bye,
Chris

[qrkourier]

I'm currently wondering:

• Does the init container (ziti controller edge init) need to have access to the certificates?

Hi Chris, Thanks for another upstream contribution! No, init doesn't use the certs. However, with clustered mode there will be changes in this area of the chart since the controller must be running before initialization. For example, when bootstrapping a new cluster the first node will start without a default admin, then an IPC command will inject it during initialization.

• Are the identity.[cert|key] options required / Is the client certificate required for the management api and prometheus metrics endpoints?

The conventional identity directive requires a client cert and key to be configured even if they are not currently used by the code path. It is not an error from Ziti's perspective to re-use the server cert and key in those properties, and my slight preference is to generate a client usage cert and separate key, mainly for consistency.

[qrkourier]

I'm a little apprehensive about complicating the web PKI with separate certs. I'll give it some thought. I've been working on two branches that both touch the PKI, and need to consider the implications there.

[qrkourier]

I didn't notice any barriers to adopting an approach like this, and will revisit this PR when I'm converging clustered controller changes in the v2 chart in the next couple of weeks: #314

[marvkis]

Hi @qrkourier, Thanks for the update.
I still have it in the back of my mind, and depending on how much free time I have, I may pick it up again. Or if you're faster, I'll be happy to test the new chart! The next two weeks will be very busy, so I don't think I'll find the time to work on it. Will take a look at 314 before picking it up again.