fix: update existing cert-manager Certificate CRs on operator upgrade

createSSLByCertManager() uses r.client.Create() with an IsAlreadyExists
guard, so any spec changes (duration, renewBefore, SANs, labels)
introduced in newer operator versions are never applied to Certificate
CRs that were created by an older version.

The most significant impact is the CA certificate duration: clusters
originally deployed with operator < 1.15.0 still carry duration=8760h
(1 year) instead of the current default of 26280h (3 years).

Replace the create-and-ignore pattern with a createOrUpdateCertificate
helper that attempts Create first, and on AlreadyExists fetches the
existing Certificate, compares Spec and Labels, and issues an Update
when they differ.

Fixes #2413

Author: larainema

e2e-tests/tls-issue-cert-manager/compare/certificate_some-name-tls-issue-ca-cert-updated.yml

@@ -0,0 +1,19 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  generation: 3
+  labels:
+    app.kubernetes.io/instance: some-name-tls-issue
+    app.kubernetes.io/managed-by: percona-xtradb-cluster-operator
+    app.kubernetes.io/name: percona-xtradb-cluster
+    app.kubernetes.io/part-of: percona-xtradb-cluster
+  name: some-name-tls-issue-ca-cert
+spec:
+  commonName: some-name-tls-issue-ca
+  duration: 20000h0m0s
+  isCA: true
+  issuerRef:
+    kind: Issuer
+    name: some-name-tls-issue-pxc-ca-issuer
+  renewBefore: 730h0m0s
+  secretName: some-name-tls-issue-ca-cert

e2e-tests/tls-issue-cert-manager/compare/certificate_some-name-tls-issue-ssl-updated.yml

@@ -0,0 +1,24 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  generation: 3
+  labels:
+    app.kubernetes.io/instance: some-name-tls-issue
+    app.kubernetes.io/managed-by: percona-xtradb-cluster-operator
+    app.kubernetes.io/name: percona-xtradb-cluster
+    app.kubernetes.io/part-of: percona-xtradb-cluster
+  name: some-name-tls-issue-ssl
+spec:
+  commonName: some-name-tls-issue-proxysql
+  dnsNames:
+    - some-name-tls-issue-pxc
+    - some-name-tls-issue-proxysql
+    - '*.some-name-tls-issue-pxc'
+    - '*.some-name-tls-issue-proxysql'
+    - test.com
+    - new-san.example.com
+  duration: 2160h0m0s
+  issuerRef:
+    kind: Issuer
+    name: some-name-tls-issue-pxc-issuer
+  secretName: some-name-tls-issue-ssl

e2e-tests/tls-issue-cert-manager/conf/some-name-tls-issue-updated.yml

@@ -0,0 +1,100 @@
+apiVersion: pxc.percona.com/v1
+kind: PerconaXtraDBCluster
+metadata:
+  name: some-name-tls-issue
+  finalizers:
+    - percona.com/delete-pxc-pods-in-order
+spec:
+  tls:
+   certValidityDuration: 2160h
+   caValidityDuration: 20000h
+   SANs:
+     - test.com
+     - new-san.example.com
+  secretsName: my-cluster-secrets
+  vaultSecretName: some-name-vault
+  pause: false
+  pxc:
+    size: 3
+    image: -pxc
+    resources:
+      requests:
+        memory: 0.1G
+        cpu: 100m
+      limits:
+        memory: "2G"
+        cpu: "1"
+    volumeSpec:
+      persistentVolumeClaim:
+        resources:
+          requests:
+            storage: 2Gi
+    affinity:
+      antiAffinityTopologyKey: "kubernetes.io/hostname"
+  proxysql:
+    enabled: false
+    size: 2
+    image: -proxysql
+    resources:
+      requests:
+        memory: 0.1G
+        cpu: 100m
+      limits:
+        memory: 1G
+        cpu: 700m
+    affinity:
+      antiAffinityTopologyKey: "kubernetes.io/hostname"
+    volumeSpec:
+      persistentVolumeClaim:
+        resources:
+          requests:
+            storage: 2Gi
+  haproxy:
+    enabled: true
+    size: 2
+    image: -haproxy
+    resources:
+      requests:
+        memory: 0.1G
+        cpu: 100m
+      limits:
+        memory: 1G
+        cpu: 700m
+    affinity:
+      antiAffinityTopologyKey: "kubernetes.io/hostname"
+  pmm:
+    enabled: false
+    image: perconalab/pmm-client:1.17.1
+    serverHost: monitoring-service
+    serverUser: pmm
+  backup:
+    image: -backup
+    storages:
+      pvc:
+        type: filesystem
+        volume:
+          persistentVolumeClaim:
+            accessModes: [ "ReadWriteOnce" ]
+            resources:
+              requests:
+                storage: 1Gi
+      aws-s3:
+        type: s3
+        s3:
+          region: us-east-1
+          bucket: operator-testing
+          credentialsSecret: aws-s3-secret
+      minio:
+        type: s3
+        s3:
+          credentialsSecret: minio-secret
+          region: us-east-1
+          bucket: operator-testing
+          endpointUrl: http://minio-service:9000/
+      gcp-cs:
+        type: s3
+        s3:
+          credentialsSecret: gcp-cs-secret
+          region: us-east-1
+          bucket: operator-testing
+          endpointUrl: https://storage.googleapis.com

e2e-tests/tls-issue-cert-manager/run

@@ -48,6 +48,21 @@ main() {
 	desc 'check ssl-internal certificate using HAProxy'
 	check_verify_identity "$cluster-haproxy"
 
+	desc 'update tls spec: change duration and add new SAN'
+	apply_config "$test_dir/conf/$cluster-updated.yml"
+	sleep 30
+
+	desc 'check if CA certificate updated'
+	compare_kubectl certificate/$cluster-ca-cert "-updated"
+
+	desc 'check if SSL certificate updated'
+	compare_kubectl certificate/$cluster-ssl "-updated"
+
+	wait_cluster_consistency "$cluster" 3 2
+
+	desc 'check ssl-internal certificate using PXC after update'
+	check_verify_identity "$cluster-pxc"
+
 	destroy $namespace
 	desc "test passed"
 }