K8SPG-951: add spec.issuerConf by mayankshah1607 · Pull Request #1684 · percona/percona-postgresql-operator

mayankshah1607 · 2026-07-14T10:17:50Z

CHANGE DESCRIPTION

Problem:

Adds support for specifying cert-manager issuer conf:

apiVersion: pgv2.percona.com/v2
kind: PerconaPGCluster
metadata:
  name: cluster1
spec:
  tls:
    issuerConf:
      name: some-selfsigned-issuer
      kind: ClusterIssuer
      group: cert-manager.io

CHECKLIST

Jira

Is the Jira ticket created and referenced properly?
Does the Jira ticket have the proper statuses for documentation (Needs Doc) and QA (Needs QA)?
Does the Jira ticket link to the proper milestone (Fix Version field)?

Tests

Is an E2E test/test case added for the new feature/change?
Are unit tests added where appropriate?

Config/Logging/Testability

Are all needed new/changed options added to default YAML files?
Are all needed new/changed options added to the Helm Chart?
Did we add proper logging messages for operator actions?
Did we ensure compatibility with the previous version or cluster upgrade process?
Does the change support oldest and newest supported PG version?
Does the change support oldest and newest supported Kubernetes version?

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

Copilot

Pull request overview

Adds spec.tls.issuerConf to the PostgresCluster API to support multiple cert-manager issuer modes (managed namespaced Issuer, managed cluster-scoped ClusterIssuer, and external/third-party issuers), and updates reconciliation logic so leaf certificates can reference the resolved issuerRef. The PR also adjusts controller-runtime client caching to allow direct API-server Get on ClusterIssuers without requiring cluster-wide list/watch RBAC, and adds tests covering the new behaviors.

Changes:

Introduce spec.tls.issuerConf (CRD + Go types + deepcopy) to configure issuer references.
Implement issuer-mode resolution and apply logic for Issuer/ClusterIssuer/external issuers, plus CA handling fallbacks for external issuers.
Disable controller-runtime cache for cert-manager.io/v1 ClusterIssuer and add/extend unit tests.

Reviewed changes

Copilot reviewed 19 out of 21 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
pkg/apis/upstream.pgv2.percona.com/v1beta1/zz_generated.deepcopy.go	Deepcopy updates for the new `TLSSpec.IssuerConf` field.
pkg/apis/upstream.pgv2.percona.com/v1beta1/postgrescluster_types.go	Adds `TLSSpec.IssuerConf` to the API type.
percona/runtime/runtime.go	Disables informer cache for ClusterIssuer via `ClientCacheOptions()` and applies it to managers.
percona/runtime/runtime_test.go	Adds tests around cache options / manager creation.
percona/certmanager/certmanager.go	Implements issuer modes, issuerRef resolution, and managed/external behaviors across Apply* methods.
percona/certmanager/certmanager_test.go	Adds/extends tests for issuer modes, namespace resolution, drift updates, and external issuer behavior.
internal/naming/names.go	Adds naming helpers for cluster-scoped CA issuer/secret.
internal/naming/names_test.go	Tests for the new naming helpers.
internal/controller/postgrescluster/pki.go	Makes PKI reconciliation issuer-mode aware, including managed-cluster secret locations and external mode handling.
internal/controller/postgrescluster/pki_test.go	Adds issuer-mode awareness tests (with envtest/fake-client workarounds).
internal/controller/postgrescluster/pgbackrest.go	Adds CA selection helper for pgBackRest when using external issuers (no operator root CA).
internal/controller/postgrescluster/pgbackrest_test.go	Unit tests for `pgBackRestCACert`.
internal/controller/postgrescluster/instance.go	Adds CA selection helper for instance cert embedding when using external issuers.
internal/controller/postgrescluster/instance_test.go	Unit tests for `instanceCACert`.
internal/controller/postgrescluster/controller.go	Ensures cert-manager watch registration logic runs even when rootCA is nil (external mode).
deploy/cw-bundle.yaml	CRD schema update for `spec.tls.issuerConf`.
deploy/crd.yaml	CRD schema update for `spec.tls.issuerConf`.
deploy/bundle.yaml	CRD schema update for `spec.tls.issuerConf`.
config/crd/bases/upstream.pgv2.percona.com_postgresclusters.yaml	Base CRD schema update for `spec.tls.issuerConf`.
config/crd/bases/pgv2.percona.com_perconapgclusters.yaml	Base CRD schema update for `spec.tls.issuerConf`.
build/crd/percona/generated/pgv2.percona.com_perconapgclusters.yaml	Generated CRD schema update for `spec.tls.issuerConf`.

Files not reviewed (1)

pkg/apis/upstream.pgv2.percona.com/v1beta1/zz_generated.deepcopy.go: Generated file

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

Copilot

Pull request overview

Copilot reviewed 26 out of 28 changed files in this pull request and generated 3 comments.

Files not reviewed (1)

pkg/apis/upstream.pgv2.percona.com/v1beta1/zz_generated.deepcopy.go: Generated file

 	if err == nil {
 		needsUpdate := false

-		hasOwnerRef, err := controllerutil.HasOwnerReference(existing.OwnerReferences, cluster, c.scheme)
-		if err != nil {
-			return errors.Wrap(err, "check owner reference")
-		}
-
-		if !hasOwnerRef {
-			gvk := v1beta1.SchemeBuilder.GroupVersion.WithKind("PostgresCluster")
-			existing.OwnerReferences = []metav1.OwnerReference{{
-				APIVersion:         gvk.GroupVersion().String(),
-				Kind:               gvk.Kind,
-				Name:               cluster.GetName(),
-				UID:                cluster.GetUID(),
-				BlockOwnerDeletion: ptr.To(true),
-				Controller:         ptr.To(true),
-			}}
-			needsUpdate = true
+		if !clusterScoped {
+			hasOwnerRef, err := controllerutil.HasOwnerReference(existing.OwnerReferences, cluster, c.scheme)


Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

egegunes · 2026-07-20T05:20:55Z

+	if rootCA != nil {
+		caCert, err := rootCA.Certificate.MarshalText()
+		return caCert, errors.Wrap(err, "failed to marshal root CA certificate")
+	}
+
+	if ca := clientSecret.Data[corev1.ServiceAccountRootCAKey]; len(ca) > 0 {
+		return ca, nil
+	}
+	if ca := repoSecret.Data[corev1.ServiceAccountRootCAKey]; len(ca) > 0 {
+		return ca, nil
+	}
+
+	return nil, errors.New("external issuer did not return a CA certificate for pgBackRest")


why do we need these kind of fallbacks here and in instance.go? i'd expect rootCA to be passed properly by the CA issued by ClusterIssuer

rootCA can be nil in case of external issuers or ClusterIssuer that are not managed by the operator (missing RBAC, created externally).. So in this case we just try to look at the issued leaf cert and get the ca.crt from there

wouldn't it be better to stop reconciliation on a upper level if rootCA is nil rather than this fallback logic?

If we return early, how would we know the root CA then? This fallback exists so that the root CA can be inferred from the externally issued leaf certs. Am I missing something?

maybe i am missing something.

so we have a separate certificate+secret for root CA. for some reason it's nil which means we don't know if it exists. in this case we try to detect the CA from leaf certificates even though we don't have a way to reliably know if those certs are signed by the expected root CA.

rootCA can be nil in case of external issuers or ClusterIssuer that are not managed by the operator (missing RBAC, created externally)..

maybe i don't really understand this scenario:

if this is a misconfigured Issuer/ClusterIssuer scenario, i don't think we need to continue reconciliation.

if this is inherent to any kind of custom Issuer/ClusterIssuer, i'm confused because i don't remember this in the implementations in K8SPSMDB and K8SPS

Ok, I'll try to explain from the top:

This reconcileCertManagerPGBackrestSecret (where this function is called) is responsible for reconciling an internal pgBackRest Secret for its internal TLS (represented by the intent parameter). Among other things, one thing it needs is the rootCA. That can be obtained in 2 ways:

When the rootCA is managed by the operator: that can be Issuer, ClusterIssuer (if RBAC is present) or even Custom Secret (not via cert-manager). In this case rootCA is never nil. If it is, the reconciliation is halted at reconcileRootCertificate itself.

When the rootCA not managed by the operator: this is the case when issuer type is some external issuer (or RBAC for ClusterIssuer is missing). In this case, operator has no idea what rootCA is, and hence it is nil (note this isn't actually an error state). But we need CA cert for pgBackRest, so it just reads the ca.crt from the leaf cert issued by the external issuer. If the external issuer itself was misconfigured, then the leaf cert will be missing (error on line 2305 and 2312) or if ca.crt is missing in both (error in line 2351)

So with this context, to answer your questions:

if this is a misconfigured Issuer/ClusterIssuer scenario, i don't think we need to continue reconciliation.

We won't reconcile, appropriate errors are thrown when the required certs are missing as I explained above

if this is inherent to any kind of custom Issuer/ClusterIssuer, i'm confused because i don't remember this in the implementations in K8SPSMDB and K8SPS

We don't have this kind of Secret reconciliation (internal pgBackRest Secret) in either operators, so this approach is unique, but the overall behaviour is still consistent with both operators

ok I see reconcileRootCertificate returns (nil, nil) if issuer is external. what's the practical difference between issuer/clusterIssuer managed by the operator and created externally?

what's the practical difference between issuer/clusterIssuer managed by the operator and created externally?

Operator managed is always self-signed, whereas externally created can be anything (ACME, Vault, any in-tree types, or an external type which is a different CR. We won't always have a rootCA Secret in this case)

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

JNKPercona · 2026-07-23T13:09:38Z

Test Name	Result	Time
backup-enable-disable	passed	00:00:00
builtin-extensions	passed	00:00:00
cert-manager-tls	failure	00:07:20
custom-envs	passed	00:00:00
custom-tls	passed	00:00:00
database-init-sql	passed	00:00:00
demand-backup	passed	00:00:00
demand-backup-offline-snapshot	passed	00:00:00
dynamic-configuration	passed	00:00:00
finalizers	passed	00:00:00
init-deploy	passed	00:03:48
huge-pages	passed	00:00:00
major-upgrade-14-to-15	passed	00:00:00
major-upgrade-15-to-16	passed	00:00:00
major-upgrade-16-to-17	passed	00:00:00
major-upgrade-17-to-18	passed	00:00:00
ldap	passed	00:00:00
ldap-tls	passed	00:00:00
monitoring	passed	00:00:00
monitoring-pmm3	passed	00:00:00
one-pod	passed	00:00:00
operator-self-healing	passed	00:00:00
pgbouncer-mtls	passed	00:00:00
pitr	passed	00:00:00
scaling	passed	00:00:00
scheduled-backup	passed	00:32:14
self-healing	passed	00:00:00
sidecars	passed	00:00:00
standby-pgbackrest	passed	00:00:00
standby-streaming	passed	00:00:00
start-from-backup	passed	00:00:00
tablespaces	passed	00:00:00
telemetry-transfer	passed	00:00:00
upgrade-consistency	passed	00:00:00
upgrade-minor	passed	00:00:00
users	passed	00:00:00
migration-from-crunchy-standby	passed	00:00:00
migration-from-crunchy-pv	passed	00:00:00
migration-from-crunchy-backup-restore	passed	00:00:00

Summary	Value
Tests Run	39/39
Job Duration	00:50:18
Total Test Time	00:43:22

commit: 1112177
image: perconalab/percona-postgresql-operator:PR-1684-11121776e

mayankshah1607 added 2 commits July 13, 2026 16:43

added spec.issuerConf to CRD

7f9450b

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

wip

187c2f8

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

mayankshah1607 requested a review from Copilot July 14, 2026 10:21

Copilot started reviewing on behalf of mayankshah1607 July 14, 2026 10:22 View session

Copilot AI reviewed Jul 14, 2026

View reviewed changes

mayankshah1607 and others added 11 commits July 15, 2026 12:40

Merge branch 'main' into K8SPG-951-issuer-conf

482d0c3

cleanup

e347f11

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

use issuer name for secret name

6e5dcbd

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

trim down unnecessary comments

abe1790

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

improve ResolveIssuerMode by checking labels

9d97033

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

add groupName in issuerRef

8c941e7

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

remove unnecessary test

a19b878

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

updated cr.yaml

c7f2e5b

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

remove unnecessarily verbose comments

f544698

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

update e2e test

cbf3959

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

linting

d123e94

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

mayankshah1607 requested a review from Copilot July 15, 2026 10:28

Copilot started reviewing on behalf of mayankshah1607 July 15, 2026 10:29 View session

Copilot AI reviewed Jul 15, 2026

View reviewed changes

mayankshah1607 and others added 7 commits July 15, 2026 16:06

Potential fix for pull request finding

4e0ff68

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

fix scheme ordering

63b3e41

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

unit test fix

491a4d0

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

Merge branch 'main' into K8SPG-951-issuer-conf

bedf9c4

Merge branch 'main' into K8SPG-951-issuer-conf

42ca64e

fix panic

f2dc250

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

e2e test fixes

ec13aa1

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

mayankshah1607 marked this pull request as ready for review July 17, 2026 14:19

mayankshah1607 requested review from eleo007, jvpasinatto and valmiranogueira as code owners July 17, 2026 14:19

mayankshah1607 requested review from DhruthiKV, egegunes, gkech, hors, nmarukovich, oksana-grishchenko and pooknull as code owners July 17, 2026 14:19

Merge branch 'main' into K8SPG-951-issuer-conf

8ce02eb

mayankshah1607 changed the title ~~K8SPG-951: [WIP] add spec.issuerConf~~ K8SPG-951: add spec.issuerConf Jul 20, 2026

egegunes reviewed Jul 20, 2026

View reviewed changes

mayankshah1607 requested a review from egegunes July 20, 2026 07:35

Merge branch 'main' into K8SPG-951-issuer-conf

5edf149

mayankshah1607 added this to the v3.1.0 milestone Jul 22, 2026

oksana-grishchenko reviewed Jul 22, 2026

View reviewed changes

Comment thread pkg/apis/upstream.pgv2.percona.com/v1beta1/postgrescluster_types.go Outdated

Comment thread internal/naming/names.go Outdated

Comment thread build/crd/percona/generated/pgv2.percona.com_perconapgclusters.yaml Outdated

mayankshah1607 and others added 2 commits July 23, 2026 14:54

Merge branch 'main' into K8SPG-951-issuer-conf

f304d27

remove ticket references

1112177

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

mayankshah1607 requested a review from oksana-grishchenko July 23, 2026 09:25

Uh oh!

Conversation

mayankshah1607 commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CHANGE DESCRIPTION

CHECKLIST

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

egegunes Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

mayankshah1607 Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

egegunes Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

mayankshah1607 Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

egegunes Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

mayankshah1607 Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

egegunes Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

mayankshah1607 Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

JNKPercona commented Jul 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

mayankshah1607 commented Jul 14, 2026 •

edited

Loading

mayankshah1607 Jul 20, 2026 •

edited

Loading

mayankshah1607 Jul 22, 2026 •

edited

Loading

mayankshah1607 Jul 22, 2026 •

edited

Loading