Release 1.23.0

docs/RN/Kubernetes-Operator-for-PSMONGODB-RN1.22.0.md

@@ -269,7 +269,7 @@ Learn more about the workflow and the setup in our [documentation](../system-use
 
 The Operator deprecates the support of Percona Server for MongoDB 6.0 as this major version entered end-of-life stage. You can still run Percona Server for MongoDB 6.0 in the Operator and existing functionality remains compatible. However, we will no longer test new features and improvements against this version.
 
-Percona Server for MongoDB 6.0 will be removed from the Operator in version 1.23.0.
+Percona Server for MongoDB 6.0 will be removed from the Operator in version 1.24.0.
 
 ### Deprecated support for PMM2 
 

docs/RN/index.md

@@ -1,5 +1,6 @@
 # Percona Operator for MongoDB Release Notes
 
+- [Percona Operator for MongoDB 1.23.0 ({{date.1_23_0}})](Kubernetes-Operator-for-PSMONGODB-RN1.23.0.md)
 - [Percona Operator for MongoDB 1.22.0 ({{date.1_22_0}})](Kubernetes-Operator-for-PSMONGODB-RN1.22.0.md)
 - [Percona Operator for MongoDB 1.21.2 ({{date.1_21_2}})](Kubernetes-Operator-for-PSMONGODB-RN1.21.2.md)
 - [Percona Operator for MongoDB 1.21.1 ({{date.1_21_1}})](Kubernetes-Operator-for-PSMONGODB-RN1.21.1.md)

docs/System-Requirements.md

@@ -47,5 +47,6 @@ Choose how you wish to install the Operator:
 * [on Google Kubernetes Engine (GKE)](gke.md)
 * [on Amazon Elastic Kubernetes Service (AWS EKS)](eks.md)
 * [on Microsoft Azure Kubernetes Service (AKS)](aks.md)
+* [on Rancher Kubernetes Engine (RKE2)](rke2.md)
 * [on Openshift](openshift.md)
 * [in a Kubernetes-based environment](kubernetes.md)

docs/TLS.md

@@ -5,6 +5,8 @@ Percona Operator for MongoDB uses Transport Layer Security (TLS) cryptographic p
 * External - to enable client applications communicate with the cluster
 * Internal - for communication between Percona Server for MongoDB instances in the cluster. The internal certificate is also used as an authorization method.
 
+These certificates are stored in Secrets. Default Secret names are `<cluster-name>-ssl` and `<cluster-name>-ssl-internal`. These Secrets are referenced in the `secrets.ssl` and `secrets.sslInternal` Custom Resource options.
+
 You control TLS usage with the `tls.mode` option in the Custom Resource. This setting defines how Percona Server for MongoDB cluster handles TLS for both internal and external connections. You can choose from the following modes:
 
 - `allowTLS`: The cluster accepts both TLS and non-TLS incoming connections, but does not use TLS for internal communication.
@@ -24,24 +26,59 @@ spec:
 
 ## TLS Certificates
 
-TLS security can be configured in several ways:
+You can configure TLS security in several ways:
+
+| Approach | Best for | Renewal |
+| -------- | -------- | ------- |
+| Operator-generated certificates (default) | Quick start, development | Manual |
+| cert-manager with Operator-managed issuers | Automated TLS without external PKI | Automatic (cert-manager) |
+| cert-manager with your existing `Issuer` or `ClusterIssuer` | Production clusters that use the organization's PKI (Smallstep, ACME, etc.) | Automatic (cert-manager) |
+| Manual Secrets | Full control, air-gapped or custom PKI workflows | Manual |
+
+* By default, the Operator generates long-term certificates automatically during the cluster creation if there are no
+certificate secrets available and no cert-manager is installed. When generating certificates, the Operator creates two Secrets objects named `<cluster-name>-ssl` and `<cluster-name>-ssl-internal`. These Secrets are referenced in the `secrets.ssl` and `secrets.sslInternal` options in the Custom Resource.
 
-* The Operator generates long-term certificates automatically during the cluster creation if there are no
-certificate secrets available. When generating certificates, the Operator creates two Secrets objects named `<cluster-name>-ssl` and `<cluster-name>-ssl-internal`. These Secrets are also referenced in the `secrets.ssl` and `secrets.sslInternal` options in the Custom Resource.
+    Operator-generated certificates are not renewed automatically. You must renew them manually if you need new certificates.
 
-   This is the default behavior. If you need new certificates, and you must renew them manually.
+    To allow certificates automatically generated by the Operator, the [tls.allowInvalidCertificates](operator.md#tlsallowinvalidcertificates)
+    Custom Resource option is set to `true` by default. You can set it to `false` when using other certificate generation methods, such as cert-manager with a trusted CA.
 
-   To allow certificates automatically generated by the Operator, the [tls.allowInvalidCertificates](operator.md#tlsallowinvalidcertificates)
-    Custom Resource option is set to `true` by default. You can set it to `false` when using other certificate generation methods, such as using cert-manager.
+* The Operator can use an installed *cert-manager* to automatically generate and
+    renew short-term TLS certificates. By default it creates namespace-scoped issuers
+    in the database namespace. Starting with Operator 1.23.0, you can also point it
+    at an existing cluster-wide [`ClusterIssuer`](tls-cert-manager.md#use-an-existing-clusterissuer)
+    so MongoDB certificates are signed by your organization's CA.
+* You can [generate TLS certificates manually](tls-manual.md) and pass them to the Operator as Kubernetes Secrets.
 
-* The Operator can use a specifically installed *cert-manager*, which will
-    automatically generate and renew short-term TLS certificates
-* You can generate TLS certificates manually.
-
-   **For testing purposes**, you can use pre-generated certificates available in the
+**For testing purposes**, you can use pre-generated certificates available in the
 `deploy/ssl-secrets.yaml` file. But we strongly recommend
 **to not use them on any production system**!
 
+### Certificate management policy
+
+Starting with Operator version 1.23.0, you can control what happens when TLS Secrets are missing via the `spec.tls.certManagementPolicy` option in the Custom Resource:
+
+* `auto` (default) — If Secrets are not found, the Operator creates new certificates automatically (self-signed or via cert-manager). New certificates can replace a lost user-managed Secret with a **new CA**, which triggers a rolling restart of all database Pods, and can disconnect clients that trust the original CA.
+* `userProvidedOnly` — The Operator skips auto-creation or replacement of unavailable TLS certificates, so that you control the certificate lifecycle management (manually, via External Secrets, GitOps, or your own cert-manager workflow). If a Secret is missing, Pods keep running with existing certificates where possible, and the Operator sets the `TLSSecretsReady=False` condition until you restore the Secret.
+
+| Your setup | Recommended policy |
+|------------|-------------------|
+| Operator self-signed or Operator-driven cert-manager | `auto` |
+| Manual, External Secrets, or GitOps-managed TLS Secrets in production | `userProvidedOnly` |
+
+Example:
+
+```yaml
+spec:
+  tls:
+    mode: preferTLS
+    certManagementPolicy: userProvidedOnly
+  secrets:
+    ssl: my-cluster-name-ssl
+    sslInternal: my-cluster-name-ssl-internal
+```
+
+See [Configure the TLS certificate management policy](tls-cert-management-policy.md) for setup steps, monitoring, recovery, and policy switching.
 
 ## TLS configuration
 
@@ -50,17 +87,9 @@ The following sections provide guidelines how to:
 * [Configure TLS security with the Operator using cert-manager](tls-cert-manager.md)
 * [Generate certificates manually](tls-manual.md)
 * [Update certificates](tls-update.md)
+* [Configure the TLS certificate management policy](tls-cert-management-policy.md)
 * [Disable TLS temporarily](tls-disable.md)
 
 To use TLS for external traffic, you need to additionally configure your client application. See [this blog post :octicons-link-external-16:](https://www.percona.com/blog/authenticating-your-clients-to-mongodb-on-kubernetes-using-x509-certificates/) for detailed instruction with examples. Also, you can check the [official MongoDB documentation :octicons-link-external-16:](https://www.mongodb.com/docs/manual/tutorial/configure-ssl-clients/). 
 
 For clients outside of your Kubernetes-based environment, you must also [expose your cluster](expose.md).
-
-
-
-
-
-
-
-
-

docs/annotations.md

@@ -78,6 +78,7 @@ Use **Annotations** when:
 | `percona.com/ssl-hash` | Pods | Stores the hash of the most recent TLS configuration | 
 | `percona.com/ssl-internal-hash` | Pods | Stores the hash of the most recent TLS configuration for internal communication |
 | `percona.com/passwords-updated`| Secrets | Indicates when passwords were last updated in the Secret |
+| `percona.com/external-dns-managed` | Services | Set by the Operator when External DNS `/hostname` and `/ttl` annotations are generated from values defined in `expose.externalDNS`. Marks ownership of those annotations.  Do not set or remove it manually. See [How the Operator manages External DNS annotations](expose.md#how-the-operator-manages-external-dns-annotations). | `"true"` |
 | `kubectl.kubernetes.io/restartedAt` | PVC | Records the most recent timestamp when the associated resource was intentionally restarted. This annotation is typically used to trigger rolling restarts of StatefulSets, ensuring Pods or PVCs are refreshed according to Kubernetes best practices. | `2026-02-01T12:34:56Z` |
 
 ## Setting labels and annotations in the Custom Resource
@@ -182,4 +183,6 @@ spec:
 ...
 ```
 
-The label and annotation values must exactly match the ones defined for the Service to be kept.
+The label and annotation values must exactly match the ones defined for the Service to be kept.
+
+External DNS annotations follow separate ownership rules. The Operator manages `external-dns.alpha.kubernetes.io/hostname` and `/ttl` only on Services marked with `percona.com/external-dns-managed`. Manual External DNS annotations on unmarked Services, and other External DNS keys such as `/target` or `/alias`, are preserved and do not need to be listed in `ignoreAnnotations`. See [How the Operator manages External DNS annotations](expose.md#how-the-operator-manages-external-dns-annotations) for details.