K8SPSMDB-1418: Allow setting CA for backup storages by nmarukovich · Pull Request #2164 · percona/percona-server-mongodb-operator

nmarukovich · 2025-12-23T13:52:47Z

CHANGE DESCRIPTION

Problem:
Currently, when using MinIO with corporate PKI, users must set insecureSkipTLSVerify: true, which disables TLS validation entirely. This is a security concern for production environments.
Cause:
Short explanation of the root cause of the issue if applicable.

Solution:
This PR adds support for custom CA bundles when using MinIO as backup storage with corporate PKI certificates. The operator now mounts CA certificates into backup-agent containers and configures the SSL_CERT_FILE environment variable for TLS validation.

Added caBundle field to BackupStorageMinioSpec

Volume Management:

For 1+ CA bundles: Creates ProjectedVolume that merges certificates
Mounts to /etc/s3/certs-in/ (read-only) and /etc/s3/certs/ (read-write emptyDir)
Entrypoint script merges certificates: cat /etc/s3/certs-in/*.crt > /etc/s3/certs/ca-bundle.crt

Key Features:

Auto-merge: Multiple CA bundles are automatically merged into single file
Default key: If key is not specified, defaults to ca.crt
Items filtering: Only specified key is mounted from Secret (prevents mounting tls.crt, tls.key from cert-manager Secrets)
Version gated: Only applies to CR version >= 1.22.0

CHECKLIST

Jira

Is the Jira ticket created and referenced properly?
Does the Jira ticket have the proper statuses for documentation (Needs Doc) and QA (Needs QA)?
Does the Jira ticket link to the proper milestone (Fix Version field)?

Tests

Is an E2E test/test case added for the new feature/change?
Are unit tests added where appropriate?
Are OpenShift compare files changed for E2E tests (compare/*-oc.yml)?

Config/Logging/Testability

Are all needed new/changed options added to default YAML files?
Are all needed new/changed options added to the Helm Chart?
Did we add proper logging messages for operator actions?
Did we ensure compatibility with the previous version or cluster upgrade process?
Does the change support oldest and newest supported MongoDB version?
Does the change support oldest and newest supported Kubernetes version?

github-actions · 2025-12-23T13:53:10Z

build/pbm-entry.sh

+    cat /etc/s3/certs-in/*.crt > /etc/s3/certs/ca-bundle.crt
+    chmod 0644 /etc/s3/certs/ca-bundle.crt


[shfmt] _{reported by reviewdog 🐶}

Suggested change

cat /etc/s3/certs-in/*.crt > /etc/s3/certs/ca-bundle.crt

chmod 0644 /etc/s3/certs/ca-bundle.crt

cat /etc/s3/certs-in/*.crt >/etc/s3/certs/ca-bundle.crt

chmod 0644 /etc/s3/certs/ca-bundle.crt

github-actions · 2025-12-25T13:21:29Z

e2e-tests/demand-backup-physical-minio-native-tls/run

+EOF
+
+kubectl_bin wait --for=condition=Ready certificate/minio-cert \
+  -n ${namespace} --timeout=120s


[shfmt] _{reported by reviewdog 🐶}

Suggested change

-n ${namespace} --timeout=120s

-n ${namespace} --timeout=120s

github-actions · 2025-12-25T13:21:30Z

e2e-tests/demand-backup-physical-minio-native-tls/run

+  -n ${namespace} --timeout=120s
+
+kubectl_bin get secret minio-tls-temp -n ${namespace} \
+  -o jsonpath='{.data.tls\.crt}' | base64 -d > /tmp/minio-cert.pem


[shfmt] _{reported by reviewdog 🐶}

Suggested change

-o jsonpath='{.data.tls\.crt}' | base64 -d > /tmp/minio-cert.pem

-o jsonpath='{.data.tls\.crt}' | base64 -d >/tmp/minio-cert.pem

github-actions · 2025-12-25T13:21:30Z

e2e-tests/demand-backup-physical-minio-native-tls/run

+  -o jsonpath='{.data.tls\.crt}' | base64 -d > /tmp/minio-cert.pem
+
+kubectl_bin get secret minio-tls-temp -n ${namespace} \
+  -o jsonpath='{.data.tls\.key}' | base64 -d > /tmp/minio-key.pem


[shfmt] _{reported by reviewdog 🐶}

Suggested change

-o jsonpath='{.data.tls\.key}' | base64 -d > /tmp/minio-key.pem

-o jsonpath='{.data.tls\.key}' | base64 -d >/tmp/minio-key.pem

github-actions · 2025-12-25T13:21:30Z

e2e-tests/demand-backup-physical-minio-native-tls/run

+  --from-file=public.crt=/tmp/minio-cert.pem \
+  --from-file=private.key=/tmp/minio-key.pem


[shfmt] _{reported by reviewdog 🐶}

Suggested change

--from-file=public.crt=/tmp/minio-cert.pem \

--from-file=private.key=/tmp/minio-key.pem

--from-file=public.crt=/tmp/minio-cert.pem \

--from-file=private.key=/tmp/minio-key.pem

github-actions · 2025-12-25T13:21:30Z

e2e-tests/demand-backup-physical-minio-native-tls/run

+  --from-file=private.key=/tmp/minio-key.pem
+
+kubectl_bin create secret generic minio-ca-bundle -n ${namespace} \
+  --from-file=ca.crt=/tmp/minio-cert.pem


[shfmt] _{reported by reviewdog 🐶}

Suggested change

--from-file=ca.crt=/tmp/minio-cert.pem

--from-file=ca.crt=/tmp/minio-cert.pem

…ver-mongodb-operator into K8SPSMDB-1418_add_ca

mayankshah1607 · 2025-12-29T11:14:10Z

pkg/apis/psmdb/v1/psmdb_types.go

+	MaxUploadParts        int32                     `json:"maxUploadParts,omitempty"`
+	StorageClass          string                    `json:"storageClass,omitempty"`
+	InsecureSkipTLSVerify bool                      `json:"insecureSkipTLSVerify,omitempty"`
+	CABundle              *corev1.SecretKeySelector `json:"caBundle,omitempty"`


Please update PR description if we plan to add it to S3 as well

no, we want to keep it only for minio type.

Then should we remove it from here? It is specified in the S3 type as well

mayankshah1607 · 2025-12-29T11:20:36Z

pkg/psmdb/statefulset.go

+		if storage.Type == api.BackupStorageMinio {
+			if storage.Minio.CABundle != nil &&
+				storage.Minio.CABundle.Name != "" &&
+				storage.Minio.CABundle.Key != "" {


Should we default the key to ca.crt if unspecified?

Ye, I think it's a good suggestion. Added.

pkg/psmdb/statefulset.go

Co-authored-by: Mayank Shah <mayank.shah@percona.com>

mayankshah1607 · 2025-12-30T07:42:58Z

pkg/psmdb/statefulset.go

 	return result
 }
+
+type caRef struct{ Name, Key string }


Do we really need a new type for this? Can't we use SecretKeySelector, since it contains the same fields?

mayankshah1607 · 2025-12-30T07:45:27Z

pkg/psmdb/statefulset.go

+		cas := collectStorageCABundles(cr)
+		if len(cas) == 1 {
+			c.VolumeMounts = append(c.VolumeMounts, corev1.VolumeMount{
+				Name:      naming.BackupStorageCAFileVolumeName,
+				MountPath: naming.BackupStorageCAFileDirectory,
+				ReadOnly:  true,
+			})
+
+		} else if len(cas) > 1 {
+			c.VolumeMounts = append(c.VolumeMounts,
+				corev1.VolumeMount{
+					Name:      "ca-bundle-in",
+					MountPath: "/etc/s3/certs-in",
+					ReadOnly:  true,
+				},
+				corev1.VolumeMount{
+					Name:      naming.BackupStorageCAFileVolumeName,
+					MountPath: naming.BackupStorageCAFileDirectory,
+					ReadOnly:  false,
+				},
+			)
+		}


Can we extract this to a helper function like getCAVolumes and getCAVolumeMounts? Might help reduce the overall complexity of the outer function and also allow us to add a basic unit test..

We can also do a bit of re-write to eleminate the else if by doing an early return, wdyt?

mayankshah1607 · 2025-12-30T07:49:31Z

pkg/psmdb/statefulset.go

+	if cr.CompareVersion("1.22.0") >= 0 && cr.Spec.Backup.Enabled {
+		cas := collectStorageCABundles(cr)
+
+		if len(cas) == 1 {


On another thought, I wonder if we really need to check the length of the provided CAs..

What if the user-provided CAs always go to the ca-bundle-in volume (even if 1 CA is specified), and the init container append everything to the ca-bundle.crt in the emptydir volume like it does now.. That way we don't have to check the length here and can simplify the code, wdyt?

mayankshah1607 · 2025-12-30T07:50:50Z

pkg/apis/psmdb/v1/psmdb_types.go

+	MaxUploadParts        int32                     `json:"maxUploadParts,omitempty"`
+	StorageClass          string                    `json:"storageClass,omitempty"`
+	InsecureSkipTLSVerify bool                      `json:"insecureSkipTLSVerify,omitempty"`
+	CABundle              *corev1.SecretKeySelector `json:"caBundle,omitempty"`


Then should we remove it from here? It is specified in the S3 type as well

…ator into K8SPSMDB-1418_add_ca

github-actions · 2026-01-15T10:50:27Z

e2e-tests/demand-backup-physical-minio-native-tls/run

+desc 'Verify CA bundle infrastructure'
+
+kubectl_bin exec ${cluster}-rs0-0 -n ${namespace} -c backup-agent -- \
+  test -f /etc/s3/certs/ca-bundle.crt


[shfmt] _{reported by reviewdog 🐶}

Suggested change

test -f /etc/s3/certs/ca-bundle.crt

test -f /etc/s3/certs/ca-bundle.crt

github-actions · 2026-01-15T10:50:28Z

e2e-tests/demand-backup-physical-minio-native-tls/run

+  test -f /etc/s3/certs/ca-bundle.crt
+
+kubectl_bin exec ${cluster}-rs0-0 -n ${namespace} -c backup-agent -- \
+  env | grep SSL_CERT_FILE


[shfmt] _{reported by reviewdog 🐶}

Suggested change

env | grep SSL_CERT_FILE

env | grep SSL_CERT_FILE

github-actions · 2026-01-15T10:50:28Z

e2e-tests/demand-backup-physical-minio-native-tls/run

+  env | grep SSL_CERT_FILE
+
+cert_count=$(kubectl_bin exec ${cluster}-rs0-0 -n ${namespace} -c backup-agent -- \
+  grep -c "BEGIN CERTIFICATE" /etc/s3/certs/ca-bundle.crt)


[shfmt] _{reported by reviewdog 🐶}

Suggested change

grep -c "BEGIN CERTIFICATE" /etc/s3/certs/ca-bundle.crt)

grep -c "BEGIN CERTIFICATE" /etc/s3/certs/ca-bundle.crt)

github-actions · 2026-01-15T10:50:28Z

e2e-tests/demand-backup-physical-minio-native-tls/run

+EOF
+
+kubectl_bin wait --for=condition=Ready certificate/minio2-cert \
+  -n ${namespace} --timeout=120s


[shfmt] _{reported by reviewdog 🐶}

Suggested change

-n ${namespace} --timeout=120s

-n ${namespace} --timeout=120s

github-actions · 2026-01-15T10:50:28Z

e2e-tests/demand-backup-physical-minio-native-tls/run

+  -n ${namespace} --timeout=120s
+
+kubectl_bin get secret minio2-tls-temp -n ${namespace} \
+  -o jsonpath='{.data.tls\.crt}' | base64 -d > /tmp/minio2-cert.pem


[shfmt] _{reported by reviewdog 🐶}

Suggested change

-o jsonpath='{.data.tls\.crt}' | base64 -d > /tmp/minio2-cert.pem

-o jsonpath='{.data.tls\.crt}' | base64 -d >/tmp/minio2-cert.pem

github-actions · 2026-01-15T10:50:28Z

e2e-tests/demand-backup-physical-minio-native-tls/run

+  --from-file=private.key=/tmp/minio2-key.pem
+
+kubectl_bin create secret generic minio2-ca-bundle -n ${namespace} \
+  --from-file=ca.crt=/tmp/minio2-cert.pem


[shfmt] _{reported by reviewdog 🐶}

Suggested change

--from-file=ca.crt=/tmp/minio2-cert.pem

--from-file=ca.crt=/tmp/minio2-cert.pem

github-actions · 2026-01-15T10:50:28Z

e2e-tests/demand-backup-physical-minio-native-tls/run

+
+desc "Verify merged CA bundle"
+cert_count=$(kubectl_bin exec ${cluster}-rs0-0 -n ${namespace} -c backup-agent -- \
+  grep -c "BEGIN CERTIFICATE" /etc/s3/certs/ca-bundle.crt)


[shfmt] _{reported by reviewdog 🐶}

Suggested change

grep -c "BEGIN CERTIFICATE" /etc/s3/certs/ca-bundle.crt)

grep -c "BEGIN CERTIFICATE" /etc/s3/certs/ca-bundle.crt)

github-actions · 2026-01-15T10:50:28Z

e2e-tests/demand-backup-physical-minio-native-tls/run

+  'db.createUser({user:"myApp",pwd:"myPass",roles:[{db:"myApp",role:"readWrite"}]})' \
+  "userAdmin:userAdmin123456@${cluster}-rs0.${namespace}"


[shfmt] _{reported by reviewdog 🐶}

Suggested change

'db.createUser({user:"myApp",pwd:"myPass",roles:[{db:"myApp",role:"readWrite"}]})' \

"userAdmin:userAdmin123456@${cluster}-rs0.${namespace}"

'db.createUser({user:"myApp",pwd:"myPass",roles:[{db:"myApp",role:"readWrite"}]})' \

"userAdmin:userAdmin123456@${cluster}-rs0.${namespace}"

github-actions · 2026-01-15T10:50:28Z

e2e-tests/demand-backup-physical-minio-native-tls/run

+  'db.getSiblingDB("myApp").test.insert({ x: 100500 })' \
+  "myApp:myPass@${cluster}-rs0.${namespace}"


[shfmt] _{reported by reviewdog 🐶}

Suggested change

'db.getSiblingDB("myApp").test.insert({ x: 100500 })' \

"myApp:myPass@${cluster}-rs0.${namespace}"

'db.getSiblingDB("myApp").test.insert({ x: 100500 })' \

"myApp:myPass@${cluster}-rs0.${namespace}"

github-actions · 2026-01-15T10:50:28Z

e2e-tests/demand-backup-physical-minio-native-tls/run

+  'db.getSiblingDB("myApp").test.drop()' \
+  "myApp:myPass@${cluster}-rs0.${namespace}"


[shfmt] _{reported by reviewdog 🐶}

Suggested change

'db.getSiblingDB("myApp").test.drop()' \

"myApp:myPass@${cluster}-rs0.${namespace}"

'db.getSiblingDB("myApp").test.drop()' \

"myApp:myPass@${cluster}-rs0.${namespace}"

github-actions · 2026-01-15T10:50:28Z

e2e-tests/demand-backup-physical-minio-native-tls/run

+desc 'Verify CA bundle infrastructure'
+
+kubectl_bin exec ${cluster}-rs0-0 -n ${namespace} -c backup-agent -- \
+  test -f /etc/s3/certs/ca-bundle.crt


[shfmt] _{reported by reviewdog 🐶}

Suggested change

test -f /etc/s3/certs/ca-bundle.crt

test -f /etc/s3/certs/ca-bundle.crt

github-actions · 2026-01-15T10:50:28Z

e2e-tests/demand-backup-physical-minio-native-tls/run

+  test -f /etc/s3/certs/ca-bundle.crt
+
+kubectl_bin exec ${cluster}-rs0-0 -n ${namespace} -c backup-agent -- \
+  env | grep SSL_CERT_FILE


[shfmt] _{reported by reviewdog 🐶}

Suggested change

env | grep SSL_CERT_FILE

env | grep SSL_CERT_FILE

github-actions · 2026-01-15T10:50:28Z

e2e-tests/demand-backup-physical-minio-native-tls/run

+  env | grep SSL_CERT_FILE
+
+cert_count=$(kubectl_bin exec ${cluster}-rs0-0 -n ${namespace} -c backup-agent -- \
+  grep -c "BEGIN CERTIFICATE" /etc/s3/certs/ca-bundle.crt)


[shfmt] _{reported by reviewdog 🐶}

Suggested change

grep -c "BEGIN CERTIFICATE" /etc/s3/certs/ca-bundle.crt)

grep -c "BEGIN CERTIFICATE" /etc/s3/certs/ca-bundle.crt)

github-actions · 2026-01-15T10:50:28Z

e2e-tests/demand-backup-physical-minio-native-tls/run

+EOF
+
+kubectl_bin wait --for=condition=Ready certificate/minio2-cert \
+  -n ${namespace} --timeout=120s


[shfmt] _{reported by reviewdog 🐶}

Suggested change

-n ${namespace} --timeout=120s

-n ${namespace} --timeout=120s

github-actions · 2026-01-15T10:50:28Z

e2e-tests/demand-backup-physical-minio-native-tls/run

+  -n ${namespace} --timeout=120s
+
+kubectl_bin get secret minio2-tls-temp -n ${namespace} \
+  -o jsonpath='{.data.tls\.crt}' | base64 -d > /tmp/minio2-cert.pem


[shfmt] _{reported by reviewdog 🐶}

Suggested change

-o jsonpath='{.data.tls\.crt}' | base64 -d > /tmp/minio2-cert.pem

-o jsonpath='{.data.tls\.crt}' | base64 -d >/tmp/minio2-cert.pem

github-actions · 2026-01-15T10:50:29Z

e2e-tests/demand-backup-physical-minio-native-tls/run

+  --from-file=private.key=/tmp/minio2-key.pem
+
+kubectl_bin create secret generic minio2-ca-bundle -n ${namespace} \
+  --from-file=ca.crt=/tmp/minio2-cert.pem


[shfmt] _{reported by reviewdog 🐶}

Suggested change

--from-file=ca.crt=/tmp/minio2-cert.pem

--from-file=ca.crt=/tmp/minio2-cert.pem

github-actions · 2026-01-15T10:50:29Z

e2e-tests/demand-backup-physical-minio-native-tls/run

+
+desc "Verify merged CA bundle"
+cert_count=$(kubectl_bin exec ${cluster}-rs0-0 -n ${namespace} -c backup-agent -- \
+  grep -c "BEGIN CERTIFICATE" /etc/s3/certs/ca-bundle.crt)


[shfmt] _{reported by reviewdog 🐶}

Suggested change

grep -c "BEGIN CERTIFICATE" /etc/s3/certs/ca-bundle.crt)

grep -c "BEGIN CERTIFICATE" /etc/s3/certs/ca-bundle.crt)

github-actions · 2026-01-15T10:50:29Z

e2e-tests/demand-backup-physical-minio-native-tls/run

+  'db.createUser({user:"myApp",pwd:"myPass",roles:[{db:"myApp",role:"readWrite"}]})' \
+  "userAdmin:userAdmin123456@${cluster}-rs0.${namespace}"


[shfmt] _{reported by reviewdog 🐶}

Suggested change

'db.createUser({user:"myApp",pwd:"myPass",roles:[{db:"myApp",role:"readWrite"}]})' \

"userAdmin:userAdmin123456@${cluster}-rs0.${namespace}"

'db.createUser({user:"myApp",pwd:"myPass",roles:[{db:"myApp",role:"readWrite"}]})' \

"userAdmin:userAdmin123456@${cluster}-rs0.${namespace}"

github-actions · 2026-01-15T10:50:29Z

e2e-tests/demand-backup-physical-minio-native-tls/run

+  'db.getSiblingDB("myApp").test.insert({ x: 100500 })' \
+  "myApp:myPass@${cluster}-rs0.${namespace}"


[shfmt] _{reported by reviewdog 🐶}

Suggested change

'db.getSiblingDB("myApp").test.insert({ x: 100500 })' \

"myApp:myPass@${cluster}-rs0.${namespace}"

'db.getSiblingDB("myApp").test.insert({ x: 100500 })' \

"myApp:myPass@${cluster}-rs0.${namespace}"

github-actions · 2026-01-15T10:50:29Z

e2e-tests/demand-backup-physical-minio-native-tls/run

+  'db.getSiblingDB("myApp").test.drop()' \
+  "myApp:myPass@${cluster}-rs0.${namespace}"


[shfmt] _{reported by reviewdog 🐶}

Suggested change

'db.getSiblingDB("myApp").test.drop()' \

"myApp:myPass@${cluster}-rs0.${namespace}"

'db.getSiblingDB("myApp").test.drop()' \

"myApp:myPass@${cluster}-rs0.${namespace}"

JNKPercona · 2026-01-19T15:41:43Z

Test Name	Result	Time
arbiter	passed	00:00:00
balancer	passed	00:00:00
cross-site-sharded	passed	00:00:00
custom-replset-name	passed	00:00:00
custom-tls	passed	00:00:00
custom-users-roles	passed	00:00:00
custom-users-roles-sharded	passed	00:00:00
data-at-rest-encryption	passed	00:00:00
data-sharded	passed	00:00:00
demand-backup	passed	00:00:00
demand-backup-eks-credentials-irsa	passed	00:00:00
demand-backup-fs	passed	00:00:00
demand-backup-if-unhealthy	passed	00:00:00
demand-backup-incremental	passed	00:00:00
demand-backup-incremental-sharded	passed	00:00:00
demand-backup-physical-parallel	passed	00:00:00
demand-backup-physical-aws	passed	00:00:00
demand-backup-physical-azure	passed	00:00:00
demand-backup-physical-gcp-s3	passed	00:00:00
demand-backup-physical-gcp-native	passed	00:00:00
demand-backup-physical-minio	passed	00:00:00
demand-backup-physical-minio-native	passed	00:00:00
demand-backup-physical-minio-native-tls	passed	00:00:00
demand-backup-physical-sharded-parallel	passed	00:00:00
demand-backup-physical-sharded-aws	passed	00:00:00
demand-backup-physical-sharded-azure	passed	00:00:00
demand-backup-physical-sharded-gcp-native	passed	00:00:00
demand-backup-physical-sharded-minio	passed	00:00:00
demand-backup-physical-sharded-minio-native	passed	00:00:00
demand-backup-sharded	passed	00:00:00
disabled-auth	passed	00:00:00
expose-sharded	passed	00:00:00
finalizer	passed	00:00:00
ignore-labels-annotations	passed	00:00:00
init-deploy	passed	00:00:00
ldap	passed	00:00:00
ldap-tls	passed	00:00:00
limits	passed	00:00:00
liveness	passed	00:00:00
mongod-major-upgrade	passed	00:00:00
mongod-major-upgrade-sharded	passed	00:00:00
monitoring-2-0	passed	00:00:00
monitoring-pmm3	passed	00:00:00
multi-cluster-service	passed	00:00:00
multi-storage	failure	00:02:33
non-voting-and-hidden	passed	00:00:00
one-pod	passed	00:00:00
operator-self-healing-chaos	passed	00:00:00
pitr	passed	00:00:00
pitr-physical	passed	00:00:00
pitr-sharded	passed	00:00:00
pitr-to-new-cluster	passed	00:00:00
pitr-physical-backup-source	passed	00:00:00
preinit-updates	passed	00:00:00
pvc-resize	passed	00:00:00
recover-no-primary	passed	00:00:00
replset-overrides	passed	00:00:00
replset-remapping	passed	00:00:00
replset-remapping-sharded	passed	00:00:00
rs-shard-migration	passed	00:00:00
scaling	passed	00:00:00
scheduled-backup	passed	00:00:00
security-context	passed	00:00:00
self-healing-chaos	passed	00:00:00
service-per-pod	passed	00:00:00
serviceless-external-nodes	passed	00:00:00
smart-update	passed	00:00:00
split-horizon	passed	00:00:00
stable-resource-version	passed	00:00:00
storage	passed	00:00:00
tls-issue-cert-manager	passed	00:00:00
unsafe-psa	passed	00:00:00
upgrade	passed	00:00:00
upgrade-consistency	passed	00:00:00
upgrade-consistency-sharded-tls	passed	00:00:00
upgrade-sharded	passed	00:00:00
upgrade-partial-backup	passed	00:00:00
users	passed	00:00:00
users-vault	passed	00:00:00
version-service	passed	00:00:00

Summary	Value
Tests Run	80/80
Job Duration	00:33:17
Total Test Time	00:02:33

commit: 698b94e
image: perconalab/percona-server-mongodb-operator:PR-2164-698b94ee

K8SPSMDB-1418 add ca)

1ef0ddf

pull-request-size bot added the size/XL 500-999 lines label Dec 23, 2025

github-actions bot added tests build labels Dec 23, 2025

github-actions bot reviewed Dec 23, 2025

View reviewed changes

nmarukovich changed the title ~~K8SPSMDB-1418 add ca)~~ K8SPSMDB-1418 add ca Dec 24, 2025

update test

43e926e

pull-request-size bot added size/XXL 1000+ lines and removed size/XL 500-999 lines labels Dec 25, 2025

github-actions bot reviewed Dec 25, 2025

View reviewed changes

nmarukovich and others added 4 commits December 26, 2025 12:29

fix test

4b36ccb

Merge branch 'main' into K8SPSMDB-1418_add_ca

4b54399

fix tests

a8342c4

Merge branch 'K8SPSMDB-1418_add_ca' of github.com:percona/percona-ser…

4a4c178

…ver-mongodb-operator into K8SPSMDB-1418_add_ca

nmarukovich marked this pull request as ready for review December 29, 2025 07:55

nmarukovich requested review from egegunes, eleo007, gkech, hors, jvpasinatto, pooknull and valmiranogueira as code owners December 29, 2025 07:55

nmarukovich and others added 4 commits December 29, 2025 13:12

fix condition

663b1ab

Merge branch 'main' into K8SPSMDB-1418_add_ca

42d6719

fix test

c088d47

Merge branch 'K8SPSMDB-1418_add_ca' of github.com:percona/percona-ser…

e2f8710

…ver-mongodb-operator into K8SPSMDB-1418_add_ca

mayankshah1607 requested changes Dec 29, 2025

View reviewed changes

nmarukovich and others added 2 commits December 29, 2025 13:44

Update pkg/psmdb/statefulset.go

5554967

Co-authored-by: Mayank Shah <mayank.shah@percona.com>

add default value

0f91076

mayankshah1607 reviewed Dec 30, 2025

View reviewed changes

nmarukovich added 2 commits January 14, 2026 09:46

Merge branch 'main' of github.com:percona/percona-server-mongodb-oper…

1649cc3

…ator into K8SPSMDB-1418_add_ca

fix PR comments

38a04f7

gkech previously approved these changes Jan 14, 2026

View reviewed changes

nmarukovich requested a review from egegunes January 14, 2026 12:04

egegunes previously approved these changes Jan 14, 2026

View reviewed changes

mayankshah1607 previously approved these changes Jan 15, 2026

View reviewed changes

fix test

e7d1f5c

nmarukovich dismissed stale reviews from mayankshah1607, egegunes, and gkech via e7d1f5c January 15, 2026 10:50

github-actions bot reviewed Jan 15, 2026

View reviewed changes

nmarukovich and others added 2 commits January 15, 2026 16:20

fix generation

e90ae97

Merge branch 'main' into K8SPSMDB-1418_add_ca

fed7fad

egegunes previously approved these changes Jan 16, 2026

View reviewed changes

nmarukovich added 2 commits January 16, 2026 12:07

Merge branch 'main' into K8SPSMDB-1418_add_ca

a8bdd49

Merge branch 'main' into K8SPSMDB-1418_add_ca

698b94e

hors previously approved these changes Jan 19, 2026

View reviewed changes

hors self-requested a review January 19, 2026 10:41

mayankshah1607 previously approved these changes Jan 19, 2026

View reviewed changes

gkech previously approved these changes Jan 19, 2026

View reviewed changes

fix multi-storage test

9c2c4e2

hors dismissed stale reviews from gkech, mayankshah1607, egegunes, and themself via 9c2c4e2 January 19, 2026 17:01

Merge branch 'main' into K8SPSMDB-1418_add_ca

4649e2d

hors merged commit 83f62ff into main Jan 19, 2026
12 checks passed

hors deleted the K8SPSMDB-1418_add_ca branch January 19, 2026 17:02

		cat /etc/s3/certs-in/*.crt > /etc/s3/certs/ca-bundle.crt
		chmod 0644 /etc/s3/certs/ca-bundle.crt

	-n ${namespace} --timeout=120s
	-n ${namespace} --timeout=120s

	-o jsonpath='{.data.tls\.crt}' \| base64 -d > /tmp/minio-cert.pem
	-o jsonpath='{.data.tls\.crt}' \| base64 -d >/tmp/minio-cert.pem

	-o jsonpath='{.data.tls\.key}' \| base64 -d > /tmp/minio-key.pem
	-o jsonpath='{.data.tls\.key}' \| base64 -d >/tmp/minio-key.pem

		--from-file=public.crt=/tmp/minio-cert.pem \
		--from-file=private.key=/tmp/minio-key.pem

	--from-file=ca.crt=/tmp/minio-cert.pem
	--from-file=ca.crt=/tmp/minio-cert.pem

	test -f /etc/s3/certs/ca-bundle.crt
	test -f /etc/s3/certs/ca-bundle.crt

	grep -c "BEGIN CERTIFICATE" /etc/s3/certs/ca-bundle.crt)
	grep -c "BEGIN CERTIFICATE" /etc/s3/certs/ca-bundle.crt)

	--from-file=ca.crt=/tmp/minio2-cert.pem
	--from-file=ca.crt=/tmp/minio2-cert.pem

		'db.createUser({user:"myApp",pwd:"myPass",roles:[{db:"myApp",role:"readWrite"}]})' \
		"userAdmin:userAdmin123456@${cluster}-rs0.${namespace}"

		'db.getSiblingDB("myApp").test.insert({ x: 100500 })' \
		"myApp:myPass@${cluster}-rs0.${namespace}"

		'db.getSiblingDB("myApp").test.drop()' \
		"myApp:myPass@${cluster}-rs0.${namespace}"

Conversation

nmarukovich commented Dec 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CHANGE DESCRIPTION

CHECKLIST

Uh oh!

github-actions bot Dec 23, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 25, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 25, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 25, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 25, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 25, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jan 15, 2026

nmarukovich commented Dec 23, 2025 •

edited

Loading