Encryption Cleanup: drop LegacyFakeDnsName in SANs
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 6.1k
- Forks
- 1.2k
- Avg merge
- 2d 7h
- Merged PRs (30d)
- 2
Description
Description
In our certificates for the system-internal-tls feature, we are still using certificates.LegacyFakeDnsName for legacy reasons and to make trust work on ingress layers that do not support trusting multiple SANs (like in contour and gateway-api).
As soon as this is resolved, we need to clean that up and remove certificates.LegacyFakeDnsName
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the system-internal-tls certificate generation and every use of certificates.LegacyFakeDnsName, then investigate whether the Contour and Gateway API ingress trust limitation described here has been resolved. Once that dependency is confirmed, remove the legacy SAN usage and the LegacyFakeDnsName definition, and run the relevant certificate and TLS tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- networking, security
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100