K8SPG-951: add spec.issuerConf by mayankshah1607 · Pull Request #1684 · percona/percona-postgresql-operator

mayankshah1607 · 2026-07-14T10:17:50Z

CHANGE DESCRIPTION

Problem:

Adds support for specifying cert-manager issuer conf:

apiVersion: pgv2.percona.com/v2
kind: PerconaPGCluster
metadata:
  name: cluster1
spec:
  tls:
    issuerConf:
      name: some-selfsigned-issuer
      kind: ClusterIssuer
      group: cert-manager.io

CHECKLIST

Jira

Is the Jira ticket created and referenced properly?
Does the Jira ticket have the proper statuses for documentation (Needs Doc) and QA (Needs QA)?
Does the Jira ticket link to the proper milestone (Fix Version field)?

Tests

Is an E2E test/test case added for the new feature/change?
Are unit tests added where appropriate?

Config/Logging/Testability

Are all needed new/changed options added to default YAML files?
Are all needed new/changed options added to the Helm Chart?
Did we add proper logging messages for operator actions?
Did we ensure compatibility with the previous version or cluster upgrade process?
Does the change support oldest and newest supported PG version?
Does the change support oldest and newest supported Kubernetes version?

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

Copilot

Pull request overview

Adds spec.tls.issuerConf to the PostgresCluster API to support multiple cert-manager issuer modes (managed namespaced Issuer, managed cluster-scoped ClusterIssuer, and external/third-party issuers), and updates reconciliation logic so leaf certificates can reference the resolved issuerRef. The PR also adjusts controller-runtime client caching to allow direct API-server Get on ClusterIssuers without requiring cluster-wide list/watch RBAC, and adds tests covering the new behaviors.

Changes:

Introduce spec.tls.issuerConf (CRD + Go types + deepcopy) to configure issuer references.
Implement issuer-mode resolution and apply logic for Issuer/ClusterIssuer/external issuers, plus CA handling fallbacks for external issuers.
Disable controller-runtime cache for cert-manager.io/v1 ClusterIssuer and add/extend unit tests.

Reviewed changes

Copilot reviewed 19 out of 21 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
pkg/apis/upstream.pgv2.percona.com/v1beta1/zz_generated.deepcopy.go	Deepcopy updates for the new `TLSSpec.IssuerConf` field.
pkg/apis/upstream.pgv2.percona.com/v1beta1/postgrescluster_types.go	Adds `TLSSpec.IssuerConf` to the API type.
percona/runtime/runtime.go	Disables informer cache for ClusterIssuer via `ClientCacheOptions()` and applies it to managers.
percona/runtime/runtime_test.go	Adds tests around cache options / manager creation.
percona/certmanager/certmanager.go	Implements issuer modes, issuerRef resolution, and managed/external behaviors across Apply* methods.
percona/certmanager/certmanager_test.go	Adds/extends tests for issuer modes, namespace resolution, drift updates, and external issuer behavior.
internal/naming/names.go	Adds naming helpers for cluster-scoped CA issuer/secret.
internal/naming/names_test.go	Tests for the new naming helpers.
internal/controller/postgrescluster/pki.go	Makes PKI reconciliation issuer-mode aware, including managed-cluster secret locations and external mode handling.
internal/controller/postgrescluster/pki_test.go	Adds issuer-mode awareness tests (with envtest/fake-client workarounds).
internal/controller/postgrescluster/pgbackrest.go	Adds CA selection helper for pgBackRest when using external issuers (no operator root CA).
internal/controller/postgrescluster/pgbackrest_test.go	Unit tests for `pgBackRestCACert`.
internal/controller/postgrescluster/instance.go	Adds CA selection helper for instance cert embedding when using external issuers.
internal/controller/postgrescluster/instance_test.go	Unit tests for `instanceCACert`.
internal/controller/postgrescluster/controller.go	Ensures cert-manager watch registration logic runs even when rootCA is nil (external mode).
deploy/cw-bundle.yaml	CRD schema update for `spec.tls.issuerConf`.
deploy/crd.yaml	CRD schema update for `spec.tls.issuerConf`.
deploy/bundle.yaml	CRD schema update for `spec.tls.issuerConf`.
config/crd/bases/upstream.pgv2.percona.com_postgresclusters.yaml	Base CRD schema update for `spec.tls.issuerConf`.
config/crd/bases/pgv2.percona.com_perconapgclusters.yaml	Base CRD schema update for `spec.tls.issuerConf`.
build/crd/percona/generated/pgv2.percona.com_perconapgclusters.yaml	Generated CRD schema update for `spec.tls.issuerConf`.

Files not reviewed (1)

pkg/apis/upstream.pgv2.percona.com/v1beta1/zz_generated.deepcopy.go: Generated file

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

Copilot

Pull request overview

Copilot reviewed 26 out of 28 changed files in this pull request and generated 3 comments.

Files not reviewed (1)

pkg/apis/upstream.pgv2.percona.com/v1beta1/zz_generated.deepcopy.go: Generated file

 	if err == nil {
 		needsUpdate := false

-		hasOwnerRef, err := controllerutil.HasOwnerReference(existing.OwnerReferences, cluster, c.scheme)
-		if err != nil {
-			return errors.Wrap(err, "check owner reference")
-		}
-
-		if !hasOwnerRef {
-			gvk := v1beta1.SchemeBuilder.GroupVersion.WithKind("PostgresCluster")
-			existing.OwnerReferences = []metav1.OwnerReference{{
-				APIVersion:         gvk.GroupVersion().String(),
-				Kind:               gvk.Kind,
-				Name:               cluster.GetName(),
-				UID:                cluster.GetUID(),
-				BlockOwnerDeletion: ptr.To(true),
-				Controller:         ptr.To(true),
-			}}
-			needsUpdate = true
+		if !clusterScoped {
+			hasOwnerRef, err := controllerutil.HasOwnerReference(existing.OwnerReferences, cluster, c.scheme)


Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

egegunes · 2026-07-20T05:20:55Z

+	if rootCA != nil {
+		caCert, err := rootCA.Certificate.MarshalText()
+		return caCert, errors.Wrap(err, "failed to marshal root CA certificate")
+	}
+
+	if ca := clientSecret.Data[corev1.ServiceAccountRootCAKey]; len(ca) > 0 {
+		return ca, nil
+	}
+	if ca := repoSecret.Data[corev1.ServiceAccountRootCAKey]; len(ca) > 0 {
+		return ca, nil
+	}
+
+	return nil, errors.New("external issuer did not return a CA certificate for pgBackRest")


why do we need these kind of fallbacks here and in instance.go? i'd expect rootCA to be passed properly by the CA issued by ClusterIssuer

rootCA can be nil in case of external issuers or ClusterIssuer that are not managed by the operator (missing RBAC, created externally).. So in this case we just try to look at the issued leaf cert and get the ca.crt from there

wouldn't it be better to stop reconciliation on a upper level if rootCA is nil rather than this fallback logic?

If we return early, how would we know the root CA then? This fallback exists so that the root CA can be inferred from the externally issued leaf certs. Am I missing something?

JNKPercona · 2026-07-20T05:32:10Z

Test Name	Result	Time
backup-enable-disable	passed	00:00:00
builtin-extensions	passed	00:00:00
cert-manager-tls	passed	00:00:00
custom-envs	passed	00:00:00
custom-tls	passed	00:00:00
database-init-sql	passed	00:00:00
demand-backup	passed	00:00:00
demand-backup-offline-snapshot	passed	00:00:00
dynamic-configuration	passed	00:00:00
finalizers	passed	00:00:00
init-deploy	passed	00:00:00
huge-pages	passed	00:00:00
major-upgrade-14-to-15	passed	00:00:00
major-upgrade-15-to-16	passed	00:00:00
major-upgrade-16-to-17	passed	00:00:00
major-upgrade-17-to-18	passed	00:00:00
ldap	passed	00:00:00
ldap-tls	passed	00:00:00
monitoring	passed	00:00:00
monitoring-pmm3	passed	00:00:00
one-pod	passed	00:00:00
operator-self-healing	passed	00:00:00
pgbouncer-mtls	passed	00:00:00
pitr	passed	00:00:00
scaling	passed	00:00:00
scheduled-backup	passed	00:00:00
self-healing	passed	00:00:00
sidecars	passed	00:00:00
standby-pgbackrest	passed	00:00:00
standby-streaming	passed	00:13:26
start-from-backup	passed	00:00:00
tablespaces	passed	00:00:00
telemetry-transfer	passed	00:00:00
upgrade-consistency	passed	00:00:00
upgrade-minor	passed	00:00:00
users	passed	00:00:00
migration-from-crunchy-standby	passed	00:00:00
migration-from-crunchy-pv	passed	00:00:00
migration-from-crunchy-backup-restore	passed	00:00:00

Summary	Value
Tests Run	39/39
Job Duration	00:27:49
Total Test Time	00:13:26

commit: 8ce02eb
image: perconalab/percona-postgresql-operator:PR-1684-8ce02ebb9

mayankshah1607 added 2 commits July 13, 2026 16:43

added spec.issuerConf to CRD

7f9450b

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

wip

187c2f8

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

mayankshah1607 requested a review from Copilot July 14, 2026 10:21

Copilot started reviewing on behalf of mayankshah1607 July 14, 2026 10:22 View session

Copilot AI reviewed Jul 14, 2026

View reviewed changes

mayankshah1607 and others added 11 commits July 15, 2026 12:40

Merge branch 'main' into K8SPG-951-issuer-conf

482d0c3

cleanup

e347f11

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

use issuer name for secret name

6e5dcbd

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

trim down unnecessary comments

abe1790

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

improve ResolveIssuerMode by checking labels

9d97033

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

add groupName in issuerRef

8c941e7

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

remove unnecessary test

a19b878

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

updated cr.yaml

c7f2e5b

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

remove unnecessarily verbose comments

f544698

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

update e2e test

cbf3959

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

linting

d123e94

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

mayankshah1607 requested a review from Copilot July 15, 2026 10:28

Copilot started reviewing on behalf of mayankshah1607 July 15, 2026 10:29 View session

Copilot AI reviewed Jul 15, 2026

View reviewed changes

mayankshah1607 and others added 7 commits July 15, 2026 16:06

Potential fix for pull request finding

4e0ff68

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

fix scheme ordering

63b3e41

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

unit test fix

491a4d0

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

Merge branch 'main' into K8SPG-951-issuer-conf

bedf9c4

Merge branch 'main' into K8SPG-951-issuer-conf

42ca64e

fix panic

f2dc250

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

e2e test fixes

ec13aa1

Signed-off-by: Mayank Shah <mayank.shah@percona.com>

mayankshah1607 marked this pull request as ready for review July 17, 2026 14:19

mayankshah1607 requested review from eleo007, jvpasinatto and valmiranogueira as code owners July 17, 2026 14:19

mayankshah1607 requested review from DhruthiKV, egegunes, gkech, hors, nmarukovich, oksana-grishchenko and pooknull as code owners July 17, 2026 14:19

Merge branch 'main' into K8SPG-951-issuer-conf

8ce02eb

mayankshah1607 changed the title ~~K8SPG-951: [WIP] add spec.issuerConf~~ K8SPG-951: add spec.issuerConf Jul 20, 2026

egegunes reviewed Jul 20, 2026

View reviewed changes

mayankshah1607 requested a review from egegunes July 20, 2026 07:35

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

K8SPG-951: add spec.issuerConf#1684

K8SPG-951: add spec.issuerConf#1684
mayankshah1607 wants to merge 21 commits into
mainfrom
K8SPG-951-issuer-conf

mayankshah1607 commented Jul 14, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

egegunes Jul 20, 2026

Uh oh!

mayankshah1607 Jul 20, 2026 •

edited

Loading

Uh oh!

egegunes Jul 21, 2026

Uh oh!

mayankshah1607 Jul 21, 2026

Uh oh!

JNKPercona commented Jul 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

mayankshah1607 commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CHANGE DESCRIPTION

CHECKLIST

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

egegunes Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

mayankshah1607 Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

egegunes Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

mayankshah1607 Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

JNKPercona commented Jul 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

mayankshah1607 commented Jul 14, 2026 •

edited

Loading

mayankshah1607 Jul 20, 2026 •

edited

Loading