diff --git a/docs/use-tf-controller/with-tf-runner-exposed-using-hostname-subdomain.md b/docs/use-tf-controller/with-tf-runner-exposed-using-hostname-subdomain.md index 40da1125..44a27683 100644 --- a/docs/use-tf-controller/with-tf-runner-exposed-using-hostname-subdomain.md +++ b/docs/use-tf-controller/with-tf-runner-exposed-using-hostname-subdomain.md @@ -30,7 +30,7 @@ For such setup, you can switch the DNS resolution mode to [Hostname/Subdomain](h - Create a `Headless service` named `tf-runner` in each allowed namespace -```yaml hl_lines="4-5,8-10" +```yaml hl_lines="4-5 8-10" apiVersion: v1 kind: Service metadata: @@ -103,4 +103,4 @@ The Runner's pod can then be targeted by TF-Controller using `.pod.` and `*.tf-runner..svc.` hosts on the Runner's namespace. The Runner's pod present this certificate during TLS handshake with TF-Controller. \ No newline at end of file +IMPORTANT: The gRPC communication between TF-Controller and Runner's pod is secured with mTLS. TF-controller generates a valid wildcard TLS certificate for `*..pod.` and `*.tf-runner..svc.` hosts on the Runner's namespace. The Runner's pod present this certificate during TLS handshake with TF-Controller.