wip

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

Author: mayankshah1607

internal/controller/postgrescluster/controller.go

@@ -300,7 +300,7 @@ func (r *Reconciler) Reconcile(
 		rootCA, err = r.reconcileRootCertificate(ctx, cluster)
 	}
 
-	if err == nil && rootCA != nil {
+	if err == nil {
 		certManagerManaged, certErr := r.isRootCACertManagerManaged(ctx, cluster)
 		if certErr != nil {
 			log.V(1).Info("failed to check if root CA is cert-manager managed, will retry on next reconcile",

internal/controller/postgrescluster/instance.go

@@ -1575,15 +1575,20 @@ func (r *Reconciler) reconcileCertManagerInstanceCertificates(
 	_ = leafCert.Certificate.UnmarshalText(instanceCerts.Data["dns.crt"])
 	_ = leafCert.PrivateKey.UnmarshalText(instanceCerts.Data["dns.key"])
 
+	caCert, err := instanceCACert(rootCertificateAuth, existing)
+	if err != nil {
+		return nil, err
+	}
+
 	err = patroni.InstanceCertificates(ctx,
-		rootCertificateAuth.Certificate, leafCert.Certificate,
+		caCert, leafCert.Certificate,
 		leafCert.PrivateKey, instanceCerts)
 	if err != nil {
 		return nil, errors.Wrap(err, "failed to add patroni certificates")
 	}
 
 	err = pgbackrest.InstanceCertificates(ctx, cluster,
-		rootCertificateAuth.Certificate, leafCert.Certificate, leafCert.PrivateKey,
+		caCert, leafCert.Certificate, leafCert.PrivateKey,
 		instanceCerts)
 	if err != nil {
 		return nil, errors.Wrap(err, "failed to add pgbackrest certificates")
@@ -1597,6 +1602,28 @@ func (r *Reconciler) reconcileCertManagerInstanceCertificates(
 	return instanceCerts, nil
 }
 
+// instanceCACert returns the CA certificate to embed alongside an instance's
+// leaf certificate. When rootCertificateAuth is set (the operator manages
+// the CA itself), it's the source of truth. When it's nil (external issuer —
+// see K8SPG-951), this reads the ca.crt cert-manager wrote into the
+// instance's own just-issued secret.
+func instanceCACert(rootCertificateAuth *pki.RootCertificateAuthority, issuedSecret *corev1.Secret) (pki.Certificate, error) {
+	if rootCertificateAuth != nil {
+		return rootCertificateAuth.Certificate, nil
+	}
+
+	ca := issuedSecret.Data[corev1.ServiceAccountRootCAKey]
+	if len(ca) == 0 {
+		return pki.Certificate{}, errors.New("external issuer did not return a CA certificate for the instance")
+	}
+
+	var caCert pki.Certificate
+	if err := caCert.UnmarshalText(ca); err != nil {
+		return pki.Certificate{}, errors.Wrap(err, "failed to parse CA certificate from cert-manager secret")
+	}
+	return caCert, nil
+}
+
 // reconcileInternalInstanceCertificates creates instance certificates using internal PKI.
 func (r *Reconciler) reconcileInternalInstanceCertificates(
 	ctx context.Context, cluster *v1beta1.PostgresCluster,

internal/controller/postgrescluster/instance_test.go

@@ -37,6 +37,7 @@ import (
 	"github.com/percona/percona-postgresql-operator/v2/internal/controller/runtime"
 	"github.com/percona/percona-postgresql-operator/v2/internal/logging"
 	"github.com/percona/percona-postgresql-operator/v2/internal/naming"
+	"github.com/percona/percona-postgresql-operator/v2/internal/pki"
 	"github.com/percona/percona-postgresql-operator/v2/internal/testing/cmp"
 	"github.com/percona/percona-postgresql-operator/v2/internal/testing/events"
 	"github.com/percona/percona-postgresql-operator/v2/internal/testing/require"
@@ -2158,3 +2159,45 @@ func TestCleanupDisruptionBudgets(t *testing.T) {
 		})
 	})
 }
+
+func TestInstanceCACert(t *testing.T) {
+	t.Run("uses rootCertificateAuth when present", func(t *testing.T) {
+		root, err := pki.NewRootCertificateAuthority()
+		assert.NilError(t, err)
+
+		caCert, err := instanceCACert(root, &corev1.Secret{})
+		assert.NilError(t, err)
+
+		want, err := root.Certificate.MarshalText()
+		assert.NilError(t, err)
+		got, err := caCert.MarshalText()
+		assert.NilError(t, err)
+		assert.DeepEqual(t, want, got)
+	})
+
+	t.Run("parses ca.crt from issued secret when rootCertificateAuth is nil", func(t *testing.T) {
+		root, err := pki.NewRootCertificateAuthority()
+		assert.NilError(t, err)
+		caBytes, err := root.Certificate.MarshalText()
+		assert.NilError(t, err)
+
+		issuedSecret := &corev1.Secret{Data: map[string][]byte{corev1.ServiceAccountRootCAKey: caBytes}}
+
+		caCert, err := instanceCACert(nil, issuedSecret)
+		assert.NilError(t, err)
+		got, err := caCert.MarshalText()
+		assert.NilError(t, err)
+		assert.DeepEqual(t, caBytes, got)
+	})
+
+	t.Run("errors when issued secret has no ca.crt", func(t *testing.T) {
+		_, err := instanceCACert(nil, &corev1.Secret{})
+		assert.ErrorContains(t, err, "did not return a CA certificate")
+	})
+
+	t.Run("errors when ca.crt is not a valid certificate", func(t *testing.T) {
+		issuedSecret := &corev1.Secret{Data: map[string][]byte{corev1.ServiceAccountRootCAKey: []byte("not a cert")}}
+		_, err := instanceCACert(nil, issuedSecret)
+		assert.ErrorContains(t, err, "failed to parse CA certificate")
+	})
+}

internal/controller/postgrescluster/pgbackrest.go

@@ -2322,9 +2322,9 @@ func (r *Reconciler) reconcileCertManagerPGBackRestSecret(
 	// Populate the pgBackRest secret from cert-manager-issued certs.
 	initialize.Map(&intent.Data)
 
-	caCert, err := rootCA.Certificate.MarshalText()
+	caCert, err := pgBackRestCACert(rootCA, clientSecret, repoSecret)
 	if err != nil {
-		return errors.Wrap(err, "failed to marshal root CA certificate")
+		return err
 	}
 	intent.Data[pgbackrest.CertAuthoritySecretKey] = caCert
 	intent.Data[pgbackrest.CertClientSecretKey] = clientSecret.Data[corev1.TLSCertKey]
@@ -2335,6 +2335,29 @@ func (r *Reconciler) reconcileCertManagerPGBackRestSecret(
 	return nil
 }
 
+// pgBackRestCACert returns the CA certificate bytes to trust for pgBackRest's
+// client/repo TLS. When rootCA is set (the operator manages the CA itself),
+// it's the source of truth. When rootCA is nil (external issuer — see
+// K8SPG-951), there is no operator-tracked CA; instead this reads the ca.crt
+// cert-manager wrote into one of the just-issued leaf secrets, which is
+// present as long as the external issuer returns CA data in its response
+// (true for CA-backed issuers; not guaranteed for e.g. some ACME issuers).
+func pgBackRestCACert(rootCA *pki.RootCertificateAuthority, clientSecret, repoSecret *corev1.Secret) ([]byte, error) {
+	if rootCA != nil {
+		caCert, err := rootCA.Certificate.MarshalText()
+		return caCert, errors.Wrap(err, "failed to marshal root CA certificate")
+	}
+
+	if ca := clientSecret.Data[corev1.ServiceAccountRootCAKey]; len(ca) > 0 {
+		return ca, nil
+	}
+	if ca := repoSecret.Data[corev1.ServiceAccountRootCAKey]; len(ca) > 0 {
+		return ca, nil
+	}
+
+	return nil, errors.New("external issuer did not return a CA certificate for pgBackRest")
+}
+
 // +kubebuilder:rbac:groups="",resources="serviceaccounts",verbs={create,patch}
 // +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources="roles",verbs={create,patch}
 // +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources="rolebindings",verbs={create,patch}

internal/controller/postgrescluster/pgbackrest_test.go

@@ -4571,3 +4571,40 @@ func TestBackupsEnabled(t *testing.T) {
 		assert.Assert(t, backupsReconciliationAllowed)
 	})
 }
+
+func TestPgBackRestCACert(t *testing.T) {
+	t.Run("uses rootCA when present", func(t *testing.T) {
+		root, err := pki.NewRootCertificateAuthority()
+		assert.NilError(t, err)
+
+		caCert, err := pgBackRestCACert(root, &corev1.Secret{}, &corev1.Secret{})
+		assert.NilError(t, err)
+
+		want, err := root.Certificate.MarshalText()
+		assert.NilError(t, err)
+		assert.DeepEqual(t, want, caCert)
+	})
+
+	t.Run("falls back to client secret ca.crt when rootCA is nil", func(t *testing.T) {
+		clientSecret := &corev1.Secret{Data: map[string][]byte{corev1.ServiceAccountRootCAKey: []byte("client-ca-bytes")}}
+		repoSecret := &corev1.Secret{}
+
+		caCert, err := pgBackRestCACert(nil, clientSecret, repoSecret)
+		assert.NilError(t, err)
+		assert.DeepEqual(t, []byte("client-ca-bytes"), caCert)
+	})
+
+	t.Run("falls back to repo secret ca.crt when client secret has none", func(t *testing.T) {
+		clientSecret := &corev1.Secret{}
+		repoSecret := &corev1.Secret{Data: map[string][]byte{corev1.ServiceAccountRootCAKey: []byte("repo-ca-bytes")}}
+
+		caCert, err := pgBackRestCACert(nil, clientSecret, repoSecret)
+		assert.NilError(t, err)
+		assert.DeepEqual(t, []byte("repo-ca-bytes"), caCert)
+	})
+
+	t.Run("errors when neither secret has a CA cert", func(t *testing.T) {
+		_, err := pgBackRestCACert(nil, &corev1.Secret{}, &corev1.Secret{})
+		assert.ErrorContains(t, err, "did not return a CA certificate")
+	})
+}

internal/controller/postgrescluster/pki.go

@@ -42,12 +42,23 @@ func (r *Reconciler) reconcileRootCertificate(
 ) (
 	*pki.RootCertificateAuthority, error,
 ) {
+	mode, err := certmanager.ResolveIssuerMode(ctx, r.Client, cluster)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to resolve issuer mode")
+	}
+	if mode == certmanager.IssuerModeExternal {
+		return nil, nil
+	}
+
 	const keyCertificate, keyPrivateKey = "root.crt", "root.key"
 
 	// K8SPG-553
 	existing := &corev1.Secret{
 		ObjectMeta: naming.PostgresRootCASecret(cluster),
 	}
+	if mode == certmanager.IssuerModeManagedCluster {
+		existing.ObjectMeta = naming.ClusterCACertSecret(cluster, certmanager.CertManagerNamespace())
+	}
 
 	privateKey := keyPrivateKey
 	certificateKey := keyCertificate
@@ -64,11 +75,11 @@ func (r *Reconciler) reconcileRootCertificate(
 		}
 	}
 
-	err := errors.WithStack(
+	err = errors.WithStack(
 		r.Client.Get(ctx, client.ObjectKeyFromObject(existing), existing))
 	// K8SPG-555: we need to check ca certificate from old operator versions
 	// TODO: remove when 2.4.0 will become unsupported
-	if k8serrors.IsNotFound(err) {
+	if k8serrors.IsNotFound(err) && mode == certmanager.IssuerModeManagedNamespaced {
 		nn := client.ObjectKeyFromObject(existing)
 		nn.Name = naming.RootCertSecret
 		err = errors.WithStack(
@@ -104,6 +115,12 @@ func (r *Reconciler) reconcileRootCertificate(
 		return nil, errors.New("waiting for cert-manager to issue a valid CA certificate")
 	}
 
+	if mode == certmanager.IssuerModeManagedCluster {
+		// The cluster-scoped CA cert/secret is entirely cert-manager's
+		// responsibility; there is no internal-PKI fallback for it.
+		return nil, errors.New("waiting for cert-manager to issue a valid CA certificate")
+	}
+
 	root := &pki.RootCertificateAuthority{}
 
 	if err == nil {
@@ -186,8 +203,17 @@ func (r *Reconciler) reconcileCertManagerRootCertificate(
 		return nil, errors.Wrap(err, "error applying CA certificate")
 	}
 
+	mode, err := certmanager.ResolveIssuerMode(ctx, r.Client, cluster)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to resolve issuer mode")
+	}
+	secretMeta := naming.PostgresRootCASecret(cluster)
+	if mode == certmanager.IssuerModeManagedCluster {
+		secretMeta = naming.ClusterCACertSecret(cluster, certmanager.CertManagerNamespace())
+	}
+
 	// Try to fetch the CA secret created by cert-manager.
-	secret := &corev1.Secret{ObjectMeta: naming.PostgresRootCASecret(cluster)}
+	secret := &corev1.Secret{ObjectMeta: secretMeta}
 	if err := r.Client.Get(ctx, client.ObjectKeyFromObject(secret), secret); err != nil {
 		if k8serrors.IsNotFound(err) {
 			log.Info("waiting for cert-manager to issue CA certificate")
@@ -335,9 +361,14 @@ func (r *Reconciler) reconcileCertManagerClusterCertificate(
 ) {
 	c := r.CertManagerCtrlFunc(r.Client, r.Scheme, false)
 
-	err := c.ApplyIssuer(ctx, cluster)
+	mode, err := certmanager.ResolveIssuerMode(ctx, r.Client, cluster)
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to apply TLS issuer")
+		return nil, errors.Wrap(err, "failed to resolve issuer mode")
+	}
+	if mode != certmanager.IssuerModeExternal {
+		if err := c.ApplyIssuer(ctx, cluster); err != nil {
+			return nil, errors.Wrap(err, "failed to apply TLS issuer")
+		}
 	}
 
 	primaryDNSNames, err := naming.ServiceDNSNames(ctx, primaryService, cluster.Spec.ClusterServiceDNSSuffix)
@@ -385,11 +416,27 @@ func (r *Reconciler) isRootCACertManagerManaged(ctx context.Context, cluster *v1
 		return false, nil
 	}
 
+	mode, err := certmanager.ResolveIssuerMode(ctx, r.Client, cluster)
+	if err != nil {
+		return false, errors.Wrap(err, "failed to resolve issuer mode")
+	}
+
 	installed, err := r.isCertManagerInstalled(ctx, cluster.Namespace)
-	if err != nil || !installed {
+	if err != nil {
 		return false, err
 	}
 
+	if mode != certmanager.IssuerModeManagedNamespaced {
+		if !installed {
+			return false, errors.New("cert-manager is required when spec.tls.issuerConf is set")
+		}
+		return true, nil
+	}
+
+	if !installed {
+		return false, nil
+	}
+
 	rootSecret := &corev1.Secret{ObjectMeta: naming.PostgresRootCASecret(cluster)}
 	err = r.Client.Get(ctx, client.ObjectKeyFromObject(rootSecret), rootSecret)
 	if err != nil {