fix(mariadb): include base service hostname in leaf cert SAN list

The leaf cert now covers the base ClusterIP service `<release>` alongside
the existing `-primary` and `-secondary` services so a client connection
that uses the unqualified release name (e.g. via cozystack platform DNS)
passes hostname verification. The headless `-internal` wildcard and the
external LoadBalancer hostname are unaffected.

Signed-off-by: Arsolitt <arsolitt@gmail.com>

packages/apps/mariadb/templates/certmanager.yaml

@@ -47,8 +47,8 @@ spec:
     secretName: {{ .Release.Name }}-ca-tls
 ---
 # Leaf server TLS Certificate passed to mariadb-operator via spec.tls.serverCertSecretRef.
-# The SAN list covers the primary and secondary services plus, when external is true,
-# the external DNS name for the LoadBalancer service.
+# The SAN list covers the base, primary, and secondary services plus, when external is
+# true, the external DNS name for the LoadBalancer service.
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
@@ -69,7 +69,7 @@ spec:
     - localhost
     - {{ printf "*.%s-internal.%s.svc" $name $ns | quote }}
     - {{ printf "*.%s-internal.%s.svc.%s" $name $ns $clusterDomain | quote }}
-    {{- range $svc := list (printf "%s-primary" $name) (printf "%s-secondary" $name) }}
+    {{- range $svc := list $name (printf "%s-primary" $name) (printf "%s-secondary" $name) }}
     - {{ $svc }}
     - {{ $svc }}.{{ $ns }}.svc
     - {{ $svc }}.{{ $ns }}.svc.{{ $clusterDomain }}

packages/apps/mariadb/tests/tls_test.yaml

@@ -142,6 +142,15 @@ tests:
       external: true
     documentIndex: 3
     asserts:
+      - contains:
+          path: spec.dnsNames
+          content: "my-mariadb"
+      - contains:
+          path: spec.dnsNames
+          content: "my-mariadb.tenant-test.svc"
+      - contains:
+          path: spec.dnsNames
+          content: "my-mariadb.tenant-test.svc.cluster.local"
       - contains:
           path: spec.dnsNames
           content: "my-mariadb-primary"
@@ -253,6 +262,9 @@ tests:
       - notContains:
           path: spec.dnsNames
           content: "my-mariadb.example.com"
+      - contains:
+          path: spec.dnsNames
+          content: "my-mariadb"
       - contains:
           path: spec.dnsNames
           content: "my-mariadb-primary"