diff --git a/pkg/api/util/names.go b/pkg/api/util/names.go
index a61c1a1be..4a335336b 100644
--- a/pkg/api/util/names.go
+++ b/pkg/api/util/names.go
@@ -72,6 +72,11 @@ func ComputeSecureUniqueDeterministicNameFromData(fullName string, maxNameLength
 		return "", err
 	}
 
+	// Although fullName is already a DNS subdomain, we can't just cut it
+	// at N characters and expect another DNS subdomain. That's because
+	// we might cut it right after a ".", which would give an invalid DNS
+	// subdomain (eg. test.-<hash>). So we make sure the last character
+	// is an alpha-numeric character.
 	prefix := DNSSafeShortenToNCharacters(fullName, maxNameLength-hashLength-1)
 	hashResult := hash.Sum(nil)