fix(chart): webhook cert SAN must use .Release.Namespace, not .Values.service.namespace - #1828
Open
grkml wants to merge 1 commit into
Open
Conversation
….service.namespace The cert-manager Certificate's dnsNames were built from `.Values.service.namespace` (default `redis-operator`), while the webhook Service (templates/service.yaml) and the MutatingWebhookConfiguration clientConfig (templates/mutating-webhook-configuration.yaml) both use `.Release.Namespace`. When the chart is installed into any namespace other than the `service.namespace` default, the Certificate SAN becomes `webhook-service.<service.namespace>.svc` but the API server connects to `webhook-service.<release-namespace>.svc`, so the TLS SAN check fails. With the mutating webhook's failurePolicy=Fail this surfaces as a 503 on the first Redis CR admission — silent until then. Pin the SAN to `.Release.Namespace` so it always matches the Service the webhook is actually reached at. Note: `service.namespace` (values.yaml) is now unused. Left in place to keep this a minimal non-breaking fix; happy to drop it in a follow-up if preferred. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
grkml
requested review from
drivebyer,
iamabhishek-dubey and
shubham-cmyk
as code owners
June 30, 2026 03:42
Member
|
Please work on DCO check for commit sign off |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The
redis-operatorchart builds the cert-managerCertificatednsNamesfrom.Values.service.namespace(defaultredis-operator), but the webhookServiceand theMutatingWebhookConfigurationclientConfigboth use.Release.Namespace:ot-operators)templates/cert-manager.yaml(Certificate SAN).Values.service.namespacewebhook-service.redis-operator.svctemplates/service.yaml(Service).Release.Namespacewebhook-service.ot-operators.svctemplates/mutating-webhook-configuration.yaml(clientConfig).Release.Namespacewebhook-service.ot-operators.svcWhen the chart is installed into any namespace other than the
service.namespacedefault, the Certificate SAN no longer matches the DNS name the API server actually dials, so the webhook TLS handshake fails the SAN check. Because the mutating webhook isfailurePolicy: Fail, this is silent at install time and only surfaces as a503(x509/SAN error) on the first Redis CR admission.This PR pins the SAN to
.Release.Namespaceso it always matches the Service the webhook is reached at.Reproduction
```console
$ helm template redis-operator charts/redis-operator -n ot-operators
--set redisOperator.webhook=true --set certmanager.enabled=true
```
Before — Certificate SAN vs. webhook Service disagree:
```yaml
Certificate
dnsNames:
MutatingWebhookConfiguration -> clientConfig.service
name: webhook-service
namespace: ot-operators # .Release.Namespace
```
After this change — they match:
```yaml
dnsNames:
```
Type of change
Checklist
helm templateinto a non-default namespace).helm unittestcase if the maintainers want one.)Additional Context
After this change
.Values.service.namespaceis no longer referenced by any template. I left the value in place to keep this a minimal, non-breaking fix — glad to remove it (and the README row) in a follow-up if you'd prefer.