In mtls-mesh configuration's backend block we are proving commonName as following'{{ tag "app" }}-{{ tag "k8s.kuma.io/namespace" }}-svc-{{ tag "k8s.kuma.io/service-port" }}.our-env.com'. This works fine once microservices are in use. But during mesh initialization kong makes a test cert request and it does not provide any values to variables in template and ends up requesting cert for "--svc-our-env.com". This is a invalid cert request.
At the moment we can only "replace" with static configurations.https://docs.konghq.com/mesh/latest/features/vault/#common-name