-
Notifications
You must be signed in to change notification settings - Fork 61
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
adding further description of KeyManager #285
base: master
Are you sure you want to change the base?
Conversation
✅ Deploy Preview for spiffe ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
fead5da
to
e46bc40
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hi @ChaosInTheCRD - Thank you for the PR! My day job is editing and writing software documentation, so here's my take on the wording. Someone else can review the meaning.
Signed-off-by: chaosinthecrd <[email protected]>
Signed-off-by: chaosinthecrd <[email protected]>
Co-authored-by: Steve Anderson <[email protected]> Signed-off-by: chaosinthecrd <[email protected]>
7bd517e
to
789297e
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for making the suggested changes!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you @ChaosInTheCRD for this enhancement in the documentation.
While I think that a clarification about how the Key Manager operates is needed, I would probably word this little differently because IMO it puts some negative emphasis that's not the intent of the section.
Let me discuss this with the SPIRE maintainers team and get back here with the feedback.
Thanks again!
Hey! No problem, it wasn't my intention to make anything sound negative, just to draw a line between what the key manager is and what the upstream authority is |
Description of the change
I began some work to try and make a KeyManager plugin that handed off signing to a CA service in the hope that said service could make policy decisions based on the SVID being presented (e.g., X.509 Certificate Signing request). Of course this does not work, and I misled myself. I am hopeful that this PR will make it more clear for others that hope to do the same thing.