K8SPXC-896-897: check both SSL secret and SSL internal secret in reconsileSSL
@@ -23,20 +23,33 @@ func (r *ReconcilePerconaXtraDBCluster) reconsileSSL(cr *api.PerconaXtraDBCluste
return nil
}
secretObj := corev1.Secret{}
- err := r.client.Get(context.TODO(),
+ secretInternalObj := corev1.Secret{}
+ errSecret := r.client.Get(context.TODO(),
types.NamespacedName{
Namespace: cr.Namespace,
Name: cr.Spec.PXC.SSLSecretName,
},
&secretObj,
)
- if err == nil {
+ errInternalSecret := r.client.Get(context.TODO(),
+ types.NamespacedName{
+ Namespace: cr.Namespace,
+ Name: cr.Spec.PXC.SSLInternalSecretName,
+ },
+ &secretInternalObj,
+ )
+ if errSecret == nil && errInternalSecret == nil {
return nil
- } else if !k8serr.IsNotFound(err) {
- return fmt.Errorf("get secret: %v", err)
+ } else if errSecret != nil && !k8serr.IsNotFound(errSecret) {
+ return fmt.Errorf("get secret: %v", errSecret)
+ } else if errInternalSecret != nil && !k8serr.IsNotFound(errInternalSecret) {
+ return fmt.Errorf("get internal secret: %v", errInternalSecret)
}
-
- err = r.createSSLByCertManager(cr)
+ // don't create secret ssl-internal if secret ssl is not created by operator
+ if errSecret == nil && !metav1.IsControlledBy(&secretObj, cr) {
+ return nil
+ }
+ err := r.createSSLByCertManager(cr)
if err != nil {
if cr.Spec.TLS != nil && cr.Spec.TLS.IssuerConf != nil {
return fmt.Errorf("create ssl with cert manager %w", err)
@@ -272,7 +285,7 @@ func (r *ReconcilePerconaXtraDBCluster) createSSLManualy(cr *api.PerconaXtraDBCl
Type: corev1.SecretTypeTLS,
}
err = r.client.Create(context.TODO(), &secretObj)
- if err != nil {
+ if err != nil && !k8serr.IsAlreadyExists(err) {
return fmt.Errorf("create TLS secret: %v", err)
}
pxcHosts := []string{
@@ -299,7 +312,7 @@ func (r *ReconcilePerconaXtraDBCluster) createSSLManualy(cr *api.PerconaXtraDBCl
Type: corev1.SecretTypeTLS,
}
err = r.client.Create(context.TODO(), &secretObjInternal)
- if err != nil {
+ if err != nil && !k8serr.IsAlreadyExists(err) {
return fmt.Errorf("create TLS internal secret: %v", err)
}
return nil
