mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 14:02:56 +09:00
Arsolitt
bc6c3f2611
The README still described the chart-side cert-manager chain that was replaced when the chart switched to CNPG operator-managed TLS via spec.certificates.serverAltDNSNames. Rewrite the section to explain the actual cert ownership boundary (CNPG owns the chain, chart only injects the external hostname), the trust anchor location (operator-managed <release>-ca Secret, key ca.crt), and the chart-side semantics of the tri-state tls.enabled flag. The values.yaml @field comment is updated in the same direction, with regenerated schema/types.go/cozyrds. Clarifies that tls.enabled=false only skips the chart-side SAN injection - CNPG retains its built-in TLS on the wire regardless of this flag. To force PostgreSQL TLS off entirely, the caller would set postgresql.parameters.ssl="off" at the CNPG layer. Signed-off-by: Arsolitt <arsolitt@gmail.com>