Remove common name from all server certificates, as it's ignored when any SAN exists (!7956) · Merge requests · Sylva-projects / sylva-core

What does this MR do and why?

➜ ./tools/serve-crustgather-artifact.sh -u https://gitlab.com/sylva-projects/sylva-core/-/jobs/14525776835 -b

➜ kubectl get kustomization neuvector-federation-tls -n rke2-capo --context management -o yaml | yq .spec.postBuild.substitute
CACERT: ""
CERT: ""
CERTIFICATE_NAMESPACE: neuvector
SERVICE: neuvector-federation
SERVICE_DNS: federation-managed.neuvector.wc-2550408780-rke2-capo.wclusters.sylva

to be used for envsubst over kustomize-units/tls-components/tls-certificate/certificate.yaml.

Per https://cert-manager.io/v1.8-docs/reference/api-docs/#cert-manager.io/v1.Certificate

CommonName is a common name to be used on the Certificate. The CommonName should have a length of 64 characters or fewer to avoid generating invalid CSRs. This value is ignored by TLS clients when any subject alt name is set. This is x509 behaviour: https://tools.ietf.org/html/rfc6125#section-6.4.4

The options for SAN in same cert-manager spec doc:

dnsNames []string (Optional) Requested DNS subject alternative names.

ipAddresses []string (Optional) Requested IP address subject alternative names.

uris []string (Optional) Requested URI subject alternative names.

otherNames []OtherName (Optional) otherNames is an escape hatch for SAN that allows any type.

emailAddresses []string (Optional) Requested email subject alternative names.

This means federation-managed.neuvector.wc-2550408780-rke2-capo.wclusters.sylva at 68 chars is valid in dnsNames (DNS FQDN max length is of 253 chars), but invalid in commonName, and that common name is meaningless for clients when some SAN is already set. Same is mentioned in https://cert-manager.io/docs/usage/certificate/#creating-certificate-resources

Avoid using commonName for DNS names in end-entity (leaf) certificates .. Usually, commonName is used to give human-readable names to CA certificates

This MR removes Certificate.spec.commonName from all server certs, as it makes sense to be present only for the CA cert.

Closes #4079 (closed)

Test coverage

CI configuration

Below you can choose test deployment variants to run in this MR's CI.

Click to open to CI configuration

Legend:

Icon	Meaning	Available values
☁️	Infra Provider	`capd`, `capo`, `capm3`
🚀	Bootstrap Provider	`kubeadm` (alias `kadm`), `rke2`, `okd`, `ck8s`
🐧	Node OS	`ubuntu`, `suse`, `na`, `leapmicro`
🛠️	Deployment Options	Deployment option list and description
🎬	Pipeline Scenarios	Available scenario list and description
🟢	Enabled units	Any available units name, by default apply to management and workload cluster. Can be prefixed by `mgmt:` or `wkld:` to be applied only to a specific cluster type
🔴	Disabled units	Any available units name, by default apply to management and workload cluster. Can be prefixed by `mgmt:` or `wkld:` to be applied only to a specific cluster type
🏗️	Target platform	Can be used to select specific deployment environment Available platform list and description
⚡	Pipeline control	`autorun`, `manual` or `blocking`. Can be used to override global config and start a deployment pipeline the required way

Global config for deployment pipelines

autorun pipelines
allow failure on pipelines
record sylvactl events

Notes:

Enabling autorun will make deployment pipelines to be run automatically without human interaction
Disabling allow failure will make deployment pipelines mandatory for pipeline success.
if both autorun and allow failure are disabled, deployment pipelines will need manual triggering but will be blocking the pipeline

Be aware: after configuration change, pipeline is not triggered automatically. Please run it manually (by clicking the run pipeline button in Pipelines tab) or push new code.

Edited May 26, 2026 by Bogdan-Adrian Burciu

Remove common name from all server certificates, as it's ignored when any SAN exists

What does this MR do and why?

Related reference(s)

Test coverage

CI configuration

Global config for deployment pipelines

Merge request reports