operator/charts: add extraDNSNames to TLS certificates for failover SANs

[david-yu]

What

Adds an extraDNSNames field to the broker TLS Certificate configuration, letting users specify additional Subject Alternative Names (SANs) on the generated server certificate.

• Chart path (Redpanda CRD / Helm chart): tls.certs.<name>.extraDNSNames
• Multicluster path (StretchCluster / RedpandaBrokerPool): per-pool tls.certs.<name>.extraDNSNames (each pool is its own cluster)

The names are always appended regardless of whether an issuerRef is supplied, and are ignored when a secretRef is set (the operator doesn't generate the cert in that case).

Why

The motivating use case is TLS failover between clusters. Today there is no way to add custom SANs to broker certs — only the automatic internal service names plus the applyInternalDNSNames toggle. By baking a single, stable, shared hostname (e.g. redpanda.failover.example.com) into the server certificates of two clusters, clients can fail over between them (e.g. by repointing DNS) without hitting a TLS hostname mismatch.

This pairs naturally with the shadow-link DR story, where clients may need to switch from a source cluster to a shadow cluster transparently.

Example

tls:
  certs:
    default:
      caEnabled: true
      extraDNSNames:
        - redpanda.failover.example.com
        - "*.redpanda.failover.example.com"

Implementation

Layer	File
Chart values type	charts/redpanda/values.go (TLSCert.ExtraDNSNames)
Chart cert generation	charts/redpanda/certs.go
Operator API type	operator/api/redpanda/v1alpha2/redpanda_clusterspec_types.go (Certificate.ExtraDNSNames)
Nil-safe accessor	operator/api/redpanda/v1alpha2/stretch_cluster_helpers.go (GetExtraDNSNames)
Multicluster cert generation	operator/multicluster/certs.go

Generated artifacts (CRDs, values.schema.json, partials, applyconfigurations, deepcopy, chart templates) were regenerated via task generate.

Tests

• charts/redpanda: new TestClientCertsExtraDNSNames asserts both automatic and extra SANs appear on the generated server cert.
• operator/multicluster: new tls-extra-dns-names render golden case proves the SANs flow through per-pool cert generation.
• All existing chart TestTemplate and multicluster TestRender golden tests pass with no unrelated drift.

Notes / open questions for review

• In the multicluster path, cluster-level TLS cert config does not propagate to pools today (the same is already true for issuerRef), so extraDNSNames is honored at the pool level. That granularity is arguably correct for failover (per-cluster SANs), but flagging it in case reviewers want cluster→pool TLS propagation addressed separately.
• Scoped to dnsNames. If IP-based SANs are wanted, a follow-up extraIPAddresses field wiring into Spec.IPAddresses would be straightforward.

🤖 Generated with Claude Code