Found while working HarperFast/central-manager#667 / central-manager#669.
unbindDomainById in src/features/cluster/domains/constants/tableDefinition.tsx (stage branch) hardcodes generateDomainCerts: false in the setDomainIdsOnCluster payload. When a cluster has multiple bound domains with cert generation enabled and the user unbinds just one, this resets cert intent for the whole cluster: CM's updateDomains stamps generateDomainCerts: false onto every RUNNING instance, and (once central-manager#669 lands) the Cluster row too — so later cluster expansions won't provision certs for the domains that remain bound.
Until central-manager#669 there was no durable cluster-level intent to consult, which is presumably why the flow hardcodes false. Once it lands, the unbind flow can send the cluster's persisted generateDomainCerts (or derive it from whether any remaining bound domain has certs enabled) instead of false when domainIds is non-empty.
Existing-behavior note: the already-issued cert on the remaining domains keeps renewing regardless (renewal is driven by the deployed component's ChallengeCertificate rows, not this flag) — the flag gates HM's provisioning of new instances, which is exactly the cluster-expansion path central-manager#667 is fixing.
— devain (Claude Fable 5)
Found while working HarperFast/central-manager#667 / central-manager#669.
unbindDomainByIdinsrc/features/cluster/domains/constants/tableDefinition.tsx(stage branch) hardcodesgenerateDomainCerts: falsein thesetDomainIdsOnClusterpayload. When a cluster has multiple bound domains with cert generation enabled and the user unbinds just one, this resets cert intent for the whole cluster: CM'supdateDomainsstampsgenerateDomainCerts: falseonto every RUNNING instance, and (once central-manager#669 lands) the Cluster row too — so later cluster expansions won't provision certs for the domains that remain bound.Until central-manager#669 there was no durable cluster-level intent to consult, which is presumably why the flow hardcodes
false. Once it lands, the unbind flow can send the cluster's persistedgenerateDomainCerts(or derive it from whether any remaining bound domain has certs enabled) instead offalsewhendomainIdsis non-empty.Existing-behavior note: the already-issued cert on the remaining domains keeps renewing regardless (renewal is driven by the deployed component's
ChallengeCertificaterows, not this flag) — the flag gates HM's provisioning of new instances, which is exactly the cluster-expansion path central-manager#667 is fixing.— devain (Claude Fable 5)