TKESSL fails to identify the same target with SAN IP address in SAS® Workload Orchestrator on an IPv6 only deployment


When running SAS Workload Orchestrator in an IPv6-only deployment, SAS Workload Orchestrator uses TKEK8S to establish TLS connections to the Kubernetes API Server. However, TLS certificate validation fails because TKESSL incorrectly determines that the target IPv6 address does not match the IPv6 Subject Alternative Name (SAN) entry in the certificate, even though both represent the same address.

As a result, TLS connections can fail in IPv6-only environments, which prevents successful communication with the Kubernetes API Server.

Cause

During certificate validation, TKESSL converts the target IPv6 address into an internal binary representation and compares it against the SAN IP address contained in the certificate. The conversion logic produces an incomplete IPv6 binary format for compressed IPv6 addresses.

Additional Information

This change is low risk because it is localized to a single function and replaces custom IP address handling with existing networking APIs designed specifically for address normalization and comparison.