fix: derive k8s secret name from bundle folder instead of CN prefix - #178
Merged
Conversation
When a bundle name is configured, the export folder uses that name but the Kubernetes secret metadata.name was still derived from the certificate CN. This mismatch meant the secret name inside k8s.yaml didn't match the directory it lived in. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Adjusts bundle export so Kubernetes TLS secret metadata.name aligns with the configured bundle export folder name (instead of being CN-derived), improving consistency between generated k8s.yaml and its containing directory.
Changes:
- Derive Kubernetes secret
metadata.namefrom the sanitized bundle folder name. - Update
CHANGELOG.mdto record the fix under## [Unreleased]. - Bump
modernc.org/sqlitedependency (and correspondinggo.sumentries).
Reviewed changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| internal/certstore/export.go | Switches K8s secret naming to use the bundle folder value passed to the writer. |
| go.mod | Updates modernc.org/sqlite version requirement. |
| go.sum | Updates checksums to match the sqlite version bump. |
| CHANGELOG.md | Adds an Unreleased “Fixed” entry documenting the secret-name change. |
You can also share your feedback on Copilot code review. Take the survey.
The K8s secret metadata.name now uses the bundle folder name directly. Bundle names in YAML configs are validated against DNS-1123 subdomain rules at parse time, with errors that include the file path and line number of the offending value. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The DNS-1123 regex allowed up to 253 chars (subdomain limit) when a single label is capped at 63 chars per RFC 1123. Also update architecture.md to reflect new ValidateK8sSecretName helper and bundleconfig DNS-1123 validation. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
metadata.nameto use the bundle export folder name instead of the CN-derived prefix, so the secret name matches the directory it lives inContext
When a bundle name is configured, the export folder correctly uses that name, but the K8s secret
metadata.namewas still derived from the certificate's Common Name. For example, a bundle namedmy-servicewould export tomy-service/but thek8s.yamlinside would havemetadata.name: example.cominstead ofmetadata.name: my-service.Test plan
go test ./...passes (verified by pre-commit)🤖 Generated with Claude Code