Skip to content

chore: Reduce certificate lifetime to 14 days, clean up subject/SANs #539

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jnschaeffer wants to merge 2 commits into
base: main
Choose a base branch
from
Open

chore: Reduce certificate lifetime to 14 days, clean up subject/SANs #539

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
40d7b12
chore: Reduce certificate lifetime to 14 days, clean up subject/SANs
jnschaeffer Jul 7, 2026
1a72ce8
Update tests to match new certificate subject
jnschaeffer Jul 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 3 additions & 8 deletions pkg/cluster-handler/controller/multigrescluster/certificate.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@ import (
"context"
"errors"
"fmt"
"strings"

apierrors "k8s.io/apimachinery/pkg/api/errors"
apimeta "k8s.io/apimachinery/pkg/api/meta"
Expand All @@ -22,12 +21,12 @@ const (
// CertIssuerName is the cert-manager ClusterIssuer used for TLS certificates.
CertIssuerName = "supabase-issuer"

// CertDuration is the certificate duration (5 years), matching non-HA projects.
CertDuration = "44640h0m0s"
// CertDuration is the certificate duration.
CertDuration = "336h0m0s"

@niconosenzo niconosenzo Jul 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wondering if we should separate the constructors or use different duration for, e.g., external facing certificates (multigateway) and component-to-component certificates.


// CertLiteralSubjectTemplate is the literal subject template for certificates.
// The CN placeholder is replaced with the certCommonName.
CertLiteralSubjectTemplate = "C=US, ST=Delware, L=New Castle,O=Supabase Inc, CN=%s"
CertLiteralSubjectTemplate = "C=US, ST=Delaware, L=New Castle, O=Supabase Inc, CN=%s"
)

var certGVK = schema.GroupVersionKind{
Expand All @@ -47,11 +46,7 @@ func buildCertificate(
) (*unstructured.Unstructured, error) {
cn := cluster.Spec.CertCommonName

// Build the secondary SAN by stripping the "db." prefix if present.
dnsNames := []any{cn}

@Verolop Verolop Jul 8, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you please update certificate_test.go to match this? TestBuildCertificate still expects the stripped secondary SAN (abc123.supabase.red) here, plus the old Delware subject string.

Also, can you confirm that dropping the stripped SAN is safe? The subject spelling fix seems fine, but removing this SAN could break any client still connecting via the non-db. hostname.

if after, ok := strings.CutPrefix(cn, "db."); ok {
dnsNames = append(dnsNames, after)
}

cert := &unstructured.Unstructured{}
cert.SetGroupVersionKind(certGVK)
Expand Down
25 changes: 2 additions & 23 deletions pkg/cluster-handler/controller/multigrescluster/certificate_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ func TestBuildCertificate(t *testing.T) {
wantSubject string
wantSecretName string
}{
"standard certCommonName with db prefix": {
"standard certCommonName": {
cluster: &multigresv1alpha1.MultigresCluster{
TypeMeta: metav1.TypeMeta{
APIVersion: "multigres.com/v1alpha1",
Expand All @@ -51,29 +51,8 @@ func TestBuildCertificate(t *testing.T) {
wantName: "db.abc123.supabase.red",
wantDNSNames: []any{
"db.abc123.supabase.red",
"abc123.supabase.red",
},
wantSubject: "C=US, ST=Delware, L=New Castle,O=Supabase Inc, CN=db.abc123.supabase.red",
wantSecretName: multigresv1alpha1.CertSecretName,
},
"certCommonName without db prefix": {
cluster: &multigresv1alpha1.MultigresCluster{
TypeMeta: metav1.TypeMeta{
APIVersion: "multigres.com/v1alpha1",
Kind: "MultigresCluster",
},
ObjectMeta: metav1.ObjectMeta{
Name: "test-cluster",
Namespace: "supabase",
UID: "cluster-uid-2",
},
Spec: multigresv1alpha1.MultigresClusterSpec{
CertCommonName: "custom.example.com",
},
},
wantName: "custom.example.com",
wantDNSNames: []any{"custom.example.com"},
wantSubject: "C=US, ST=Delware, L=New Castle,O=Supabase Inc, CN=custom.example.com",
wantSubject: "C=US, ST=Delaware, L=New Castle, O=Supabase Inc, CN=db.abc123.supabase.red",
wantSecretName: multigresv1alpha1.CertSecretName,
},
}
Expand Down