recheck cert-manager RBAC on each reconciliation to handle late-added permissions

Horiodino · Horiodino · commit 3f8f86f568cc · 2026-04-29T12:49:32.000+05:30
Signed-off-by: Praful Khanduri &lt;holiodin@gmail.com&gt;
diff --git a/apis/v1beta1/opentelemetrycollector_types.go b/apis/v1beta1/opentelemetrycollector_types.go
@@ -247,6 +247,11 @@ type TargetAllocatorMTLS struct {
 	// Enabled indicates whether to enable mTLS between the target allocator and the collector.
 	// +optional
 	Enabled bool `json:"enabled,omitempty"`
+	// UseCertManager defines whether cert-manager should be used to provision certificates for mTLS.
+	// Defaults to true.
+	// +optional
+	// +kubebuilder:default:=true
+	UseCertManager *bool `json:"useCertManager,omitempty"`
 }
 
 // Probe defines the OpenTelemetry's pod probe config.
diff --git a/apis/v1beta1/zz_generated.deepcopy.go b/apis/v1beta1/zz_generated.deepcopy.go
diff --git a/bundle/community/manifests/opentelemetry-operator.clusterserviceversion.yaml b/bundle/community/manifests/opentelemetry-operator.clusterserviceversion.yaml
@@ -521,6 +521,20 @@ spec:
           - patch
           - update
           - watch
+        - apiGroups:
+          - cert-manager.io
+          resources:
+          - issuers
+          - certificaterequests
+          - certificates
+          verbs:
+          - create
+          - get
+          - list
+          - watch
+          - update
+          - patch
+          - delete
         - apiGroups:
           - authentication.k8s.io
           resources:
diff --git a/bundle/community/manifests/opentelemetry.io_opentelemetrycollectors.yaml b/bundle/community/manifests/opentelemetry.io_opentelemetrycollectors.yaml
@@ -8190,6 +8190,9 @@ spec:
                     properties:
                       enabled:
                         type: boolean
+                      useCertManager:
+                        default: true
+                        type: boolean
                     type: object
                   nodeSelector:
                     additionalProperties:
diff --git a/bundle/openshift/manifests/opentelemetry-operator.clusterserviceversion.yaml b/bundle/openshift/manifests/opentelemetry-operator.clusterserviceversion.yaml
@@ -521,6 +521,20 @@ spec:
           - patch
           - update
           - watch
+        - apiGroups:
+          - cert-manager.io
+          resources:
+          - issuers
+          - certificaterequests
+          - certificates
+          verbs:
+          - create
+          - get
+          - list
+          - watch
+          - update
+          - patch
+          - delete
         - apiGroups:
           - authentication.k8s.io
           resources:
diff --git a/bundle/openshift/manifests/opentelemetry.io_opentelemetrycollectors.yaml b/bundle/openshift/manifests/opentelemetry.io_opentelemetrycollectors.yaml
@@ -8189,6 +8189,9 @@ spec:
                     properties:
                       enabled:
                         type: boolean
+                      useCertManager:
+                        default: true
+                        type: boolean
                     type: object
                   nodeSelector:
                     additionalProperties:
diff --git a/config/crd/bases/opentelemetry.io_opentelemetrycollectors.yaml b/config/crd/bases/opentelemetry.io_opentelemetrycollectors.yaml
@@ -8176,6 +8176,9 @@ spec:
                     properties:
                       enabled:
                         type: boolean
+                      useCertManager:
+                        default: true
+                        type: boolean
                     type: object
                   nodeSelector:
                     additionalProperties:
diff --git a/docs/api/opentelemetrycollectors.md b/docs/api/opentelemetrycollectors.md
@@ -34336,6 +34336,16 @@ Mtls defines the mTLS configuration for the target allocator. If enabled, the ta
           Enabled indicates whether to enable mTLS between the target allocator and the collector.<br/>
         </td>
         <td>false</td>
+      </tr><tr>
+        <td><b>useCertManager</b></td>
+        <td>boolean</td>
+        <td>
+          UseCertManager defines whether cert-manager should be used to provision certificates for mTLS.
+Defaults to true.<br/>
+          <br/>
+            <i>Default</i>: true<br/>
+        </td>
+        <td>false</td>
       </tr></tbody>
 </table>
 
diff --git a/internal/controllers/opentelemetrycollector_controller.go b/internal/controllers/opentelemetrycollector_controller.go
@@ -33,6 +33,7 @@ import (
 
 	"github.com/open-telemetry/opentelemetry-operator/apis/v1alpha1"
 	"github.com/open-telemetry/opentelemetry-operator/apis/v1beta1"
+	internalCertmanager "github.com/open-telemetry/opentelemetry-operator/internal/autodetect/certmanager"
 	"github.com/open-telemetry/opentelemetry-operator/internal/autodetect/gatewayapi"
 	"github.com/open-telemetry/opentelemetry-operator/internal/autodetect/openshift"
 	"github.com/open-telemetry/opentelemetry-operator/internal/autodetect/prometheus"
@@ -156,8 +157,18 @@ func getCollectorConfigMapsToKeep(configVersionsToKeep int, configMaps []*corev1
 }
 
 func (r *OpenTelemetryCollectorReconciler) GetParams(ctx context.Context, instance v1beta1.OpenTelemetryCollector) (manifests.Params, error) {
+	// Recheck cert-manager RBAC on each reconciliation to handle late-added permissions.
+	// Only attempt to upgrade from NotAvailable → Available
+	if r.reviewer != nil && r.config.CertManagerAvailability != internalCertmanager.Available {
+		if warnings, err := internalCertmanager.CheckCertManagerPermissions(ctx, r.reviewer); err == nil && warnings == nil {
+			r.log.V(2).Info("cert-manager permissions detected during reconciliation, upgrading availability")
+			r.config.CertManagerAvailability = internalCertmanager.Available
+		}
+	}
+	cfg := r.config
+
 	p := manifests.Params{
-		Config:   r.config,
+		Config:   cfg,
 		Client:   r.Client,
 		OtelCol:  instance,
 		Log:      r.log,
diff --git a/internal/controllers/targetallocator_controller.go b/internal/controllers/targetallocator_controller.go
@@ -33,6 +33,7 @@ import (
 	"github.com/open-telemetry/opentelemetry-operator/internal/autodetect/prometheus"
 	"github.com/open-telemetry/opentelemetry-operator/internal/config"
 	"github.com/open-telemetry/opentelemetry-operator/internal/manifests/targetallocator"
+	"github.com/open-telemetry/opentelemetry-operator/internal/rbac"
 	taStatus "github.com/open-telemetry/opentelemetry-operator/internal/status/targetallocator"
 	"github.com/open-telemetry/opentelemetry-operator/pkg/constants"
 )
@@ -44,6 +45,7 @@ type TargetAllocatorReconciler struct {
 	scheme   *runtime.Scheme
 	log      logr.Logger
 	config   config.Config
+	reviewer *rbac.Reviewer
 }
 
 // TargetAllocatorReconcilerParams is the set of options to build a new TargetAllocatorReconciler.
@@ -60,8 +62,18 @@ func (r *TargetAllocatorReconciler) getParams(ctx context.Context, instance v1al
 	if err != nil {
 		return targetallocator.Params{}, err
 	}
+
+	// Recheck cert-manager RBAC on each reconciliation to handle late-added permissions.
+	// Only attempt to upgrade from NotAvailable → Available
+	if r.reviewer != nil && r.config.CertManagerAvailability != certmanager.Available {
+		if warnings, err := certmanager.CheckCertManagerPermissions(ctx, r.reviewer); err == nil && warnings == nil {
+			r.log.V(2).Info("cert-manager permissions detected during reconciliation, upgrading availability")
+			r.config.CertManagerAvailability = certmanager.Available
+		}
+	}
+	cfg := r.config
 	p := targetallocator.Params{
-		Config:          r.config,
+		Config:          cfg,
 		Client:          r.Client,
 		Log:             r.log,
 		Scheme:          r.scheme,
@@ -124,13 +136,15 @@ func NewTargetAllocatorReconciler(
 	recorder events.EventRecorder,
 	config config.Config,
 	logger logr.Logger,
+	reviewer *rbac.Reviewer,
 ) *TargetAllocatorReconciler {
 	return &TargetAllocatorReconciler{
 		Client:   client,
 		log:      logger,
 		scheme:   scheme,
 		config:   config,
 		recorder: recorder,
+		reviewer: reviewer,
 	}
 }
 
diff --git a/internal/controllers/targetallocator_controller_test.go b/internal/controllers/targetallocator_controller_test.go
@@ -41,6 +41,7 @@ func TestNewObjectsOnReconciliation_TargetAllocator(t *testing.T) {
 		events.NewFakeRecorder(10),
 		cfg,
 		testLogger,
+		nil,
 	)
 	created := &v1alpha1.TargetAllocator{
 		ObjectMeta: metav1.ObjectMeta{
@@ -112,6 +113,7 @@ func TestSkipWhenInstanceDoesNotExist_TargetAllocator(t *testing.T) {
 		events.NewFakeRecorder(10),
 		cfg,
 		testLogger,
+		nil,
 	)
 
 	// test
@@ -150,6 +152,7 @@ func TestUnmanaged_TargetAllocator(t *testing.T) {
 		events.NewFakeRecorder(10),
 		cfg,
 		testLogger,
+		nil,
 	)
 	unmanaged := &v1alpha1.TargetAllocator{
 		ObjectMeta: metav1.ObjectMeta{
@@ -206,6 +209,7 @@ func TestBuildError_TargetAllocator(t *testing.T) {
 		events.NewFakeRecorder(10),
 		cfg,
 		testLogger,
+		nil,
 	)
 	unmanaged := &v1alpha1.TargetAllocator{
 		ObjectMeta: metav1.ObjectMeta{
diff --git a/internal/controllers/targetallocator_reconciler_test.go b/internal/controllers/targetallocator_reconciler_test.go
@@ -56,6 +56,7 @@ func TestTargetAllocatorReconciler_GetCollector(t *testing.T) {
 		events.NewFakeRecorder(10),
 		config.New(),
 		testLogger,
+		nil,
 	)
 
 	t.Run("not owned by a collector", func(t *testing.T) {
@@ -116,6 +117,7 @@ func TestTargetAllocatorReconciler_GetCollector(t *testing.T) {
 			events.NewFakeRecorder(10),
 			config.New(),
 			testLogger,
+			nil,
 		)
 		ta := v1alpha1.TargetAllocator{
 			ObjectMeta: metav1.ObjectMeta{
diff --git a/internal/manifests/collector/configmap.go b/internal/manifests/collector/configmap.go
@@ -9,7 +9,6 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
-	"github.com/open-telemetry/opentelemetry-operator/internal/autodetect/certmanager"
 	"github.com/open-telemetry/opentelemetry-operator/internal/components"
 	"github.com/open-telemetry/opentelemetry-operator/internal/manifests"
 	"github.com/open-telemetry/opentelemetry-operator/internal/manifests/manifestutils"
@@ -48,10 +47,7 @@ func ConfigMap(params manifests.Params) (*corev1.ConfigMap, error) {
 
 	replaceCfgOpts := []ta.TAOption{}
 
-	if otelCol.Spec.TargetAllocator.Enabled &&
-		otelCol.Spec.TargetAllocator.Mtls != nil &&
-		otelCol.Spec.TargetAllocator.Mtls.Enabled &&
-		params.Config.CertManagerAvailability == certmanager.Available {
+	if isTAMTLSEnabledWithCertManager(params.Config, *otelCol) {
 		replaceCfgOpts = append(replaceCfgOpts, ta.WithTLSConfig(
 			filepath.Join(constants.TACollectorTLSDirPath, constants.TACollectorCAFileName),
 			filepath.Join(constants.TACollectorTLSDirPath, constants.TACollectorTLSCertFileName),
diff --git a/internal/manifests/collector/container.go b/internal/manifests/collector/container.go
@@ -15,7 +15,6 @@ import (
 	"k8s.io/apimachinery/pkg/util/validation"
 
 	"github.com/open-telemetry/opentelemetry-operator/apis/v1beta1"
-	"github.com/open-telemetry/opentelemetry-operator/internal/autodetect/certmanager"
 	"github.com/open-telemetry/opentelemetry-operator/internal/config"
 	"github.com/open-telemetry/opentelemetry-operator/internal/naming"
 	"github.com/open-telemetry/opentelemetry-operator/pkg/constants"
@@ -62,10 +61,7 @@ func Container(cfg config.Config, logger logr.Logger, otelcol v1beta1.OpenTeleme
 			})
 	}
 
-	if otelcol.Spec.TargetAllocator.Enabled &&
-		otelcol.Spec.TargetAllocator.Mtls != nil &&
-		otelcol.Spec.TargetAllocator.Mtls.Enabled &&
-		cfg.CertManagerAvailability == certmanager.Available {
+	if isTAMTLSEnabledWithCertManager(cfg, otelcol) {
 		volumeMounts = append(volumeMounts,
 			corev1.VolumeMount{
 				Name:      naming.TAClientCertificate(otelcol.Name),
diff --git a/internal/manifests/collector/mtls.go b/internal/manifests/collector/mtls.go
@@ -0,0 +1,26 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+package collector
+
+import (
+	"github.com/open-telemetry/opentelemetry-operator/apis/v1beta1"
+	"github.com/open-telemetry/opentelemetry-operator/internal/autodetect/certmanager"
+	"github.com/open-telemetry/opentelemetry-operator/internal/config"
+)
+
+func isTAMTLSEnabledWithCertManager(cfg config.Config, otelcol v1beta1.OpenTelemetryCollector) bool {
+	if otelcol.Spec.TargetAllocator.Mtls == nil {
+		return false
+	}
+
+	useCertManager := true
+	if otelcol.Spec.TargetAllocator.Mtls.UseCertManager != nil {
+		useCertManager = *otelcol.Spec.TargetAllocator.Mtls.UseCertManager
+	}
+
+	return otelcol.Spec.TargetAllocator.Enabled &&
+		otelcol.Spec.TargetAllocator.Mtls.Enabled &&
+		useCertManager &&
+		cfg.CertManagerAvailability == certmanager.Available
+}
diff --git a/internal/manifests/collector/mtls_test.go b/internal/manifests/collector/mtls_test.go
@@ -0,0 +1,38 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+package collector
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/open-telemetry/opentelemetry-operator/apis/v1beta1"
+	"github.com/open-telemetry/opentelemetry-operator/internal/autodetect/certmanager"
+	"github.com/open-telemetry/opentelemetry-operator/internal/config"
+)
+
+func TestIsTAMTLSEnabledWithCertManager_DefaultsToTrue(t *testing.T) {
+	collector := v1beta1.OpenTelemetryCollector{}
+	collector.Spec.TargetAllocator.Enabled = true
+	collector.Spec.TargetAllocator.Mtls = &v1beta1.TargetAllocatorMTLS{Enabled: true}
+
+	cfg := config.Config{CertManagerAvailability: certmanager.Available}
+
+	assert.True(t, isTAMTLSEnabledWithCertManager(cfg, collector))
+}
+
+func TestIsTAMTLSEnabledWithCertManager_DisabledWhenUseCertManagerFalse(t *testing.T) {
+	useCertManager := false
+	collector := v1beta1.OpenTelemetryCollector{}
+	collector.Spec.TargetAllocator.Enabled = true
+	collector.Spec.TargetAllocator.Mtls = &v1beta1.TargetAllocatorMTLS{
+		Enabled:        true,
+		UseCertManager: &useCertManager,
+	}
+
+	cfg := config.Config{CertManagerAvailability: certmanager.Available}
+
+	assert.False(t, isTAMTLSEnabledWithCertManager(cfg, collector))
+}
diff --git a/internal/manifests/collector/volume.go b/internal/manifests/collector/volume.go
@@ -9,7 +9,6 @@ import (
 	corev1 "k8s.io/api/core/v1"
 
 	"github.com/open-telemetry/opentelemetry-operator/apis/v1beta1"
-	"github.com/open-telemetry/opentelemetry-operator/internal/autodetect/certmanager"
 	"github.com/open-telemetry/opentelemetry-operator/internal/components"
 	"github.com/open-telemetry/opentelemetry-operator/internal/config"
 	"github.com/open-telemetry/opentelemetry-operator/internal/manifests/manifestutils"
@@ -37,10 +36,7 @@ func Volumes(cfg config.Config, otelcol v1beta1.OpenTelemetryCollector) []corev1
 		},
 	}}
 
-	if otelcol.Spec.TargetAllocator.Enabled &&
-		otelcol.Spec.TargetAllocator.Mtls != nil &&
-		otelcol.Spec.TargetAllocator.Mtls.Enabled &&
-		cfg.CertManagerAvailability == certmanager.Available {
+	if isTAMTLSEnabledWithCertManager(cfg, otelcol) {
 		volumes = append(volumes, corev1.Volume{
 			Name: naming.TAClientCertificate(otelcol.Name),
 			VolumeSource: corev1.VolumeSource{
diff --git a/internal/manifests/targetallocator/mtls.go b/internal/manifests/targetallocator/mtls.go
@@ -10,9 +10,17 @@ import (
 )
 
 func isMTLSEnabled(cfg config.Config, collector *v1beta1.OpenTelemetryCollector) bool {
+	if collector == nil || collector.Spec.TargetAllocator.Mtls == nil {
+		return false
+	}
+
+	useCertManager := true
+	if collector.Spec.TargetAllocator.Mtls.UseCertManager != nil {
+		useCertManager = *collector.Spec.TargetAllocator.Mtls.UseCertManager
+	}
+
 	return cfg.CertManagerAvailability == certmanager.Available &&
-		collector != nil &&
 		collector.Spec.TargetAllocator.Enabled &&
-		collector.Spec.TargetAllocator.Mtls != nil &&
-		collector.Spec.TargetAllocator.Mtls.Enabled
+		collector.Spec.TargetAllocator.Mtls.Enabled &&
+		useCertManager
 }
diff --git a/internal/manifests/targetallocator/mtls_test.go b/internal/manifests/targetallocator/mtls_test.go
diff --git a/main.go b/main.go
diff --git a/tests/e2e-ta-collector-mtls/ta-collector-mtls-scrapeconfig-node/00-install.yaml b/tests/e2e-ta-collector-mtls/ta-collector-mtls-scrapeconfig-node/00-install.yaml
diff --git a/tests/e2e-ta-collector-mtls/ta-collector-mtls/02-install.yaml b/tests/e2e-ta-collector-mtls/ta-collector-mtls/02-install.yaml
