K8SPG-951: [WIP] add spec.issuerConf#1684
Draft
mayankshah1607 wants to merge 2 commits into
Draft
Conversation
Signed-off-by: Mayank Shah <mayank.shah@percona.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Adds spec.tls.issuerConf to the PostgresCluster API to support multiple cert-manager issuer modes (managed namespaced Issuer, managed cluster-scoped ClusterIssuer, and external/third-party issuers), and updates reconciliation logic so leaf certificates can reference the resolved issuerRef. The PR also adjusts controller-runtime client caching to allow direct API-server Get on ClusterIssuers without requiring cluster-wide list/watch RBAC, and adds tests covering the new behaviors.
Changes:
- Introduce
spec.tls.issuerConf(CRD + Go types + deepcopy) to configure issuer references. - Implement issuer-mode resolution and apply logic for Issuer/ClusterIssuer/external issuers, plus CA handling fallbacks for external issuers.
- Disable controller-runtime cache for
cert-manager.io/v1 ClusterIssuerand add/extend unit tests.
Reviewed changes
Copilot reviewed 19 out of 21 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/apis/upstream.pgv2.percona.com/v1beta1/zz_generated.deepcopy.go | Deepcopy updates for the new TLSSpec.IssuerConf field. |
| pkg/apis/upstream.pgv2.percona.com/v1beta1/postgrescluster_types.go | Adds TLSSpec.IssuerConf to the API type. |
| percona/runtime/runtime.go | Disables informer cache for ClusterIssuer via ClientCacheOptions() and applies it to managers. |
| percona/runtime/runtime_test.go | Adds tests around cache options / manager creation. |
| percona/certmanager/certmanager.go | Implements issuer modes, issuerRef resolution, and managed/external behaviors across Apply* methods. |
| percona/certmanager/certmanager_test.go | Adds/extends tests for issuer modes, namespace resolution, drift updates, and external issuer behavior. |
| internal/naming/names.go | Adds naming helpers for cluster-scoped CA issuer/secret. |
| internal/naming/names_test.go | Tests for the new naming helpers. |
| internal/controller/postgrescluster/pki.go | Makes PKI reconciliation issuer-mode aware, including managed-cluster secret locations and external mode handling. |
| internal/controller/postgrescluster/pki_test.go | Adds issuer-mode awareness tests (with envtest/fake-client workarounds). |
| internal/controller/postgrescluster/pgbackrest.go | Adds CA selection helper for pgBackRest when using external issuers (no operator root CA). |
| internal/controller/postgrescluster/pgbackrest_test.go | Unit tests for pgBackRestCACert. |
| internal/controller/postgrescluster/instance.go | Adds CA selection helper for instance cert embedding when using external issuers. |
| internal/controller/postgrescluster/instance_test.go | Unit tests for instanceCACert. |
| internal/controller/postgrescluster/controller.go | Ensures cert-manager watch registration logic runs even when rootCA is nil (external mode). |
| deploy/cw-bundle.yaml | CRD schema update for spec.tls.issuerConf. |
| deploy/crd.yaml | CRD schema update for spec.tls.issuerConf. |
| deploy/bundle.yaml | CRD schema update for spec.tls.issuerConf. |
| config/crd/bases/upstream.pgv2.percona.com_postgresclusters.yaml | Base CRD schema update for spec.tls.issuerConf. |
| config/crd/bases/pgv2.percona.com_perconapgclusters.yaml | Base CRD schema update for spec.tls.issuerConf. |
| build/crd/percona/generated/pgv2.percona.com_perconapgclusters.yaml | Generated CRD schema update for spec.tls.issuerConf. |
Files not reviewed (1)
- pkg/apis/upstream.pgv2.percona.com/v1beta1/zz_generated.deepcopy.go: Generated file
Comment on lines
+234
to
+237
| if mode == IssuerModeManagedCluster { | ||
| caSecretName := naming.ClusterCACertSecret(cluster, CertManagerNamespace()).Name | ||
| meta := metav1.ObjectMeta{Name: issuerRef(cluster, mode).Name} | ||
|
|
Comment on lines
+111
to
+116
| case v1.ClusterIssuerKind: | ||
| existing := &v1.ClusterIssuer{} | ||
| err := cl.Get(ctx, types.NamespacedName{Name: ic.Name}, existing) | ||
| switch { | ||
| case err == nil, k8serrors.IsNotFound(err): | ||
| return IssuerModeManagedCluster, nil |
Comment on lines
+145
to
+146
| case IssuerModeManagedCluster: | ||
| return cmmeta.IssuerReference{Name: issuerConf(cluster).Name, Kind: v1.ClusterIssuerKind} |
Comment on lines
+147
to
+152
| default: | ||
| name := naming.TLSIssuer(cluster).Name | ||
| if ic := issuerConf(cluster); ic != nil && ic.Name != "" { | ||
| name = ic.Name | ||
| } | ||
| return cmmeta.IssuerReference{Name: name, Kind: v1.IssuerKind} |
Comment on lines
+16
to
+26
| func TestCreateRuntimeManagerDisablesClusterIssuerCache(t *testing.T) { | ||
| t.Setenv("WATCH_NAMESPACE", "") | ||
|
|
||
| scheme := runtime.NewScheme() | ||
| _ = cmv1.AddToScheme(scheme) | ||
|
|
||
| opts := manager.Options{Scheme: scheme} | ||
| mgr, err := CreateRuntimeManager(&rest.Config{Host: "https://127.0.0.1:1"}, feature.NewGate(), opts) | ||
| require.NoError(t, err) | ||
| require.NotNil(t, mgr) | ||
| } |
Comment on lines
+234
to
+236
| // K8SPG-951 | ||
| // +optional | ||
| IssuerConf *cmmeta.IssuerReference `json:"issuerConf,omitempty"` |
Collaborator
commit: 187c2f8 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CHANGE DESCRIPTION
Problem:
Short explanation of the problem.
Cause:
Short explanation of the root cause of the issue if applicable.
Solution:
Short explanation of the solution we are providing with this PR.
CHECKLIST
Jira
Needs Doc) and QA (Needs QA)?Tests
Config/Logging/Testability