docs: document applyInternalDNSNames for custom-issuer TLS (DOC-182) - #1889
docs: document applyInternalDNSNames for custom-issuer TLS (DOC-182)#1889JakeSCahill wants to merge 2 commits into
Conversation
When users bring their own cert-manager Issuer, the chart omits the brokers' internal Service addresses from the Certificate, and the applyInternalDNSNames setting that restores them was documented only in the generated CRD reference. Explain the behavior and the setting in the cert-manager TLS guide, verified against charts/redpanda/certs.go.
✅ Deploy Preview for redpanda-docs-preview ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughThe documentation explains that custom Issuers exclude internal Kubernetes Service DNS names from Certificates by default. It documents Estimated code review effort: 1 (Trivial) | ~2 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@modules/manage/pages/kubernetes/security/tls/k-cert-manager.adoc`:
- Around line 311-319: Update the private-CA TLS example by changing caEnabled
to true so the chart provisions ca.crt in listener trust stores and the
documented in-cluster validation flow works.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: c37333f9-2571-4df1-8e9f-4a860ce8658b
📒 Files selected for processing (1)
modules/manage/pages/kubernetes/security/tls/k-cert-manager.adoc
Review finding: the applyInternalDNSNames example describes a private CA Issuer but kept caEnabled: false, copied from the public-CA example above it. With caEnabled: false the chart points listener trust stores at the container's CA certificates and chart-managed clients at tls.crt, so in-cluster validation against a private CA fails. Set caEnabled: true in that example and add a sentence explaining why. The public-CA examples keep caEnabled: false, which is correct for publicly trusted issuers such as Let's Encrypt.
1 participant
Resolves DOC-182 (May 2024): the Helm chart option that injects the brokers' internal DNS names into user-provided Issuer Certificates (helm-charts#1156, now
tls.certs.<cert>.applyInternalDNSNames) was never documented in the TLS guide - it appears only in the generated CRD reference.Adds an explanation to the Use a public CA certificate section of
k-cert-manager.adoc: with a customissuerRef, internal Service addresses are omitted from the Certificate (public CAs cannot issue for cluster-local names), and private-CA users can setapplyInternalDNSNames: trueto restore them so in-cluster clients validate internal listeners with the same Certificate.Verified against chart source:
charts/redpanda/certs.goappends the internal Service DNS names whenissuerRefis nil orapplyInternalDNSNamesis true, and the field lives on the per-certificateTLSCertstruct invalues.go. The Netlify preview validates the page.🤖 Generated with Claude Code