From 3fd032e28b837d02c99dda28f3bdf88e26fa8ff3 Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Thu, 3 Sep 2026 20:47:57 +0300 Subject: [PATCH] docs(mariadb): say the CA Secret is excluded by name, not unnamed MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The clause claimed the ApplicationDefinition names neither Secret. It names this one: "mariadb-.ca-tls" sits in its secrets.exclude list, and the bats guard pins it there. What is true is narrower — neither is named as the source the anchor is published from — so say that and say where the name does appear, or the sentence invites a reader to conclude the ApplicationDefinition has no reference to the Secret at all. Rewrap the SAN-list paragraph's one 124-column line back into the block it sits in, which is otherwise at 78. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin --- packages/apps/mariadb/templates/certmanager.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/packages/apps/mariadb/templates/certmanager.yaml b/packages/apps/mariadb/templates/certmanager.yaml index 64c97181a..ed60e0e16 100644 --- a/packages/apps/mariadb/templates/certmanager.yaml +++ b/packages/apps/mariadb/templates/certmanager.yaml @@ -33,8 +33,8 @@ spec: # source the trust anchor is published from: the TenantProjection this chart # renders names the operator's key-free -ca-bundle as the source # instead, so no publication path ever runs next to the CA private key. The - # ApplicationDefinition names neither — it selects the published anchor by - # label. + # ApplicationDefinition names neither as a source: it excludes this Secret by + # name and selects the published anchor by label. # # The operator only watches Secrets referenced by serverCASecretRef / # serverCertSecretRef when they carry its watch label, and it sets the same @@ -94,9 +94,9 @@ spec: # The operator does not check either: with both serverCASecretRef and # serverCertSecretRef supplied it skips certificate issuance, so the code that # would validate SANs is never reached. It still reads the Secret — for the pod -# annotation hash and for status — but never inspects the names in it. So an upstream rename surfaces as a handshake failure -# in a cluster, and closing that gap needs an e2e case that connects, not -# another rendering assertion. +# annotation hash and for status — but never inspects the names in it. So an +# upstream rename surfaces as a handshake failure in a cluster, and closing +# that gap needs an e2e case that connects, not another rendering assertion. apiVersion: cert-manager.io/v1 kind: Certificate metadata: