From 4e65dc80f04ced33c34c1a95eb8980926e638b0b Mon Sep 17 00:00:00 2001
From: Akram <akram.benaissi@gmail.com>
Date: Tue, 30 Jun 2026 18:57:20 +0400
Subject: [PATCH] fix(helm): generate namespace-aware SANs in certgen and
 cert-manager templates

The certgen hook and cert-manager Certificate template hardcoded
openshell.openshell.svc.cluster.local in server certificate SANs,
breaking deployments in any namespace other than openshell. Use
.Release.Namespace in the templates so the SANs match the actual
service FQDN regardless of the target namespace.

Closes #2060

Signed-off-by: Akram <akram.benaissi@gmail.com>
---
 deploy/helm/openshell/templates/_helpers.tpl   | 18 ++++++++++++++++++
 .../openshell/templates/cert-manager-pki.yaml  |  7 ++++++-
 deploy/helm/openshell/templates/certgen.yaml   |  4 ++++
 3 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/deploy/helm/openshell/templates/_helpers.tpl b/deploy/helm/openshell/templates/_helpers.tpl
index 30c0275765..5872dc4043 100644
--- a/deploy/helm/openshell/templates/_helpers.tpl
+++ b/deploy/helm/openshell/templates/_helpers.tpl
@@ -144,6 +144,24 @@ init-container
 {{- end -}}
 {{- end }}
 
+{{/*
+Default server certificate DNS SANs derived from the release name and namespace.
+Returns a YAML list. Append extra SANs from values with range loops.
+*/}}
+{{- define "openshell.defaultServerDnsNames" -}}
+{{- $name := include "openshell.fullname" . -}}
+{{- $ns := .Release.Namespace -}}
+{{- list $name
+      (printf "%s.%s.svc" $name $ns)
+      (printf "%s.%s.svc.cluster.local" $name $ns)
+      "localhost"
+      (printf "%s.localhost" $name)
+      (printf "*.%s.localhost" $name)
+      "host.docker.internal"
+      "host.containers.internal"
+  | toYaml }}
+{{- end }}
+
 {{/*
 Gateway workload kind. StatefulSet is the default because the default SQLite
 database requires persistent per-pod storage.
diff --git a/deploy/helm/openshell/templates/cert-manager-pki.yaml b/deploy/helm/openshell/templates/cert-manager-pki.yaml
index 43a19d5f55..fdd702a305 100644
--- a/deploy/helm/openshell/templates/cert-manager-pki.yaml
+++ b/deploy/helm/openshell/templates/cert-manager-pki.yaml
@@ -55,7 +55,12 @@ spec:
   renewBefore: {{ .Values.certManager.certificateRenewBefore | quote }}
   commonName: openshell-server
   dnsNames:
-    {{- toYaml .Values.certManager.serverDnsNames | nindent 4 }}
+    {{- range (include "openshell.defaultServerDnsNames" . | fromYamlArray) }}
+    - {{ . | quote }}
+    {{- end }}
+    {{- range .Values.certManager.serverDnsNames }}
+    - {{ . | quote }}
+    {{- end }}
   {{- if .Values.certManager.serverIpAddresses }}
   ipAddresses:
     {{- toYaml .Values.certManager.serverIpAddresses | nindent 4 }}
diff --git a/deploy/helm/openshell/templates/certgen.yaml b/deploy/helm/openshell/templates/certgen.yaml
index 3651e188f5..c4f2d74e85 100644
--- a/deploy/helm/openshell/templates/certgen.yaml
+++ b/deploy/helm/openshell/templates/certgen.yaml
@@ -103,6 +103,10 @@ spec:
             {{- end }}
             - --jwt-secret-name={{ include "openshell.sandboxJwtSecretName" . }}
             {{- if and .Values.pkiInitJob.enabled (not .Values.certManager.enabled) }}
+            {{- range (include "openshell.defaultServerDnsNames" . | fromYamlArray) }}
+            - --server-san={{ . }}
+            {{- end }}
+            - --server-san=127.0.0.1
             {{- range .Values.pkiInitJob.serverDnsNames }}
             - --server-san={{ . }}
             {{- end }}