Merge pull request #827 from stuggi/wild_card_galera_rabbit

[TLS] add wild card hostnames for headless galera/rabbitmq svc
openstack-k8s-operators · Jun 11, 2024 · 5de8b1b · 5de8b1b
2 parents 0659ccb + 867879f
commit 5de8b1b
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 0 deletions.
diff --git a/pkg/openstack/galera.go b/pkg/openstack/galera.go
@@ -43,6 +43,7 @@ func ReconcileGaleras(
 
 	for name, spec := range instance.Spec.Galera.Templates {
 		hostname := fmt.Sprintf("%s.%s.svc", name, instance.Namespace)
+		hostnameHeadless := fmt.Sprintf("%s-galera.%s.svc", name, instance.Namespace)
 
 		// Galera gets always configured to support TLS connections.
 		// If TLS can/must be used is a per user configuration.
@@ -52,6 +53,10 @@ func ReconcileGaleras(
 			Hostnames: []string{
 				hostname,
 				fmt.Sprintf("%s.%s", hostname, ClusterInternalDomain),
+				hostnameHeadless,
+				fmt.Sprintf("%s.%s", hostnameHeadless, ClusterInternalDomain),
+				fmt.Sprintf("*.%s", hostnameHeadless),
+				fmt.Sprintf("*.%s.%s", hostnameHeadless, ClusterInternalDomain),
 			},
 			// Note (dciabrin) from https://github.com/openstack-k8s-operators/openstack-operator/pull/678#issuecomment-1952459166
 			// the certificate created for galera should populate the 'organization' field,

diff --git a/pkg/openstack/rabbitmq.go b/pkg/openstack/rabbitmq.go
@@ -195,6 +195,8 @@ func reconcileRabbitMQ(
 	}
 
 	hostname := fmt.Sprintf("%s.%s.svc", name, instance.Namespace)
+	hostnameHeadless := fmt.Sprintf("%s-nodes.%s.svc", name, instance.Namespace)
+
 	tlsCert := ""
 	commonName := fmt.Sprintf("%s.%s", hostname, ClusterInternalDomain)
 
@@ -206,6 +208,10 @@ func reconcileRabbitMQ(
 			Hostnames: []string{
 				hostname,
 				fmt.Sprintf("%s.%s", hostname, ClusterInternalDomain),
+				hostnameHeadless,
+				fmt.Sprintf("%s.%s", hostnameHeadless, ClusterInternalDomain),
+				fmt.Sprintf("*.%s", hostnameHeadless),
+				fmt.Sprintf("*.%s.%s", hostnameHeadless, ClusterInternalDomain),
 			},
 			Subject: &certmgrv1.X509Subject{
 				Organizations: []string{fmt.Sprintf("%s.%s", rabbitmq.Namespace, ClusterInternalDomain)},