From 62f778be197f76f24f6f96a12fdc33dbe330c61d Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Wed, 20 May 2026 14:08:08 +0300
Subject: [PATCH] fix(mariadb): include base service hostname in leaf cert SAN
 list

The leaf cert now covers the base ClusterIP service `<release>` alongside
the existing `-primary` and `-secondary` services so a client connection
that uses the unqualified release name (e.g. via cozystack platform DNS)
passes hostname verification. The headless `-internal` wildcard and the
external LoadBalancer hostname are unaffected.

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 packages/apps/mariadb/templates/certmanager.yaml |  6 +++---
 packages/apps/mariadb/tests/tls_test.yaml        | 12 ++++++++++++
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/packages/apps/mariadb/templates/certmanager.yaml b/packages/apps/mariadb/templates/certmanager.yaml
index c28892f47..df17d2797 100644
--- a/packages/apps/mariadb/templates/certmanager.yaml
+++ b/packages/apps/mariadb/templates/certmanager.yaml
@@ -47,8 +47,8 @@ spec:
     secretName: {{ .Release.Name }}-ca-tls
 ---
 # Leaf server TLS Certificate passed to mariadb-operator via spec.tls.serverCertSecretRef.
-# The SAN list covers the primary and secondary services plus, when external is true,
-# the external DNS name for the LoadBalancer service.
+# The SAN list covers the base, primary, and secondary services plus, when external is
+# true, the external DNS name for the LoadBalancer service.
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
@@ -69,7 +69,7 @@ spec:
     - localhost
     - {{ printf "*.%s-internal.%s.svc" $name $ns | quote }}
     - {{ printf "*.%s-internal.%s.svc.%s" $name $ns $clusterDomain | quote }}
-    {{- range $svc := list (printf "%s-primary" $name) (printf "%s-secondary" $name) }}
+    {{- range $svc := list $name (printf "%s-primary" $name) (printf "%s-secondary" $name) }}
     - {{ $svc }}
     - {{ $svc }}.{{ $ns }}.svc
     - {{ $svc }}.{{ $ns }}.svc.{{ $clusterDomain }}
diff --git a/packages/apps/mariadb/tests/tls_test.yaml b/packages/apps/mariadb/tests/tls_test.yaml
index e485117a9..01f0e9258 100644
--- a/packages/apps/mariadb/tests/tls_test.yaml
+++ b/packages/apps/mariadb/tests/tls_test.yaml
@@ -142,6 +142,15 @@ tests:
       external: true
     documentIndex: 3
     asserts:
+      - contains:
+          path: spec.dnsNames
+          content: "my-mariadb"
+      - contains:
+          path: spec.dnsNames
+          content: "my-mariadb.tenant-test.svc"
+      - contains:
+          path: spec.dnsNames
+          content: "my-mariadb.tenant-test.svc.cluster.local"
       - contains:
           path: spec.dnsNames
           content: "my-mariadb-primary"
@@ -253,6 +262,9 @@ tests:
       - notContains:
           path: spec.dnsNames
           content: "my-mariadb.example.com"
+      - contains:
+          path: spec.dnsNames
+          content: "my-mariadb"
       - contains:
           path: spec.dnsNames
           content: "my-mariadb-primary"