From 0af9d5b62af34b2f003c8ea9c01e6fce6146b2f7 Mon Sep 17 00:00:00 2001 From: Henry Tran Date: Fri, 24 Aug 2018 09:46:38 -0400 Subject: [PATCH] Add documentation for enable-dynamic-certificates feature --- docs/user-guide/cli-arguments.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/user-guide/cli-arguments.md b/docs/user-guide/cli-arguments.md index da624c072..df7efeca4 100644 --- a/docs/user-guide/cli-arguments.md +++ b/docs/user-guide/cli-arguments.md @@ -16,6 +16,7 @@ They are set in the container spec of the `nginx-ingress-controller` Deployment | --default-ssl-certificate string | Secret containing a SSL certificate to be used by the default HTTPS server (catch-all). Takes the form "namespace/name". | | --election-id string | Election id to use for Ingress status updates. (default "ingress-controller-leader") | | --enable-dynamic-configuration | Dynamically refresh backends on topology changes instead of reloading NGINX. Feature backed by OpenResty Lua libraries. (enabled by default) | +| --enable-dynamic-certificates | Dynamically serves certificates instead of reloading NGINX when certificates are created, updated, or deleted. Currently does not support OCSP stapling, so --enable-ssl-chain-completion must be turned off. Assuming the certificate is generated with a 2048 bit RSA key/cert pair, this feature can store roughly 5000 certificates. This is an experiemental feature that currently is not ready for production use. Feature backed by OpenResty Lua libraries. (disabled by default) | | --enable-ssl-chain-completion | Autocomplete SSL certificate chains with missing intermediate CA certificates. A valid certificate chain is required to enable OCSP stapling. Certificates uploaded to Kubernetes must have the "Authority Information Access" X.509 v3 extension for this to succeed. (default true) | | --enable-ssl-passthrough | Enable SSL Passthrough. | | --force-namespace-isolation | Force namespace isolation. Prevents Ingress objects from referencing Secrets and ConfigMaps located in a different namespace than their own. May be used together with watch-namespace. |