Use wildcard SANs for RabbitMQ TLS certificates

Replace per-pod dnsNames with wildcard SANs in the cert-manager
Certificate for RabbitMQ:

- *.{name}-nodes.{ns} (Erlang node name format, no .svc suffix)
- *.{name}-nodes.{ns}.svc
- *.{name}-nodes.{ns}.svc.{clusterDomain}

This enables verify_peer for inter-node TLS with OTP 26+, which
enforces strict hostname verification. The wildcard covers all
StatefulSet pods and ephemeral Erlang peers spawned during peer
discovery. It also removes the need to reissue certificates when
scaling replicas.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: lmiccini

api/go.mod

@@ -143,4 +143,4 @@ replace k8s.io/component-base => k8s.io/component-base v0.31.14 //allow-merging
 
 replace github.com/cert-manager/cmctl/v2 => github.com/cert-manager/cmctl/v2 v2.1.2-0.20241127223932-88edb96860cf //allow-merging
 
-replace github.com/openstack-k8s-operators/infra-operator/apis => github.com/lmiccini/infra-operator/apis v0.0.0-20260323131947-8d359988b429
+replace github.com/openstack-k8s-operators/infra-operator/apis => github.com/lmiccini/infra-operator/apis v0.0.0-20260324133747-2a4926724e72

api/go.sum

@@ -90,8 +90,8 @@ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
 github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
-github.com/lmiccini/infra-operator/apis v0.0.0-20260323131947-8d359988b429 h1:QwkH9nTpHVmflD0ABJZCN0V2N3XvlCkfYgmQthkMg2k=
-github.com/lmiccini/infra-operator/apis v0.0.0-20260323131947-8d359988b429/go.mod h1:QXzR9220I2d7CcoHqL4HWtU1PogJSN3NLmnh+bK3mco=
+github.com/lmiccini/infra-operator/apis v0.0.0-20260324133747-2a4926724e72 h1:PT0eMuQwicBQMfxMb5HBV9RY1efke5JNXxre2M5tkoI=
+github.com/lmiccini/infra-operator/apis v0.0.0-20260324133747-2a4926724e72/go.mod h1:QXzR9220I2d7CcoHqL4HWtU1PogJSN3NLmnh+bK3mco=
 github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
 github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
 github.com/maruel/natural v1.1.1 h1:Hja7XhhmvEFhcByqDoHz9QZbkWey+COd9xWfCfn1ioo=

config/operator/manager_operator_images.yaml

@@ -26,7 +26,7 @@ spec:
         - name: RELATED_IMAGE_HORIZON_OPERATOR_MANAGER_IMAGE_URL
           value: quay.io/openstack-k8s-operators/horizon-operator@sha256:67c5689bf3ea12b55f2c76e8dbefad03a980a6545d46f16493004cdcff4bfee4
         - name: RELATED_IMAGE_INFRA_OPERATOR_MANAGER_IMAGE_URL
-          value: quay.io/lmiccini/infra-operator@sha256:e05efe1bebd32134d2ad07a5bb3535d4a09e99f50e4365575d698a74d9a1d85b
+          value: quay.io/lmiccini/infra-operator@sha256:f42a7ee4583180fc6a75725e7c1fd9dabf13742335a12632444ea52dbffd8166
         - name: RELATED_IMAGE_IRONIC_OPERATOR_MANAGER_IMAGE_URL
           value: quay.io/openstack-k8s-operators/ironic-operator@sha256:741c1bc38c0d9430995a0d0aae6adae5c1f490b23d620564595cdd40683df68b
         - name: RELATED_IMAGE_KEYSTONE_OPERATOR_MANAGER_IMAGE_URL

go.mod

@@ -182,4 +182,4 @@ replace k8s.io/component-base => k8s.io/component-base v0.31.14 //allow-merging
 
 replace github.com/cert-manager/cmctl/v2 => github.com/cert-manager/cmctl/v2 v2.1.2-0.20241127223932-88edb96860cf //allow-merging
 
-replace github.com/openstack-k8s-operators/infra-operator/apis => github.com/lmiccini/infra-operator/apis v0.0.0-20260323131947-8d359988b429
+replace github.com/openstack-k8s-operators/infra-operator/apis => github.com/lmiccini/infra-operator/apis v0.0.0-20260324133747-2a4926724e72

go.sum

@@ -114,8 +114,8 @@ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
 github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
-github.com/lmiccini/infra-operator/apis v0.0.0-20260323131947-8d359988b429 h1:QwkH9nTpHVmflD0ABJZCN0V2N3XvlCkfYgmQthkMg2k=
-github.com/lmiccini/infra-operator/apis v0.0.0-20260323131947-8d359988b429/go.mod h1:QXzR9220I2d7CcoHqL4HWtU1PogJSN3NLmnh+bK3mco=
+github.com/lmiccini/infra-operator/apis v0.0.0-20260324133747-2a4926724e72 h1:PT0eMuQwicBQMfxMb5HBV9RY1efke5JNXxre2M5tkoI=
+github.com/lmiccini/infra-operator/apis v0.0.0-20260324133747-2a4926724e72/go.mod h1:QXzR9220I2d7CcoHqL4HWtU1PogJSN3NLmnh+bK3mco=
 github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
 github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
 github.com/maruel/natural v1.1.1 h1:Hja7XhhmvEFhcByqDoHz9QZbkWey+COd9xWfCfn1ioo=

hack/export_operator_related_images.sh

@@ -6,7 +6,7 @@ export RELATED_IMAGE_DESIGNATE_OPERATOR_MANAGER_IMAGE_URL=quay.io/openstack-k8s-
 export RELATED_IMAGE_GLANCE_OPERATOR_MANAGER_IMAGE_URL=quay.io/openstack-k8s-operators/glance-operator@sha256:f649f31aca138e78f72963c98bafaeb0da514133f1d731019552c76dad08394c
 export RELATED_IMAGE_HEAT_OPERATOR_MANAGER_IMAGE_URL=quay.io/openstack-k8s-operators/heat-operator@sha256:875a5a57ca5820e2b8b01463d5efbe0644afc288fcbb78898795d34637c1b7e2
 export RELATED_IMAGE_HORIZON_OPERATOR_MANAGER_IMAGE_URL=quay.io/openstack-k8s-operators/horizon-operator@sha256:67c5689bf3ea12b55f2c76e8dbefad03a980a6545d46f16493004cdcff4bfee4
-export RELATED_IMAGE_INFRA_OPERATOR_MANAGER_IMAGE_URL=quay.io/lmiccini/infra-operator@sha256:e05efe1bebd32134d2ad07a5bb3535d4a09e99f50e4365575d698a74d9a1d85b
+export RELATED_IMAGE_INFRA_OPERATOR_MANAGER_IMAGE_URL=quay.io/lmiccini/infra-operator@sha256:f42a7ee4583180fc6a75725e7c1fd9dabf13742335a12632444ea52dbffd8166
 export RELATED_IMAGE_IRONIC_OPERATOR_MANAGER_IMAGE_URL=quay.io/openstack-k8s-operators/ironic-operator@sha256:741c1bc38c0d9430995a0d0aae6adae5c1f490b23d620564595cdd40683df68b
 export RELATED_IMAGE_KEYSTONE_OPERATOR_MANAGER_IMAGE_URL=quay.io/openstack-k8s-operators/keystone-operator@sha256:9fd3681c6c8549a78b12dc5e83676bc0956558b01327b95598aa424d62acb189
 export RELATED_IMAGE_MANILA_OPERATOR_MANAGER_IMAGE_URL=quay.io/openstack-k8s-operators/manila-operator@sha256:e5f1303497321c083933cd8ab46e0c95c3f7f3f4101e0c2c3df79eb089abab9e

internal/openstack/rabbitmq.go

@@ -201,9 +201,14 @@ func reconcileRabbitMQ(
 		fmt.Sprintf("%s.%s", hostname, clusterDomain),
 		hostnameHeadless,
 		fmt.Sprintf("%s.%s", hostnameHeadless, clusterDomain),
-	}
-	for i := 0; i < int(*spec.Replicas); i++ {
-		hostnames = append(hostnames, fmt.Sprintf("%s-server-%d.%s-nodes.%s", name, i, name, instance.Namespace))
+		// Wildcard SANs cover all StatefulSet pods and ephemeral Erlang peers,
+		// enabling verify_peer for inter-node TLS with OTP 26+ and removing
+		// the need to reissue certificates when scaling replicas.
+		// The short form (without .svc) is needed because RABBITMQ_NODENAME
+		// uses $(POD_NAME).$(SERVICE_NAME).$(NAMESPACE) without .svc suffix.
+		fmt.Sprintf("*.%s-nodes.%s", name, instance.Namespace),
+		fmt.Sprintf("*.%s-nodes.%s.svc", name, instance.Namespace),
+		fmt.Sprintf("*.%s-nodes.%s.svc.%s", name, instance.Namespace, clusterDomain),
 	}
 
 	tlsCert := ""