mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-10 06:24:09 +09:00
Aleksei Sviridkin
3d2dd4271a
Two things the chart got wrong about how mariadb-operator handles TLS. The operator only reconciles on changes to the Secrets behind serverCASecretRef and serverCertSecretRef when those Secrets carry its watch label; the watches are predicate-gated on it. Neither Secret had the label, and cert-manager owns them rather than the MariaDB resource, so ownership does not trigger a reconcile either. The leaf rotates its private key on every renewal, so a renewal would land in the Secret and the running pods would keep serving the superseded certificate until the next full resync. Label both Secrets. The operator also reconciles a trust bundle of its own, named <release>-ca-bundle, whenever TLS is enabled. It contains only ca.crt, never a private key, and it spans a CA rollover. That is exactly the trust anchor the tenant needs, and it already exists in the namespace, so grant it to the tenant instead of stating that no CA is available. The previous wording told operators to skip verification or to turn enforcement off, which weakened security to work around a problem that was not real. Point the backup job at the bundle too. It was projecting ca.crt out of the leaf Secret, which only ever holds the CA that signed the current certificate and needlessly couples backups to leaf rotation. Signed-off-by: Aleksei Sviridkin <f@lex.la>