Covers -a.security/-b.security for clusters with different CAs, the
asymmetry between the gRPC leg (chain only, no hostname check) and the
HTTP leg (full SAN verification), and a tested nginx-ingress recipe for
when only Ingress objects can be created.
Also documents client_cert/client_key on the server-side [grpc.*]
sections, which were undocumented.
Claude-Session: https://claude.ai/code/session_01YVJWE5w6Sdm3XJ3nPDaMyu
Security: document WEED_TLS_CERT_REFRESH_INTERVAL for tuning refresh window
Added a user-facing env var that overrides the 5h default refresh cadence
for both gRPC mTLS and HTTPS cert reloading, for operators running short-
lived certs (Vault, cert-manager with 24h leaves, etc.).
Security: extend certificate rotation to HTTPS clients and document scope
PR #9181 now also hot-reloads HTTPS client mTLS certs for weed mount,
backup, upload, filer.copy, filer→volume, and s3→filer/volume — covering
the data-plane HTTP path used by FUSE mount. MQ broker/agent, Kafka
gateway, and mount's control plane were already covered via the gRPC
mTLS refresh. Document the CA-bundle-not-reloading caveat and call out
the Kafka notification / filer-store driver TLS as outside scope.
Security: document certificate rotation without restarts (k8s cert-manager)
Covers which surfaces hot-reload (gRPC mTLS, HTTPS master/volume/filer/s3/
webdav/admin after PR #9181) and which do not (HTTPS client). Includes a
cert-manager example and the refresh-window / in-flight caveats.
Chris Lu