K8SPXC-1030: Don't delete cert-manager certs by default #1171
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
We shouldn't set owner references to cert-manager objects if we don't want to delete secrets too. This way, after the PXC cluster is deleted issuers, certificates and their secrets will remain intact in the cluster. If users want to cleanup objects created for SSL, we introduce a new finalizer: `delete-ssl`. If this finalizer is set, the operator will delete secrets, certificates and issuers. Unfortunately, cert-manager doesn't set owner reference to the secret it created and this behaviour can only configured by command line flag in the controller. Since we can't control how users deploy cert-manager to their clusters, we shouldn't rely on this feature and cleanup certificates and secrets altogether. Hopefully, cert-manager/cert-manager#5158 will merged and we can configure this behaviour on certificate level.
tplavcic
previously approved these changes
Jun 2, 2022
Collaborator
commit: 658e73d |
Contributor
|
with 2.28.0 pmm-client version monitoring test passed. |
hors
approved these changes
Jul 19, 2022
inelpandzic
approved these changes
Jul 19, 2022
pooknull
reviewed
Jul 19, 2022
egegunes
added a commit
that referenced
this pull request
Aug 1, 2022
* K8SPXC-1030: Don't delete cert-manager certs by default We shouldn't set owner references to cert-manager objects if we don't want to delete secrets too. This way, after the PXC cluster is deleted issuers, certificates and their secrets will remain intact in the cluster. If users want to cleanup objects created for SSL, we introduce a new finalizer: `delete-ssl`. If this finalizer is set, the operator will delete secrets, certificates and issuers. Unfortunately, cert-manager doesn't set owner reference to the secret it created and this behaviour can only configured by command line flag in the controller. Since we can't control how users deploy cert-manager to their clusters, we shouldn't rely on this feature and cleanup certificates and secrets altogether. Hopefully, cert-manager/cert-manager#5158 will merged and we can configure this behaviour on certificate level. * fix tests Co-authored-by: Viacheslav Sarzhan <[email protected]>
nmarukovich
pushed a commit
that referenced
this pull request
Aug 1, 2022
* K8SPXC-1030: Don't delete cert-manager certs by default We shouldn't set owner references to cert-manager objects if we don't want to delete secrets too. This way, after the PXC cluster is deleted issuers, certificates and their secrets will remain intact in the cluster. If users want to cleanup objects created for SSL, we introduce a new finalizer: `delete-ssl`. If this finalizer is set, the operator will delete secrets, certificates and issuers. Unfortunately, cert-manager doesn't set owner reference to the secret it created and this behaviour can only configured by command line flag in the controller. Since we can't control how users deploy cert-manager to their clusters, we shouldn't rely on this feature and cleanup certificates and secrets altogether. Hopefully, cert-manager/cert-manager#5158 will merged and we can configure this behaviour on certificate level. * fix tests Co-authored-by: Viacheslav Sarzhan <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
We shouldn't set owner references to cert-manager objects if we don't want to delete secrets too. This way, after the PXC cluster is deleted issuers, certificates and their secrets will remain intact in the cluster.
If users want to cleanup objects created for SSL, we introduce a new finalizer:
delete-ssl. If this finalizer is set, the operator will delete secrets, certificates and issuers. Unfortunately, cert-manager doesn't set owner reference to the secret it created and this behaviour can only configured by command line flag in the controller. Since we can't control how users deploy cert-manager to their clusters, we shouldn't rely on this feature and cleanup certificates and secrets altogether. Hopefully, cert-manager/cert-manager#5158 will merged and we can configure this behaviour on certificate level.