K8SPSMDB-1413: add ClusterIssuer support

config/crd/bases/psmdb.percona.com_perconaservermongodbs.yaml

@@ -25423,8 +25423,6 @@ spec:
                         type: string
                       name:
                         type: string
-                    required:
-                    - name
                     type: object
                   mode:
                     type: string

deploy/bundle.yaml

@@ -26310,8 +26310,6 @@ spec:
                         type: string
                       name:
                         type: string
-                    required:
-                    - name
                     type: object
                   mode:
                     type: string
@@ -26635,6 +26633,7 @@ rules:
   - cert-manager.io
   resources:
   - issuers
+  - clusterissuers
   - certificates
   - certificaterequests
   verbs:
@@ -26741,3 +26740,5 @@ spec:
               value: "false"
             - name: MAX_CONCURRENT_RECONCILES
               value: "1"
+            - name: CERTMANAGER_NAMESPACE
+              value: "cert-manager"

deploy/crd.yaml

@@ -26310,8 +26310,6 @@ spec:
                         type: string
                       name:
                         type: string
-                    required:
-                    - name
                     type: object
                   mode:
                     type: string

deploy/cw-bundle.yaml

@@ -26310,8 +26310,6 @@ spec:
                         type: string
                       name:
                         type: string
-                    required:
-                    - name
                     type: object
                   mode:
                     type: string
@@ -26662,6 +26660,7 @@ rules:
   - cert-manager.io
   resources:
   - issuers
+  - clusterissuers
   - certificates
   - certificaterequests
   verbs:

deploy/cw-rbac.yaml

@@ -133,6 +133,7 @@ rules:
   - cert-manager.io
   resources:
   - issuers
+  - clusterissuers
   - certificates
   - certificaterequests
   verbs:

deploy/operator.yaml

@@ -60,3 +60,5 @@ spec:
               value: "false"
             - name: MAX_CONCURRENT_RECONCILES
               value: "1"
+            - name: CERTMANAGER_NAMESPACE
+              value: "cert-manager"

deploy/rbac.yaml

@@ -106,6 +106,7 @@ rules:
   - cert-manager.io
   resources:
   - issuers
+  - clusterissuers
   - certificates
   - certificaterequests
   verbs:

e2e-tests/functions

@@ -563,56 +563,56 @@ deploy_operator_gh_release() {
 }
 
 deploy_minio() {
-  local cert_secret="$1"
-  local service_name="${2:-minio-service}"
-
-  desc "install MinIO: ${service_name}"
-
-  # Cleanup old installation
-  helm uninstall "${service_name}" 2>/dev/null || :
-  helm repo remove minio 2>/dev/null || :
-  helm repo add minio https://charts.min.io/
-
-  local endpoint="http://${service_name}:9000"
-  local minio_args=(
-    --version $MINIO_VER
-    --set replicas=1
-    --set mode=standalone
-    --set resources.requests.memory=256Mi
-    --set rootUser=rootuser
-    --set rootPassword=rootpass123
-    --set "users[0].accessKey=some-access-key"
-    --set "users[0].secretKey=some-secret-key"
-    --set "users[0].policy=consoleAdmin"
-    --set service.type=ClusterIP
-    --set configPathmc=/tmp/
-    --set securityContext.enabled=false
-    --set persistence.size=2G
-    --set fullnameOverride="${service_name}"
-    --set serviceAccount.create=true
-    --set serviceAccount.name="${service_name}-sa"
-  )
-
-  if [[ -n $cert_secret ]]; then
-    endpoint="https://${service_name}:9000"
-    minio_args+=(
-      --set tls.enabled=true
-      --set tls.certSecret="$cert_secret"
-    )
-  fi
-
-  retry 10 60 helm install "${service_name}" "${minio_args[@]}" minio/minio
-
-  local MINIO_POD=$(kubectl_bin get pods --selector=release="${service_name}" -o 'jsonpath={.items[].metadata.name}')
-  wait_pod $MINIO_POD
-
-  if [ -n "$OPERATOR_NS" ]; then
-    kubectl_bin create svc -n ${OPERATOR_NS} externalname "${service_name}" \
-      --external-name="${service_name}.${namespace}.svc.cluster.local" \
-      --tcp="9000" 2>/dev/null || :
-  fi
-
-  create_minio_bucket operator-testing $endpoint
+	local cert_secret="$1"
+	local service_name="${2:-minio-service}"
+
+	desc "install MinIO: ${service_name}"
+
+	# Cleanup old installation
+	helm uninstall "${service_name}" 2>/dev/null || :
+	helm repo remove minio 2>/dev/null || :
+	helm repo add minio https://charts.min.io/
+
+	local endpoint="http://${service_name}:9000"
+	local minio_args=(
+		--version $MINIO_VER
+		--set replicas=1
+		--set mode=standalone
+		--set resources.requests.memory=256Mi
+		--set rootUser=rootuser
+		--set rootPassword=rootpass123
+		--set "users[0].accessKey=some-access-key"
+		--set "users[0].secretKey=some-secret-key"
+		--set "users[0].policy=consoleAdmin"
+		--set service.type=ClusterIP
+		--set configPathmc=/tmp/
+		--set securityContext.enabled=false
+		--set persistence.size=2G
+		--set fullnameOverride="${service_name}"
+		--set serviceAccount.create=true
+		--set serviceAccount.name="${service_name}-sa"
+	)
+
+	if [[ -n $cert_secret ]]; then
+		endpoint="https://${service_name}:9000"
+		minio_args+=(
+			--set tls.enabled=true
+			--set tls.certSecret="$cert_secret"
+		)
+	fi
+
+	retry 10 60 helm install "${service_name}" "${minio_args[@]}" minio/minio
+
+	local MINIO_POD=$(kubectl_bin get pods --selector=release="${service_name}" -o 'jsonpath={.items[].metadata.name}')
+	wait_pod $MINIO_POD
+
+	if [ -n "$OPERATOR_NS" ]; then
+		kubectl_bin create svc -n ${OPERATOR_NS} externalname "${service_name}" \
+			--external-name="${service_name}.${namespace}.svc.cluster.local" \
+			--tcp="9000" 2>/dev/null || :
+	fi
+
+	create_minio_bucket operator-testing $endpoint
 }
 
 create_minio_bucket() {
@@ -1272,6 +1272,8 @@ run_pumba() {
 deploy_cert_manager() {
 	desc 'deploy cert manager'
 
+	kubectl_bin -n cert-manager delete clusterissuer --all || :
+	kubectl_bin -n cert-manager delete certificate --all || :
 	kubectl_bin create namespace cert-manager || :
 	kubectl_bin label namespace cert-manager certmanager.k8s.io/disable-validation=true || :
 	kubectl_bin apply -f "https://github.com/cert-manager/cert-manager/releases/download/v${CERT_MANAGER_VER}/cert-manager.yaml" --validate=false || : 2>/dev/null

e2e-tests/run-distro.csv

@@ -47,6 +47,7 @@ replset-remapping-sharded
 rs-shard-migration
 scaling
 split-horizon
+tls-clusterissuer-cert-manager
 tls-issue-cert-manager
 upgrade
 upgrade-sharded

e2e-tests/run-pr.csv

@@ -77,6 +77,7 @@ smart-update
 split-horizon
 stable-resource-version
 storage
+tls-clusterissuer-cert-manager
 tls-issue-cert-manager
 unsafe-psa
 upgrade

e2e-tests/run-release.csv

@@ -77,6 +77,7 @@ smart-update
 split-horizon
 stable-resource-version
 storage
+tls-clusterissuer-cert-manager
 tls-issue-cert-manager
 unsafe-psa
 upgrade

e2e-tests/tls-clusterissuer-cert-manager/compare/certificate_some-name-ssl-custom.yml

@@ -0,0 +1,44 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  annotations:
+    some-random-annotation: "true"
+  generation: 1
+  name: some-name-ssl
+spec:
+  commonName: some-name
+  dnsNames:
+    - localhost
+    - some-name-rs0
+    - some-name-rs0.NAME_SPACE
+    - some-name-rs0.NAME_SPACE.svc.cluster.local
+    - '*.some-name-rs0'
+    - '*.some-name-rs0.NAME_SPACE'
+    - '*.some-name-rs0.NAME_SPACE.svc.cluster.local'
+    - some-name-rs0.NAME_SPACE.svc.clusterset.local
+    - '*.some-name-rs0.NAME_SPACE.svc.clusterset.local'
+    - '*.NAME_SPACE.svc.clusterset.local'
+    - some-name-mongos
+    - some-name-mongos.NAME_SPACE
+    - some-name-mongos.NAME_SPACE.svc.cluster.local
+    - '*.some-name-mongos'
+    - '*.some-name-mongos.NAME_SPACE'
+    - '*.some-name-mongos.NAME_SPACE.svc.cluster.local'
+    - some-name-cfg
+    - some-name-cfg.NAME_SPACE
+    - some-name-cfg.NAME_SPACE.svc.cluster.local
+    - '*.some-name-cfg'
+    - '*.some-name-cfg.NAME_SPACE'
+    - '*.some-name-cfg.NAME_SPACE.svc.cluster.local'
+    - some-name-mongos.NAME_SPACE.svc.clusterset.local
+    - '*.some-name-mongos.NAME_SPACE.svc.clusterset.local'
+    - some-name-cfg.NAME_SPACE.svc.clusterset.local
+    - '*.some-name-cfg.NAME_SPACE.svc.clusterset.local'
+  duration: 2160h0m0s
+  issuerRef:
+    kind: ClusterIssuer
+    name: some-name-psmdb-issuer
+  secretName: some-name-ssl
+  subject:
+    organizations:
+      - CUSTOM

e2e-tests/tls-clusterissuer-cert-manager/compare/certificate_some-name-ssl-internal-custom.yml

@@ -0,0 +1,44 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  annotations:
+    some-random-annotation: "true"
+  generation: 1
+  name: some-name-ssl-internal
+spec:
+  commonName: some-name
+  dnsNames:
+    - localhost
+    - some-name-rs0
+    - some-name-rs0.NAME_SPACE
+    - some-name-rs0.NAME_SPACE.svc.cluster.local
+    - '*.some-name-rs0'
+    - '*.some-name-rs0.NAME_SPACE'
+    - '*.some-name-rs0.NAME_SPACE.svc.cluster.local'
+    - some-name-rs0.NAME_SPACE.svc.clusterset.local
+    - '*.some-name-rs0.NAME_SPACE.svc.clusterset.local'
+    - '*.NAME_SPACE.svc.clusterset.local'
+    - some-name-mongos
+    - some-name-mongos.NAME_SPACE
+    - some-name-mongos.NAME_SPACE.svc.cluster.local
+    - '*.some-name-mongos'
+    - '*.some-name-mongos.NAME_SPACE'
+    - '*.some-name-mongos.NAME_SPACE.svc.cluster.local'
+    - some-name-cfg
+    - some-name-cfg.NAME_SPACE
+    - some-name-cfg.NAME_SPACE.svc.cluster.local
+    - '*.some-name-cfg'
+    - '*.some-name-cfg.NAME_SPACE'
+    - '*.some-name-cfg.NAME_SPACE.svc.cluster.local'
+    - some-name-mongos.NAME_SPACE.svc.clusterset.local
+    - '*.some-name-mongos.NAME_SPACE.svc.clusterset.local'
+    - some-name-cfg.NAME_SPACE.svc.clusterset.local
+    - '*.some-name-cfg.NAME_SPACE.svc.clusterset.local'
+  duration: 2160h0m0s
+  issuerRef:
+    kind: ClusterIssuer
+    name: some-name-psmdb-issuer
+  secretName: some-name-ssl-internal
+  subject:
+    organizations:
+      - CUSTOM

e2e-tests/tls-clusterissuer-cert-manager/compare/certificate_some-name-ssl-internal.yml

@@ -0,0 +1,53 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  annotations: {}
+  generation: 1
+  labels:
+    app.kubernetes.io/instance: some-name
+    app.kubernetes.io/managed-by: percona-server-mongodb-operator
+    app.kubernetes.io/name: percona-server-mongodb
+    app.kubernetes.io/part-of: percona-server-mongodb
+  name: some-name-ssl-internal
+  ownerReferences:
+    - blockOwnerDeletion: true
+      controller: true
+      kind: PerconaServerMongoDB
+      name: some-name
+spec:
+  commonName: some-name
+  dnsNames:
+    - localhost
+    - some-name-rs0
+    - some-name-rs0.NAME_SPACE
+    - some-name-rs0.NAME_SPACE.svc.cluster.local
+    - '*.some-name-rs0'
+    - '*.some-name-rs0.NAME_SPACE'
+    - '*.some-name-rs0.NAME_SPACE.svc.cluster.local'
+    - some-name-rs0.NAME_SPACE.svc.clusterset.local
+    - '*.some-name-rs0.NAME_SPACE.svc.clusterset.local'
+    - '*.NAME_SPACE.svc.clusterset.local'
+    - some-name-mongos
+    - some-name-mongos.NAME_SPACE
+    - some-name-mongos.NAME_SPACE.svc.cluster.local
+    - '*.some-name-mongos'
+    - '*.some-name-mongos.NAME_SPACE'
+    - '*.some-name-mongos.NAME_SPACE.svc.cluster.local'
+    - some-name-cfg
+    - some-name-cfg.NAME_SPACE
+    - some-name-cfg.NAME_SPACE.svc.cluster.local
+    - '*.some-name-cfg'
+    - '*.some-name-cfg.NAME_SPACE'
+    - '*.some-name-cfg.NAME_SPACE.svc.cluster.local'
+    - some-name-mongos.NAME_SPACE.svc.clusterset.local
+    - '*.some-name-mongos.NAME_SPACE.svc.clusterset.local'
+    - some-name-cfg.NAME_SPACE.svc.clusterset.local
+    - '*.some-name-cfg.NAME_SPACE.svc.clusterset.local'
+  duration: 2160h0m0s
+  issuerRef:
+    kind: ClusterIssuer
+    name: some-name-NAME_SPACE-psmdb-issuer
+  secretName: some-name-ssl-internal
+  subject:
+    organizations:
+      - PSMDB