K8SPXC-1848: update existing cert-manager Certificate CRs on operator upgrade

e2e-tests/tls-issue-cert-manager/compare/certificate_some-name-tls-issue-ca-cert-updated.yml

@@ -0,0 +1,19 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  generation: 2
+  labels:
+    app.kubernetes.io/instance: some-name-tls-issue
+    app.kubernetes.io/managed-by: percona-xtradb-cluster-operator
+    app.kubernetes.io/name: percona-xtradb-cluster
+    app.kubernetes.io/part-of: percona-xtradb-cluster
+  name: some-name-tls-issue-ca-cert
+spec:
+  commonName: some-name-tls-issue-ca
+  duration: 20000h0m0s
+  isCA: true
+  issuerRef:
+    kind: Issuer
+    name: some-name-tls-issue-pxc-ca-issuer
+  renewBefore: 730h0m0s
+  secretName: some-name-tls-issue-ca-cert

e2e-tests/tls-issue-cert-manager/compare/certificate_some-name-tls-issue-ssl-updated.yml

@@ -0,0 +1,24 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  generation: 2
+  labels:
+    app.kubernetes.io/instance: some-name-tls-issue
+    app.kubernetes.io/managed-by: percona-xtradb-cluster-operator
+    app.kubernetes.io/name: percona-xtradb-cluster
+    app.kubernetes.io/part-of: percona-xtradb-cluster
+  name: some-name-tls-issue-ssl
+spec:
+  commonName: some-name-tls-issue-proxysql
+  dnsNames:
+    - some-name-tls-issue-pxc
+    - some-name-tls-issue-proxysql
+    - '*.some-name-tls-issue-pxc'
+    - '*.some-name-tls-issue-proxysql'
+    - test.com
+    - new-san.example.com
+  duration: 2160h0m0s
+  issuerRef:
+    kind: Issuer
+    name: some-name-tls-issue-pxc-issuer
+  secretName: some-name-tls-issue-ssl

e2e-tests/tls-issue-cert-manager/conf/some-name-tls-issue-updated.yml

@@ -0,0 +1,100 @@
+apiVersion: pxc.percona.com/v1
+kind: PerconaXtraDBCluster
+metadata:
+  name: some-name-tls-issue
+  finalizers:
+    - percona.com/delete-pxc-pods-in-order
+spec:
+  tls:
+   certValidityDuration: 2160h
+   caValidityDuration: 20000h
+   SANs:
+     - test.com
+     - new-san.example.com
+  secretsName: my-cluster-secrets
+  vaultSecretName: some-name-vault
+  pause: false
+  pxc:
+    size: 3
+    image: -pxc
+    resources:
+      requests:
+        memory: 0.1G
+        cpu: 100m
+      limits:
+        memory: "2G"
+        cpu: "1"
+    volumeSpec:
+      persistentVolumeClaim:
+        resources:
+          requests:
+            storage: 2Gi
+    affinity:
+      antiAffinityTopologyKey: "kubernetes.io/hostname"
+  proxysql:
+    enabled: false
+    size: 2
+    image: -proxysql
+    resources:
+      requests:
+        memory: 0.1G
+        cpu: 100m
+      limits:
+        memory: 1G
+        cpu: 700m
+    affinity:
+      antiAffinityTopologyKey: "kubernetes.io/hostname"
+    volumeSpec:
+      persistentVolumeClaim:
+        resources:
+          requests:
+            storage: 2Gi
+  haproxy:
+    enabled: true
+    size: 2
+    image: -haproxy
+    resources:
+      requests:
+        memory: 0.1G
+        cpu: 100m
+      limits:
+        memory: 1G
+        cpu: 700m
+    affinity:
+      antiAffinityTopologyKey: "kubernetes.io/hostname"
+  pmm:
+    enabled: false
+    image: perconalab/pmm-client:1.17.1
+    serverHost: monitoring-service
+    serverUser: pmm
+  backup:
+    image: -backup
+    storages:
+      pvc:
+        type: filesystem
+        volume:
+          persistentVolumeClaim:
+            accessModes: [ "ReadWriteOnce" ]
+            resources:
+              requests:
+                storage: 1Gi
+      aws-s3:
+        type: s3
+        s3:
+          region: us-east-1
+          bucket: operator-testing
+          credentialsSecret: aws-s3-secret
+      minio:
+        type: s3
+        s3:
+          credentialsSecret: minio-secret
+          region: us-east-1
+          bucket: operator-testing
+          endpointUrl: http://minio-service:9000/
+      gcp-cs:
+        type: s3
+        s3:
+          credentialsSecret: gcp-cs-secret
+          region: us-east-1
+          bucket: operator-testing
+          endpointUrl: https://storage.googleapis.com

e2e-tests/tls-issue-cert-manager/run

@@ -17,6 +17,25 @@ check_verify_identity() {
 		bash -c "printf '%s\n' \"${command}\" | mysql -sN $args"
 }
 
+wait_for_certificate_generation() {
+	local certificate="$1"
+	local target_generation="$2"
+	local retries="${3:-36}"
+	local current_generation
+
+	for _ in $(seq 1 "$retries"); do
+		current_generation=$(kubectl_bin get certificate "$certificate" -o jsonpath='{.metadata.generation}' 2>/dev/null || true)
+		if [ "$current_generation" = "$target_generation" ]; then
+			return 0
+		fi
+		echo "Certificate $certificate is at generation ${current_generation:-unknown}; waiting for generation $target_generation"
+		sleep 5
+	done
+
+	echo "Certificate $certificate did not reach generation $target_generation after $retries retries"
+	return 1
+}
+
 trigger_ca_rotation() {
 	desc 'set rotationPolicy=Always on CA certificate'
 	kubectl_bin patch certificate "$cluster-ca-cert" --type=merge \
@@ -138,6 +157,24 @@ main() {
 	desc 'check ssl-internal certificate using HAProxy'
 	check_verify_identity "$cluster-haproxy"
 
+	desc 'update tls spec: change duration and add new SAN'
+	apply_config "$test_dir/conf/$cluster-updated.yml"
+
+	desc 'wait for cert-manager certificate specs to be updated'
+	wait_for_certificate_generation "$cluster-ca-cert" 2
+	wait_for_certificate_generation "$cluster-ssl" 2
+
+	desc 'check if CA certificate updated'
+	compare_kubectl certificate/$cluster-ca-cert "-updated"
+
+	desc 'check if SSL certificate updated'
+	compare_kubectl certificate/$cluster-ssl "-updated"
+
+	wait_cluster_consistency "$cluster" 3 2
+
+	desc 'check ssl-internal certificate using PXC after update'
+	check_verify_identity "$cluster-pxc"
+
 	desc 'trigger CA rotation and verify leaf cert re-issuance'
 	trigger_ca_rotation