In the operator itself (https://raw.githubusercontent.com/percona/percona-xtradb-cluster-operator/v1.20.0/deploy/rbac.yaml), the section on cert-manager has
- apiGroups:
- certmanager.k8s.io
- cert-manager.io
resources:
- issuers
- certificates
- certificates/status
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
- deletecollection
but the chart is missing the "certificates/status" resource (see https://github.com/percona/percona-helm-charts/blob/main/charts/pxc-operator/templates/role.yaml#L133) , resulting in errors along the lines of
failed to reconcile SSL. Please create your TLS secret XXXXXXX-pxc-db-ssl and XXXXXX-pxc-db-ssl-internal manually or setup cert-manager correctly: reconcile CA rotation: update certificate status XXXXXX-pxc-db-ssl: certificates.cert-manager.io \"XXXXXX-pxc-db-ssl\" is forbidden: User \"system:serviceaccount:percona:pxc-operator\" cannot update resource \"certificates/status\" in API group \"cert-manager.io\" in the namespace \"percona\"
In the operator itself (https://raw.githubusercontent.com/percona/percona-xtradb-cluster-operator/v1.20.0/deploy/rbac.yaml), the section on cert-manager has
but the chart is missing the "certificates/status" resource (see https://github.com/percona/percona-helm-charts/blob/main/charts/pxc-operator/templates/role.yaml#L133) , resulting in errors along the lines of