Repository navigation
feat(topology): issue client certs for external servers that name no secrets - #713
Merged
Merged
Conversation
…secrets - External servers that name no Secrets get the operator-issued client certificate, so clusters can share one topology server. - Secrets an external server does name still take precedence, and the operator issues nothing for it. - The CN length limit now covers these roots, since the cluster root is the certificate's common name. Signed-off-by: Verónica López <veronica.lopez@supabase.io>
🔬 Go Test Coverage ReportSummary
Status✅ PASS DetailShow New Coverage |
Contributor
Author
|
/e2e |
|
✅ E2E tests success — View run |
niconosenzo
approved these changes
Oct 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
this PR issues the topology client certificate for an external topology server that names no Secrets.
With topoTLS enabled, the operator issued a client certificate only for a managed topology server and assumed an external one brings its own CA and client Secrets. A cluster pointed at a topology server shared with other clusters, whose serving certificate comes from the same topoTLS issuer, got no credential and could not connect, since that server requires a client certificate.
An external server that names either Secret keeps today's behaviour: its Secrets take precedence and the operator issues nothing. Otherwise the credential is the one a managed topology gets (same Secret, usages and issuer, cluster root as CN), so the CN length limit and the root checks now apply to these clusters too.
Main changes
OperatorIssuesTopoClientCert, true when topoTLS is enabled unless the global topology is external and names a CA or client Secret.ExternalTopoServerSpecand indocs/development/shared-topology.md, and regenerate the CRDs.Testing
Ran
make test,make test-integrationandmake lint. New unit tests cover the predicate, the issued certificate's issuer, Secret and CN, the resolved topology ref with and without named Secrets, and the bounded root. Did not run the e2e suite; it has no scenario yet with one topology server shared by several clusters.