From e20892ace93d1325d075614ab124712e449d35a0 Mon Sep 17 00:00:00 2001 From: ccccpj Date: Mon, 3 Aug 2026 22:01:39 +0800 Subject: [PATCH] fix(helm): exclude external hosts from mTLS certificate (#5666) --- .../templates/cert-manager-mtls/04-server-cert.yaml | 4 ---- scripts/test_helm_templates.sh | 10 ++++++++++ 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/helm/rustfs/templates/cert-manager-mtls/04-server-cert.yaml b/helm/rustfs/templates/cert-manager-mtls/04-server-cert.yaml index 5da0dddfa..b120a169f 100644 --- a/helm/rustfs/templates/cert-manager-mtls/04-server-cert.yaml +++ b/helm/rustfs/templates/cert-manager-mtls/04-server-cert.yaml @@ -21,10 +21,6 @@ spec: - "*.{{ include "rustfs.fullname" . }}-headless" - "*.{{ include "rustfs.fullname" . }}-headless.{{ .Release.Namespace }}.svc.{{ include "rustfs.clusterDomain" . }}" - "{{ include "rustfs.fullname" . }}-svc.{{ .Release.Namespace }}.svc.{{ include "rustfs.clusterDomain" . }}" - {{- range .Values.ingress.hosts }} - - {{ .host | quote }} - - {{ printf "*.%s" .host | quote }} - {{- end }} usages: - server auth {{- end }} diff --git a/scripts/test_helm_templates.sh b/scripts/test_helm_templates.sh index ecbaa4e83..05e4456be 100755 --- a/scripts/test_helm_templates.sh +++ b/scripts/test_helm_templates.sh @@ -362,6 +362,16 @@ if ! grep -q 'svc\.cluster\.local"' <<<"$cert_default"; then echo "Default mTLS server cert SANs must use svc.cluster.local" >&2 exit 1 fi +if grep -q 'example\.rustfs\.com' <<<"$cert_default"; then + echo "mTLS server cert SANs must not include the default external ingress host" >&2 + exit 1 +fi + +cert_external_host=$(render_server_cert --set ingress.hosts[0].host=storage.example.test) +if grep -q 'storage\.example\.test' <<<"$cert_external_host"; then + echo "mTLS server cert SANs must not include custom external ingress hosts" >&2 + exit 1 +fi cert_custom=$(render_server_cert --set clusterDomain=cluster.internal) if ! grep -q 'svc\.cluster\.internal"' <<<"$cert_custom"; then