xCAT/confluent
2
0
Fork 0
mirror of https://github.com/xcat2/confluent.git synced 2026-09-04 20:17:58 +00:00
Code Issues Projects Releases Wiki Activity

Fix pubkeys.addpolicy documentation to match implementation

Browse Source 
validvalues listed 'automatic'/'manual', but that was outdated.
Commit 454e1b8267 and cc70dcfa2b
implemented unset/'tofu' (trust-on-first-use, the default), 'manual', 'ca-only',
and an implicit 'ca' (any value that isn't otherwise handled falls
through to the standard CA-verification path, keying an already
pinned match without a full CA reverify).
The validvalues fix in ecaa75d967 rejected
these new values. Add new valid values with proper documentation.
This commit is contained in:
Markus Hilger
2026-07-02 15:49:24 +02:00
parent ada4cb196d
commit 4c0b2e44f4
1 changed files with 13 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
confluent_server/confluent/config/attributes.py
+13 -7
View File
@@ -655,13 +655,19 @@ node = {
},
'pubkeys.addpolicy': {
'description': ('Policy to use when encountering unknown public '
'keys. Choices are "automatic" to accept and '
'store new key if no key known and "manual" '
'to always reject a new key, even if no key known'
'Note that if the trusted CA verifies the certificate,'
' that is accepted ignoring this policy. Default '
'policy is "automatic"'),
'validvalues': ('automatic', 'manual'),
'keys. If unset (default), behaves as "tofu" '
'(trust-on-first-use): accept and store a new key '
'if no key is currently known. "manual" always '
'rejects a new key, even if no key is known, '
'requiring it to be pinned manually. "ca" requires '
'the trusted CA to validate the certificate before '
'pinning a new or changed key, but a previously '
'pinned key that still matches is trusted without '
're-checking the CA. "ca-only" is stricter: it '
'requires the trusted CA to validate the '
'certificate on every check, even when a '
'previously pinned key would otherwise match.'),
'validvalues': ('tofu', 'manual', 'ca', 'ca-only'),
},
'pubkeys.tls_hardwaremanager': {
'description': ('Fingerprint of the TLS certificate recognized as'