Remove Certificate Chain from Cert Generator #2045
Conversation
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: andreyvelich The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
There was a problem hiding this comment.
@andreyvelich Thanks for refactoring the katib-cert-generator!
Do you have any objections @tenzen-y @johnugeorge @shaowei-su ?
I agree with you since, according to the x509 Go library documentation, we can create the self-signed certificate by specifying the same certificates in the x509.CreateCertificate function.
The certificate is signed by parent. If parent is equal to template then the certificate is self-signed.
https://pkg.go.dev/crypto/x509#CreateCertificate
Also, can you update the docs for the katib-cert-generator?
https://github.com/kubeflow/katib/blob/master/docs/developer-guide.md#katib-cert-generator
I removed Certificate Chain from our Cert generator.
I think having chain is not necessary for Kubernetes Webhooks. I was able to create Katib Experiments in my environment with these changes.
Also, we can leave only Full Service Domain in our DNS names.
Do you have any objections @tenzen-y @johnugeorge @shaowei-su ?