K8SPSMDB-1457: add certManagementPolicy option#2266
Open
myJamong wants to merge 12 commits intopercona:mainfrom
Open
K8SPSMDB-1457: add certManagementPolicy option#2266myJamong wants to merge 12 commits intopercona:mainfrom
myJamong wants to merge 12 commits intopercona:mainfrom
Conversation
myJamong
requested review from
egegunes,
eleo007,
gkech,
hors,
jvpasinatto,
mayankshah1607,
nmarukovich,
oksana-grishchenko,
pooknull and
valmiranogueira
as code owners
|
|
Author
|
One consideration is whether to add a guardrail that blocks the userProvidedOnly → auto switch when SSL secrets are missing. However, this might not be the right approach because:
What do you think? Would it be better to add a validation/warning at the operator level, or is documenting this behavior sufficient? |
Contributor
I think this is auto doing its job. I don't think we need to add logic into operator for additional guardrails. |
Author
egegunes
changed the title
myJamong
force-pushed
the
K8SPSMDB-1457-add-certManagementPolicy-option
branch
from
306d678 to
65bc7a8
Compare
Author
|
just changed the commit author on force push |
…s userProviededOnly
… userProvieded Only policy
… TLS secret is missing
egegunes
requested changes
Mar 9, 2026
Comment on lines
+1639
to
+1644
| cr.Status.AddCondition(api.ClusterCondition{ | ||
| Status: api.ConditionTrue, | ||
| Type: api.ConditionTypeTLSSecretMissing, | ||
| Reason: "TLSSecretNotFound", | ||
| Message: fmt.Sprintf("TLS secret %s is missing, certManagementPolicy is userProvidedOnly", api.SSLSecretName(cr)), | ||
| }) |
Contributor
There was a problem hiding this comment.
@myJamong I think rather than having a negative condition type and a positive status, we should have a positive type and negative status. for example:
cr.Status.AddCondition(api.ClusterCondition{
Status: api.ConditionFalse,
Type: api.ConditionTypeTLSSecretsReady,
Reason: "TLSSecretNotFound",
Message: fmt.Sprintf("TLS secret %s is missing, certManagementPolicy is userProvidedOnly", api.SSLSecretName(cr)),
})
Author
There was a problem hiding this comment.
Changed - 4968ab6
Renamed TLSSecretMissing to TLSSecretsReady with positive type and negative status and updated all references including unit tests and e2e tests.
Collaborator
commit: f9fc556 |
egegunes
approved these changes
Mar 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CHANGE DESCRIPTION
Problem:
The Percona Server for MongoDB Operator automatically generates a new SSL certificate when it cannot find a user-provided secret. In scenarios where the user-provided secret is temporarily lost (e.g., EKS upgrade, External Secrets controller failure, operational mistake), the operator creates a new self-signed certificate with a different CA. This triggers a rolling restart of all MongoDB pods, causing client applications that rely on the original CA certificate to lose connectivity — leading to a severe and unexpected service outage.
Cause:
In reconcileSSL(), the operator cannot distinguish between "the secret was never created" and "the secret existed but was lost." When a user-provided secret is missing, the operator falls through to the automatic certificate creation logic (createSSLManually or createSSLByCertManager), regardless of whether the user intended to manage certificates externally.
Solution:
Added a new configurable field spec.tls.certManagementPolicy to the CRD with two possible values:
This puts control back into the hands of the user, preventing unintended certificate regeneration and pod restarts in production environments.
Relates to: #1758
CHECKLIST
Jira
Needs Doc) and QA (Needs QA)?Tests
compare/*-oc.yml)?Config/Logging/Testability