Change domain name in cluster

In the installed cluster (control, client cluster), if necessary, you can change the domain name. This may be necessary if you want to use an internal load balancer for the Ingress controller and an enterprise domain instead of shturval.link.

The instructions below describe two options for changing the domain name: using a script or sequentially executing commands manually.

Automation using a script

Instead of executing commands sequentially, you can use the change-domain-name.sh script. The script is suitable for the management cluster and the client cluster: the launch mode is selected by the argument mgmt or client. Script:

checks for the presence of mandatory utilities: kubectl, jq, sleep;
checks required environment variables and access to the cluster via KUBECONFIG;
creates backup copies of resources before changes;
performs all necessary patch operations for the cluster;
skips missing resources and values in which the old domain is not found;
updates namespace annotations for access to ArgoCD;
waits for changes to be applied and restarts the necessary loads;
Requests confirmation before making changes.

Run the script from a Bash-compatible shell on a local machine where you have access to the required cluster. Download the script from the link change-domain-name.sh.

Make the file executable before running it.

Command

chmod +x ./change-domain-name.sh

Management cluster domain

Pay attention!

Changing the domain name of a management cluster will block access to its client clusters using kubeconfig. To restore access, you will need to change domain names or re-create clusters.
All actions to change a domain name are performed in the command line interface.
To execute scripts you will need the jq utility.

To change your domain name:

Connect to the management cluster with static kubeconfig. In the graphical interface you can find it in the namespace of the management cluster, in Secretwith the name clustername-kubeconfig or get it from any Control Plane node of the cluster along the path /etc/kubernetes/admin.conf.

After connecting, choose one of the ways to change the domain name: run the script or run the commands manually.

Option 1. Executing the script

Prepare environment variables and run the script in mgmt mode.

Variables and run command

export KUBECONFIG=./mgmtcluster.conf
export OLD="mgmtcluster.ip-10-11-12-14.shturval.link"
export NEW="mgmtcluster.mydomain.ru"

./change-domain-name.sh mgmt

Variable	Description	Example
`OLD`	Current management cluster domain name	mgmtcluster.ip-10-11-12-14.shturval.link
`NEW`	New (corporate) management cluster domain name	mgmtcluster.mydomain.ru
`KUBECONFIG`	Static kubeconfig management cluster	mgmtcluster.conf

The script will create backup copies of resources in the ./bak directory, change the domain in ClusterProfile, ShturvalServicePatch, NodeConfigItem, ShturvalServiceConfig and namespace annotations, wait 5 minutes and restart the loads in namespaces shturval-backend, shturval-cd and ingress.

Once launched, confirm execution when prompted with Continue? [y/N].

If you are using a script, manual steps 2-4 are not required.

Option 2: Manually executing commands sequentially

Create backup copies of all resources that will be edited:

cluster profiles (ClusterProfile);
ShturvalServicePatch and ShturvalServiceConfig;
node configuration (NCI).

If there is an error changing a domain name in the cluster, you can use a backup to roll back the changes.

Backup commands

mkdir bak
kubectl get clusterprofile -n kube-system -o yaml >./bak/clusterprofile.yaml
kubectl get shturvalservicepatch -o yaml >./bak/shturvalservicepatch.yaml
kubectl get shturvalserviceconfig -o yaml >./bak/shturvalserviceconfig.yaml
kubectl get nodeconfigitem -o yaml >./bak/nodeconfigitem.yaml

Change the domain name to:

default cluster profile - default-client-cluster-profile;
ShturvalServicePatch: shturval-ingress-controller-common and shturval-frontend-oidc-client;
NCI - controlplane-oidc-nci;
ShturvalServiceConfig: shturval-auth, shturval-backend, shturval-cd, shturval-dashboards, shturval-frontend, shturval-metrics-collector, shturval-monitoring, as follows.

Preparing variables

export KUBECONFIG=<your-value>
export OLD="<your-value>"
export NEW="<your-value>"

Variable	Description	Example
`OLD`	Current management cluster domain name	mgmtcluster.ip-10-11-12-14.shturval.link
`NEW`	New (corporate) management cluster domain name	mgmtcluster.mydomain.ru
`KUBECONFIG`	Static kubeconfig management cluster	mgmtcluster.conf

Domain change commands

# Replace domain values in custom resources with the new domain name
kubectl patch clusterprofile default-client-cluster-profile -n kube-system --type=json -p='[{"op": "replace", "path": "/spec/loggingEndpoint", "value": "logs.'$NEW'"}, {"op": "replace", "path": "/spec/monitoringEndpoint", "value": "vminsert.'$NEW'"}]'
kubectl patch shturvalservicepatch shturval-ingress-controller-common --type=json -p='[{"op": "replace", "path": "/spec/customvalues/controller/shturval/commonName", "value": "'"$NEW"'"}]'
kubectl patch shturvalservicepatch shturval-frontend-oidc-client --type=json -p='[{"op": "replace", "path": "/spec/customvalues/auth_url_production", "value": "//shturval.'"$NEW"'"}]'
kubectl patch nodeconfigitem controlplane-oidc-nci --type=json -p='[{"op": "replace", "path": "/spec/kubeapi/oidc/issuerurl", "value": "https://shturval.'"$NEW"'"}]'

# Replace the domain name in ShturvalServiceConfig
for resource in shturval-auth shturval-backend shturval-cd shturval-dashboards shturval-frontend shturval-metrics-collector shturval-monitoring; do echo "Processing $resource..."; NEW_VALUES=$(kubectl get shturvalserviceconfig "$resource" -o jsonpath='{.spec.customvalues}' | jq --arg old "$OLD" --arg new "$NEW" 'tostring | gsub($old; $new) | fromjson'); kubectl patch shturvalserviceconfig "$resource" --type=json -p="[{'op': 'replace', 'path': '/spec/customvalues', 'value': $NEW_VALUES}]"; done

# Update namespace annotations for ArgoCD access
for resource in $(kubectl get namespace -o jsonpath='{.items[*].metadata.name}'); do 
   echo "Processing $resource..."; \
   NEW_VALUES=$(kubectl get namespace "$resource" -o jsonpath='{.metadata.annotations}' | jq --arg old "$OLD" --arg new "$NEW" 'tostring | gsub($old; $new) | fromjson'); kubectl patch namespace "$resource" --type=json -p="[{'op': 'replace', 'path': '/metadata/annotations', 'value': $NEW_VALUES}]"; \
done 

# Wait 5 minutes for changes to apply
sleep 5m

Restart the pods in namespaces shturval-backend, shturval-cd and ingress, as follows:

Pod restart command

for ns in shturval-backend shturval-cd ingress;do for i in $(kubectl -n $ns get deployments.apps,statefulset.apps -o name);do kubectl -n $ns rollout restart $i;done; done

Wait for the pods to restart. If you need to install a corporate certificate after changing the domain, follow the instructions in the Scenario for adding a corporate certificate to a cluster section.

Client cluster domain

To change the domain name in a client cluster:

Connect to the cluster with static kubeconfig. In the graphical interface, you can find it in the control cluster, in the namespace with the name of the client cluster (Secret with the name clustername-kubeconfig) or get it from any Control Plane cluster node along the path /etc/kubernetes/admin.conf.

After connecting, choose one of the ways to change the domain name: run the script or go through the steps manually.

Option 1. Executing the script

Prepare environment variables and run the script in client mode.

Variables and run command

export KUBECONFIG=./mycluster.conf
export OLD="mycluster.ip-10-11-12-13.shturval.link"
export NEW="mycluster.mydomain.ru"
export OLDMGMT="mgmtcluster.ip-10-11-12-14.shturval.link"
export NEWMGMT="mgmtcluster.mydomain.ru"

./change-domain-name.sh client

If the management cluster domain name has not changed, set the NEWMGMT variable to the same value as OLDMGMT.

If the root CA certificate in the management cluster has been changed, additionally specify the path to it.

export CA=/path/to/ca.crt

Variable	Description	Example
`OLD`	Current domain name of the client cluster	mycluster.ip-10-11-12-13.shturval.link
`NEW`	New (corporate) domain name for the client cluster	mycluster.mydomain.ru
`KUBECONFIG`	Static kubeconfig of client cluster	mycluster.conf
`OLDMGMT`	Current management cluster domain name	mgmtcluster.ip-10-11-12-14.shturval.link
`NEWMGMT`	New (corporate) management cluster domain name	mgmtcluster.mydomain.ru
`CA`	Path to the root certificate. If the management cluster has not changed the root certificate, do not export this variable	/path/to/ca.crt

The script will create backup copies of resources in the ./bak_client directory, change the domain in ShturvalServicePatch, NodeConfigItem, ShturvalServiceConfig and namespace annotations, replace the root CA certificate if necessary, wait 5 minutes and restart the loads in namespace shturval-cd and ingress.

After running the script, confirm execution when the script prompts Continue? [y/N].

If you are using a script, manual steps 2-5 are not required.

Option 2: Manually executing commands sequentially

Create backup copies of all resources that will be changed:

ShturvalServicePatch;
ShturvalServiceConfig;
node configuration (NCI).

In case of an error changing the domain name in the cluster, you can use the backup to roll back changes.

Command

mkdir bak_client
kubectl get shturvalservicepatch -o yaml >./bak_client/shturvalservicepatch.yaml
kubectl get shturvalserviceconfig -o yaml >./bak_client/shturvalserviceconfig.yaml
kubectl get nodeconfigitem -o yaml >./bak_client/nodeconfigitem.yaml

Change the domain name to:

ShturvalServicePatch - shturval-ingress-controller-common;
NCI - controlplane-oidc-nci, as follows.

Preparing variables

export KUBECONFIG=<your-value>
export OLD="<your-value>"
export NEW="<your-value>"
export OLDMGMT="<your-value>"
export NEWMGMT="<your-value>"
export CA=<your-value> # Required only if the root certificate was changed in the management cluster

Variable	Description	Example
`OLD`	Current domain name of the client cluster	mycluster.ip-10-11-12-13.shturval.link
`NEW`	New (corporate) domain name for the client cluster	mycluster.mydomain.ru
`KUBECONFIG`	Static kubeconfig of client cluster	mycluster.conf
`OLDMGMT`	Current management cluster domain name	mgmtcluster.ip-10-11-12-14.shturval.link
`NEWMGMT`	New (corporate) management cluster domain name	mgmtcluster.mydomain.ru
`CA`	Path to the root certificate. If the management cluster has not changed the root certificate, do not export this variable	/path/to/ca.crt

Commands for changing a domain name in custom resources

kubectl patch shturvalservicepatch shturval-ingress-controller-common --type=json -p='[{"op": "replace", "path": "/spec/customvalues/controller/shturval/commonName", "value": "'"$NEW"'"}]'
kubectl patch nodeconfigitem controlplane-oidc-nci --type=json -p='[{"op": "replace", "path": "/spec/kubeapi/oidc/issuerurl", "value": "https://shturval.'"$NEWMGMT"'"}]'

If the root CA certificate has been changed in the management cluster, replace it in the OIDC settings by running the command below:

Root certificate replacement command

CAVALUE=$(base64 -w0 -i $CA); kubectl patch nodeconfigitem controlplane-oidc-nci --type=json -p='[{"op": "replace", "path": "/spec/kubeapi/oidc/cafile", "value": "'"$CAVALUE"'"}]'

Change the domain name in ShturvalServiceConfig:

shturval-cd;
shturval-dashboards;
shturval-metrics-collector;
shturval-monitoring;
shturval-log-collector.

Command

for resource in shturval-cd shturval-dashboards shturval-metrics-collector shturval-monitoring shturval-log-collector; do 
   echo "Processing $resource..."; \
   NEW_VALUES=$(kubectl get shturvalserviceconfig "$resource" -o jsonpath='{.spec.customvalues}' | jq --arg old "$OLD" --arg new "$NEW" 'tostring | gsub($old; $new) | fromjson'); kubectl patch shturvalserviceconfig "$resource" --type=json -p="[{'op': 'replace', 'path': '/spec/customvalues', 'value': $NEW_VALUES}]"; \
   NEW_VALUES=$(kubectl get shturvalserviceconfig "$resource" -o jsonpath='{.spec.customvalues}' | jq --arg old "$OLDMGMT" --arg new "$NEWMGMT" 'tostring | gsub($old; $new) | fromjson'); kubectl patch shturvalserviceconfig "$resource" --type=json -p="[{'op': 'replace', 'path': '/spec/customvalues', 'value': $NEW_VALUES}]"; \
done

# Update namespace annotations for ArgoCD access
for resource in $(kubectl get namespace -o jsonpath='{.items[*].metadata.name}'); do 
   echo "Processing $resource..."; \
   NEW_VALUES=$(kubectl get namespace "$resource" -o jsonpath='{.metadata.annotations}' | jq --arg old "$OLD" --arg new "$NEW" 'tostring | gsub($old; $new) | fromjson'); kubectl patch namespace "$resource" --type=json -p="[{'op': 'replace', 'path': '/metadata/annotations', 'value': $NEW_VALUES}]"; \
done 

# Wait 5 minutes for changes to apply
sleep 5m

Restart the pods in namespaces ingress and shturval-cd, as follows:

Command

for ns in shturval-cd ingress;do for i in $(kubectl -n $ns get deployments.apps,statefulset.apps -o name);do kubectl -n $ns rollout restart $i;done; done

Wait for the pods to restart.

Изменено 2026-05-21 at 00:00

Change domain name in cluster

Automation using a script #

Management cluster domain #

Option 1. Executing the script #

Option 2: Manually executing commands sequentially #

Client cluster domain #

Option 1. Executing the script #

Option 2: Manually executing commands sequentially #

Automation using a script

Management cluster domain

Option 1. Executing the script

Option 2: Manually executing commands sequentially

Client cluster domain

Option 1. Executing the script

Option 2: Manually executing commands sequentially