From 83852538e3f2dfd1eaecb0f06b910f0e680fd396 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Tue, 26 May 2026 13:22:09 +0300
Subject: [PATCH] refactor(mariadb): switch CA and leaf private keys to ECDSA
 P-256

ECDSA P-256 keys offer equivalent or better security than RSA-4096 with
significantly smaller key material and faster handshake operations. Both
CA and leaf certificates are updated; existing rotation policies are
preserved (Never for CA, Always for leaf).

Note: cert-manager will re-issue both CA and leaf on next reconcile.
Existing trust anchors that pin the CA cert will break; tenants must
refresh their ca.crt after upgrading.

Assisted-by: LLM
Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../apps/mariadb/templates/certmanager.yaml   |  8 +--
 packages/apps/mariadb/tests/tls_test.yaml     | 59 +++++++++++++++++++
 2 files changed, 63 insertions(+), 4 deletions(-)

diff --git a/packages/apps/mariadb/templates/certmanager.yaml b/packages/apps/mariadb/templates/certmanager.yaml
index 1996fd426..9547283c0 100644
--- a/packages/apps/mariadb/templates/certmanager.yaml
+++ b/packages/apps/mariadb/templates/certmanager.yaml
@@ -29,8 +29,8 @@ spec:
     group: cert-manager.io
   privateKey:
     rotationPolicy: Never
-    algorithm: RSA
-    size: 4096
+    algorithm: ECDSA
+    size: 256
   # CA usages: signing + cert sign (issuing leaf certs) + crl sign (RFC 5280)
   usages:
     - signing
@@ -83,8 +83,8 @@ spec:
     {{- end }}
   privateKey:
     rotationPolicy: Always
-    algorithm: RSA
-    size: 4096
+    algorithm: ECDSA
+    size: 256
   issuerRef:
     name: {{ .Release.Name }}-ca
     kind: Issuer
diff --git a/packages/apps/mariadb/tests/tls_test.yaml b/packages/apps/mariadb/tests/tls_test.yaml
index c7d15bec8..f2050de57 100644
--- a/packages/apps/mariadb/tests/tls_test.yaml
+++ b/packages/apps/mariadb/tests/tls_test.yaml
@@ -714,3 +714,62 @@ tests:
       - contains:
           path: spec.dnsNames
           content: "*.my-mariadb-internal"
+
+  # -------------------------------------------------------------------
+  # ECDSA: CA and leaf use ECDSA P-256
+  # Smaller keys, faster handshakes, stronger per-bit security than RSA.
+  # rotationPolicy preserved: Never for CA, Always for leaf.
+  # -------------------------------------------------------------------
+  - it: "CA cert uses ECDSA P-256 algorithm"
+    templates:
+      - templates/certmanager.yaml
+    set:
+      tls:
+        enabled: true
+    documentIndex: 1
+    asserts:
+      - equal:
+          path: spec.privateKey.algorithm
+          value: ECDSA
+      - equal:
+          path: spec.privateKey.size
+          value: 256
+
+  - it: "leaf cert uses ECDSA P-256 algorithm"
+    templates:
+      - templates/certmanager.yaml
+    set:
+      tls:
+        enabled: true
+    documentIndex: 3
+    asserts:
+      - equal:
+          path: spec.privateKey.algorithm
+          value: ECDSA
+      - equal:
+          path: spec.privateKey.size
+          value: 256
+
+  - it: "CA cert rotationPolicy is Never (ECDSA)"
+    templates:
+      - templates/certmanager.yaml
+    set:
+      tls:
+        enabled: true
+    documentIndex: 1
+    asserts:
+      - equal:
+          path: spec.privateKey.rotationPolicy
+          value: Never
+
+  - it: "leaf cert rotationPolicy is Always (ECDSA)"
+    templates:
+      - templates/certmanager.yaml
+    set:
+      tls:
+        enabled: true
+    documentIndex: 3
+    asserts:
+      - equal:
+          path: spec.privateKey.rotationPolicy
+          value: Always