gRPC TLS hostname mismatch between VTGate and vttablet

Goal: align tablet certificate SANs with the address Vitess clients use for gRPC TLS connections in a Kubernetes deployment.

Vitess components encrypt inter-component gRPC traffic with TLS, and Go gRPC clients verify the hostname by default. If VTGate addresses a tablet using a Kubernetes headless service DNS name while the tablet certificate contains only the pod DNS name or pod IP, the handshake fails. It is unclear whether Vitess advertises the service DNS name, pod DNS name, or pod IP for tablet-to-tablet replication and rebuild connections, and whether that advertised address differs by Vitess major version.

Questions:

• Which address does Vitess advertise for tablet-to-tablet gRPC connections in Kubernetes?
• Should tablet certificate SANs target the headless service DNS name, pod DNS name, or pod IP?
• Does the advertised address change across Vitess releases?