From 0ead130bfc7a5854acc3264662631a7bee8e5e8f Mon Sep 17 00:00:00 2001 From: MorezMartin Date: Thu, 2 Jul 2026 19:05:20 +0200 Subject: [PATCH] feat(k8s): add certificates.dnsNames to inject custom SANs in cert-manager certs (#10198) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * feat(k8s): add certificates.dnsNames to inject custom SANs in cert-manager certs Add certificates.dnsNames configuration option that allows users to inject custom Subject Alternative Names (SANs) into all cert-manager Certificate resources. This enables exposing SeaweedFS components under custom hostnames/CN that aren't covered by the default wildcard patterns (e.g., '*.filer.default.svc'). The dnsNames list is iterated over in all 6 cert templates (admin, client, filer, master, volume, worker) and appended to the spec.x509.subject.names list. Refs: PR #10035 (original fix-grpc-filer) Co-Authored-By: Athena 🏛️ (custom / Qwen3.6-35B-A3B-UD-Q4_K_XL.gguf) * k8s: quote certificates.dnsNames entries so wildcard SANs render valid YAML --------- Co-authored-by: MorezMartin Co-authored-by: Chris Lu --- k8s/charts/seaweedfs/templates/cert/admin-cert.yaml | 5 +++++ k8s/charts/seaweedfs/templates/cert/client-cert.yaml | 5 +++++ k8s/charts/seaweedfs/templates/cert/filer-cert.yaml | 5 +++++ k8s/charts/seaweedfs/templates/cert/master-cert.yaml | 5 +++++ k8s/charts/seaweedfs/templates/cert/volume-cert.yaml | 5 +++++ k8s/charts/seaweedfs/templates/cert/worker-cert.yaml | 5 +++++ k8s/charts/seaweedfs/values.yaml | 1 + 7 files changed, 31 insertions(+) diff --git a/k8s/charts/seaweedfs/templates/cert/admin-cert.yaml b/k8s/charts/seaweedfs/templates/cert/admin-cert.yaml index 6ceaf01b4..defe448e6 100644 --- a/k8s/charts/seaweedfs/templates/cert/admin-cert.yaml +++ b/k8s/charts/seaweedfs/templates/cert/admin-cert.yaml @@ -29,6 +29,11 @@ spec: - '*.{{ include "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}' - '*.{{ include "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}.svc' - '*.{{ include "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}.svc.cluster.local' +{{- if .Values.certificates.dnsNames }} +{{- range .Values.certificates.dnsNames }} + - {{ . | quote }} +{{- end }} +{{- end }} {{- if .Values.certificates.ipAddresses }} ipAddresses: {{- range .Values.certificates.ipAddresses }} diff --git a/k8s/charts/seaweedfs/templates/cert/client-cert.yaml b/k8s/charts/seaweedfs/templates/cert/client-cert.yaml index c3d806462..abfecbde8 100644 --- a/k8s/charts/seaweedfs/templates/cert/client-cert.yaml +++ b/k8s/charts/seaweedfs/templates/cert/client-cert.yaml @@ -23,6 +23,11 @@ spec: - '*.{{ .Release.Namespace }}' - '*.{{ .Release.Namespace }}.svc' - '*.{{ .Release.Namespace }}.svc.cluster.local' +{{- if .Values.certificates.dnsNames }} +{{- range .Values.certificates.dnsNames }} + - {{ . | quote }} +{{- end }} +{{- end }} - '*.{{ include "seaweedfs.fullname" . }}-master' - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}' - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc' diff --git a/k8s/charts/seaweedfs/templates/cert/filer-cert.yaml b/k8s/charts/seaweedfs/templates/cert/filer-cert.yaml index 18c568a3b..6a86756b9 100644 --- a/k8s/charts/seaweedfs/templates/cert/filer-cert.yaml +++ b/k8s/charts/seaweedfs/templates/cert/filer-cert.yaml @@ -28,6 +28,11 @@ spec: - '*.{{ .Release.Namespace }}' - '*.{{ .Release.Namespace }}.svc' - '*.{{ .Release.Namespace }}.svc.cluster.local' +{{- if .Values.certificates.dnsNames }} +{{- range .Values.certificates.dnsNames }} + - {{ . | quote }} +{{- end }} +{{- end }} - '*.{{ include "seaweedfs.fullname" . }}-master' - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}' - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc' diff --git a/k8s/charts/seaweedfs/templates/cert/master-cert.yaml b/k8s/charts/seaweedfs/templates/cert/master-cert.yaml index be33c2ce7..7c375bea4 100644 --- a/k8s/charts/seaweedfs/templates/cert/master-cert.yaml +++ b/k8s/charts/seaweedfs/templates/cert/master-cert.yaml @@ -28,6 +28,11 @@ spec: - '*.{{ .Release.Namespace }}' - '*.{{ .Release.Namespace }}.svc' - '*.{{ .Release.Namespace }}.svc.cluster.local' +{{- if .Values.certificates.dnsNames }} +{{- range .Values.certificates.dnsNames }} + - {{ . | quote }} +{{- end }} +{{- end }} - '*.{{ include "seaweedfs.fullname" . }}-master' - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}' - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc' diff --git a/k8s/charts/seaweedfs/templates/cert/volume-cert.yaml b/k8s/charts/seaweedfs/templates/cert/volume-cert.yaml index 115b8495c..23389be16 100644 --- a/k8s/charts/seaweedfs/templates/cert/volume-cert.yaml +++ b/k8s/charts/seaweedfs/templates/cert/volume-cert.yaml @@ -28,6 +28,11 @@ spec: - '*.{{ .Release.Namespace }}' - '*.{{ .Release.Namespace }}.svc' - '*.{{ .Release.Namespace }}.svc.cluster.local' +{{- if .Values.certificates.dnsNames }} +{{- range .Values.certificates.dnsNames }} + - {{ . | quote }} +{{- end }} +{{- end }} - '*.{{ include "seaweedfs.fullname" . }}-master' - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}' - '*.{{ include "seaweedfs.fullname" . }}-master.{{ .Release.Namespace }}.svc' diff --git a/k8s/charts/seaweedfs/templates/cert/worker-cert.yaml b/k8s/charts/seaweedfs/templates/cert/worker-cert.yaml index 8a70b7827..df1aa682c 100644 --- a/k8s/charts/seaweedfs/templates/cert/worker-cert.yaml +++ b/k8s/charts/seaweedfs/templates/cert/worker-cert.yaml @@ -29,6 +29,11 @@ spec: - '*.{{ include "seaweedfs.fullname" . }}-worker.{{ .Release.Namespace }}' - '*.{{ include "seaweedfs.fullname" . }}-worker.{{ .Release.Namespace }}.svc' - '*.{{ include "seaweedfs.fullname" . }}-worker.{{ .Release.Namespace }}.svc.cluster.local' +{{- if .Values.certificates.dnsNames }} +{{- range .Values.certificates.dnsNames }} + - {{ . | quote }} +{{- end }} +{{- end }} {{- if .Values.certificates.ipAddresses }} ipAddresses: {{- range .Values.certificates.ipAddresses }} diff --git a/k8s/charts/seaweedfs/values.yaml b/k8s/charts/seaweedfs/values.yaml index f17de6ad6..e0998ad70 100644 --- a/k8s/charts/seaweedfs/values.yaml +++ b/k8s/charts/seaweedfs/values.yaml @@ -1745,6 +1745,7 @@ cosi: certificates: commonName: "SeaweedFS CA" + dnsNames: [] ipAddresses: [] keyAlgorithm: RSA keySize: 2048