Skip to content

Commit

Permalink
Merge pull request #346 from vdice/docs/update-charts-mention
Browse files Browse the repository at this point in the history
docs(README): update charts link/reference
  • Loading branch information
vdice authored May 25, 2017
2 parents efc158f + 7cc5a82 commit 1377bd7
Showing 1 changed file with 3 additions and 2 deletions.
5 changes: 3 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -487,13 +487,13 @@ __This configuration is not suitable for production.__ The primary use case for

### Customizing the charts

The Helm Classic charts available for installing router (either with or without the rest of Deis Workflow) are intended to get users up and running as quickly as possible. As such, the charts do not strictly require any editing prior to installation in order to successfully bootstrap a cluster. However, there are some useful customizations that should be applied for use in production environments:
The Helm [chart][] available for installing router (either with or without the rest of Deis Workflow) is intended to get users up and running as quickly as possible. As such, the chart does not strictly require any editing prior to installation in order to successfully bootstrap a cluster. However, there are some useful customizations that should be applied for use in production environments:

* __Specify a [platform domain](#platform-domain).__ Without a platform domain specified, any routable service specifying one or more non-fully-qualified domain names (not containing any `.` character) among its `router.deis.io/domains` will be matched using a regular expression of the form `^{{ $domain }}\.(?<domain>.+)$` where `{{ $domain }}` resolves to the non-fully-qualified domain name. By way of example, the idiosyncrasy that this exposes is that traffic bound for the `foo` subdomain of _any_ domain would be routed to an application that lists the non-fully-qualified domain name `foo` among its `router.deis.io/domains`. While this behavior is not innately wrong, it may not be desirable. To circumvent this, specify a [platform domain](#platform-domain). This will cause routable services specifying one or more non-fully-qualified domain names to be matched, explicitly, as subdomains of the platform domain. Apart from remediating this minor idiosyncrasy, this is required in order to properly utilize a wildcard SSL certificate and may also result in a very modest performance improvement.

* __Do you need to use SSL to [secure the platform domain](#platform-cert)?__

* __If using SSL, generate and provide your own dhparam.__ A dhparam is a secret key used in [Diffie Hellman key exchange](https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange) during the SSL handshake in order to help ensure [perfect forward secrecy](https://en.wikipedia.org/wiki/Forward_secrecy). The Helm Classic charts available for installing router (either with or without the rest of Deis Workflow) already include a dhparam, but recall that dhparams are intended to be secret. The dhparam included in the charts is marginally preferable to using Nginx's default dhparam only because it is lesser-known, but it is _still_ publicly available in the [deis/charts](https://github.com/deis/charts) repository. As such, users wishing to run the router in production _and_ use SSL are best off generating their own dhparam. After being generated, it should be base64 encoded and included as the value of the `dhparam` key in a Kubernetes secret named `deis-router-dhparam` in the same namespace as the router itself.
* __If using SSL, generate and provide your own dhparam.__ A dhparam is a secret key used in [Diffie Hellman key exchange](https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange) during the SSL handshake in order to help ensure [perfect forward secrecy](https://en.wikipedia.org/wiki/Forward_secrecy). The Helm [chart][] available for installing router (either with or without the rest of Deis Workflow) already includes a dhparam, but recall that dhparams are intended to be secret. The dhparam included in the chart is marginally preferable to using Nginx's default dhparam only because it is lesser-known, but it is _still_ publicly available in the [chart][]. As such, users wishing to run the router in production _and_ use SSL are best off generating their own dhparam. After being generated, it should be base64 encoded and included as the value of the `dhparam` key in a Kubernetes secret named `deis-router-dhparam` in the same namespace as the router itself.

For example, to generate and base64 encode the dhparam on a Mac:

Expand Down Expand Up @@ -539,3 +539,4 @@ Unless required by applicable law or agreed to in writing, software distributed

[issues]: https://github.com/deis/router/issues
[prs]: https://github.com/deis/router/pulls
[chart]: https://github.com/deis/router/tree/master/charts/router

0 comments on commit 1377bd7

Please sign in to comment.