doc: correct diagrams; replace tabs with spaces.
@@ -17,6 +17,7 @@ Here is the overview for etcd-operator TLS flow, which should set us up well for
### Trust delegation diagram:
+```
-----------------
| external PKI | (something that can sign the operator's CSRs)
-----------------
@@ -47,17 +48,17 @@ Here is the overview for etcd-operator TLS flow, which should set us up well for
| I | |
| G | | cluster-A-backup-sidecar
| N | |-------------> [ client-interface CLIENT CERT ]
- | |
- | |
- | |
+ | | |
+ | | |
+ | | |
| | --------------> [ etcd-cluster-B client-interface CLIENT CERT ]
| | |
| | DIRECT | SIGN
| | |
- | |--------> [ etcd-cluster-B client-interface CERTIFICATE AUTHORITY ]
+ | | |--------> [ etcd-cluster-B client-interface CERTIFICATE AUTHORITY ]
/|\ | CERT | |
| | | | | etcd-cluster-B-0000
- | | | | |------> ...
+ | | | |------> ...
CSR | \|/ |
| | ...
|
@@ -84,6 +85,7 @@ Here is the overview for etcd-operator TLS flow, which should set us up well for
| |------> ...
|
| ...
+```
@@ -116,6 +118,7 @@ Here is the overview for etcd-operator TLS flow, which should set us up well for
#### Direct Sign (intra-component)
+```
[ signer ]
|
|
@@ -123,11 +126,13 @@ Here is the overview for etcd-operator TLS flow, which should set us up well for
|
|
-----> [ signee ]
+```
In the case that the _signer_ and _signee_ are within the same component, we have the _signer's_ private key material immediately available to produce a signed certificate for the _signee_. No need for CSR exchange.
#### CSR/Cert exchange (inter-component)
+```
[ signer ]
|
/|\ CERT |
@@ -135,6 +140,7 @@ In the case that the _signer_ and _signee_ are within the same component, we hav
| | |
CSR \|/ |
-----> [ signee ]
+```
This is a symbol for a _signee_ submitting a CSR to a _signer_, and recieving back a signed certificate back.
