K8SPG-1045: add .spec.tls.certManagementPolicy field

build/crd/percona/generated/pgv2.percona.com_perconapgclusters.yaml

@@ -28817,6 +28817,12 @@ spec:
                 properties:
                   caValidityDuration:
                     type: string
+                  certManagementPolicy:
+                    default: auto
+                    enum:
+                    - auto
+                    - userProvidedOnly
+                    type: string
                   certValidityDuration:
                     type: string
                   issuerConf:

config/crd/bases/pgv2.percona.com_perconapgclusters.yaml

@@ -29515,6 +29515,12 @@ spec:
                 properties:
                   caValidityDuration:
                     type: string
+                  certManagementPolicy:
+                    default: auto
+                    enum:
+                    - auto
+                    - userProvidedOnly
+                    type: string
                   certValidityDuration:
                     type: string
                   issuerConf:

config/crd/bases/upstream.pgv2.percona.com_postgresclusters.yaml

@@ -28759,6 +28759,12 @@ spec:
                 properties:
                   caValidityDuration:
                     type: string
+                  certManagementPolicy:
+                    default: auto
+                    enum:
+                    - auto
+                    - userProvidedOnly
+                    type: string
                   certValidityDuration:
                     type: string
                   issuerConf:

deploy/bundle.yaml

@@ -29812,6 +29812,12 @@ spec:
                 properties:
                   caValidityDuration:
                     type: string
+                  certManagementPolicy:
+                    default: auto
+                    enum:
+                    - auto
+                    - userProvidedOnly
+                    type: string
                   certValidityDuration:
                     type: string
                   issuerConf:
@@ -66984,6 +66990,12 @@ spec:
                 properties:
                   caValidityDuration:
                     type: string
+                  certManagementPolicy:
+                    default: auto
+                    enum:
+                    - auto
+                    - userProvidedOnly
+                    type: string
                   certValidityDuration:
                     type: string
                   issuerConf:

deploy/cr.yaml

@@ -59,6 +59,7 @@ spec:
 #      name: replication1-cert
 #  tlsOnly: false
 #  tls:
+#    certManagementPolicy: auto
 #    certValidityDuration: 2160h
 #    caValidityDuration: 26280h
 #    pgBackRestCertValidityDuration: 2160h

deploy/crd.yaml

@@ -29812,6 +29812,12 @@ spec:
                 properties:
                   caValidityDuration:
                     type: string
+                  certManagementPolicy:
+                    default: auto
+                    enum:
+                    - auto
+                    - userProvidedOnly
+                    type: string
                   certValidityDuration:
                     type: string
                   issuerConf:
@@ -66984,6 +66990,12 @@ spec:
                 properties:
                   caValidityDuration:
                     type: string
+                  certManagementPolicy:
+                    default: auto
+                    enum:
+                    - auto
+                    - userProvidedOnly
+                    type: string
                   certValidityDuration:
                     type: string
                   issuerConf:

deploy/cw-bundle.yaml

@@ -29812,6 +29812,12 @@ spec:
                 properties:
                   caValidityDuration:
                     type: string
+                  certManagementPolicy:
+                    default: auto
+                    enum:
+                    - auto
+                    - userProvidedOnly
+                    type: string
                   certValidityDuration:
                     type: string
                   issuerConf:
@@ -66984,6 +66990,12 @@ spec:
                 properties:
                   caValidityDuration:
                     type: string
+                  certManagementPolicy:
+                    default: auto
+                    enum:
+                    - auto
+                    - userProvidedOnly
+                    type: string
                   certValidityDuration:
                     type: string
                   issuerConf:

e2e-tests/run-pr.csv

@@ -2,6 +2,7 @@ backup-enable-disable
 builtin-extensions
 custom-extensions
 cert-manager-tls
+cert-management-policy
 custom-envs
 custom-tls
 database-init-sql

e2e-tests/run-release.csv

@@ -1,6 +1,7 @@
 backup-enable-disable
 builtin-extensions
 cert-manager-tls
+cert-management-policy
 custom-envs
 custom-extensions
 custom-tls

e2e-tests/tests/cert-management-policy/00-assert.yaml

@@ -0,0 +1,24 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+timeout: 120
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: perconapgclusters.pgv2.percona.com
+spec:
+  group: pgv2.percona.com
+  names:
+    kind: PerconaPGCluster
+    listKind: PerconaPGClusterList
+    plural: perconapgclusters
+    singular: perconapgcluster
+  scope: Namespaced
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+metadata:
+  name: check-operator-deploy-status
+timeout: 120
+commands:
+  - script: kubectl assert exist-enhanced deployment percona-postgresql-operator -n ${OPERATOR_NS:-$NAMESPACE} --field-selector status.readyReplicas=1

e2e-tests/tests/cert-management-policy/00-deploy-operator.yaml

@@ -0,0 +1,13 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+timeout: 120
+commands:
+  - script: |-
+      set -o errexit
+      set -o xtrace
+
+      source ../../functions
+      init_temp_dir
+
+      destroy_cert_manager
+      deploy_operator

e2e-tests/tests/cert-management-policy/01-assert.yaml

@@ -0,0 +1,79 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+timeout: 300
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cert-management-policy-cluster-ca-cert
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cert-management-policy-cluster-cert
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cert-management-policy-replication-cert
+---
+kind: StatefulSet
+apiVersion: apps/v1
+metadata:
+  labels:
+    postgres-operator.crunchydata.com/cluster: cert-management-policy
+    postgres-operator.crunchydata.com/data: postgres
+    postgres-operator.crunchydata.com/instance-set: instance1
+status:
+  observedGeneration: 1
+  replicas: 1
+  readyReplicas: 1
+  currentReplicas: 1
+  updatedReplicas: 1
+  collisionCount: 0
+---
+kind: Deployment
+apiVersion: apps/v1
+metadata:
+  name: cert-management-policy-pgbouncer
+  labels:
+    postgres-operator.crunchydata.com/cluster: cert-management-policy
+    postgres-operator.crunchydata.com/role: pgbouncer
+status:
+  observedGeneration: 1
+  replicas: 1
+  updatedReplicas: 1
+  readyReplicas: 1
+---
+apiVersion: upstream.pgv2.percona.com/v1beta1
+kind: PostgresCluster
+metadata:
+  name: cert-management-policy
+status:
+  instances:
+    - name: instance1
+      readyReplicas: 1
+      replicas: 1
+      updatedReplicas: 1
+  observedGeneration: 1
+  proxy:
+    pgBouncer:
+      readyReplicas: 1
+      replicas: 1
+---
+apiVersion: pgv2.percona.com/v2
+kind: PerconaPGCluster
+metadata:
+  name: cert-management-policy
+status:
+  pgbouncer:
+    ready: 1
+    size: 1
+  postgres:
+    instances:
+    - name: instance1
+      ready: 1
+      size: 1
+    ready: 1
+    size: 1
+  state: ready

e2e-tests/tests/cert-management-policy/01-create-initial-cluster.yaml

@@ -0,0 +1,15 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+timeout: 10
+commands:
+  - script: |-
+      set -o errexit
+      set -o xtrace
+
+      source ../../functions
+
+      get_cr "cert-management-policy" \
+        | yq '.spec.tls.certManagementPolicy = "auto"' \
+        | yq '.spec.proxy.pgBouncer.replicas = 1' \
+        | yq '.spec.instances[].replicas = 1' \
+        | kubectl -n "$NAMESPACE" apply -f -

e2e-tests/tests/cert-management-policy/02-save-secrets.yaml

@@ -0,0 +1,33 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+timeout: 180
+commands:
+  - script: |-
+      set -o errexit
+      set -o pipefail
+      set -o xtrace
+
+      source ../../functions
+
+      cluster="cert-management-policy"
+      instance=$(kubectl -n "$NAMESPACE" get statefulset \
+        -l postgres-operator.crunchydata.com/cluster="$cluster",postgres-operator.crunchydata.com/data=postgres \
+        -o jsonpath='{.items[0].metadata.name}')
+
+      kubectl -n "$NAMESPACE" get secret \
+        "${cluster}-cluster-ca-cert" \
+        "${cluster}-cluster-cert" \
+        "${cluster}-replication-cert" \
+        "${cluster}-pgbackrest" \
+        "${cluster}-pgbouncer" \
+        "${instance}-certs" \
+        -o yaml \
+        | yq eval 'del(
+            .metadata,
+            .items[].metadata.creationTimestamp,
+            .items[].metadata.managedFields,
+            .items[].metadata.ownerReferences,
+            .items[].metadata.resourceVersion,
+            .items[].metadata.uid
+          )' - \
+        >"$TEMP_DIR/tls-secrets.yaml"

e2e-tests/tests/cert-management-policy/03-delete-cluster-and-secrets.yaml

@@ -0,0 +1,30 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+timeout: 180
+commands:
+  - script: |-
+      set -o errexit
+      set -o pipefail
+      set -o xtrace
+
+      source ../../functions
+
+      cluster="cert-management-policy"
+
+      kubectl -n "$NAMESPACE" delete perconapgcluster "$cluster" --wait=false
+      remove_all_finalizers
+      kubectl -n "$NAMESPACE" wait --for=delete "perconapgcluster/$cluster" --timeout=120s
+      kubectl -n "$NAMESPACE" wait --for=delete "postgrescluster/$cluster" --timeout=120s
+
+      kubectl -n "$NAMESPACE" delete pvc \
+        -l postgres-operator.crunchydata.com/cluster="$cluster" \
+        --ignore-not-found
+
+      kubectl -n "$NAMESPACE" delete secret \
+        -l postgres-operator.crunchydata.com/cluster="$cluster" \
+        --ignore-not-found
+      kubectl -n "$NAMESPACE" delete secret \
+        "${cluster}-cluster-ca-cert" \
+        "${cluster}-cluster-cert" \
+        "${cluster}-replication-cert" \
+        --ignore-not-found

e2e-tests/tests/cert-management-policy/04-assert.yaml

@@ -0,0 +1,19 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+timeout: 60
+---
+apiVersion: pgv2.percona.com/v2
+kind: PerconaPGCluster
+metadata:
+  name: cert-management-policy
+status:
+  conditions:
+  - reason: PGBackRestRepoHostReady
+    status: "False"
+    type: ReadyForBackup
+  - reason: TLSSecretsMissing
+    status: "False"
+    type: TLSSecretsReady
+  - reason: Paused
+    status: "False"
+    type: Progressing

e2e-tests/tests/cert-management-policy/04-create-user-provided-cluster.yaml

@@ -0,0 +1,17 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  - script: |-
+      set -o errexit
+      set -o pipefail
+      set -o xtrace
+
+      source ../../functions
+
+      cluster="cert-management-policy"
+
+      get_cr "$cluster" \
+        | yq '.spec.tls.certManagementPolicy = "userProvidedOnly"' \
+        | yq '.spec.proxy.pgBouncer.replicas = 1' \
+        | yq '.spec.instances[].replicas = 1' \
+        | kubectl -n "$NAMESPACE" apply -f -