From 492ec1a3931ed41873a764aa787da6f560eb59d3 Mon Sep 17 00:00:00 2001 From: JakeSCahill Date: Thu, 6 Aug 2026 17:34:44 +0100 Subject: [PATCH 1/2] docs: document applyInternalDNSNames for custom-issuer TLS (DOC-182) When users bring their own cert-manager Issuer, the chart omits the brokers' internal Service addresses from the Certificate, and the applyInternalDNSNames setting that restores them was documented only in the generated CRD reference. Explain the behavior and the setting in the cert-manager TLS guide, verified against charts/redpanda/certs.go. --- .../kubernetes/security/tls/k-cert-manager.adoc | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/modules/manage/pages/kubernetes/security/tls/k-cert-manager.adoc b/modules/manage/pages/kubernetes/security/tls/k-cert-manager.adoc index 625833dc99..4f22c04f31 100644 --- a/modules/manage/pages/kubernetes/security/tls/k-cert-manager.adoc +++ b/modules/manage/pages/kubernetes/security/tls/k-cert-manager.adoc @@ -303,6 +303,21 @@ helm upgrade --install redpanda redpanda/redpanda --namespace --crea ==== include::manage:partial$kubernetes/tls-update-note.adoc[] ==== ++ +When you provide your own Issuer, the Helm chart does not add the brokers' internal Kubernetes Service addresses to the Certificate, because public CAs such as Let's Encrypt cannot issue certificates for cluster-local names. If your Issuer is a private CA that can issue certificates for internal addresses, set `applyInternalDNSNames` to `true`. This setting adds the internal addresses to the Certificate so that clients inside the Kubernetes cluster can validate connections to the internal listeners with the same Certificate: ++ +[,yaml] +---- +tls: + enabled: true + certs: + external: + issuerRef: + name: + kind: + applyInternalDNSNames: true + caEnabled: false +---- . Make sure the Certificates are in a `READY` state. + From 17eae09b7248934fbf4ca104868f1138c6044338 Mon Sep 17 00:00:00 2001 From: JakeSCahill Date: Sat, 8 Aug 2026 19:25:45 +0100 Subject: [PATCH 2/2] fix(k8s-tls): set caEnabled to true in the private-CA example Review finding: the applyInternalDNSNames example describes a private CA Issuer but kept caEnabled: false, copied from the public-CA example above it. With caEnabled: false the chart points listener trust stores at the container's CA certificates and chart-managed clients at tls.crt, so in-cluster validation against a private CA fails. Set caEnabled: true in that example and add a sentence explaining why. The public-CA examples keep caEnabled: false, which is correct for publicly trusted issuers such as Let's Encrypt. --- .../pages/kubernetes/security/tls/k-cert-manager.adoc | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/modules/manage/pages/kubernetes/security/tls/k-cert-manager.adoc b/modules/manage/pages/kubernetes/security/tls/k-cert-manager.adoc index 4f22c04f31..469d8e18c5 100644 --- a/modules/manage/pages/kubernetes/security/tls/k-cert-manager.adoc +++ b/modules/manage/pages/kubernetes/security/tls/k-cert-manager.adoc @@ -304,7 +304,9 @@ helm upgrade --install redpanda redpanda/redpanda --namespace --crea include::manage:partial$kubernetes/tls-update-note.adoc[] ==== + -When you provide your own Issuer, the Helm chart does not add the brokers' internal Kubernetes Service addresses to the Certificate, because public CAs such as Let's Encrypt cannot issue certificates for cluster-local names. If your Issuer is a private CA that can issue certificates for internal addresses, set `applyInternalDNSNames` to `true`. This setting adds the internal addresses to the Certificate so that clients inside the Kubernetes cluster can validate connections to the internal listeners with the same Certificate: +When you provide your own Issuer, the Helm chart does not add the brokers' internal Kubernetes Service addresses to the Certificate, because public CAs such as Let's Encrypt cannot issue certificates for cluster-local names. If your Issuer is a private CA that can issue certificates for internal addresses, set `applyInternalDNSNames` to `true`. This setting adds the internal addresses to the Certificate so that clients inside the Kubernetes cluster can validate connections to the internal listeners with the same Certificate. ++ +Because a private CA is not publicly trusted, also set `caEnabled` to `true`. The chart then uses the `ca.crt` file in the Certificate's Secret for the listener trust stores and for chart-managed clients such as `rpk`. When `caEnabled` is `false`, listeners fall back to the container's CA certificates, which do not trust your private CA. + [,yaml] ---- @@ -316,7 +318,7 @@ tls: name: kind: applyInternalDNSNames: true - caEnabled: false + caEnabled: true ---- . Make sure the Certificates are in a `READY` state.