Skip to content

Commit a8ca69c

Browse files
valmiranogueiravalmiranogueira
authored
Merge branch 'main' into K8SPG-984-k8s-upgrade
2 parents 68367a8 + 4a6c022 commit a8ca69c

137 files changed

Lines changed: 1224 additions & 928 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎cmd/postgres-operator/main.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,6 @@ import (
3434
"github.com/percona/percona-postgresql-operator/v2/internal/controller/runtime"
3535
"github.com/percona/percona-postgresql-operator/v2/internal/controller/standalone_pgadmin"
3636
"github.com/percona/percona-postgresql-operator/v2/internal/feature"
37-
"github.com/percona/percona-postgresql-operator/v2/internal/initialize"
3837
"github.com/percona/percona-postgresql-operator/v2/internal/logging"
3938
"github.com/percona/percona-postgresql-operator/v2/internal/naming"
4039
"github.com/percona/percona-postgresql-operator/v2/internal/upgradecheck"
@@ -175,6 +174,7 @@ func addControllersToManager(ctx context.Context, mgr manager.Manager) error {
175174
if cm.Controller() == nil {
176175
return errors.New("missing controller in manager")
177176
}
177+
r.Controller = cm.Controller()
178178

179179
if err := mgr.GetFieldIndexer().IndexField(
180180
context.Background(),
@@ -288,7 +288,7 @@ func initManager(ctx context.Context) (runtime.Options, error) {
288288
log := logging.FromContext(ctx)
289289

290290
options := runtime.Options{}
291-
options.Cache.SyncPeriod = initialize.Pointer(time.Hour)
291+
options.Cache.SyncPeriod = new(time.Hour)
292292

293293
options.HealthProbeBindAddress = ":8081"
294294

‎e2e-tests/functions‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1142,6 +1142,11 @@ deploy_cert_manager() {
11421142
until kubectl get validatingwebhookconfiguration cert-manager-webhook -o jsonpath='{.webhooks[0].clientConfig.caBundle}' | grep -q '[A-Za-z0-9+/=]'; do
11431143
sleep 5
11441144
done
1145+
1146+
echo "Waiting for cert-manager webhook service to have endpoints..."
1147+
until kubectl -n cert-manager get endpoints cert-manager-webhook -o jsonpath='{.subsets[*].addresses}' | grep -q '.'; do
1148+
sleep 5
1149+
done
11451150
}
11461151

11471152
destroy_cert_manager() {

‎e2e-tests/tests/cert-manager-tls/00-deploy-operator.yaml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
apiVersion: kuttl.dev/v1beta1
22
kind: TestStep
3-
timeout: 10
43
commands:
54
- script: |-
65
set -o errexit
@@ -9,7 +8,7 @@ commands:
98
source ../../functions
109
init_temp_dir # do this only in the first TestStep
1110
12-
deploy_cert_manager
11+
destroy_cert_manager
1312
deploy_operator
1413
deploy_client
15-
deploy_cmctl
14+
timeout: 120

‎e2e-tests/tests/cert-manager-tls/01-assert.yaml‎

Lines changed: 1 addition & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -58,34 +58,6 @@ metadata:
5858
status:
5959
succeeded: 1
6060
---
61-
apiVersion: upstream.pgv2.percona.com/v1beta1
62-
kind: PostgresCluster
63-
metadata:
64-
name: cert-manager-tls
65-
ownerReferences:
66-
- apiVersion: pgv2.percona.com/v2
67-
kind: PerconaPGCluster
68-
name: cert-manager-tls
69-
controller: true
70-
blockOwnerDeletion: true
71-
finalizers:
72-
- postgres-operator.crunchydata.com/finalizer
73-
status:
74-
instances:
75-
- name: instance1
76-
readyReplicas: 3
77-
replicas: 3
78-
updatedReplicas: 3
79-
observedGeneration: 1
80-
pgbackrest:
81-
repos:
82-
- name: repo1
83-
stanzaCreated: true
84-
proxy:
85-
pgBouncer:
86-
readyReplicas: 3
87-
replicas: 3
88-
---
8961
apiVersion: pgv2.percona.com/v2
9062
kind: PerconaPGCluster
9163
metadata:
@@ -101,4 +73,4 @@ status:
10173
size: 3
10274
ready: 3
10375
size: 3
104-
state: ready
76+
state: ready

‎e2e-tests/tests/cert-manager-tls/01-create-cluster.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
apiVersion: kuttl.dev/v1beta1
22
kind: TestStep
3-
timeout: 10
43
commands:
54
- script: |-
65
set -o errexit
@@ -9,4 +8,5 @@ commands:
98
source ../../functions
109
1110
get_cr "cert-manager-tls" \
12-
| kubectl -n "${NAMESPACE}" apply -f -
11+
| kubectl -n "${NAMESPACE}" apply -f -
12+
timeout: 10

‎e2e-tests/tests/cert-manager-tls/02-verify-internal-pki.yaml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
apiVersion: kuttl.dev/v1beta1
2+
kind: TestStep
3+
commands:
4+
- script: |-
5+
set -o errexit
6+
set -o xtrace
7+
8+
source ../../functions
9+
10+
root_ca_annotation=$(kubectl -n "$NAMESPACE" get secret cert-manager-tls-cluster-cert \
11+
-o jsonpath='{.metadata.annotations.cert-manager\.io/certificate-name}' 2>/dev/null || true)
12+
13+
if [[ -n "$root_ca_annotation" ]]; then
14+
echo "Root CA secret has cert-manager annotation but cert-manager is not installed!"
15+
exit 1
16+
fi
17+
18+
cert_count=$(kubectl -n "$NAMESPACE" get certificate 2>/dev/null | grep -c cert-manager-tls || true)
19+
if [[ "$cert_count" -gt 0 ]]; then
20+
echo "Found cert-manager Certificate resources but cert-manager should not be installed"
21+
exit 1
22+
fi
23+
24+
instance_sts=$(kubectl -n "$NAMESPACE" get sts \
25+
-l postgres-operator.crunchydata.com/cluster=cert-manager-tls,postgres-operator.crunchydata.com/instance-set=instance1 \
26+
-o jsonpath='{.items[*].metadata.name}')
27+
28+
for sts_name in $instance_sts; do
29+
secret_name="${sts_name}-certs"
30+
31+
cm_annotation=$(kubectl -n "$NAMESPACE" get secret "$secret_name" \
32+
-o jsonpath='{.metadata.annotations.cert-manager\.io/certificate-name}' 2>/dev/null || true)
33+
if [[ -n "$cm_annotation" ]]; then
34+
echo "Instance secret $secret_name has cert-manager annotation unexpectedly"
35+
exit 1
36+
fi
37+
38+
for key in dns.crt dns.key patroni.ca-roots patroni.crt-combined; do
39+
escaped_key="${key//./\\.}"
40+
val=$(kubectl -n "$NAMESPACE" get secret "$secret_name" -o jsonpath="{.data.${escaped_key}}")
41+
if [[ -z "$val" ]]; then
42+
echo "Instance secret $secret_name is missing key: $key"
43+
exit 1
44+
fi
45+
done
46+
done
47+
timeout: 60

‎e2e-tests/tests/cert-manager-tls/03-verify-tls-secrets.yaml‎

Lines changed: 13 additions & 107 deletions
Original file line numberDiff line numberDiff line change
@@ -1,125 +1,31 @@
11
apiVersion: kuttl.dev/v1beta1
22
kind: TestStep
3-
timeout: 120
43
commands:
54
- script: |-
65
set -o errexit
76
set -o xtrace
87
98
source ../../functions
109
11-
verify_secret_data() {
12-
local secret_name="$1"
13-
shift
14-
for key in "$@"; do
15-
escaped_key="${key//./\\.}"
16-
val=$(kubectl -n "$NAMESPACE" get secret "$secret_name" -o jsonpath="{.data.${escaped_key}}")
17-
if [[ -z "$val" ]]; then
18-
echo "Secret $secret_name is missing key: $key"
19-
return 1
20-
fi
21-
done
22-
}
10+
ssl_info=$(run_psql_local "SHOW ssl;" "postgres:$(get_psql_user_pass cert-manager-tls-pguser-postgres)@$(get_psql_user_host cert-manager-tls-pguser-postgres)")
2311
24-
retry 12 5 verify_secret_data cert-manager-tls-cluster-ca-cert tls.crt tls.key ca.crt
25-
26-
ca_secret_type=$(kubectl -n "$NAMESPACE" get secret cert-manager-tls-cluster-ca-cert -o jsonpath='{.type}')
27-
if [[ "$ca_secret_type" != "kubernetes.io/tls" ]]; then
28-
echo "CA secret type is incorrect: $ca_secret_type (expected kubernetes.io/tls)"
29-
exit 1
30-
fi
31-
32-
ca_issuer_name=$(kubectl -n "$NAMESPACE" get secret cert-manager-tls-cluster-ca-cert -o jsonpath='{.metadata.annotations.cert-manager\.io/issuer-name}')
33-
if [[ "$ca_issuer_name" != "cert-manager-tls-ca-issuer" ]]; then
34-
echo "CA secret issuer annotation is incorrect: $ca_issuer_name"
35-
exit 1
36-
fi
37-
38-
retry 12 5 verify_secret_data cert-manager-tls-cluster-cert tls.crt tls.key ca.crt
39-
40-
cluster_secret_type=$(kubectl -n "$NAMESPACE" get secret cert-manager-tls-cluster-cert -o jsonpath='{.type}')
41-
if [[ "$cluster_secret_type" != "kubernetes.io/tls" ]]; then
42-
echo "Cluster TLS secret type is incorrect: $cluster_secret_type (expected kubernetes.io/tls)"
43-
exit 1
44-
fi
45-
46-
cluster_issuer_name=$(kubectl -n "$NAMESPACE" get secret cert-manager-tls-cluster-cert -o jsonpath='{.metadata.annotations.cert-manager\.io/issuer-name}')
47-
if [[ "$cluster_issuer_name" != "cert-manager-tls-tls-issuer" ]]; then
48-
echo "Cluster TLS secret issuer annotation is incorrect: $cluster_issuer_name"
49-
exit 1
50-
fi
51-
52-
retry 12 5 verify_secret_data cert-manager-tls-pgbouncer-frontend-tls tls.crt tls.key ca.crt
53-
54-
pgb_secret_type=$(kubectl -n "$NAMESPACE" get secret cert-manager-tls-pgbouncer-frontend-tls -o jsonpath='{.type}')
55-
if [[ "$pgb_secret_type" != "kubernetes.io/tls" ]]; then
56-
echo "PgBouncer TLS secret type is incorrect: $pgb_secret_type (expected kubernetes.io/tls)"
57-
exit 1
58-
fi
59-
60-
pgb_issuer_name=$(kubectl -n "$NAMESPACE" get secret cert-manager-tls-pgbouncer-frontend-tls -o jsonpath='{.metadata.annotations.cert-manager\.io/issuer-name}')
61-
if [[ "$pgb_issuer_name" != "cert-manager-tls-tls-issuer" ]]; then
62-
echo "PgBouncer TLS secret issuer annotation is incorrect: $pgb_issuer_name"
12+
if [[ "$ssl_info" != *"on"* ]]; then
13+
echo "SSL is not enabled on PostgreSQL with internal PKI"
6314
exit 1
6415
fi
6516
66-
retry 12 5 verify_secret_data cert-manager-tls-pgbackrest-client-tls tls.crt tls.key
17+
repl_ssl_count=$(run_psql_local \
18+
"SELECT count(*) FROM pg_stat_ssl s JOIN pg_stat_replication r ON s.pid = r.pid WHERE s.ssl = true;" \
19+
"postgres:$(get_psql_user_pass cert-manager-tls-pguser-postgres)@cert-manager-tls-primary")
20+
repl_ssl_count=$(echo "$repl_ssl_count" | tr -d '[:space:]')
6721
68-
pgbr_client_issuer=$(kubectl -n "$NAMESPACE" get secret cert-manager-tls-pgbackrest-client-tls -o jsonpath='{.metadata.annotations.cert-manager\.io/issuer-name}')
69-
if [[ "$pgbr_client_issuer" != "cert-manager-tls-tls-issuer" ]]; then
70-
echo "pgBackRest client TLS secret issuer annotation is incorrect: $pgbr_client_issuer"
22+
if [[ "$repl_ssl_count" -lt 1 ]]; then
23+
echo "No SSL replication connections found with internal PKI, got: $repl_ssl_count"
7124
exit 1
7225
fi
7326
74-
retry 12 5 verify_secret_data cert-manager-tls-pgbackrest-repo-tls tls.crt tls.key
75-
76-
pgbr_repo_issuer=$(kubectl -n "$NAMESPACE" get secret cert-manager-tls-pgbackrest-repo-tls -o jsonpath='{.metadata.annotations.cert-manager\.io/issuer-name}')
77-
if [[ "$pgbr_repo_issuer" != "cert-manager-tls-tls-issuer" ]]; then
78-
echo "pgBackRest repo TLS secret issuer annotation is incorrect: $pgbr_repo_issuer"
79-
exit 1
80-
fi
81-
82-
retry 12 5 verify_secret_data cert-manager-tls-pgbackrest pgbackrest.ca-roots pgbackrest-client.crt pgbackrest-client.key pgbackrest-repo-host.crt pgbackrest-repo-host.key
83-
84-
pgbr_client_cert_in_secret=$(kubectl -n "$NAMESPACE" get secret cert-manager-tls-pgbackrest -o jsonpath='{.data.pgbackrest-client\.crt}')
85-
pgbr_client_cert_from_cm=$(kubectl -n "$NAMESPACE" get secret cert-manager-tls-pgbackrest-client-tls -o jsonpath='{.data.tls\.crt}')
86-
if [[ "$pgbr_client_cert_in_secret" != "$pgbr_client_cert_from_cm" ]]; then
87-
echo "pgBackRest main secret client cert does not match cert-manager-issued cert"
88-
exit 1
89-
fi
90-
91-
pgbr_repo_cert_in_secret=$(kubectl -n "$NAMESPACE" get secret cert-manager-tls-pgbackrest -o jsonpath='{.data.pgbackrest-repo-host\.crt}')
92-
pgbr_repo_cert_from_cm=$(kubectl -n "$NAMESPACE" get secret cert-manager-tls-pgbackrest-repo-tls -o jsonpath='{.data.tls\.crt}')
93-
if [[ "$pgbr_repo_cert_in_secret" != "$pgbr_repo_cert_from_cm" ]]; then
94-
echo "pgBackRest main secret repo cert does not match cert-manager-issued cert"
95-
exit 1
96-
fi
97-
98-
retry 12 5 verify_secret_data cert-manager-tls-pgbouncer pgbouncer-frontend.crt pgbouncer-frontend.key pgbouncer-frontend.ca-roots
99-
100-
pgb_cert_in_secret=$(kubectl -n "$NAMESPACE" get secret cert-manager-tls-pgbouncer -o jsonpath='{.data.pgbouncer-frontend\.crt}')
101-
pgb_cert_from_cm=$(kubectl -n "$NAMESPACE" get secret cert-manager-tls-pgbouncer-frontend-tls -o jsonpath='{.data.tls\.crt}')
102-
if [[ "$pgb_cert_in_secret" != "$pgb_cert_from_cm" ]]; then
103-
echo "pgBouncer main secret frontend cert does not match cert-manager-issued cert"
104-
exit 1
105-
fi
106-
107-
instance_sts=$(kubectl -n "$NAMESPACE" get sts -l postgres-operator.crunchydata.com/cluster=cert-manager-tls,postgres-operator.crunchydata.com/instance-set=instance1 -o jsonpath='{.items[*].metadata.name}')
108-
for sts_name in $instance_sts; do
109-
secret_name="${sts_name}-certs"
110-
111-
secret_type=$(kubectl -n "$NAMESPACE" get secret "$secret_name" -o jsonpath='{.type}')
112-
if [[ "$secret_type" != "kubernetes.io/tls" ]]; then
113-
echo "Instance secret $secret_name type is incorrect: $secret_type (expected kubernetes.io/tls)"
114-
exit 1
115-
fi
116-
117-
issuer_name=$(kubectl -n "$NAMESPACE" get secret "$secret_name" -o jsonpath='{.metadata.annotations.cert-manager\.io/issuer-name}')
118-
if [[ "$issuer_name" != "cert-manager-tls-tls-issuer" ]]; then
119-
echo "Instance secret $secret_name issuer annotation is incorrect: $issuer_name"
120-
exit 1
121-
fi
27+
pg_cert_serial=$(run_comand_on_pod "openssl s_client -connect cert-manager-tls-primary:5432 -starttls postgres <<< '' 2>/dev/null | openssl x509 -noout -serial" | tr -d '[:space:]')
12228
123-
verify_secret_data "$secret_name" tls.crt tls.key dns.crt dns.key patroni.ca-roots patroni.crt-combined pgbackrest-server.crt pgbackrest-server.key
124-
echo "Instance secret $secret_name is valid"
125-
done
29+
kubectl create configmap -n "${NAMESPACE}" internal-pki-cert-serial \
30+
--from-literal=pg-serial="$pg_cert_serial"
31+
timeout: 30

‎e2e-tests/tests/cert-manager-tls/04-write-data.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,4 +13,5 @@ commands:
1313
1414
run_psql_local \
1515
'\c myapp \\\ INSERT INTO myApp (id) VALUES (100500)' \
16-
"postgres:$(get_psql_user_pass cert-manager-tls-pguser-postgres)@$(get_psql_user_host cert-manager-tls-pguser-postgres)"
16+
"postgres:$(get_psql_user_pass cert-manager-tls-pguser-postgres)@$(get_psql_user_host cert-manager-tls-pguser-postgres)"
17+
timeout: 30

‎e2e-tests/tests/cert-manager-tls/05-deploy-cert-manager.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
apiVersion: kuttl.dev/v1beta1
2+
kind: TestStep
3+
commands:
4+
- script: |-
5+
set -o errexit
6+
set -o xtrace
7+
8+
source ../../functions
9+
10+
deploy_cert_manager
11+
deploy_cmctl
12+
13+
kubectl -n "$NAMESPACE" delete pod -l postgres-operator.crunchydata.com/role=pgbouncer,postgres-operator.crunchydata.com/cluster=cert-manager-tls
14+
15+
wait_cluster_consistency cert-manager-tls
16+
timeout: 120

‎e2e-tests/tests/cert-manager-tls/06-verify-internal-pki-preserved.yaml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
apiVersion: kuttl.dev/v1beta1
2+
kind: TestStep
3+
commands:
4+
- script: |-
5+
set -o errexit
6+
set -o xtrace
7+
8+
source ../../functions
9+
10+
root_ca_annotation=$(kubectl -n "$NAMESPACE" get secret cert-manager-tls-cluster-cert \
11+
-o jsonpath='{.metadata.annotations.cert-manager\.io/certificate-name}' 2>/dev/null || true)
12+
13+
if [[ -n "$root_ca_annotation" ]]; then
14+
echo "FAIL: Root CA secret was taken over by cert-manager!"
15+
exit 1
16+
fi
17+
18+
cert_count=$(kubectl -n "$NAMESPACE" get certificate 2>/dev/null | grep -c cert-manager-tls || true)
19+
if [[ "$cert_count" -gt 0 ]]; then
20+
echo "FAIL: cert-manager Certificate resources were created for the existing cluster"
21+
exit 1
22+
fi
23+
24+
instance_sts=$(kubectl -n "$NAMESPACE" get sts \
25+
-l postgres-operator.crunchydata.com/cluster=cert-manager-tls,postgres-operator.crunchydata.com/instance-set=instance1 \
26+
-o jsonpath='{.items[*].metadata.name}')
27+
28+
for sts_name in $instance_sts; do
29+
secret_name="${sts_name}-certs"
30+
31+
cm_annotation=$(kubectl -n "$NAMESPACE" get secret "$secret_name" \
32+
-o jsonpath='{.metadata.annotations.cert-manager\.io/certificate-name}' 2>/dev/null || true)
33+
if [[ -n "$cm_annotation" ]]; then
34+
echo "FAIL: Instance secret $secret_name was taken over by cert-manager"
35+
exit 1
36+
fi
37+
done
38+
39+
pg_cert_serial=$(run_comand_on_pod "openssl s_client -connect cert-manager-tls-primary:5432 -starttls postgres <<< '' 2>/dev/null | openssl x509 -noout -serial" | tr -d '[:space:]')
40+
pg_cert_serial_before=$(kubectl -n "$NAMESPACE" get configmap internal-pki-cert-serial -o jsonpath='{.data.pg-serial}')
41+
42+
if [[ "$pg_cert_serial" != "$pg_cert_serial_before" ]]; then
43+
echo "FAIL: PostgreSQL certificate changed after cert-manager installation!"
44+
exit 1
45+
fi
46+
timeout: 60

0 commit comments

Comments
 (0)