venafi: service-generated CSRs must not be locked

[maelvls]

It seems our documentation isn't precise enough and does not mention the possibility for "Service Generated CSRs" to be a valid configuration as long as it is not locked; for example the following works with cert-manager:

Signed-off-by: Maël Valais mael@vls.dev

cc @SpectralHiss

[netlify]

✔️ Deploy Preview for cert-manager-website ready!

🔨 Explore the source changes: 3745695

🔍 Inspect the deploy log: https://app.netlify.com/sites/cert-manager-website/deploys/61a9e2172df7d30007227621

😎 Browse the preview: https://deploy-preview-767--cert-manager-website.netlify.app/docs/configuration/venafi

[SpectralHiss]

if we just add that cert-manager can work with the policy set to server provided csr without it being locked it would be good.
In that case vcert (and by extension, cert-manager) will set organisation fields etc. will be set to the policy value.

I don't think the CSR itself is modified but this is a leaky abstraction by TPP, it's just that in that mode the certificate will have different properties derived from the policy than what the CSR requested.

[maelvls]

@SpectralHiss Got it. I added an explanation of what will happen if you use "Service Generated CSR" unlocked. What do you think?

[SpectralHiss]

this is a good addition to the Venafi issuer docs 👍

[SpectralHiss]

/lgtm

[jetstack-bot]

@SpectralHiss: changing LGTM is restricted to collaborators

Details

In response to this:

/lgtm

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[wallrj]

Thanks both of you for figuring this out.

/lgtm
/approve

[jetstack-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: maelvls, wallrj

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [maelvls]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment