fix

Author: pooknull

e2e-tests/tests/cert-management-policy/03-delete-cluster-and-secrets.yaml

@@ -16,6 +16,10 @@ commands:
       kubectl -n "$NAMESPACE" wait --for=delete "perconapgcluster/$cluster" --timeout=120s
       kubectl -n "$NAMESPACE" wait --for=delete "postgrescluster/$cluster" --timeout=120s
 
+      kubectl -n "$NAMESPACE" delete pvc \
+        -l postgres-operator.crunchydata.com/cluster="$cluster" \
+        --ignore-not-found
+
       kubectl -n "$NAMESPACE" delete secret \
         -l postgres-operator.crunchydata.com/cluster="$cluster" \
         --ignore-not-found

e2e-tests/tests/cert-management-policy/05-assert.yaml

@@ -9,3 +9,28 @@ metadata:
     postgres-operator.crunchydata.com/cluster: cert-management-policy
     postgres-operator.crunchydata.com/data: postgres
     postgres-operator.crunchydata.com/instance-set: instance1
+---
+apiVersion: pgv2.percona.com/v2
+kind: PerconaPGCluster
+metadata:
+  name: cert-management-policy
+status:
+  conditions:
+  - reason: PGBackRestRepoHostReady
+    status: "False"
+    type: ReadyForBackup
+  - reason: TLSSecretsMissing
+    status: "False"
+    type: TLSSecretsReady
+  - reason: Paused
+    status: "False"
+    type: Progressing
+  - reason: RepoHostNotReady
+    status: "False"
+    type: PGBackRestRepoHostReady
+  - reason: StanzaNotCreated
+    status: "False"
+    type: PGBackRestReplicaRepoReady
+  - reason: RepoBackupNotComplete
+    status: "False"
+    type: PGBackRestReplicaCreate

e2e-tests/tests/cert-management-policy/05-restore-secrets.yaml

@@ -7,4 +7,7 @@ commands:
 
       source ../../functions
 
-      kubectl -n "$NAMESPACE" apply -f "$TEMP_DIR/tls-secrets.yaml"
+      yq eval \
+        'del(.items[] | select(.metadata.name | test("-certs$")))' \
+        "$TEMP_DIR/tls-secrets.yaml" \
+        | kubectl -n "$NAMESPACE" apply -f -

e2e-tests/tests/cert-management-policy/06-restore-instance-secret.yaml

@@ -13,14 +13,11 @@ commands:
         -l postgres-operator.crunchydata.com/cluster="$cluster",postgres-operator.crunchydata.com/data=postgres \
         -o jsonpath='{.items[0].metadata.name}')
 
-      old_instance_secret=$(yq eval -r \
-        '[.items[].metadata.name | select(test("-certs$"))][0] // ""' \
-        "$TEMP_DIR/tls-secrets.yaml")
       new_instance_secret="${instance}-certs"
 
-      if [[ -n "$old_instance_secret" && "$old_instance_secret" != "$new_instance_secret" ]]; then
-        old_instance_secret="$old_instance_secret" new_instance_secret="$new_instance_secret" yq eval \
-          '.items[] | select(.metadata.name == strenv(old_instance_secret)) | .metadata.name = strenv(new_instance_secret)' \
-          "$TEMP_DIR/tls-secrets.yaml" \
-          | kubectl -n "$NAMESPACE" apply -f -
-      fi
+      instance="$instance" new_instance_secret="$new_instance_secret" yq eval \
+        '.items[] | select(.metadata.name | test("-certs$")) |
+          .metadata.name = strenv(new_instance_secret) |
+          .metadata.labels."postgres-operator.crunchydata.com/instance" = strenv(instance)' \
+        "$TEMP_DIR/tls-secrets.yaml" \
+        | kubectl -n "$NAMESPACE" apply -f -

internal/controller/postgrescluster/instance.go

@@ -1491,7 +1491,12 @@ func (r *Reconciler) reconcileInstanceCertificates(
 	if cluster.Spec.CustomTLSSecret == nil {
 		if cluster.Spec.TLS.GetCertManagementPolicy() == v1beta1.CertManagementUserProvidedOnly {
 			existing := &corev1.Secret{ObjectMeta: naming.InstanceCertificates(instance)}
-			if err := r.Client.Get(ctx, client.ObjectKeyFromObject(existing), existing); err != nil {
+			// Allow the StatefulSet to be created so its generated name is visible
+			// to the user. The next reconciliation checks its certificate Secret
+			// and pauses until the user provides it.
+			if err := client.IgnoreNotFound(
+				r.Client.Get(ctx, client.ObjectKeyFromObject(existing), existing),
+			); err != nil {
 				return nil, errors.Wrapf(err, "get user-provided instance TLS secret %s", existing.Name)
 			}
 			return existing, nil

internal/controller/postgrescluster/pki.go

@@ -324,7 +324,7 @@ func (r *Reconciler) reconcileClusterCertificate(
 		return cluster.Spec.CustomTLSSecret, nil
 	}
 
-	if cluster.Spec.TLS.CertManagementPolicy == v1beta1.CertManagementUserProvidedOnly {
+	if cluster.Spec.TLS.GetCertManagementPolicy() == v1beta1.CertManagementUserProvidedOnly {
 		return r.reconcileUserProvidedClusterCertificate(ctx, cluster)
 	}
 	certManagerManaged, err := r.isRootCACertManagerManaged(ctx, cluster)