Aleksei Sviridkin 48e3d1d611 feat(redis,postgres): certify the per-engine external hostname ...

The tenant Gateway's TLS-passthrough listeners are designed to route
databases by SNI under a per-engine subdomain (*.redis.<apex>,
*.postgres.<apex>), and a passthrough listener forwards the handshake
untouched, so the engine's own server certificate must carry
<release>.<engine>.<apex> or a verifying client fails the hostname
check.

The name is issued next to the existing flat <release>.<apex>, under
the same TLS-and-external condition, so that a later move between the
two hostname schemes reissues no certificate and leaves clients on the
same trust anchor. Nothing renders a route yet; the certificate is
prepared ahead of it. Adding the name changes the SAN list, so existing
external TLS releases get their server certificate reissued once on
upgrade, from the same CA.

Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <f@lex.la>

2026-10-07 04:43:15 +03:00

..

types.go

feat(redis,postgres): certify the per-engine external hostname

2026-10-07 04:43:15 +03:00

zz_generated.deepcopy.go

feat(postgres): allow preloading an allowlist of shipped modules

2026-09-29 17:02:44 +02:00