From f5a512f46976c5ceb0ffbd4b94a80ba5b56ef660 Mon Sep 17 00:00:00 2001 From: mdarii Date: Mon, 1 May 2023 20:38:46 +0200 Subject: [PATCH 1/3] http binding - updated documentation Signed-off-by: mdarii --- .../components-reference/supported-bindings/http.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/daprdocs/content/en/reference/components-reference/supported-bindings/http.md b/daprdocs/content/en/reference/components-reference/supported-bindings/http.md index bc2184073..d68170715 100644 --- a/daprdocs/content/en/reference/components-reference/supported-bindings/http.md +++ b/daprdocs/content/en/reference/components-reference/supported-bindings/http.md @@ -26,6 +26,8 @@ spec: value: /Users/somepath/client.pem # OPTIONAL or - name: MTLSClientKey value: /Users/somepath/client.key # OPTIONAL or + - name: MTLSRenegotiation + value: RenegotiateOnceAsClient # OPTIONAL one of: RenegotiateNever, RenegotiateOnceAsClient, RenegotiateFreelyAsClient - name: securityToken # OPTIONAL secretKeyRef: name: mysecret @@ -42,6 +44,7 @@ spec: | MTLSRootCA | N | Output |Path to root ca certificate or pem encoded string | | MTLSClientCert | N | Output |Path to client certificate or pem encoded string | | MTLSClientKey | N | Output |Path client private key or pem encoded string | +| MTLSRenegotiation | N | Output |Type of TLS renegotiation to be used | `RenegotiateOnceAsClient` | securityToken | N | Output |The value of a token to be added to an HTTP request as a header. Used together with `securityTokenHeader` | | securityTokenHeader| N | Output |The name of the header for `securityToken` on an HTTP request that | @@ -317,6 +320,8 @@ These fields can be passed as a file path or as a pem encoded string. - If the pem encoded string is provided, the string is used as is. When these fields are configured, the Dapr sidecar uses the provided certificate to authenticate itself with the server during the TLS handshake process. +If remote server is enforcing TLS renegotiation you need to set also metadata field `MTLSRenegotiation`, it accepts one of following options: `RenegotiateNever`,`RenegotiateOnceAsClient` or `RenegotiateFreelyAsClient`. For more details check please: https://pkg.go.dev/crypto/tls#RenegotiationSupport + ### When to use: You can use this when the server with which the HTTP binding is configured to communicate requires mTLS or client TLS authentication. From 3f8e9991c8b6b79c8dbdc64bec4d317240eb0dd6 Mon Sep 17 00:00:00 2001 From: mdarii Date: Tue, 2 May 2023 21:23:53 +0200 Subject: [PATCH 2/3] changes after review Signed-off-by: mdarii --- .../components-reference/supported-bindings/http.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/daprdocs/content/en/reference/components-reference/supported-bindings/http.md b/daprdocs/content/en/reference/components-reference/supported-bindings/http.md index d68170715..f41dd3959 100644 --- a/daprdocs/content/en/reference/components-reference/supported-bindings/http.md +++ b/daprdocs/content/en/reference/components-reference/supported-bindings/http.md @@ -320,7 +320,11 @@ These fields can be passed as a file path or as a pem encoded string. - If the pem encoded string is provided, the string is used as is. When these fields are configured, the Dapr sidecar uses the provided certificate to authenticate itself with the server during the TLS handshake process. -If remote server is enforcing TLS renegotiation you need to set also metadata field `MTLSRenegotiation`, it accepts one of following options: `RenegotiateNever`,`RenegotiateOnceAsClient` or `RenegotiateFreelyAsClient`. For more details check please: https://pkg.go.dev/crypto/tls#RenegotiationSupport +If the remote server is enforcing TLS renegotiation, you also need to set the metadata field `MTLSRenegotiation`. This field accepts one of following options: +- `RenegotiateNever` +- `RenegotiateOnceAsClient` +- `RenegotiateFreelyAsClient`. +For more details see [the Go `RenegotiationSupport` documentation](https://pkg.go.dev/crypto/tls#RenegotiationSupport). ### When to use: You can use this when the server with which the HTTP binding is configured to communicate requires mTLS or client TLS authentication. From 85e8fcfcc1d4cf0da043861ea2768d45e6803c8d Mon Sep 17 00:00:00 2001 From: mdarii Date: Tue, 2 May 2023 21:26:37 +0200 Subject: [PATCH 3/3] fixed typo Signed-off-by: mdarii --- .../en/reference/components-reference/supported-bindings/http.md | 1 + 1 file changed, 1 insertion(+) diff --git a/daprdocs/content/en/reference/components-reference/supported-bindings/http.md b/daprdocs/content/en/reference/components-reference/supported-bindings/http.md index f41dd3959..b95099430 100644 --- a/daprdocs/content/en/reference/components-reference/supported-bindings/http.md +++ b/daprdocs/content/en/reference/components-reference/supported-bindings/http.md @@ -324,6 +324,7 @@ If the remote server is enforcing TLS renegotiation, you also need to set the me - `RenegotiateNever` - `RenegotiateOnceAsClient` - `RenegotiateFreelyAsClient`. + For more details see [the Go `RenegotiationSupport` documentation](https://pkg.go.dev/crypto/tls#RenegotiationSupport). ### When to use: