fix(llm-request-router): validate certificate SANs against the PKI role

The OpenBao signing role this chart provisions is created with
allow_subdomains=true and allow_bare_domains=false. A certificate SAN outside
pki.allowedDomains therefore renders cleanly and is then rejected by OpenBao at
issuance, surfacing as a cert-manager failure with no pointer back to the value
that caused it. This was the one coupling in the LLM PKI path with no
render-time guard.

Enabling backend routing with the LLM addon made it materially easier to hit.
The chart appends the pod-hostname wildcard to the Certificate whenever backend
routing is on, so every LLM deployment with PKI now requests an in-cluster
wildcard. An operator whose allowedDomains omits cluster.local previously
rendered and installed; now the request would be refused at issuance.

Validate coverage at render instead, applying the role's own rules: a name is
covered when it is a strict subdomain of an allowed domain, a wildcard is
additionally covered when it sits directly on one, and a bare domain is never
covered because the role refuses bare issuance.

The tests pin the cases that must NOT fail as well as those that must. A guard
that is too strict here would block valid deployments, which is worse than the
trap it replaces. Three of them were initially passing for the wrong reason and
were corrected: the near-miss suffix case had the pattern inverted, and the
bare-domain case was failing on the appended wildcard rather than on the bare
name, so the bare rule was never exercised.

Relates to #689

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Mike Camp <mcamp@nvidia.com>

Author: mikeyrcamp

deploy/helm/llm-request-router/llm-request-router/templates/_helpers.tpl

@@ -174,6 +174,48 @@ comparing suffixes.
 {{- end -}}
 {{- end -}}
 
+{{/*
+The OpenBao signing role this chart provisions is created with
+allow_subdomains=true, allow_bare_domains=false, and allow_wildcard_certificates=true.
+A SAN outside allowed_domains renders cleanly and then fails at issuance, so
+check it here instead. Only applies when this chart owns both the Certificate
+and the role.
+
+Coverage, matching the role flags:
+  name.sub.domain   covered when it is a strict subdomain of an allowed domain
+  *.sub.domain      same, and additionally when the wildcard sits directly on an
+                    allowed domain
+  domain            never covered on its own, because bare issuance is refused
+*/}}
+{{- define "llm-request-router.validatePkiAllowedDomains" -}}
+{{- $pki := .Values.llmRequestRouter.pki | default dict -}}
+{{- $certificate := .Values.llmRequestRouter.certificate | default dict -}}
+{{- if and $pki.enabled $certificate.enabled -}}
+{{- $configured := $pki.allowedDomains | default "" | toString -}}
+{{- $allowed := splitList "," $configured -}}
+{{- $dnsNames := include "llm-request-router.effectiveCertificateDnsNames" . | fromJsonArray -}}
+{{- range $dnsName := $dnsNames -}}
+{{- $name := $dnsName | toString | lower | trim -}}
+{{- $isWildcard := hasPrefix "*." $name -}}
+{{- $base := trimPrefix "*." $name -}}
+{{- $covered := false -}}
+{{- range $allowedDomain := $allowed -}}
+{{- $domain := $allowedDomain | toString | lower | trim -}}
+{{- if $domain -}}
+{{- if hasSuffix (printf ".%s" $domain) $base -}}
+{{- $covered = true -}}
+{{- else if and $isWildcard (eq $base $domain) -}}
+{{- $covered = true -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- if not $covered -}}
+{{- fail (printf "certificate DNS name %q is not covered by llmRequestRouter.pki.allowedDomains %q. The OpenBao signing role uses allow_subdomains=true and allow_bare_domains=false, so cert-manager issuance would be rejected after a successful render. Add a covering suffix, for example cluster.local for in-cluster names." $dnsName $configured) -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
 {{- define "llm-request-router.serviceAccountName" -}}
 {{- if .Values.llmRequestRouter.serviceAccount.create }}
 {{- default (include "llm-request-router.fullname" .) .Values.llmRequestRouter.serviceAccount.name }}

deploy/helm/llm-request-router/llm-request-router/templates/certificate.yaml

@@ -16,6 +16,7 @@
 {{ $certificate := .Values.llmRequestRouter.certificate | default dict -}}
 {{- if $certificate.enabled }}
 {{- include "llm-request-router.validateCertificateDnsNames" . }}
+{{- include "llm-request-router.validatePkiAllowedDomains" . }}
 {{- $issuerRef := $certificate.issuerRef | default dict -}}
 {{- $dnsNames := include "llm-request-router.effectiveCertificateDnsNames" . | fromJsonArray }}
 {{- if empty $dnsNames -}}

deploy/helm/llm-request-router/scripts/check-pki-render.sh

@@ -430,4 +430,69 @@ grep -Fq \
   'llmRequestRouter.tls.mode must be certManager or existingSecret, got "externalSecret"' \
   "${invalid_mode_error}" || fail "unknown mode render did not return the expected guard message"
 
+# The OpenBao signing role is created with allow_subdomains=true and
+# allow_bare_domains=false, so a SAN outside allowed_domains renders cleanly and
+# then fails at cert-manager issuance. Catch it at render instead. These cases
+# pin the coverage rules, including the ones that must NOT fail: a wrong guard
+# here would block valid deployments, which is worse than the trap it replaces.
+assert_allowed_domains_case() {
+  local description="$1"
+  local expectation="$2"
+  local allowed_domains="$3"
+  local dns_name="$4"
+  local case_values="${tmp_dir}/allowed-domains-values.yaml"
+  local case_error="${tmp_dir}/allowed-domains.err"
+
+  cat > "${case_values}" <<EOF
+llmRequestRouter:
+  backendRouter:
+    enabled: true
+    image:
+      repository: nvcf/stargate-k8s-router
+  certificate:
+    enabled: true
+    issuerRef:
+      name: nvcf-openbao-pki
+    dnsNames: ["${dns_name}"]
+  tls:
+    certPath: /etc/stargate/tls/tls.crt
+    keyPath: /etc/stargate/tls/tls.key
+    quicInsecure: false
+  pki:
+    enabled: true
+    allowedDomains: "${allowed_domains}"
+    image:
+      repository: nvcf-openbao-migrations
+      tag: "1"
+EOF
+
+  if helm template llm-request-router ./llm-request-router \
+    --namespace nvcf \
+    --values ./llm-request-router/values.yaml \
+    --values "${case_values}" \
+    > /dev/null 2> "${case_error}"; then
+    [ "${expectation}" = "pass" ] || fail "${description} unexpectedly rendered"
+  else
+    [ "${expectation}" = "fail" ] || fail "${description} unexpectedly failed to render"
+    grep -Fq "is not covered by llmRequestRouter.pki.allowedDomains" "${case_error}" ||
+      fail "${description} did not return the allowed-domains guard message"
+  fi
+}
+
+# Must render: these are valid deployments.
+assert_allowed_domains_case "documented customer-domain plus cluster.local" \
+  pass "example.com,cluster.local" "llm-request-router.nvcf.svc.cluster.local"
+assert_allowed_domains_case "whitespace around the comma separators" \
+  pass " example.com , cluster.local " "llm-request-router.nvcf.svc.cluster.local"
+assert_allowed_domains_case "allowed domain deeper in the suffix" \
+  pass "svc.cluster.local" "llm-request-router.nvcf.svc.cluster.local"
+
+# Must fail: issuance would be rejected.
+assert_allowed_domains_case "no overlap with the certificate names" \
+  fail "example.com" "llm-request-router.nvcf.svc.cluster.local"
+assert_allowed_domains_case "name that ends with the domain but is not a subdomain" \
+  fail "cluster.local" "evilcluster.local"
+assert_allowed_domains_case "bare domain, which the role refuses to issue" \
+  fail "llm-request-router-headless.nvcf.svc.cluster.local" "llm-request-router-headless.nvcf.svc.cluster.local"
+
 echo "PKI render checks passed"