Skip to content

Commit a76717b

Browse files
pooknullhorsinelpandzic
authored
K8SPSMDB-956: fix problems with TLS certificate renewal (#1287)
* K8SPSMDB-956: fix problems with TLS certificate renewal https://jira.percona.com/browse/K8SPSMDB-956 * refactor * add `tls-issue-cert-manager` test to `csv` files * wait for ca certs * update `cert-manager` * fix cert-manager test * increase sleep in `deploy_cert_manager` * add more sleep * fix deploy/bundle.yaml * fix `tls-issue-cert-manager` for cluster wide * update `cert-manager` url --------- Co-authored-by: Viacheslav Sarzhan <[email protected]> Co-authored-by: Inel Pandzic <[email protected]>
1 parent e6e206b commit a76717b

File tree

18 files changed

+612
-185
lines changed

18 files changed

+612
-185
lines changed

‎cmd/manager/main.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,8 @@ import (
1111
// to ensure that exec-entrypoint and run can make use of them.
1212
_ "k8s.io/client-go/plugin/pkg/client/auth"
1313

14+
certmgrscheme "github.com/cert-manager/cert-manager/pkg/client/clientset/versioned/scheme"
1415
"github.com/go-logr/logr"
15-
certmgrscheme "github.com/jetstack/cert-manager/pkg/client/clientset/versioned/scheme"
1616
uzap "go.uber.org/zap"
1717
"go.uber.org/zap/zapcore"
1818
k8sruntime "k8s.io/apimachinery/pkg/runtime"

‎e2e-tests/conf/cmctl.yml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: cmctl
5+
spec:
6+
replicas: 1
7+
selector:
8+
matchLabels:
9+
name: cmctl
10+
template:
11+
metadata:
12+
labels:
13+
name: cmctl
14+
spec:
15+
serviceAccountName: cmctl
16+
containers:
17+
- name: cmctl
18+
image: debian
19+
imagePullPolicy: Always
20+
command:
21+
- /bin/bash
22+
- -c
23+
- |
24+
apt-get update && apt-get install -y curl \
25+
&& curl -fsSL -o cmctl.tar.gz https://github.com/cert-manager/cert-manager/releases/latest/download/cmctl-linux-amd64.tar.gz \
26+
&& tar xzf cmctl.tar.gz \
27+
&& sleep 100500
28+
restartPolicy: Always

‎e2e-tests/functions

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ SKIP_BACKUPS_TO_AWS_GCP_AZURE=${SKIP_BACKUPS_TO_AWS_GCP_AZURE:-1}
1616
PMM_SERVER_VER=${PMM_SERVER_VER:-"9.9.9"}
1717
IMAGE_PMM_SERVER_REPO=${IMAGE_PMM_SERVER_REPO:-"perconalab/pmm-server"}
1818
IMAGE_PMM_SERVER_TAG=${IMAGE_PMM_SERVER_TAG:-"dev-latest"}
19-
CERT_MANAGER_VER="1.8.0"
19+
CERT_MANAGER_VER="1.12.3"
2020
tmp_dir=$(mktemp -d)
2121
sed=$(which gsed || which sed)
2222
date=$(which gdate || which date)
@@ -845,8 +845,9 @@ deploy_cert_manager() {
845845

846846
kubectl_bin create namespace cert-manager || :
847847
kubectl_bin label namespace cert-manager certmanager.k8s.io/disable-validation=true || :
848-
kubectl_bin apply -f "https://github.com/jetstack/cert-manager/releases/download/v${CERT_MANAGER_VER}/cert-manager.yaml" --validate=false || : 2>/dev/null
849-
sleep 30
848+
kubectl_bin apply -f "https://github.com/cert-manager/cert-manager/releases/download/v${CERT_MANAGER_VER}/cert-manager.yaml" --validate=false || : 2>/dev/null
849+
kubectl_bin -n cert-manager wait pod -l app.kubernetes.io/instance=cert-manager --for=condition=ready
850+
sleep 120
850851
}
851852

852853
delete_crd() {
@@ -891,7 +892,7 @@ destroy() {
891892

892893
delete_crd
893894

894-
kubectl_bin delete -f "https://github.com/jetstack/cert-manager/releases/download/v${CERT_MANAGER_VER}/cert-manager.yaml" 2>/dev/null || :
895+
kubectl_bin delete -f "https://github.com/cert-manager/cert-manager/releases/download/v${CERT_MANAGER_VER}/cert-manager.yaml" 2>/dev/null || :
895896
if [ -n "$OPENSHIFT" ]; then
896897
oc delete --grace-period=0 --force=true project "$namespace" &
897898
if [ -n "$OPERATOR_NS" ]; then

‎e2e-tests/run-distro.csv

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ pitr-physical
1919
recover-no-primary
2020
rs-shard-migration
2121
scaling
22+
tls-issue-cert-manager
2223
upgrade
2324
upgrade-sharded
2425
users

‎e2e-tests/run-minikube.csv

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ scheduled-backup
1515
security-context
1616
self-healing-chaos
1717
smart-update
18+
tls-issue-cert-manager
1819
upgrade-consistency
1920
upgrade-consistency-sharded
2021
users

‎e2e-tests/run-pr.csv

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ service-per-pod
3434
serviceless-external-nodes
3535
smart-update
3636
storage
37+
tls-issue-cert-manager
3738
upgrade
3839
upgrade-consistency
3940
upgrade-consistency-sharded

‎e2e-tests/run-release.csv

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ service-per-pod
3535
serviceless-external-nodes
3636
smart-update
3737
storage
38+
tls-issue-cert-manager
3839
upgrade
3940
upgrade-consistency
4041
upgrade-consistency-sharded

‎e2e-tests/tls-issue-cert-manager/compare/certificate_some-name-ssl-internal.yml

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: Certificate
3+
metadata:
4+
generation: 1
5+
name: some-name-ssl-internal
6+
ownerReferences:
7+
- blockOwnerDeletion: true
8+
controller: true
9+
kind: PerconaServerMongoDB
10+
name: some-name
11+
spec:
12+
commonName: some-name
13+
dnsNames:
14+
- localhost
15+
- some-name-rs0
16+
- some-name-rs0.NAME_SPACE
17+
- some-name-rs0.NAME_SPACE.svc.cluster.local
18+
- '*.some-name-rs0'
19+
- '*.some-name-rs0.NAME_SPACE'
20+
- '*.some-name-rs0.NAME_SPACE.svc.cluster.local'
21+
- some-name-rs0.NAME_SPACE.svc.clusterset.local
22+
- '*.some-name-rs0.NAME_SPACE.svc.clusterset.local'
23+
- '*.NAME_SPACE.svc.clusterset.local'
24+
- some-name-mongos
25+
- some-name-mongos.NAME_SPACE
26+
- some-name-mongos.NAME_SPACE.svc.cluster.local
27+
- '*.some-name-mongos'
28+
- '*.some-name-mongos.NAME_SPACE'
29+
- '*.some-name-mongos.NAME_SPACE.svc.cluster.local'
30+
- some-name-cfg
31+
- some-name-cfg.NAME_SPACE
32+
- some-name-cfg.NAME_SPACE.svc.cluster.local
33+
- '*.some-name-cfg'
34+
- '*.some-name-cfg.NAME_SPACE'
35+
- '*.some-name-cfg.NAME_SPACE.svc.cluster.local'
36+
- some-name-mongos.NAME_SPACE.svc.clusterset.local
37+
- '*.some-name-mongos.NAME_SPACE.svc.clusterset.local'
38+
- some-name-cfg.NAME_SPACE.svc.clusterset.local
39+
- '*.some-name-cfg.NAME_SPACE.svc.clusterset.local'
40+
duration: 2160h0m0s
41+
issuerRef:
42+
kind: Issuer
43+
name: some-name-psmdb-issuer
44+
secretName: some-name-ssl-internal
45+
subject:
46+
organizations:
47+
- PSMDB

‎e2e-tests/tls-issue-cert-manager/compare/certificate_some-name-ssl.yml

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: Certificate
3+
metadata:
4+
generation: 1
5+
name: some-name-ssl
6+
ownerReferences:
7+
- blockOwnerDeletion: true
8+
controller: true
9+
kind: PerconaServerMongoDB
10+
name: some-name
11+
spec:
12+
commonName: some-name
13+
dnsNames:
14+
- localhost
15+
- some-name-rs0
16+
- some-name-rs0.NAME_SPACE
17+
- some-name-rs0.NAME_SPACE.svc.cluster.local
18+
- '*.some-name-rs0'
19+
- '*.some-name-rs0.NAME_SPACE'
20+
- '*.some-name-rs0.NAME_SPACE.svc.cluster.local'
21+
- some-name-rs0.NAME_SPACE.svc.clusterset.local
22+
- '*.some-name-rs0.NAME_SPACE.svc.clusterset.local'
23+
- '*.NAME_SPACE.svc.clusterset.local'
24+
- some-name-mongos
25+
- some-name-mongos.NAME_SPACE
26+
- some-name-mongos.NAME_SPACE.svc.cluster.local
27+
- '*.some-name-mongos'
28+
- '*.some-name-mongos.NAME_SPACE'
29+
- '*.some-name-mongos.NAME_SPACE.svc.cluster.local'
30+
- some-name-cfg
31+
- some-name-cfg.NAME_SPACE
32+
- some-name-cfg.NAME_SPACE.svc.cluster.local
33+
- '*.some-name-cfg'
34+
- '*.some-name-cfg.NAME_SPACE'
35+
- '*.some-name-cfg.NAME_SPACE.svc.cluster.local'
36+
- some-name-mongos.NAME_SPACE.svc.clusterset.local
37+
- '*.some-name-mongos.NAME_SPACE.svc.clusterset.local'
38+
- some-name-cfg.NAME_SPACE.svc.clusterset.local
39+
- '*.some-name-cfg.NAME_SPACE.svc.clusterset.local'
40+
duration: 2160h0m0s
41+
issuerRef:
42+
kind: Issuer
43+
name: some-name-psmdb-issuer
44+
secretName: some-name-ssl
45+
subject:
46+
organizations:
47+
- PSMDB

‎e2e-tests/tls-issue-cert-manager/compare/issuer_some-name-psmdb-ca-issuer.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: Issuer
3+
metadata:
4+
generation: 1
5+
name: some-name-psmdb-ca-issuer
6+
ownerReferences:
7+
- blockOwnerDeletion: true
8+
controller: true
9+
kind: PerconaServerMongoDB
10+
name: some-name
11+
spec:
12+
selfSigned: {}

0 commit comments

Comments
 (0)