K8SPG-1045: rewrite cert-management-policy test

[pooknull]

https://perconadev.atlassian.net/browse/K8SPG-1045

DESCRIPTION

Problem:
The previous test was flaky because it expected .status.conditions to appear in a specific order. Kubernetes doesn't sort conditions, so each condition should be checked independently.

The test itself was also incorrect. It created a cluster with certManagementPolicy: auto, saved the operator-generated TLS secrets, deleted the cluster, and restored those secrets for a newly created cluster using certManagementPolicy: userProvidedOnly.

This left the new cluster with an invalid pgbackrest client certificate. The test did not detect the problem because it checked only pod's readiness.

Cause:
pgbackrest authorizes clients using a certificate CN in this format:

pgbackrest@<PostgresCluster UID>

The repo host's tls-server-auth setting and operator-generated pgbackrest certificate CN's are using this format.

After recreation, PostgresCluster has a different UID. So, the certificate contained the UID of the deleted cluster and was rejected by the new repo host.

Solution:
Rewrite the test to create a cluster directly with certManagementPolicy: userProvidedOnly and generate certificates using openssl and verify that pods are working correctly.

This PR also contains a fix described in the #1736 PR

CHECKLIST

Jira

• Is the Jira ticket created and referenced properly?
• Does the Jira ticket have the proper statuses for documentation (Needs Doc) and QA (Needs QA)?
• Does the Jira ticket link to the proper milestone (Fix Version field)?

Tests

• Is an E2E test/test case added for the new feature/change?
• Are unit tests added where appropriate?

Config/Logging/Testability

• Are all needed new/changed options added to default YAML files?
• Are all needed new/changed options added to the Helm Chart?
• Did we add proper logging messages for operator actions?
• Did we ensure compatibility with the previous version or cluster upgrade process?
• Does the change support oldest and newest supported PG version?
• Does the change support oldest and newest supported Kubernetes version?

[eleo007]

Nice-to-have: add to test writing & verifying written data and making a backup.
Also, why do we test only userProvidedOnly? Auto is default and is covered by our other tests?

[pooknull]

Nice-to-have: add to test writing & verifying written data and making a backup.

I would like to add it in a separate PR, because currently failing cert-management-policy test is a blocker for other PRs

Also, why do we test only userProvidedOnly? Auto is default and is covered by our other tests?

Auto is default, so there shouldn't be any problems.

[JNKPercona]

Test Name	Result	Time
backup-enable-disable	passed	00:00:00
builtin-extensions	passed	00:00:00
custom-extensions	failure	00:02:26
cert-manager-tls	passed	00:00:00
cert-management-policy	passed	00:00:00
custom-envs	passed	00:00:00
custom-tls	passed	00:00:00
database-init-sql	passed	00:00:00
demand-backup	passed	00:00:00
demand-backup-offline-snapshot	passed	00:00:00
dynamic-configuration	passed	00:00:00
extra-volumes	passed	00:00:00
finalizers	passed	00:00:00
init-deploy	passed	00:00:00
huge-pages	passed	00:00:00
major-upgrade-14-to-15	passed	00:00:00
major-upgrade-15-to-16	passed	00:00:00
major-upgrade-16-to-17	passed	00:00:00
major-upgrade-17-to-18	passed	00:00:00
ldap	passed	00:00:00
ldap-tls	passed	00:00:00
logcollection	passed	00:00:00
monitoring	passed	00:00:00
one-pod	passed	00:00:00
repo-host-autogrow	passed	00:00:00
operator-self-healing	passed	00:00:00
pgbouncer	passed	00:00:00
pg-tde	passed	00:00:00
pg-tde-wal-encrypt	passed	00:00:00
pitr	passed	00:00:00
scaling	passed	00:00:00
scheduled-backup	passed	00:00:00
self-healing	passed	00:00:00
sidecars	passed	00:00:00
standby-pgbackrest	passed	00:00:00
standby-streaming	passed	00:00:00
start-from-backup	passed	00:00:00
tablespaces	passed	00:00:00
telemetry-transfer	passed	00:00:00
upgrade-consistency	passed	00:00:00
upgrade-minor	passed	00:00:00
users	passed	00:00:00
migration-from-crunchy-standby	passed	00:00:00
migration-from-crunchy-pv	passed	00:00:00
migration-from-crunchy-backup-restore	passed	00:00:00

Summary	Value
Tests Run	45/45
Job Duration	00:25:02
Total Test Time	00:02:26

commit: faa1979
image: perconalab/percona-postgresql-operator:PR-1749-faa19798e