K8SPG-951: [WIP] add spec.issuerConf

[mayankshah1607]

CHANGE DESCRIPTION

Problem:

Adds support for specifying cert-manager issuer conf:

apiVersion: pgv2.percona.com/v2
kind: PerconaPGCluster
metadata:
  name: cluster1
spec:
  tls:
    issuerConf:
      name: some-selfsigned-issuer
      kind: ClusterIssuer
      group: cert-manager.io

CHECKLIST

Jira

• Is the Jira ticket created and referenced properly?
• Does the Jira ticket have the proper statuses for documentation (Needs Doc) and QA (Needs QA)?
• Does the Jira ticket link to the proper milestone (Fix Version field)?

Tests

• Is an E2E test/test case added for the new feature/change?
• Are unit tests added where appropriate?

Config/Logging/Testability

• Are all needed new/changed options added to default YAML files?
• Are all needed new/changed options added to the Helm Chart?
• Did we add proper logging messages for operator actions?
• Did we ensure compatibility with the previous version or cluster upgrade process?
• Does the change support oldest and newest supported PG version?
• Does the change support oldest and newest supported Kubernetes version?

[Copilot]

Pull request overview

Adds spec.tls.issuerConf to the PostgresCluster API to support multiple cert-manager issuer modes (managed namespaced Issuer, managed cluster-scoped ClusterIssuer, and external/third-party issuers), and updates reconciliation logic so leaf certificates can reference the resolved issuerRef. The PR also adjusts controller-runtime client caching to allow direct API-server Get on ClusterIssuers without requiring cluster-wide list/watch RBAC, and adds tests covering the new behaviors.

Changes:

• Introduce spec.tls.issuerConf (CRD + Go types + deepcopy) to configure issuer references.
• Implement issuer-mode resolution and apply logic for Issuer/ClusterIssuer/external issuers, plus CA handling fallbacks for external issuers.
• Disable controller-runtime cache for cert-manager.io/v1 ClusterIssuer and add/extend unit tests.

Reviewed changes

Copilot reviewed 19 out of 21 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
pkg/apis/upstream.pgv2.percona.com/v1beta1/zz_generated.deepcopy.go	Deepcopy updates for the new TLSSpec.IssuerConf field.
pkg/apis/upstream.pgv2.percona.com/v1beta1/postgrescluster_types.go	Adds TLSSpec.IssuerConf to the API type.
percona/runtime/runtime.go	Disables informer cache for ClusterIssuer via ClientCacheOptions() and applies it to managers.
percona/runtime/runtime_test.go	Adds tests around cache options / manager creation.
percona/certmanager/certmanager.go	Implements issuer modes, issuerRef resolution, and managed/external behaviors across Apply* methods.
percona/certmanager/certmanager_test.go	Adds/extends tests for issuer modes, namespace resolution, drift updates, and external issuer behavior.
internal/naming/names.go	Adds naming helpers for cluster-scoped CA issuer/secret.
internal/naming/names_test.go	Tests for the new naming helpers.
internal/controller/postgrescluster/pki.go	Makes PKI reconciliation issuer-mode aware, including managed-cluster secret locations and external mode handling.
internal/controller/postgrescluster/pki_test.go	Adds issuer-mode awareness tests (with envtest/fake-client workarounds).
internal/controller/postgrescluster/pgbackrest.go	Adds CA selection helper for pgBackRest when using external issuers (no operator root CA).
internal/controller/postgrescluster/pgbackrest_test.go	Unit tests for pgBackRestCACert.
internal/controller/postgrescluster/instance.go	Adds CA selection helper for instance cert embedding when using external issuers.
internal/controller/postgrescluster/instance_test.go	Unit tests for instanceCACert.
internal/controller/postgrescluster/controller.go	Ensures cert-manager watch registration logic runs even when rootCA is nil (external mode).
deploy/cw-bundle.yaml	CRD schema update for spec.tls.issuerConf.
deploy/crd.yaml	CRD schema update for spec.tls.issuerConf.
deploy/bundle.yaml	CRD schema update for spec.tls.issuerConf.
config/crd/bases/upstream.pgv2.percona.com_postgresclusters.yaml	Base CRD schema update for spec.tls.issuerConf.
config/crd/bases/pgv2.percona.com_perconapgclusters.yaml	Base CRD schema update for spec.tls.issuerConf.
build/crd/percona/generated/pgv2.percona.com_perconapgclusters.yaml	Generated CRD schema update for spec.tls.issuerConf.

Files not reviewed (1)

• pkg/apis/upstream.pgv2.percona.com/v1beta1/zz_generated.deepcopy.go: Generated file

[Copilot]

Pull request overview

Copilot reviewed 26 out of 28 changed files in this pull request and generated 3 comments.

Files not reviewed (1)

• pkg/apis/upstream.pgv2.percona.com/v1beta1/zz_generated.deepcopy.go: Generated file

[JNKPercona]

Test Name	Result	Time
backup-enable-disable	passed	00:11:48
builtin-extensions	passed	00:06:50
cert-manager-tls	passed	00:11:55
custom-envs	passed	00:22:15
custom-tls	passed	00:06:18
database-init-sql	passed	00:02:43
demand-backup	passed	00:26:08
demand-backup-offline-snapshot	passed	00:14:43
dynamic-configuration	passed	00:03:33
finalizers	passed	00:04:43
init-deploy	passed	00:03:18
huge-pages	passed	00:03:34
major-upgrade-14-to-15	passed	00:11:25
major-upgrade-15-to-16	passed	00:11:26
major-upgrade-16-to-17	passed	00:11:27
major-upgrade-17-to-18	passed	00:09:12
ldap	passed	00:04:07
ldap-tls	passed	00:05:52
monitoring	passed	00:09:21
monitoring-pmm3	passed	00:09:41
one-pod	passed	00:06:20
operator-self-healing	passed	00:10:59
pgbouncer-mtls	passed	00:03:45
pitr	passed	00:12:54
scaling	passed	00:05:39
scheduled-backup	passed	00:35:38
self-healing	passed	00:09:46
sidecars	passed	00:02:59
standby-pgbackrest	passed	00:19:01
standby-streaming	failure	00:09:26
start-from-backup	passed	00:12:52
tablespaces	passed	00:12:19
telemetry-transfer	passed	00:05:22
upgrade-consistency	passed	00:08:10
upgrade-minor	passed	00:07:14
users	passed	00:05:29
migration-from-crunchy-standby	passed	00:19:41
migration-from-crunchy-pv	passed	00:08:48
migration-from-crunchy-backup-restore	passed	00:17:26

Summary	Value
Tests Run	39/39
Job Duration	02:27:11
Total Test Time	06:44:27

commit: 8ce02eb
image: perconalab/percona-postgresql-operator:PR-1684-8ce02ebb9