grpc tls fix

Signed-off-by: alyssacgoins <[email protected]>

Author: alyssacgoins

backend/src/apiserver/main.go

@@ -99,6 +99,7 @@ func initCerts() (*tls.Config, error) {
 		return nil, err
 	}
 	tlsCfg := &tls.Config{
+		ServerName:   common.GetMLPipelineServiceName() + "." + common.GetPodNamespace() + ".svc.cluster.local",
 		Certificates: []tls.Certificate{serverCert},
 	}
 	glog.Info("TLS cert key/pair loaded.")

backend/src/v2/config/env.go

@@ -194,7 +194,7 @@ func getDefaultMinioSessionInfo() (objectstore.SessionInfo, error) {
 
 func GetMLPipelineServerConfig() *ServerConfig {
 	return &ServerConfig{
-		Address: common.GetMLPipelineServiceName() + "." + common.GetPodNamespace(),
+		Address: common.GetMLPipelineServiceName() + "." + common.GetPodNamespace() + ".svc.cluster.local",
 		Port:    mlPipelineGrpcServicePort,
 	}
 }

manifests/kustomize/env/cert-manager/base-tls-certs/kfp-api-cert.yaml

@@ -8,12 +8,14 @@ spec:
   dnsNames:
     - ml-pipeline
     - ml-pipeline.kubeflow
+    - ml-pipeline.kubeflow.svc.cluster.local
     - ml-pipeline-scheduledworkflow
     - metadata-envoy
     - metadata-envoy-service
     - metadata-grpc-service
     - metadata-grpc-service.kubeflow
     - metadata-grpc-service.$(kfp-namespace).svc.cluster.local
+    # localhost included here because cert is used in KFP pod-to-pod TLS-enabled testing against localhost base URL.
     - localhost
   ipAddresses:
     # Necessary for running TLS-enabled cluster locally.