Public Information

samples/certificates/README.md

@@ -0,0 +1,35 @@
+# (auto-) certificates and the pitfalls of *.this*
+
+*nplus* will automatically generate certificates for your ingress. It either uses an issuer like *cert-manager* or generates a *self-signed-certificate*.
+
+In your production environment though, you might want to take more control over the certificate generation process and don't leave it to *nplus* to automatically take care of it.
+In that case, you want to switch the automation *off*. 
+
+To do so, you need to understand what is happening internally:
+
+- if `.this.ingress.issuer` is set, the chart requests this issuer to generate a tls secret with the name `.this.ingress.secret`  
+  by creating a certificate resource with the name of the domain `.this.ingress.domain`
+- else, so no issuer is set, the chart checks wether the flag `.this.ingress.createSelfSignedCertificate` is set to `true` and
+  generates a tls secret with the name `.this.ingress.secret`
+- else, so neither issuer nor createSelfSignedCertificate are set, the charts will not generate anything
+
+The way how `.this` works is, that it gathers the key from `.Values.global.environment`, `.Values.global` and then `.Values` and flattens them merged into `.this`so that you can set your values 
+on different levels.
+
+However, the *merge* function overwrites non exising values and also boolean `true` overwrites a boolean `false`, not just the nil values. So to make sure we still can cancel functionality 
+by setting `null`or `false`, there is a forth merge which is set to forcefully overwrite existing keys: `override`, which can also be set on *environment*, *global* or on the *component* level.
+
+So the correct way to cancel the generation process is to force the issuer to null (which will cancel the *cert-manager* generation) and also force `createSelfSignedCertificate` to false (to cancel the *self-signed-certificate* generation):
+
+```yaml
+global:
+  override:
+    ingress:
+      enabled: true
+      secret: myCertificate
+      issuer: null
+      createSelfSignedCertificate: false
+```
+
+This makes sure, you will get an ingress, that uses the tls certificate in the secret `myCertificate` for encryption and does not generate anything.
+

samples/certificates/values.yaml

@@ -0,0 +1,6 @@
+global:
+  ingress:
+    enabled: true
+    secret: mySecret
+    issuer: null
+    createSelfSignedCertificate: false