Restart ramen pods after CA injection to ensure CA trust works

Chart.yaml

@@ -9,4 +9,4 @@ keywords:
   - ramen
   - regionaldr
 name: opp-policy-chart
-version: 0.1.0
+version: 0.1.1

README.md

@@ -1,17 +1,19 @@
 # opp-policy-chart
 
-![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square)
+![Version: 0.1.1](https://img.shields.io/badge/Version-0.1.1-informational?style=flat-square)
 
 ACM/OCM policy chart for Submariner, s3-ssl CA sync, and Ramen s3StoreProfiles CA injection (from vp-manage-proxy-cluster-ca) supporting Regional Disaster Recovery.
 
 Always deployed with **regionaldr-with-virt** (Ramen DR / virt workloads). This chart adds Submariner, s3-ssl CA sync, and Ramen `s3StoreProfiles` CA injection (sourced from **vp-manage-proxy-cluster-ca**) on the hub, with optional distribution to ManagedClusters.
 Also pair with **odf-dr-chart** (MirrorPeer / ODF).
 
 **s3-ssl** sync/precheck/policies use the **full** Proxy trustedCA ConfigMap (`vp-pattern-proxy-ca-bundle` / `ca-bundle.crt`) — the same object `Proxy/cluster.spec.trustedCA` must reference.
-**s3CaInjector** reads the **differential** Bundle (`vp-pattern-proxy-ca-bundle-differential` / `cabundle` — hub + spoke API/ingress CAs only), patches `ramen-hub-operator-config`, then (when `s3CaInjector.distributeToManagedClusters` is true) uses ACM kubeconfigs to patch `ramen-dr-cluster-operator-config` on spokes. Set `distributeToManagedClusters: false` for hub-only.
+**s3CaInjector** reads the **differential** Bundle (`vp-pattern-proxy-ca-bundle-differential` / `cabundle` — hub + spoke API/ingress CAs only), patches `ramen-hub-operator-config`, then (when `s3CaInjector.distributeToManagedClusters` is true) uses ACM kubeconfigs to patch `ramen-dr-cluster-operator-config` on spokes. After a successful patch it restarts Ramen operator pods so they reload cluster Proxy trust (profile `caCertificates` alone are not used by Ramen `ListKeys`). Set `distributeToManagedClusters: false` for hub-only.
 
 ## Notable changes
 
+v0.1.1 - Restart Ramen operator pods after s3CaInjector patches caCertificates (reload Proxy trustedCA for DRCluster S3 validation)
+
 v0.1.0 - Fold s3-ca-injector into this chart (hub + optional spoke inject via ACM kubeconfigs); prefer over standalone vp-ramen-s3-ca-injector; s3-ssl uses the full Proxy trustedCA ConfigMap, s3CaInjector uses the differential Bundle
 
 v0.0.4 - Add Submariner and s3-ssl (from odf-dr); s3-ssl sources CA from vp-proxy ConfigMap

README.md.gotmpl

@@ -9,10 +9,12 @@ Always deployed with **regionaldr-with-virt** (Ramen DR / virt workloads). This
 Also pair with **odf-dr-chart** (MirrorPeer / ODF).
 
 **s3-ssl** sync/precheck/policies use the **full** Proxy trustedCA ConfigMap (`vp-pattern-proxy-ca-bundle` / `ca-bundle.crt`) — the same object `Proxy/cluster.spec.trustedCA` must reference.
-**s3CaInjector** reads the **differential** Bundle (`vp-pattern-proxy-ca-bundle-differential` / `cabundle` — hub + spoke API/ingress CAs only), patches `ramen-hub-operator-config`, then (when `s3CaInjector.distributeToManagedClusters` is true) uses ACM kubeconfigs to patch `ramen-dr-cluster-operator-config` on spokes. Set `distributeToManagedClusters: false` for hub-only.
+**s3CaInjector** reads the **differential** Bundle (`vp-pattern-proxy-ca-bundle-differential` / `cabundle` — hub + spoke API/ingress CAs only), patches `ramen-hub-operator-config`, then (when `s3CaInjector.distributeToManagedClusters` is true) uses ACM kubeconfigs to patch `ramen-dr-cluster-operator-config` on spokes. After a successful patch it restarts Ramen operator pods so they reload cluster Proxy trust (profile `caCertificates` alone are not used by Ramen `ListKeys`). Set `distributeToManagedClusters: false` for hub-only.
 
 ## Notable changes
 
+v0.1.1 - Restart Ramen operator pods after s3CaInjector patches caCertificates (reload Proxy trustedCA for DRCluster S3 validation)
+
 v0.1.0 - Fold s3-ca-injector into this chart (hub + optional spoke inject via ACM kubeconfigs); prefer over standalone vp-ramen-s3-ca-injector; s3-ssl uses the full Proxy trustedCA ConfigMap, s3CaInjector uses the differential Bundle
 
 v0.0.4 - Add Submariner and s3-ssl (from odf-dr); s3-ssl sources CA from vp-proxy ConfigMap

scripts/ansible/s3-ca-injector.yml

@@ -2,6 +2,7 @@
 # Inject caCertificates into Ramen s3StoreProfiles from hub vp-proxy differential CA.
 # Hub always; managed clusters when DISTRIBUTE_TO_MANAGED_CLUSTERS=true (default).
 # Skips ConfigMap apply when every profile already has the desired caCertificates.
+# On patch, inject-ramen-s3-ca.sh restarts Ramen operator pods so they reload Proxy trust.
 # Env: PRIMARY_CLUSTER, SECONDARY_CLUSTER, CA_BUNDLE_*, RAMEN_*, DISTRIBUTE_TO_MANAGED_CLUSTERS,
 #      ALLOW_MISSING_PROFILES, CA_WAIT_SECONDS, RAMEN_WAIT_SECONDS, POLL_INTERVAL, MIN_PROFILES
 - name: S3 CA inject into Ramen s3StoreProfiles
@@ -167,4 +168,5 @@
           {% else %}
           ; managed-cluster distribution skipped (distributeToManagedClusters=false)
           {% endif %}
-          (ConfigMap apply skipped when caCertificates already match)
+          (ConfigMap apply skipped when caCertificates already match;
+          Ramen operator pods restarted when a patch was applied)

scripts/inject-ramen-s3-ca.sh

@@ -3,6 +3,8 @@
 # Prefer CA_FILE (hub-read PEM shared across targets). Else wait for CA ConfigMap in-cluster.
 # Never creates profiles. Soft-exit when ALLOW_MISSING_PROFILES=true and profiles are absent.
 # Skips ConfigMap apply when every profile already has the desired caCertificates value.
+# After a successful patch, restarts Ramen operator pods so they reload process trust
+# (Proxy trustedCA). Profile caCertificates alone are not used by Ramen ListKeys.
 # Honors KUBECONFIG for managed-cluster targets (empty/unset = hub in-cluster).
 set -euo pipefail
 
@@ -218,13 +220,34 @@ verify_patch() {
 	die "post-apply verification failed for ${RAMEN_NAMESPACE}/${RAMEN_CONFIGMAP}"
 }
 
+# Ramen's S3 ListKeys client uses the process trust store (cluster Proxy trustedCA),
+# not s3StoreProfiles.caCertificates. Restart operators after we patch so pods
+# remount/reload trust that s3-ssl / vp-proxy just distributed.
+restart_ramen_operators() {
+	local ns label pods
+	local -a labels=("app=ramen-hub-operator" "app=ramen-dr-cluster-operator")
+
+	log "Restarting Ramen operator pods after caCertificates patch..."
+	for ns in openshift-operators openshift-dr-system; do
+		for label in "${labels[@]}"; do
+			pods=$(oc get pods -n "$ns" -l "$label" -o name 2>/dev/null || true)
+			if [[ -n "$pods" ]]; then
+				log "  Deleting ${label} pods in ${ns}"
+				# shellcheck disable=SC2086
+				oc delete -n "$ns" $pods --ignore-not-found=true || true
+			fi
+		done
+	done
+}
+
 resolve_ca_bundle
 wait_for_ramen_profiles
 rm -f "$WORK_DIR/.ca-patched"
 patch_profiles
 if [[ -f "$WORK_DIR/.ca-patched" ]]; then
 	verify_patch
+	restart_ramen_operators
 else
-	log "Skip verify (no ConfigMap apply)"
+	log "Skip verify and restart (no ConfigMap apply)"
 fi
 log "Done."

templates/rbac-s3-ca-injector.yaml

@@ -24,6 +24,10 @@ rules:
 - apiGroups: [""]
   resources: ["configmaps", "secrets"]
   verbs: ["get", "list", "watch", "patch", "update"]
+# Restart Ramen operator pods after caCertificates patch (hub SA only; spokes use ACM kubeconfigs).
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["get", "list", "delete"]
 - apiGroups: ["cluster.open-cluster-management.io"]
   resources: ["managedclusters"]
   verbs: ["get", "list"]