Skip to content

Configure certificates subject #714

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
gulecroc wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Configure certificates subject #714

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
055132a
configure certs subject
Jul 30, 2026
187ae7a
list others certs subject properties
Aug 25, 2026
79b949b
add X.509 certificate subject upgrade doc
Aug 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -495,6 +495,35 @@ helm upgrade -n <namespace> -f values.yaml <pulsar-release-name> apachepulsar/pu

For more detailed information, see our [Upgrading](http://pulsar.apache.org/docs/helm-upgrade/) guide.

## Upgrading to Helm chart version 4.8.0

### X.509 certificate subject

In order to define the various parameters of the X.509 certificate subject, you need to update `tls.common` values :

```
# before
tls:
common:
organization:
- pulsar
# after
tls:
common:
subject:
organizations:
- pulsar
# countries: []
# organizationalUnits: []
# localities: []
# provinces: []
# streetAddresses: []
# postalCodes: []
# serialNumber: ""
```

The upgrade will fail if you still use the old value `tls.common.organization`.

## Upgrading to Helm chart version 4.6.0

### ZooKeeper and Broker Services split into ClusterIP + headless
Expand Down
8 changes: 6 additions & 2 deletions charts/pulsar/templates/_certs.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,9 +87,13 @@ spec:
{{- end }}
duration: "{{ .root.Values.tls.common.duration }}"
renewBefore: "{{ .root.Values.tls.common.renewBefore }}"
{{- if hasKey .root.Values.tls.common "organization" -}}
{{- fail "tls.common.organization is no longer supported. Please configure tls.common.subject instead" -}}

@lhotari lhotari Aug 14, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wanted to argue for a deprecation period here, then convinced myself the hard fail is right.

Without it, an existing tls.common.organization: [acme] would be silently dropped while the new default subject.organizations: [pulsar] survives Helm's merge — quietly changing the issued certificate's O with no signal. Failing loudly is the safer trade.

It's also consistent with how the chart already handles removed values (auth.authentication.provider, and cert-manager.io/v1beta1 a few lines above this one).

On placement: I checked whether the guard being inside pulsar.cert.template makes it unreachable when no Certificate renders — it does (with tls.enabled: false the legacy key is silently ignored). But that's fine: in that state the value is genuinely inert, and enabling certificates later produces an immediate, actionable error. No change needed.

{{- end -}}
{{- if .root.Values.tls.common.subject }}
subject:
organizations:
{{ toYaml .root.Values.tls.common.organization | indent 4 }}
{{ toYaml .root.Values.tls.common.subject | indent 4 }}
{{- end }}
# The use of the common name field has been deprecated since 2000 and is
# discouraged from being used.
commonName: "{{ template "pulsar.fullname" .root }}-{{ .componentConfig.component }}"
Expand Down
12 changes: 10 additions & 2 deletions charts/pulsar/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -268,8 +268,16 @@ tls:
duration: 2160h
# 15d
renewBefore: 360h
organization:
- pulsar
subject:
organizations:
Comment thread
gulecroc marked this conversation as resolved.
- pulsar
# countries: []
# organizationalUnits: []
# localities: []
# provinces: []
# streetAddresses: []
# postalCodes: []
# serialNumber: ""
keySize: 4096
keyAlgorithm: RSA
keyEncoding: PKCS8
Expand Down