Add missing Pod IPs to created certificates

Open

#620 opened on Jul 17, 2025 2 comments 0 reactions 1 assignee View on GitHub

@Techassi is already working on this.

Since Feb 25, 2026.

Assessment

This issue has not been assessed yet.

Description

Some tools call the Pods via their PodIP, e.g. Prometheus when using a ServiceMonitor.
For this to work with HTTPS-enabled products, we need to add the Pod IP to the certificate because

The clients should be able to validate the cert
Some products (currently only NiFi) raise an "Invalid SNI" error if they can not find a matching cert in it's keystore

There is currently already code for this.
The Pod IPs are gathered here:
https://github.com/stackabletech/secret-operator/blob/e5224ab480e219e434ddc695c9361a16a56a43ed/rust/operator-binary/src/backend/pod_info.rs#L142-L153

and stuffed into the certificate here
https://github.com/stackabletech/secret-operator/blob/e5224ab480e219e434ddc695c9361a16a56a43ed/rust/operator-binary/src/backend/mod.rs#L229

However the comment already highlights the problem:

This will generally be empty, since Kubernetes assigns pod IPs after CSI plugins are successful

Because of this, we are lacking SAN entries for the Pod IPs.

I don't know if this "is even possible" with our current architecture of secret-operator being a CSI driver.

So I though "maybe listener-op can help"? Not from the top of my head, as it itself is "only" a CSI driver, so the Pod has no IPs assigned when it is running as well. listener-op can currently only block Pod creation until a Service (such as a LoadBalancer) has an address assigned. But there might be some other clever way how listener-op can do this which I didn't though of.

Another though is that certificate hot-reloading should work, because we can add the IP to the cert after the Pod has an IP assigned.
But that's a bigger story - e.g. do all tools support this?
Run secret-op as init container? As sidecar?

Dominant language: Rust
Stars: 13
Forks: 8
Avg merge: 1d 8h
Merged PRs (30d): 10

Contributor guide

No contributing guide indexed for this repository

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

in_memory_filesystem_shim test fails on Windows: in-memory keys are stored with / and looked up with \ Open

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

daisy/MathCAT#817 · Opened Sep 24, 2026
bug: read reopens with a zero-size range after the last byte Open

bug core

Difficulty 2/5 1-3 hours Newbie friendliness 86/100

apache/opendal#8342 · 1 reaction · Opened Sep 24, 2026
JIT-compiled number -> Decimal conversion silently overflows instead of raising DECIMAL_OVERFLOW Open

fuzz

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

ClickHouse/ClickHouse#122114 · Opened Sep 24, 2026
Text under a transformed group is rendered with its transform applied twice Open

Difficulty 1/5 Under an hour Newbie friendliness 92/100

linebender/vello_svg#90 · Opened Sep 24, 2026
Self-host buzz-relay no longer pulling minio images Open

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

block/buzz#7880 · Opened Sep 24, 2026

More Rust issues