github/open-cluster-management
1
0
Fork 0
mirror of https://github.com/open-cluster-management-io/ocm.git synced 2026-08-18 20:00:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add cluster.local FQDN to PlacementDebugServer cert SANs (#1533)

Browse Source 
The CertRotationController only included the short SVC hostname
(service.namespace.svc) in the serving certificate SANs. Clients
resolving via the full cluster.local FQDN get a TLS verification
failure because the name doesn't match. Add the .svc.cluster.local
form so both resolve correctly.

Signed-off-by: Randy Bruno Piverger <21374229+Randy424@users.noreply.github.com>
Co-authored-by: Randy Bruno Piverger <21374229+Randy424@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Randy Bruno Piverger
2026-05-28 02:57:45 +00:00
committed by GitHub
co-authored by Randy Bruno Piverger Claude Opus 4.6
parent 41642b433c
commit 34650042f6
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/operator/operators/clustermanager/controllers/certrotationcontroller/certrotation_controller.go
+7 -1
View File
@@ -303,7 +303,13 @@ func (c certRotationController) syncOne(ctx context.Context, clustermanager *ope
if helpers.PlacementDebugServerEnabled(clustermanager) {
placementServiceName := fmt.Sprintf("%s-placement", clustermanager.Name)
hostNames := []string{fmt.Sprintf("%s.%s.svc", placementServiceName, clustermanagerNamespace)}
hostNames := []string{
fmt.Sprintf("%s.%s.svc", placementServiceName, clustermanagerNamespace),
// TODO(cluster-domain): cluster.local is the default but can be customized
// via kubelet --cluster-domain. Consider making this configurable on the
// ClusterManager CR and updating all service cert SANs to use it.
fmt.Sprintf("%s.%s.svc.cluster.local", placementServiceName, clustermanagerNamespace),
}
if _, ok := cmRotations.targetRotations[helpers.PlacementDebugServingCertSecret]; !ok {
c.rotationMap[clustermanagerName].targetRotations[helpers.PlacementDebugServingCertSecret] = certrotation.TargetRotation{