K8SPG-1045: rewrite cert-management-policy test

e2e-tests/tests/cert-management-policy/00-deploy-operator.yaml

@@ -9,5 +9,5 @@ commands:
       source ../../functions
       init_temp_dir
 
-      destroy_cert_manager
+      deploy_cert_manager
       deploy_operator

e2e-tests/tests/cert-management-policy/01-assert.yaml

@@ -1,79 +1,15 @@
 apiVersion: kuttl.dev/v1beta1
 kind: TestAssert
-timeout: 300
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: cert-management-policy-cluster-ca-cert
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: cert-management-policy-cluster-cert
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: cert-management-policy-replication-cert
----
-kind: StatefulSet
-apiVersion: apps/v1
-metadata:
-  labels:
-    postgres-operator.crunchydata.com/cluster: cert-management-policy
-    postgres-operator.crunchydata.com/data: postgres
-    postgres-operator.crunchydata.com/instance-set: instance1
-status:
-  observedGeneration: 1
-  replicas: 1
-  readyReplicas: 1
-  currentReplicas: 1
-  updatedReplicas: 1
-  collisionCount: 0
----
-kind: Deployment
-apiVersion: apps/v1
-metadata:
-  name: cert-management-policy-pgbouncer
-  labels:
-    postgres-operator.crunchydata.com/cluster: cert-management-policy
-    postgres-operator.crunchydata.com/role: pgbouncer
-status:
-  observedGeneration: 1
-  replicas: 1
-  updatedReplicas: 1
-  readyReplicas: 1
----
-apiVersion: upstream.pgv2.percona.com/v1beta1
-kind: PostgresCluster
-metadata:
-  name: cert-management-policy
-status:
-  instances:
-    - name: instance1
-      readyReplicas: 1
-      replicas: 1
-      updatedReplicas: 1
-  observedGeneration: 1
-  proxy:
-    pgBouncer:
-      readyReplicas: 1
-      replicas: 1
----
-apiVersion: pgv2.percona.com/v2
-kind: PerconaPGCluster
-metadata:
-  name: cert-management-policy
-status:
-  pgbouncer:
-    ready: 1
-    size: 1
-  postgres:
-    instances:
-    - name: instance1
-      ready: 1
-      size: 1
-    ready: 1
-    size: 1
-  state: ready
+timeout: 180
+resourceRefs:
+  - apiVersion: pgv2.percona.com/v2
+    kind: PerconaPGCluster
+    name: cert-management-policy
+    ref: cluster
+assertAll:
+  - celExpr: cluster.status.conditions.exists(c, c.type == "ReadyForBackup" && c.status == "False" && c.reason == "PGBackRestRepoHostReady" && has(c.observedGeneration) && c.observedGeneration == cluster.metadata.generation)
+    message: ReadyForBackup should be False with reason PGBackRestRepoHostReady
+  - celExpr: cluster.status.conditions.exists(c, c.type == "TLSSecretsReady" && c.status == "False" && c.reason == "TLSSecretsMissing" && has(c.observedGeneration) && c.observedGeneration == cluster.metadata.generation)
+    message: TLSSecretsReady should be False with reason TLSSecretsMissing
+  - celExpr: cluster.status.conditions.exists(c, c.type == "Progressing" && c.status == "False" && c.reason == "Paused" && has(c.observedGeneration) && c.observedGeneration == cluster.metadata.generation)
+    message: Progressing should be False with reason Paused

e2e-tests/tests/cert-management-policy/01-create-initial-cluster.yaml → e2e-tests/tests/cert-management-policy/01-create-cluster.yaml

@@ -9,7 +9,7 @@ commands:
       source ../../functions
 
       get_cr "cert-management-policy" \
-        | yq '.spec.tls.certManagementPolicy = "auto"' \
+        | yq '.spec.tls.certManagementPolicy = "userProvidedOnly"' \
         | yq '.spec.proxy.pgBouncer.replicas = 1' \
-        | yq '.spec.instances[].replicas = 1' \
+        | yq '.spec.instances[].replicas = 3' \
         | kubectl -n "$NAMESPACE" apply -f -

e2e-tests/tests/cert-management-policy/02-create-root-ca.yaml

@@ -0,0 +1,29 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  - script: |-
+      set -o errexit
+      set -o pipefail
+      set -o xtrace
+
+      source ../../functions
+
+      cluster="cert-management-policy"
+
+      issue_root_ca
+
+      kubectl -n "$NAMESPACE" create secret generic "${cluster}-cluster-ca-cert" \
+        --from-file=root.crt="$TEMP_DIR/root-ca.crt" \
+        --from-file=root.key="$TEMP_DIR/root-ca.key" \
+        --dry-run=client -o yaml \
+        | kubectl label --local -f - -o yaml \
+          postgres-operator.crunchydata.com/cluster="$cluster" \
+        | kubectl -n "$NAMESPACE" apply -f -
+
+      secret="${cluster}-cluster-ca-cert"
+      checksum=$(kubectl -n "$NAMESPACE" get secret "$secret" -o json \
+        | jq --compact-output --sort-keys '.data' \
+        | sha256sum | awk '{print $1}')
+      kubectl -n "$NAMESPACE" annotate secret "$secret" \
+        e2e.percona.com/secret-checksum="$checksum" \
+        --overwrite

e2e-tests/tests/cert-management-policy/03-create-postgres-certificate.yaml

@@ -0,0 +1,46 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  - script: |-
+      set -o errexit
+      set -o pipefail
+      set -o xtrace
+
+      source ../../functions
+
+      cluster="cert-management-policy"
+
+      primary="${cluster}-primary"
+      replicas="${cluster}-replicas"
+      primary_names=(
+        "${primary}.${NAMESPACE}.svc.cluster.local"
+        "${primary}.${NAMESPACE}.svc"
+        "${primary}.${NAMESPACE}"
+        "$primary"
+      )
+      replica_names=(
+        "${replicas}.${NAMESPACE}.svc.cluster.local"
+        "${replicas}.${NAMESPACE}.svc"
+        "${replicas}.${NAMESPACE}"
+        "$replicas"
+      )
+      issue_certificate postgres \
+        "$primary" serverAuth \
+        "${primary_names[@]}" "${replica_names[@]}"
+
+      kubectl -n "$NAMESPACE" create secret generic "${cluster}-cluster-cert" \
+        --from-file=tls.crt="$TEMP_DIR/postgres.crt" \
+        --from-file=tls.key="$TEMP_DIR/postgres.key" \
+        --from-file=ca.crt="$TEMP_DIR/root-ca.crt" \
+        --dry-run=client -o yaml \
+        | kubectl label --local -f - -o yaml \
+          postgres-operator.crunchydata.com/cluster="$cluster" \
+        | kubectl -n "$NAMESPACE" apply -f -
+
+      secret="${cluster}-cluster-cert"
+      checksum=$(kubectl -n "$NAMESPACE" get secret "$secret" -o json \
+        | jq --compact-output --sort-keys '.data' \
+        | sha256sum | awk '{print $1}')
+      kubectl -n "$NAMESPACE" annotate secret "$secret" \
+        e2e.percona.com/secret-checksum="$checksum" \
+        --overwrite

e2e-tests/tests/cert-management-policy/04-create-replication-certificate.yaml

@@ -0,0 +1,30 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  - script: |-
+      set -o errexit
+      set -o pipefail
+      set -o xtrace
+
+      source ../../functions
+
+      cluster="cert-management-policy"
+
+      issue_certificate replication _crunchyrepl clientAuth _crunchyrepl
+
+      kubectl -n "$NAMESPACE" create secret generic "${cluster}-replication-cert" \
+        --from-file=tls.crt="$TEMP_DIR/replication.crt" \
+        --from-file=tls.key="$TEMP_DIR/replication.key" \
+        --from-file=ca.crt="$TEMP_DIR/root-ca.crt" \
+        --dry-run=client -o yaml \
+        | kubectl label --local -f - -o yaml \
+          postgres-operator.crunchydata.com/cluster="$cluster" \
+        | kubectl -n "$NAMESPACE" apply -f -
+
+      secret="${cluster}-replication-cert"
+      checksum=$(kubectl -n "$NAMESPACE" get secret "$secret" -o json \
+        | jq --compact-output --sort-keys '.data' \
+        | sha256sum | awk '{print $1}')
+      kubectl -n "$NAMESPACE" annotate secret "$secret" \
+        e2e.percona.com/secret-checksum="$checksum" \
+        --overwrite