Fix fully-qualified dns name#686
Conversation
I'm assuming that a wildcard certificate should also exist so that TLS hostname verification works when connections are made to a pod in a headless service used for either the broker or zookeeper STS. Please adds CI tests to cover possible gaps. |
|
When I tested this locally, the wildcard does not allow me to hit the service using the fully-qualified name. Only removing the wildcard allows the fully-qualified name to work. |
|
I updated the ci tests to use the fully qualified name when testing producer/consumer. Is that sufficient? |
Motivation
The generated
dnsNamesconfiguration on certificates is incorrect for fully qualified names. It generates*.<release>-<component>.namespace.svc.localrather than<release>-<component>.namespace.svc.localModifications
Removes the
*.prefix on the fully-qualifieddnsNamesVerifying this change