Add extra SANs for hosted gateway TLS certificate#1296
Merged
Conversation
Signed-off-by: Arnob Kumar Saha <arnob@appscode.com>
Signed-off-by: Arnob Kumar Saha <arnob@appscode.com>
Signed-off-by: Arnob Kumar Saha <arnob@appscode.com>
Signed-off-by: Arnob Kumar Saha <arnob@appscode.com>
Signed-off-by: Arnob Kumar Saha <arnob@appscode.com> Signed-off-by: Arnob kumar saha <arnob@appscode.com>
ArnobKumarSaha
force-pushed
the
arnob-gw-tls-san
branch
from
July 9, 2026 09:22
c6eceda to
47690ce
Compare
… annotation The envoyService external-dns hostname annotation only ever set the base gateway domain, while the TLS certificate already carried SANs for nats.appscode.com, api.appscode.com and api.byte.builders in hosted mode. This left api.appscode.com routable but unresolvable. Mirror the same extra-domain list into the DNS annotation. Signed-off-by: Arnob kumar saha <arnob@appscode.com>
The ingress Certificate already added an api.<host> SAN when deploymentType is Hosted, but the gateway-native HTTPRoute never had a matching hostnames entry — it was patched in manually on the live ace HTTPRoute. Template it so it survives reconciliation. Signed-off-by: Arnob kumar saha <arnob@appscode.com>
Hosted deploymentType alone isn't specific enough - api.<host> should only apply to the appscode.com production host, not every hosted tenant. Signed-off-by: Arnob kumar saha <arnob@appscode.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
nats.<host>,api.<host>, andapi.byte.buildersto the gateway TLS certificate'sdnsNameswhen the gateway class ishostedand platform host isappscode.com.external-dns.alpha.kubernetes.io/hostnameannotation on the envoy Service, so ExternalDNS actually creates theapi.appscode.comDNS record (was routable/TLS'd but unresolvable).api.<host>to theacechart's gatewayHTTPRoutehostnames, scoped todeploymentType: Hostedandhost: appscode.comonly.