OCPBUGS-85763: Fix metrics-proxy deployment failure due to dots in volume names

control-plane-operator/controllers/hostedcontrolplane/v2/metrics_proxy/deployment.go

@@ -3,6 +3,7 @@ package metricsproxy
 import (
 	"fmt"
 	"sort"
+	"strings"
 
 	component "github.com/openshift/hypershift/support/controlplane-component"
 	"github.com/openshift/hypershift/support/metrics"
@@ -121,8 +122,9 @@ func certVolumesFromMonitors(cpContext component.WorkloadContext, namespace stri
 
 	for _, name := range names {
 		ref := refs[name]
+		volName := sanitizeVolumeName(name)
 		vol := corev1.Volume{
-			Name: name,
+			Name: volName,
 		}
 
 		if ref.isSecret {
@@ -144,14 +146,21 @@ func certVolumesFromMonitors(cpContext component.WorkloadContext, namespace stri
 
 		volumes = append(volumes, vol)
 		mounts = append(mounts, corev1.VolumeMount{
-			Name:      name,
+			Name:      volName,
 			MountPath: certBasePath + "/" + name,
 		})
 	}
 
 	return volumes, mounts, nil
 }
 
+// sanitizeVolumeName converts a resource name into a valid Kubernetes volume
+// name by replacing dots with dashes. Kubernetes volume names must conform to
+// DNS label rules which do not allow dots.
+func sanitizeVolumeName(name string) string {
+	return strings.ReplaceAll(name, ".", "-")
+}
+
 // collectSecretOrConfigMapRef adds a SecretOrConfigMap reference to the refs map.
 func collectSecretOrConfigMapRef(refs map[string]*certRef, ref prometheusoperatorv1.SecretOrConfigMap) {
 	if ref.Secret != nil {

control-plane-operator/controllers/hostedcontrolplane/v2/metrics_proxy/deployment_test.go

@@ -309,6 +309,38 @@ func TestCertVolumesFromMonitors(t *testing.T) {
 		}
 	})
 
+	t.Run("When resource names contain dots, it should sanitize volume names but preserve mount paths", func(t *testing.T) {
+		t.Parallel()
+
+		sm := newServiceMonitorWithTLS("cno", namespace, &prometheusoperatorv1.TLSConfig{
+			SafeTLSConfig: prometheusoperatorv1.SafeTLSConfig{
+				CA: prometheusoperatorv1.SecretOrConfigMap{
+					ConfigMap: &corev1.ConfigMapKeySelector{
+						LocalObjectReference: corev1.LocalObjectReference{Name: "openshift-service-ca.crt"},
+						Key:                  "service-ca.crt",
+					},
+				},
+			},
+		})
+
+		cpContext := newCertVolumeTestContext(namespace, scheme, sm)
+		volumes, mounts := assertCertVolumeCount(t, cpContext, namespace, 1, 1)
+
+		if volumes[0].Name != "openshift-service-ca-crt" {
+			t.Errorf("expected sanitized volume name openshift-service-ca-crt, got %s", volumes[0].Name)
+		}
+		if mounts[0].Name != "openshift-service-ca-crt" {
+			t.Errorf("expected sanitized mount name openshift-service-ca-crt, got %s", mounts[0].Name)
+		}
+		expectedPath := certBasePath + "/openshift-service-ca.crt"
+		if mounts[0].MountPath != expectedPath {
+			t.Errorf("expected mount path to preserve dots %q, got %q", expectedPath, mounts[0].MountPath)
+		}
+		if volumes[0].VolumeSource.ConfigMap.Name != "openshift-service-ca.crt" {
+			t.Errorf("expected ConfigMap source name to preserve original name, got %s", volumes[0].VolumeSource.ConfigMap.Name)
+		}
+	})
+
 	t.Run("When PodMonitor has no TLS config, it should be skipped", func(t *testing.T) {
 		t.Parallel()