Skip to content

Commit fbf00bc

Browse files
lake-yoolake-yoo
committed
add certManagerPolicy option
1 parent 329f997 commit fbf00bc

7 files changed

Lines changed: 190 additions & 0 deletions

File tree

‎config/crd/bases/psmdb.percona.com_perconaservermongodbs.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25413,6 +25413,12 @@ spec:
2541325413
properties:
2541425414
allowInvalidCertificates:
2541525415
type: boolean
25416+
certManagementPolicy:
25417+
default: auto
25418+
enum:
25419+
- auto
25420+
- userProvidedOnly
25421+
type: string
2541625422
certValidityDuration:
2541725423
type: string
2541825424
issuerConf:

‎deploy/cr.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ spec:
2828
# # 90 days in hours
2929
# certValidityDuration: 2160h
3030
# allowInvalidCertificates: true
31+
# certManagementPolicy: auto
3132
# issuerConf:
3233
# name: special-selfsigned-issuer
3334
# kind: ClusterIssuer

‎e2e-tests/cert-management-policy/conf/some-name-auto.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
apiVersion: psmdb.percona.com/v1
2+
kind: PerconaServerMongoDB
3+
metadata:
4+
name: some-name
5+
spec:
6+
image:
7+
imagePullPolicy: Always
8+
updateStrategy: SmartUpdate
9+
tls:
10+
certManagementPolicy: auto
11+
backup:
12+
enabled: false
13+
replsets:
14+
- name: rs0
15+
affinity:
16+
antiAffinityTopologyKey: none
17+
resources:
18+
limits:
19+
cpu: 500m
20+
memory: 1G
21+
requests:
22+
cpu: 100m
23+
memory: 0.1G
24+
volumeSpec:
25+
persistentVolumeClaim:
26+
resources:
27+
requests:
28+
storage: 1Gi
29+
expose:
30+
enabled: false
31+
type: ClusterIP
32+
size: 3
33+
secrets:
34+
users: some-users

‎e2e-tests/cert-management-policy/conf/some-name.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
apiVersion: psmdb.percona.com/v1
2+
kind: PerconaServerMongoDB
3+
metadata:
4+
name: some-name
5+
spec:
6+
image:
7+
imagePullPolicy: Always
8+
updateStrategy: SmartUpdate
9+
tls:
10+
certManagementPolicy: userProvidedOnly
11+
backup:
12+
enabled: false
13+
replsets:
14+
- name: rs0
15+
affinity:
16+
antiAffinityTopologyKey: none
17+
resources:
18+
limits:
19+
cpu: 500m
20+
memory: 1G
21+
requests:
22+
cpu: 100m
23+
memory: 0.1G
24+
volumeSpec:
25+
persistentVolumeClaim:
26+
resources:
27+
requests:
28+
storage: 1Gi
29+
expose:
30+
enabled: false
31+
type: ClusterIP
32+
size: 3
33+
secrets:
34+
users: some-users

‎e2e-tests/cert-management-policy/run‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
#!/bin/bash
2+
3+
set -o errexit
4+
5+
test_dir="$(realpath "$(dirname "$0")")"
6+
. "${test_dir}/../functions"
7+
set_debug
8+
9+
cluster="some-name"
10+
11+
test_user_provided_only() {
12+
desc '=== Test: certManagementPolicy: userProvidedOnly ==='
13+
14+
desc 'create secrets (users + TLS)'
15+
kubectl_bin apply -f "$conf_dir/secrets_with_tls.yml"
16+
17+
desc "create PSMDB cluster $cluster with certManagementPolicy: userProvidedOnly"
18+
apply_cluster "$test_dir/conf/$cluster.yml"
19+
20+
desc 'check if all Pods started'
21+
wait_for_running $cluster-rs0 3
22+
23+
desc 'save SSL secrets for later restore'
24+
kubectl_bin get secret ${cluster}-ssl -o yaml >"$tmp_dir/ssl_backup.yaml"
25+
kubectl_bin get secret ${cluster}-ssl-internal -o yaml >"$tmp_dir/ssl_internal_backup.yaml"
26+
27+
desc 'delete SSL secrets to simulate secret loss'
28+
kubectl_bin delete secret ${cluster}-ssl ${cluster}-ssl-internal
29+
30+
desc 'wait for a few reconcile loops'
31+
sleep 30
32+
33+
desc 'verify operator did NOT recreate SSL secrets'
34+
if kubectl_bin get secret ${cluster}-ssl 2>/dev/null; then
35+
echo "FAIL: operator recreated SSL secret when certManagementPolicy is userProvidedOnly"
36+
exit 1
37+
fi
38+
if kubectl_bin get secret ${cluster}-ssl-internal 2>/dev/null; then
39+
echo "FAIL: operator recreated SSL internal secret when certManagementPolicy is userProvidedOnly"
40+
exit 1
41+
fi
42+
echo "PASS: operator did not recreate SSL secrets"
43+
44+
desc 'verify pods are still running (no restart)'
45+
wait_for_running $cluster-rs0 3
46+
47+
desc 'restore SSL secrets'
48+
kubectl_bin apply -f "$tmp_dir/ssl_backup.yaml"
49+
kubectl_bin apply -f "$tmp_dir/ssl_internal_backup.yaml"
50+
51+
desc 'verify cluster is still healthy after secret restore'
52+
sleep 10
53+
wait_for_running $cluster-rs0 3
54+
55+
desc 'cleanup cluster'
56+
kubectl_bin delete psmdb $cluster
57+
wait_for_delete psmdb/$cluster 180
58+
}
59+
60+
test_auto() {
61+
desc '=== Test: certManagementPolicy: auto ==='
62+
63+
desc 'create only user secrets (no TLS secrets)'
64+
kubectl_bin apply -f "$conf_dir/secrets.yml"
65+
66+
desc "create PSMDB cluster $cluster with certManagementPolicy: auto"
67+
apply_cluster "$test_dir/conf/$cluster-auto.yml"
68+
69+
desc 'wait for operator to auto-create SSL secrets'
70+
sleep 30
71+
72+
desc 'verify operator created SSL secrets automatically'
73+
if ! kubectl_bin get secret ${cluster}-ssl 2>/dev/null; then
74+
echo "FAIL: operator did not create SSL secret when certManagementPolicy is auto"
75+
exit 1
76+
fi
77+
if ! kubectl_bin get secret ${cluster}-ssl-internal 2>/dev/null; then
78+
echo "FAIL: operator did not create SSL internal secret when certManagementPolicy is auto"
79+
exit 1
80+
fi
81+
echo "PASS: operator created SSL secrets automatically"
82+
83+
desc 'check if all Pods started'
84+
wait_for_running $cluster-rs0 3
85+
}
86+
87+
main() {
88+
create_infra "$namespace"
89+
destroy_cert_manager || true
90+
91+
test_user_provided_only
92+
test_auto
93+
94+
destroy "$namespace"
95+
96+
desc 'test passed'
97+
}
98+
99+
main

‎pkg/apis/psmdb/v1/psmdb_types.go‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -177,11 +177,21 @@ const (
177177
TLSModeRequire TLSMode = "requireTLS"
178178
)
179179

180+
type CertManagementPolicy string
181+
182+
const (
183+
CertManagementAuto CertManagementPolicy = "auto"
184+
CertManagementUserProvidedOnly CertManagementPolicy = "userProvidedOnly"
185+
)
186+
180187
type TLSSpec struct {
181188
Mode TLSMode `json:"mode,omitempty"`
182189
AllowInvalidCertificates *bool `json:"allowInvalidCertificates,omitempty"`
183190
CertValidityDuration metav1.Duration `json:"certValidityDuration,omitempty"`
184191
IssuerConf *cmmeta.ObjectReference `json:"issuerConf,omitempty"`
192+
// +kubebuilder:default=auto
193+
// +kubebuilder:validation:Enum={auto,userProvidedOnly}
194+
CertManagementPolicy CertManagementPolicy `json:"certManagementPolicy,omitempty"`
185195
}
186196

187197
func (spec *PerconaServerMongoDBSpec) Replset(name string) *ReplsetSpec {

‎pkg/controller/perconaservermongodb/ssl.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,12 @@ func (r *ReconcilePerconaServerMongoDB) reconcileSSL(ctx context.Context, cr *ap
6262
return nil
6363
}
6464

65+
// If certManagementPolicy is userProvidedOnly, the operator should not create any certificates automatically.
66+
if cr.Spec.TLS != nil && cr.Spec.TLS.CertManagementPolicy == api.CertManagementUserProvidedOnly {
67+
logf.FromContext(ctx).Info("certManagementPolicy is userProvidedOnly, skipping automatic certificate management")
68+
return nil
69+
}
70+
6571
if k8serr.IsNotFound(errSecret) && errInternalSecret == nil && isCustomSecretInternal {
6672
// If the user has only created an internal secret, we should create a copy of it as a non-internal secret.
6773
newSecret := secretInternalObj.DeepCopy()

0 commit comments

Comments
 (0)