From 055132a96638b1775d929e9f6f6c46b19c05f6bd Mon Sep 17 00:00:00 2001
From: glecroc <guillaume.lecroc@cnp.fr>
Date: Thu, 30 Jul 2026 12:59:39 +0200
Subject: [PATCH 1/3] configure certs subject

---
 charts/pulsar/templates/_certs.tpl | 8 ++++++--
 charts/pulsar/values.yaml          | 5 +++--
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/charts/pulsar/templates/_certs.tpl b/charts/pulsar/templates/_certs.tpl
index 8462d901..9f038cdb 100644
--- a/charts/pulsar/templates/_certs.tpl
+++ b/charts/pulsar/templates/_certs.tpl
@@ -87,9 +87,13 @@ spec:
 {{- end }}
   duration: "{{ .root.Values.tls.common.duration }}"
   renewBefore: "{{ .root.Values.tls.common.renewBefore }}"
+{{- if hasKey .root.Values.tls.common "organization" -}}
+{{- fail "tls.common.organization is no longer supported. Please configure tls.common.subject instead" -}}
+{{- end -}}
+{{- if .root.Values.tls.common.subject }}
   subject:
-    organizations:
-{{ toYaml .root.Values.tls.common.organization | indent 4 }}
+{{ toYaml .root.Values.tls.common.subject | indent 4 }}
+{{- end }}
   # The use of the common name field has been deprecated since 2000 and is
   # discouraged from being used.
   commonName: "{{ template "pulsar.fullname" .root }}-{{ .componentConfig.component }}"
diff --git a/charts/pulsar/values.yaml b/charts/pulsar/values.yaml
index 772f2826..4d523555 100755
--- a/charts/pulsar/values.yaml
+++ b/charts/pulsar/values.yaml
@@ -268,8 +268,9 @@ tls:
     duration: 2160h
     # 15d
     renewBefore: 360h
-    organization:
-      - pulsar
+    subject:
+      organizations:
+        - pulsar
     keySize: 4096
     keyAlgorithm: RSA
     keyEncoding: PKCS8

From 187ae7a24a6371f00fe4594ac92a5df88d38bd33 Mon Sep 17 00:00:00 2001
From: glecroc <guillaume.lecroc@cnp.fr>
Date: Tue, 25 Aug 2026 08:39:35 +0200
Subject: [PATCH 2/3] list others certs subject properties

---
 charts/pulsar/values.yaml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/charts/pulsar/values.yaml b/charts/pulsar/values.yaml
index 4d523555..1c6d6925 100755
--- a/charts/pulsar/values.yaml
+++ b/charts/pulsar/values.yaml
@@ -271,6 +271,13 @@ tls:
     subject:
       organizations:
         - pulsar
+      # countries: []
+      # organizationalUnits: []
+      # localities: []
+      # provinces: []
+      # streetAddresses: []
+      # postalCodes: []
+      # serialNumber: ""
     keySize: 4096
     keyAlgorithm: RSA
     keyEncoding: PKCS8

From 79b949b8ca1a506cb627e59f91fb4a0b30ab79b8 Mon Sep 17 00:00:00 2001
From: glecroc <guillaume.lecroc@cnp.fr>
Date: Tue, 25 Aug 2026 08:46:13 +0200
Subject: [PATCH 3/3] add X.509 certificate subject upgrade doc

---
 README.md | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/README.md b/README.md
index f12e77a1..18abda11 100644
--- a/README.md
+++ b/README.md
@@ -495,6 +495,35 @@ helm upgrade -n <namespace> -f values.yaml <pulsar-release-name> apachepulsar/pu
 
 For more detailed information, see our [Upgrading](http://pulsar.apache.org/docs/helm-upgrade/) guide.
 
+## Upgrading to Helm chart version 4.8.0
+
+### X.509 certificate subject
+
+In order to define the various parameters of the X.509 certificate subject, you need to update `tls.common` values :
+
+```
+# before
+tls:
+  common:
+    organization:
+      - pulsar
+# after
+tls:
+  common:
+    subject:
+      organizations:
+        - pulsar
+      # countries: []
+      # organizationalUnits: []
+      # localities: []
+      # provinces: []
+      # streetAddresses: []
+      # postalCodes: []
+      # serialNumber: ""
+```
+
+The upgrade will fail if you still use the old value `tls.common.organization`.
+
 ## Upgrading to Helm chart version 4.6.0
 
 ### ZooKeeper and Broker Services split into ClusterIP + headless