From fd8b37a6b14a58682114eb6f7a6ac4ba9de5a4fd Mon Sep 17 00:00:00 2001
From: masoodafar-web <masoud.afarin.moghaddam@outlook.com>
Date: Wed, 13 May 2026 22:05:26 +0330
Subject: [PATCH] docs: add note on TLS certificate requirements for cms-tls in
 Ingress configuration

---
 k8s/staging/cms-deployment.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/k8s/staging/cms-deployment.yaml b/k8s/staging/cms-deployment.yaml
index b5797a4..f54219b 100644
--- a/k8s/staging/cms-deployment.yaml
+++ b/k8s/staging/cms-deployment.yaml
@@ -101,6 +101,8 @@ spec:
 
 ---
 # CMS Ingress
+# If clients report TLS PartialChain, the tls secret (cms-tls) tls.crt must include the full chain
+# (leaf + intermediates). cert-manager ACME usually provides this; manual certs need fullchain.pem in tls.crt.
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata: