Ми також бачили, що HTTPS зазвичай надається компонентом, **зовнішнім** щодо вашого серверного застосунку, - **TLS Termination Proxy**.

І має бути щось, що відповідає за **оновлення сертифікатів HTTPS** - це може бути той самий компонент або інший.

### Приклади інструментів для HTTPS { #example-tools-for-https }

Деякі інструменти, які можна використовувати як TLS Termination Proxy:

- Traefik
    - Автоматично обробляє оновлення сертифікатів ✨
- Caddy

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package okhttp3.tls.internal.der

import java.net.ProtocolException

/**
 * Handles basic types that always use the same tag. This supports optional types and may set a type
 * hint for further adapters to process.
 *

#### 目錄結構 { #directory-structure }

你現在應該會有如下的目錄結構：

```
.
├── app
│   ├── __init__.py
│   └── main.py
├── Dockerfile
└── requirements.txt
```

#### 位於 TLS 終止代理之後 { #behind-a-tls-termination-proxy }

如果你在 TLS 終止代理（負載平衡器）如 Nginx 或 Traefik 之後執行容器，請加上 `--proxy-headers` 選項，這會告訴 Uvicorn（透過 FastAPI CLI）信任該代理所送來的標頭，表示應用在 HTTPS 後方執行等。

```Dockerfile

      ${MC} admin policy attach myminio $POLICY --user=$USER
      set -e
  else
      echo "User '$USER' has no policy attached."
  fi
}

# Try connecting to MinIO instance
{{- if .Values.tls.enabled }}
scheme=https
{{- else }}
scheme=http
{{- end }}
connectToMinio $scheme

{{ if .Values.users }}
{{ $global := . }}
# Create the users
{{- range .Values.users }}

        "com.squareup.okhttp3",
        "com.squareup.okhttp3.brotli",
        "com.squareup.okhttp3.dnsoverhttps",
        "com.squareup.okhttp3.logging",
        "com.squareup.okhttp3.sse",
        "com.squareup.okhttp3.tls",
        "com.squareup.okhttp3.urlconnection",
      )

    /** Equinox must also be on the testing classpath.  */
    private const val RESOLVE_OSGI_FRAMEWORK = "org.eclipse.osgi"

import org.mockserver.logging.MockServerLogger
import org.mockserver.model.HttpRequest.request
import org.mockserver.model.HttpResponse.response
import org.mockserver.proxyconfiguration.ProxyConfiguration
import org.mockserver.socket.tls.KeyStoreFactory
import org.testcontainers.containers.MockServerContainer
import org.testcontainers.junit.jupiter.Container
import org.testcontainers.junit.jupiter.Testcontainers

@Testcontainers
class BasicProxyTest {

- MinIO object storage set up per <https://docs.min.io/community/minio-object-store/index.html>
- Veeam requires TLS connections to the object storage.  This can be configured per <https://docs.min.io/community/minio-object-store/operations/network-encryption.html>
- The S3 bucket, Access Key and Secret Key have to be created before and outside of Veeam.

* Fix strategic merge diff list diff bug ([#26418](https://github.com/kubernetes/kubernetes/pull/26418), [@AdoHe](https://github.com/AdoHe))
* Setting TLS1.2 minimum because TLS1.0 and TLS1.1 are vulnerable ([#26169](https://github.com/kubernetes/kubernetes/pull/26169), [@victorgp](https://github.com/victorgp))

  --initial-advertise-peer-urls http://0.0.0.0:2380 \
  --initial-cluster s1=http://0.0.0.0:2380 \
  --initial-cluster-token tkn \
  --initial-cluster-state new
```

You may also setup etcd with TLS following this documentation [here](https://coreos.com/etcd/docs/latest/op-guide/security.html)

### 3. Setup MinIO with etcd

      .assertLogMatch(Regex("""secureConnectStart"""))
      .assertLogMatch(
        Regex(
          """secureConnectEnd: Handshake\{tlsVersion=TLS_1_[23] cipherSuite=TLS_.* peerCertificates=\[CN=localhost] localCertificates=\[]\}""",
        ),
      ).assertLogMatch(Regex("""connectEnd: h2"""))
      .assertLogMatch(