From 34650042f6e208e2866bd57dcdfd491f42f7e6e3 Mon Sep 17 00:00:00 2001 From: Randy Bruno Piverger Date: Wed, 27 May 2026 19:57:45 -0700 Subject: [PATCH] Add cluster.local FQDN to PlacementDebugServer cert SANs (#1533) The CertRotationController only included the short SVC hostname (service.namespace.svc) in the serving certificate SANs. Clients resolving via the full cluster.local FQDN get a TLS verification failure because the name doesn't match. Add the .svc.cluster.local form so both resolve correctly. Signed-off-by: Randy Bruno Piverger <21374229+Randy424@users.noreply.github.com> Co-authored-by: Randy Bruno Piverger <21374229+Randy424@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 --- .../certrotationcontroller/certrotation_controller.go | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/pkg/operator/operators/clustermanager/controllers/certrotationcontroller/certrotation_controller.go b/pkg/operator/operators/clustermanager/controllers/certrotationcontroller/certrotation_controller.go index 83d60449a..7f2b92743 100644 --- a/pkg/operator/operators/clustermanager/controllers/certrotationcontroller/certrotation_controller.go +++ b/pkg/operator/operators/clustermanager/controllers/certrotationcontroller/certrotation_controller.go @@ -303,7 +303,13 @@ func (c certRotationController) syncOne(ctx context.Context, clustermanager *ope if helpers.PlacementDebugServerEnabled(clustermanager) { placementServiceName := fmt.Sprintf("%s-placement", clustermanager.Name) - hostNames := []string{fmt.Sprintf("%s.%s.svc", placementServiceName, clustermanagerNamespace)} + hostNames := []string{ + fmt.Sprintf("%s.%s.svc", placementServiceName, clustermanagerNamespace), + // TODO(cluster-domain): cluster.local is the default but can be customized + // via kubelet --cluster-domain. Consider making this configurable on the + // ClusterManager CR and updating all service cert SANs to use it. + fmt.Sprintf("%s.%s.svc.cluster.local", placementServiceName, clustermanagerNamespace), + } if _, ok := cmRotations.targetRotations[helpers.PlacementDebugServingCertSecret]; !ok { c.rotationMap[clustermanagerName].targetRotations[helpers.PlacementDebugServingCertSecret] = certrotation.TargetRotation{