@@ -290,7 +290,7 @@ kind: ClusterTrustBundle
290
290
metadata :
291
291
name : example.com:server-tls:foo
292
292
labels :
293
- k8s. example/cluster-trust-bundle-version : live
293
+ example.com /cluster-trust-bundle-version : live
294
294
spec :
295
295
signerName : example.com/server-tls
296
296
trustBundle : " <... PEM DATA ...>"
@@ -321,7 +321,7 @@ spec:
321
321
+ - clusterTrustBundle:
322
322
+ signerName: example.com/server-tls
323
323
+ labelSelector:
324
- + k8s. example/cluster-trust-bundle-version: live
324
+ + example.com /cluster-trust-bundle-version: live
325
325
+ path: ca_certificates.pem
326
326
` ` `
327
327
@@ -562,11 +562,11 @@ Human operators or controllers may use unique names and labels to maintain diffe
562
562
563
563
For example, if I maintain ` example.com/my-signer ` , I can use the following strategy:
564
564
* I maintain one ClusterTrustBundle named ` example.com:my-signer:live ` , labeled
565
- ` k8s. example/cluster-trust-bundle-version=live` (the object name is mostly
565
+ ` example.com /cluster-trust-bundle-version=live ` (the object name is mostly
566
566
irrelevant).
567
567
* I maintain an additional ClusterTrustBundle named
568
568
` example.com:my-signer:canary ` , labeled
569
- ` k8s. example/cluster-trust-bundle-version=canary` .
569
+ ` example.com /cluster-trust-bundle-version=canary ` .
570
570
* I have coordinated some fraction of my workloads to use the canary label
571
571
selector, while the bulk of them use the live label selector
572
572
* When I want to perform a root rotation or other trust change, I edit the
0 commit comments