Repository navigation
External release in a tenant without a host: postgres, qdrant, nats and mariadb fail the render, redis, rabbitmq, opensearch and mongodb skip the SAN #4047
Description
Two charts break an external: true release in a tenant whose _namespace.host is empty, each in its own way.
qdrant, packages/apps/qdrant/templates/certmanager.yaml:81, appends the external SAN with no guard:
{{- if .Values.external }}
- {{ .Release.Name }}.{{ .Values._namespace.host }}
{{- end }}With an empty host that renders <release>. as a dnsName, which cert-manager rejects, so the Certificate never issues and the TLS instance never comes up.
nats, packages/apps/nats/templates/certmanager.yaml:72, uses required "external is true but _namespace.host is not set", which fails the whole release at render time instead. Loud rather than silent, but it still means a hostless tenant cannot run an external nats.
opensearch on #2682 takes the third path: the external SAN is added only when the host is non-empty, so the release renders and serves TLS on its in-cluster names, and only the external hostname is missing. Aligning qdrant and nats on that behaviour keeps external access working where the tenant has a host and degrades cleanly where it has none.
Activity
lexfrei commentedon Oct 6, 2026
The split is wider now than when I filed this. On bcda5c8, an external release with TLS in a tenant without a host goes one of two ways.
The render fails in four charts:
packages/apps/postgres/templates/db.yaml:74, throughcozy-lib.ns-host-requiredpackages/apps/qdrant/templates/certmanager.yaml:81, now also throughcozy-lib.ns-host-required, so it fails loudly instead of rendering<release>.packages/apps/nats/templates/certmanager.yaml:72, throughrequiredpackages/apps/mariadb/templates/certmanager.yaml:154, throughrequiredFour others skip the external name and keep TLS on the in-cluster names: redis (
packages/apps/redis/templates/certmanager.yaml:111-113), rabbitmq (certmanager.yaml:86-90), opensearch (certmanager.yaml:265) and mongodb (mongodb.yaml:183-184, for the split horizons).The comment in the rabbitmq chart gives the reason to skip. The tenant host comes from the optional root host, so requiring it turns an upgrade of an existing external release into a render error. I still think every engine should skip. The postgres and redis case came up again in the review of #4627: #4627 (review)
[-]qdrant, nats: an external release in a tenant without a host fails at the certificate[/-][+]External release in a tenant without a host: postgres, qdrant, nats and mariadb fail the render, redis, rabbitmq, opensearch and mongodb skip the SAN[/+]