Struct AdminTlsConfig 

pub struct AdminTlsConfig {
    pub cert: PathBuf,
    pub key: PathBuf,
    pub ca: PathBuf,
}

mTLS material for the membership-admin gRPC server (PEM file paths, read at build()). Presence on an OpenraftConfig turns the admin port into mutual TLS: cert/key is this node’s admin-server identity; ca verifies connecting admin clients (operators dialing via tsoracle admin).

Security contract: the admin CA MUST be issued from a CA chain independent of the peer CA. Anyone holding a cert signed by the configured admin CA can change cluster membership (AddLearner / Promote / RemoveNode). build enforces the trivial form of this — it rejects sharing the same CA file (by path or by byte content) — but it CANNOT detect two distinct CA files where one is in the trust chain of the other, or both chained under a shared root. Issuing the two CAs from independent roots is the operator’s responsibility.

Fields

cert: PathBuf

key: PathBuf

ca: PathBuf

Trait Implementations

impl Clone for AdminTlsConfig

fn clone(&self) -> AdminTlsConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AdminTlsConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.