Skip to content

Commit f0a521f

Browse files
gkechgithub-actions[bot]
gkech
and
github-actions[bot]
authored
K8SPG-552 cert manager integration (#1233)
* K8SPG-552 cert manager integration * fixes after merge * fixes * fixes on the cert config * fixes * fix e2e tst * fix tests * add check for restconfig * add unit tests for certmanager * imports and cert manager lib version fix * revert cert manager version env * regenerate go mod and sum * fix controller runtime * add RotationPolicyNever * cr: get certs before trying to create them * expose configuration for cert manager / tls * fix test clause * fix errors from conflicts * Update percona/certmanager/certmanager_test.go Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * cr: remove log and remove already exists handling which is not triggered anymore * fix namespaces for issuer and cert location - always match cluster * fix unit tests * fix e2e test --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
1 parent 9ace0ef commit f0a521f

43 files changed

Lines changed: 2049 additions & 47 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎build/crd/crunchy/generated/postgres-operator.crunchydata.com_postgresclusters.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22234,6 +22234,13 @@ spec:
2223422234
format: int64
2223522235
type: integer
2223622236
type: array
22237+
tls:
22238+
properties:
22239+
caValidityDuration:
22240+
type: string
22241+
certValidityDuration:
22242+
type: string
22243+
type: object
2223722244
tlsOnly:
2223822245
type: boolean
2223922246
userInterface:

‎build/crd/percona/generated/pgv2.percona.com_perconapgclusters.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21721,6 +21721,13 @@ spec:
2172121721
pattern: ^repo[1-4]
2172221722
type: string
2172321723
type: object
21724+
tls:
21725+
properties:
21726+
caValidityDuration:
21727+
type: string
21728+
certValidityDuration:
21729+
type: string
21730+
type: object
2172421731
tlsOnly:
2172521732
type: boolean
2172621733
unmanaged:

‎cmd/postgres-operator/main.go‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ import (
2929
"sigs.k8s.io/controller-runtime/pkg/log/zap"
3030
"sigs.k8s.io/controller-runtime/pkg/manager"
3131

32+
certmanagerscheme "github.com/cert-manager/cert-manager/pkg/client/clientset/versioned/scheme"
3233
"github.com/percona/percona-postgresql-operator/v2/internal/controller/pgupgrade"
3334
"github.com/percona/percona-postgresql-operator/v2/internal/controller/postgrescluster"
3435
"github.com/percona/percona-postgresql-operator/v2/internal/controller/runtime"
@@ -38,6 +39,7 @@ import (
3839
"github.com/percona/percona-postgresql-operator/v2/internal/logging"
3940
"github.com/percona/percona-postgresql-operator/v2/internal/naming"
4041
"github.com/percona/percona-postgresql-operator/v2/internal/upgradecheck"
42+
"github.com/percona/percona-postgresql-operator/v2/percona/certmanager"
4143
perconaController "github.com/percona/percona-postgresql-operator/v2/percona/controller"
4244
"github.com/percona/percona-postgresql-operator/v2/percona/controller/pgbackup"
4345
"github.com/percona/percona-postgresql-operator/v2/percona/controller/pgcluster"
@@ -129,6 +131,10 @@ func main() {
129131

130132
assertNoError(volumesnapshotv1.AddToScheme(mgr.GetScheme()))
131133

134+
// K8SPG-552
135+
// Add Scheme for cert-manager resources like Issuer and Certificate.
136+
assertNoError(certmanagerscheme.AddToScheme(mgr.GetScheme()))
137+
132138
// add all PostgreSQL Operator controllers to the runtime manager
133139
err = addControllersToManager(ctx, mgr)
134140
assertNoError(err)
@@ -154,11 +160,14 @@ func addControllersToManager(ctx context.Context, mgr manager.Manager) error {
154160
os.Setenv("REGISTRATION_REQUIRED", "false")
155161

156162
r := &postgrescluster.Reconciler{
157-
Client: mgr.GetClient(),
158-
Owner: postgrescluster.ControllerName,
159-
Recorder: mgr.GetEventRecorderFor(postgrescluster.ControllerName),
160-
Tracer: otel.Tracer(postgrescluster.ControllerName),
161-
IsOpenShift: isOpenshift(ctx, mgr.GetConfig()),
163+
Client: mgr.GetClient(),
164+
Scheme: mgr.GetScheme(),
165+
Owner: postgrescluster.ControllerName,
166+
Recorder: mgr.GetEventRecorderFor(postgrescluster.ControllerName),
167+
Tracer: otel.Tracer(postgrescluster.ControllerName),
168+
IsOpenShift: isOpenshift(ctx, mgr.GetConfig()),
169+
CertManagerCtrlFunc: certmanager.NewController,
170+
RestConfig: mgr.GetConfig(),
162171
}
163172
cm := &perconaController.CustomManager{Manager: mgr}
164173
if err := r.SetupWithManager(cm); err != nil {

‎config/crd/bases/pgv2.percona.com_perconapgclusters.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22360,6 +22360,13 @@ spec:
2236022360
pattern: ^repo[1-4]
2236122361
type: string
2236222362
type: object
22363+
tls:
22364+
properties:
22365+
caValidityDuration:
22366+
type: string
22367+
certValidityDuration:
22368+
type: string
22369+
type: object
2236322370
tlsOnly:
2236422371
type: boolean
2236522372
unmanaged:

‎config/crd/bases/postgres-operator.crunchydata.com_postgresclusters.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22145,6 +22145,13 @@ spec:
2214522145
minimum: 1
2214622146
type: integer
2214722147
type: array
22148+
tls:
22149+
properties:
22150+
caValidityDuration:
22151+
type: string
22152+
certValidityDuration:
22153+
type: string
22154+
type: object
2214822155
tlsOnly:
2214922156
type: boolean
2215022157
userInterface:

‎config/rbac/cluster/role.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,22 @@ rules:
8383
- patch
8484
- update
8585
- watch
86+
- apiGroups:
87+
- cert-manager.io
88+
- certmanager.k8s.io
89+
resources:
90+
- certificaterequests
91+
- certificates
92+
- issuers
93+
verbs:
94+
- create
95+
- delete
96+
- deletecollection
97+
- get
98+
- list
99+
- patch
100+
- update
101+
- watch
86102
- apiGroups:
87103
- coordination.k8s.io
88104
resources:

‎config/rbac/namespace/role.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,22 @@ rules:
8383
- patch
8484
- update
8585
- watch
86+
- apiGroups:
87+
- cert-manager.io
88+
- certmanager.k8s.io
89+
resources:
90+
- certificaterequests
91+
- certificates
92+
- issuers
93+
verbs:
94+
- create
95+
- delete
96+
- deletecollection
97+
- get
98+
- list
99+
- patch
100+
- update
101+
- watch
86102
- apiGroups:
87103
- coordination.k8s.io
88104
resources:

‎deploy/bundle.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22657,6 +22657,13 @@ spec:
2265722657
pattern: ^repo[1-4]
2265822658
type: string
2265922659
type: object
22660+
tls:
22661+
properties:
22662+
caValidityDuration:
22663+
type: string
22664+
certValidityDuration:
22665+
type: string
22666+
type: object
2266022667
tlsOnly:
2266122668
type: boolean
2266222669
unmanaged:
@@ -53187,6 +53194,13 @@ spec:
5318753194
minimum: 1
5318853195
type: integer
5318953196
type: array
53197+
tls:
53198+
properties:
53199+
caValidityDuration:
53200+
type: string
53201+
certValidityDuration:
53202+
type: string
53203+
type: object
5319053204
tlsOnly:
5319153205
type: boolean
5319253206
userInterface:
@@ -55734,6 +55748,22 @@ rules:
5573455748
- patch
5573555749
- update
5573655750
- watch
55751+
- apiGroups:
55752+
- cert-manager.io
55753+
- certmanager.k8s.io
55754+
resources:
55755+
- certificaterequests
55756+
- certificates
55757+
- issuers
55758+
verbs:
55759+
- create
55760+
- delete
55761+
- deletecollection
55762+
- get
55763+
- list
55764+
- patch
55765+
- update
55766+
- watch
5573755767
- apiGroups:
5573855768
- coordination.k8s.io
5573955769
resources:

‎deploy/cr.yaml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,9 @@ spec:
5858
# customReplicationTLSSecret:
5959
# name: replication1-cert
6060
# tlsOnly: false
61-
61+
# tls:
62+
# certValidityDuration: 2160h
63+
# caValidityDuration: 26280h
6264
# standby:
6365
# enabled: true
6466
# host: "<primary-ip>"

‎deploy/crd.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22657,6 +22657,13 @@ spec:
2265722657
pattern: ^repo[1-4]
2265822658
type: string
2265922659
type: object
22660+
tls:
22661+
properties:
22662+
caValidityDuration:
22663+
type: string
22664+
certValidityDuration:
22665+
type: string
22666+
type: object
2266022667
tlsOnly:
2266122668
type: boolean
2266222669
unmanaged:
@@ -53187,6 +53194,13 @@ spec:
5318753194
minimum: 1
5318853195
type: integer
5318953196
type: array
53197+
tls:
53198+
properties:
53199+
caValidityDuration:
53200+
type: string
53201+
certValidityDuration:
53202+
type: string
53203+
type: object
5319053204
tlsOnly:
5319153205
type: boolean
5319253206
userInterface:

0 commit comments

Comments
 (0)