You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by "gulecroc (via GitHub)" <gi...@apache.org> on 2026/07/30 11:27:12 UTC
[PR] Configure certificates subject [pulsar-helm-chart]
gulecroc opened a new pull request, #714:
URL: https://github.com/apache/pulsar-helm-chart/pull/714
### Motivation
Currently only certificates subject organizations is configurable.
This PR allow to configure full subject properties.
### Modifications
Move `tls.common.organization` to `tls.common.subject.organizations`.
Fail if `tls.common.organization` is still used.
### Verifying this change
- [x] Make sure that the change passes the CI checks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Configure certificates subject [pulsar-helm-chart]
Posted by "lhotari (via GitHub)" <gi...@apache.org>.
lhotari merged PR #714:
URL: https://github.com/apache/pulsar-helm-chart/pull/714
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Configure certificates subject [pulsar-helm-chart]
Posted by "gulecroc (via GitHub)" <gi...@apache.org>.
gulecroc commented on PR #714:
URL: https://github.com/apache/pulsar-helm-chart/pull/714#issuecomment-5406610243
Migration documented in https://github.com/apache/pulsar-helm-chart/pull/714/commits/79b949b8ca1a506cb627e59f91fb4a0b30ab79b8
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Configure certificates subject [pulsar-helm-chart]
Posted by "lhotari (via GitHub)" <gi...@apache.org>.
lhotari commented on code in PR #714:
URL: https://github.com/apache/pulsar-helm-chart/pull/714#discussion_r3786648293
##########
charts/pulsar/templates/_certs.tpl:
##########
@@ -87,9 +87,13 @@ spec:
{{- end }}
duration: "{{ .root.Values.tls.common.duration }}"
renewBefore: "{{ .root.Values.tls.common.renewBefore }}"
+{{- if hasKey .root.Values.tls.common "organization" -}}
+{{- fail "tls.common.organization is no longer supported. Please configure tls.common.subject instead" -}}
Review Comment:
I wanted to argue for a deprecation period here, then convinced myself the hard `fail` is right.
Without it, an existing `tls.common.organization: [acme]` would be silently dropped while the new default `subject.organizations: [pulsar]` survives Helm's merge — quietly changing the issued certificate's `O` with no signal. Failing loudly is the safer trade.
It's also consistent with how the chart already handles removed values (`auth.authentication.provider`, and `cert-manager.io/v1beta1` a few lines above this one).
On placement: I checked whether the guard being inside `pulsar.cert.template` makes it unreachable when no Certificate renders — it does (with `tls.enabled: false` the legacy key is silently ignored). But that's fine: in that state the value is genuinely inert, and enabling certificates later produces an immediate, actionable error. No change needed.
##########
charts/pulsar/values.yaml:
##########
@@ -268,8 +268,9 @@ tls:
duration: 2160h
# 15d
renewBefore: 360h
- organization:
- - pulsar
+ subject:
+ organizations:
Review Comment:
Could you list the other supported `X509Subject` fields here as comments? Right now `organizations` is the only one discoverable, so users won't know the rest exist:
```yaml
subject:
organizations:
- pulsar
# countries: []
# organizationalUnits: []
# localities: []
# provinces: []
# streetAddresses: []
# postalCodes: []
# serialNumber: ""
```
Worth doing because the block is a `toYaml` passthrough and the chart has no `values.schema.json` — so a typo like `subject.organization` (singular) gets pruned by the Certificate CRD's structural schema and issues a cert with no `O`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Configure certificates subject [pulsar-helm-chart]
Posted by "gulecroc (via GitHub)" <gi...@apache.org>.
gulecroc commented on code in PR #714:
URL: https://github.com/apache/pulsar-helm-chart/pull/714#discussion_r3850240513
##########
charts/pulsar/values.yaml:
##########
@@ -268,8 +268,9 @@ tls:
duration: 2160h
# 15d
renewBefore: 360h
- organization:
- - pulsar
+ subject:
+ organizations:
Review Comment:
fixed in https://github.com/apache/pulsar-helm-chart/pull/714/commits/187ae7a24a6371f00fe4594ac92a5df88d38bd33
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org