docs(mesh): add --skip-verify to universal dp#5432
Open
bartsmykla wants to merge 2 commits into
Open
Conversation
✅ Deploy Preview for kongdeveloper ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
There was a problem hiding this comment.
Pull request overview
Updates Kong Mesh Universal-mode documentation to account for upstream kuma-dp behavior changes where TLS verification is now enforced by default when connecting to an HTTPS control plane, requiring explicit opt-out (--skip-verify) for self-signed dev/demo setups.
Changes:
- Added
--skip-verifytokuma-dp runcommands that connect to an HTTPS control plane with self-signed certs. - Added warning admonitions explaining that
--skip-verifyis for dev/demo only and that production should use--ca-cert-file/KUMA_CONTROL_PLANE_CA_CERT_FILE.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
| app/mesh/data-plane-universal.md | Adds --skip-verify for local HTTPS control plane examples and documents security implications. |
| app/_how-tos/mesh/mesh-get-started-universal-3-kv.md | Keeps the Universal quickstart kv data-plane instructions working with newer kuma-dp TLS verification defaults. |
| app/_how-tos/mesh/mesh-get-started-universal-4-demo-app.md | Keeps the Universal quickstart demo-app data-plane instructions working with newer kuma-dp TLS verification defaults. |
| app/_how-tos/mesh/deploy-universal-self-managed.md | Updates self-managed Universal setup commands to explicitly skip verification for the guide’s self-signed control plane. |
Recent Kuma releases changed kuma-dp to verify the control plane certificate against the system trust store by default. The universal getting-started and reference guides use a self-signed control plane, so kuma-dp run against it now fails verification. Add --skip-verify to those commands to keep the guides working, with a warning pointing at the production-correct --ca-cert-file path. Signed-off-by: Bart Smykla <bartek@smykla.com>
bartsmykla
force-pushed
the
docs/mesh-universal-dp-skip-verify
branch
from
80267f1 to
c08dbe1
Compare
Drop the inaccurate "silently" wording (the old behavior logged a warning) and add the missing line-continuation in the data-plane-universal redis example. Signed-off-by: Bart Smykla <bartek@smykla.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Recent Kuma releases changed
kuma-dpto verify the control plane certificate against the system trust store by default. Skipping verification is now opt-in via--skip-verify(KUMA_CONTROL_PLANE_TLS_SKIP_VERIFY); the production path is to pass the control plane CA with--ca-cert-file/KUMA_CONTROL_PLANE_CA_CERT_FILE.The universal getting-started and data-plane-on-universal guides use a self-signed control plane, so
kuma-dp run --cp-address=https://...now fails verification. This adds--skip-verifyto those commands inapp/mesh/data-plane-universal.mdand the universal how-tos, with a warning pointing at--ca-cert-filefor production.Reviewers:
--skip-verifyis new, so you may want to version-gate these lines for older docs.Preview Links
Checklist
kuma-dpbehavior; not run end to end.descriptionentry in frontmatter.