Add CRD to control DISABLE/ENABLE automatic creation of SSL-certificate of Operator or CertManager.

[sunguck]

Proposal

Operator will create SSL-Certificate when there's no user-provided SSL Certificate.
https://github.com/percona/percona-server-mongodb-operator/blob/v1.18.0/pkg/controller/perconaservermongodb/ssl.go#L84-L101

But, sometimes we may lost AWS Secret which provides SSL certificates like following situations.

• Lost access privileges during EKS upgrade (sometimes) or other maintnance task
• Delete AWS Secret user's operation faults
• ...

At this time, Operator creates Manual-certificate or CertManger's automatic certificates and restart all mongodb pods to apply new certificates. and then application can not access mongodb because CA certificate is not matched.
Usually Operator manages a lots of mongodb clusters, this side-effect affect too many mongodb clusters.
I think this is too risky to use production mongodb cluster. And user-secret too (because we manage users and ssl & sslInternal via AWS secret)

So I suggest that CRD support property to control ENABLE or DISABLE CREATING NEW SSL CERTIFICATE AUTOMATICALLY.

Use-Case

Even if operator can not fetch AWS secret,
Operator will not deploy newly auto-created ssl and remain previous user-created SSL.

So applicaitons can access mongodb server.
And after found issues DBA manage operator can access AWS secret without any service issues.

Is this a feature you are interested in implementing yourself?

Maybe

Anything else?

Thanks for percona-server-mongodb-operator.

[hors]

@sunguck We are open to this feature. Do you have any plans to create PR? We are ready to support you.

[hors]

@sunguck I have created the Jira task https://perconadev.atlassian.net/browse/K8SPSMDB-1457 to implement it

[myJamong]

Hi @hors ,

I work closely with @sunguck , who originally created this issue. I was wondering if you're currently working on this task or have any plans to make changes to the code?

If there hasn't been any particular progress on this yet, would it be okay for us to go ahead and sumit a PR for review?

CC: @conan912

[egegunes]

Hi @myJamong, that task is scheduled for the next release but we haven't started working on it yet. Since we work on other operator releases right now, there are some time until we start working on v1.23.0 release for PSMDB operator. Feel free to submit a PR.