K8SPG-1045: fix certManagementPolicy for pgbouncer

[pooknull]

https://perconadev.atlassian.net/browse/K8SPG-1045

DESCRIPTION

Problem:
PR #1679 added .spec.tls.certManagementPolicy. When set to userProvidedOnly, the operator skips reconcile of the entire pgbouncer secret, including non-TLS values it should manage. Also, when .spec.proxy.pgbouncer.customTLSSecret is configured, the operator validates the standard pgbouncer secret instead of the customTLSSecret.

Solution:
Preserve user-provided TLS values in the standard pgbouncer secret while continuing to reconcile operator-managed non-TLS values. When .spec.proxy.pgbouncer.customTLSSecret is configured, validate that secret instead of the standard pgbouncer Secret.

CHECKLIST

Jira

• Is the Jira ticket created and referenced properly?
• Does the Jira ticket have the proper statuses for documentation (Needs Doc) and QA (Needs QA)?
• Does the Jira ticket link to the proper milestone (Fix Version field)?

Tests

• Is an E2E test/test case added for the new feature/change?
• Are unit tests added where appropriate?

Config/Logging/Testability

• Are all needed new/changed options added to default YAML files?
• Are all needed new/changed options added to the Helm Chart?
• Did we add proper logging messages for operator actions?
• Did we ensure compatibility with the previous version or cluster upgrade process?
• Does the change support oldest and newest supported PG version?
• Does the change support oldest and newest supported Kubernetes version?

[JNKPercona]

Test Name	Result	Time
backup-enable-disable	passed	00:15:14
builtin-extensions	passed	00:06:49
custom-extensions	passed	00:17:19
cert-manager-tls	failure	00:07:40
cert-management-policy	passed	00:03:25
custom-envs	passed	00:21:56
custom-tls	passed	00:06:54
database-init-sql	passed	00:05:03
demand-backup	passed	00:29:25
demand-backup-offline-snapshot	passed	00:14:52
dynamic-configuration	passed	00:04:14
extra-volumes	passed	00:03:49
finalizers	passed	00:04:25
init-deploy	passed	00:03:31
huge-pages	passed	00:03:16
major-upgrade-14-to-15	passed	00:12:50
major-upgrade-15-to-16	passed	00:10:39
major-upgrade-16-to-17	passed	00:14:15
major-upgrade-17-to-18	passed	00:18:29
ldap	passed	00:03:59
ldap-tls	passed	00:08:07
logcollection	passed	00:05:44
monitoring	passed	00:10:32
one-pod	passed	00:06:05
repo-host-autogrow	passed	00:02:31
operator-self-healing	passed	00:10:34
pgbouncer-mtls	passed	00:03:38
pg-tde	passed	00:12:15
pg-tde-wal-encrypt	passed	00:16:37
pitr	passed	00:13:03
scaling	passed	00:05:39
scheduled-backup	passed	00:29:36
self-healing	passed	00:08:48
sidecars	passed	00:03:24
standby-pgbackrest	failure	00:17:29
standby-streaming	passed	00:13:35
start-from-backup	passed	00:13:26
tablespaces	passed	00:07:27
telemetry-transfer	passed	00:05:13
upgrade-consistency	passed	00:05:57
upgrade-minor	passed	00:07:50
users	passed	00:05:26
migration-from-crunchy-standby	failure	00:17:19
migration-from-crunchy-pv	passed	00:07:59
migration-from-crunchy-backup-restore	passed	00:19:19

Summary	Value
Tests Run	45/45
Job Duration	01:40:33
Total Test Time	07:46:01

commit: 3a81ed2
image: perconalab/percona-postgresql-operator:PR-1736-3a81ed256

[Copilot]

Pull request overview

Fixes PgBouncer TLS handling under userProvidedOnly.

Changes:

• Preserves standard-secret TLS data while reconciling non-TLS values.
• Validates configured custom PgBouncer TLS secrets.
• Adds unit coverage for policy behavior and CA preservation.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
internal/pgbouncer/reconcile.go	Updates Secret and Pod TLS handling.
internal/pgbouncer/reconcile_test.go	Tests TLS policy behavior.
internal/controller/postgrescluster/pki.go	Checks the configured custom TLS Secret.
internal/controller/postgrescluster/pki_test.go	Tests custom-secret readiness checks.
internal/controller/postgrescluster/pgbouncer.go	Continues non-TLS Secret reconciliation.

Suppressed comments (1)

internal/pgbouncer/reconcile.go:200

• For userProvidedOnly plus customTLSSecret, this always passes false, so frontendCertificate keeps mounting only the custom Secret's CA and never projects the merged additionalTrustedCAs bundle. Preserve the custom-Secret exception here so configured additional authorities remain trusted.

					len(inCluster.Spec.Proxy.PGBouncer.AdditionalTrustedCAs) > 0 &&
						inCluster.Spec.TLS.GetCertManagementPolicy() != v1beta1.CertManagementUserProvidedOnly)...),

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[mayankshah1607]

@pooknull please check Copilot comments and resolve conflicts

[pooknull]

#1749 will replace this PR