Adds hard coded commonName: istiod.istio-system.svc to istiod Certificate

[JoshVanL]

This PR adds commonName: istiod.istio-system.svc as a hard coded value to the istiod Certificate. This is to allow for easier integration with Issuers that have default constraints on X509 Subjects being present when requesting certificates with DNS names. This is true for the AWSPCA Issuer.

This value is hardcoded and is not configurable through options such as app.istio.revisions. This is done under the assumption that the commonName doesn't actually need to match one of the DNS names in the cases where revisions are used, but not the default revision. If this is not the case, a workaround for users is to include the default revision, even if their istio installation doesn't include a default revision.

Once merged, we should release a new helm chart version to include this and #86 changes in the public repo.

fixes #90
/assign @irbekrm

NONE

[jetstack-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: JoshVanL

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [JoshVanL]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[irbekrm]

Looks good to me, assuming it fixes their use case.

This is done under the assumption that the commonName doesn't actually need to match one of the DNS names in the cases where revisions are used, but not the default revision. If this is not the case, a workaround for users is to include the default revision, even if their istio installation doesn't include a default revision.

Should this be added as a comment above the helm chart option? Adding a hold in case you want to add that, else feel free to unhold.

/lgtm
/hold

[JoshVanL]

Looks good to me, assuming it fixes their use case.

This is done under the assumption that the commonName doesn't actually need to match one of the DNS names in the cases where revisions are used, but not the default revision. If this is not the case, a workaround for users is to include the default revision, even if their istio installation doesn't include a default revision.

Should this be added as a comment above the helm chart option? Adding a hold in case you want to add that, else feel free to unhold.

/lgtm
/hold

Good idea. MIDD (minimal issues driven development).

[irbekrm]

MIDD (minimal issues driven development)

fixes the problem 🤷🏼

Thanks for adding the comment.

/lgtm

/hold cancel