From 726ee35448480d5926c5ff03641787e73c8d8c74 Mon Sep 17 00:00:00 2001 From: Cesar Wong Date: Tue, 8 Jul 2025 12:12:25 +0200 Subject: [PATCH] Add missing service network DNS entries to KAS cert PR #6114 backported code that did not include the service network DNS entries for the kube apiserver. This was ok in releases 4.17 and newer because in those releases a separate certificate is created to serve those service network DNS entries. However in 4.16 and older, there is only one serving certificate for the kube apiserver. This resulted in clients like ACM failing to communicate with the kube apiserver because they use the service network endpoint to install the klusterlet in the hosted cluster. This fix adds the missing entries back into the dns names of the KAS serving certificate. --- support/pki/kas.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/support/pki/kas.go b/support/pki/kas.go index a4dd7e3c90ed..22516f928cf5 100644 --- a/support/pki/kas.go +++ b/support/pki/kas.go @@ -33,6 +33,8 @@ func GetKASServerCertificatesSANs(externalAPIAddress, internalAPIAddress string, "openshift.default", "openshift.default.svc", "openshift.default.svc.cluster.local", + fmt.Sprintf("%s.%s.svc", svc.Name, svc.Namespace), + fmt.Sprintf("%s.%s.svc.cluster.local", svc.Name, svc.Namespace), } apiServerIPs := []string{ "127.0.0.1",