-
Notifications
You must be signed in to change notification settings - Fork 18
Description
Describe the bug
An update to a DocumentDB manifest does not cause the documentdb pods to be recreated or restarted, meaning new settings in the DocumentDB manifest are not applied
To Reproduce
Steps to reproduce the behavior:
- Install Document DB Operator via Helm without any custom options. I had removed CNPG so that DocumentDB would install its preferred version of CNPG.
- Deploy a new Document DB Cluster using a DocumentDB manifest that specifies an incorrect secret name for the provided TLS certificate.
- When the pod is created by the operator, it generates a self-signed certificate because it could not find the secret referenced in the manifest (expected behavior).
- Update the DocumentDB manifest to specify the correct secret name for the provided certificate.
- Wait for the operator to recognize the change to the DocumentDB manifest and re-create the pod, but nothing happens to the pod.
Expected behavior
The operator should recognize the change the DocumentDB TLS configuration and re-create the pod to apply the new settings, in this case using the certificate provided by the referenced secret.
Kubernetes Environment
- DocumentDB Operator Version: 0.1.3
- Kubernetes Version: 1.35.2
- Kubernetes Environment: Talos 1.12.5
- Cert Manager Version : 1.20.0
- CNPG Version: 1.28.0 (installed with DocumentDB just to make sure that wasn't the problem)
Additional context
I was worried that perhaps TLS Provided mode wasn't working, so I deleted the DocumentDB manifest. This caused the pod to be deleted by the operator immediately as expected. I then re-applied the DocumentDB manifest with the correct TLS settings and the pod was created with the correct TLS settings (no generation of a self-signed certificate).