docs: fix comments and mirror documentation

Author: supershal

api/v1alpha1/clusterconfig_types.go

@@ -242,8 +242,8 @@ func (ExtraAPIServerCertSANs) VariableSchema() clusterv1.VariableSchema {
 }
 
 type ImageCredentials struct {
-	// The Secret containing the registry credentials and CA certificate
-	// The Secret should have keys 'username', 'password' and 'ca.crt'
+	// The Secret containing the registry credentials and optional CA certificate
+	// using the keys `username`, `password` and `ca.crt`.
 	// This credentials Secret is not required for some registries, e.g. ECR.
 	// +optional
 	SecretRef *corev1.ObjectReference `json:"secretRef,omitempty"`
@@ -256,7 +256,7 @@ func (ImageCredentials) VariableSchema() clusterv1.VariableSchema {
 			Properties: map[string]clusterv1.JSONSchemaProps{
 				"secretRef": {
 					Description: "The Secret containing the registry credentials. " +
-						"The Secret should have keys 'username', 'password' and 'ca.crt' " +
+						"The Secret should have keys 'username', 'password' and optional 'ca.crt' " +
 						"This credentials Secret is not required for some registries, e.g. ECR.",
 					Type: "object",
 					Properties: map[string]clusterv1.JSONSchemaProps{

docs/content/customization/generic/global-mirror.md

@@ -13,7 +13,8 @@ This customization will be available when the
 
 To provide image registry mirror with CA certificate, specify the following configuration:
 
-If your registry mirror requires self signed CA certifate, create a Kubernetes Secret with keys for `ca.crt`:
+If your registry mirror requires a private or self-signed CA certificate,
+create a Kubernetes Secret with the `ca.crt` key populated with the CA certificate in PEM format:
 
 ```shell
 kubectl create secret generic my-mirror-ca-cert-secret \