K8SPSMDB-956: fix problems with TLS certificate renewal

[pooknull]

https://jira.percona.com/browse/K8SPSMDB-956

DESCRIPTION

Problem:
Certificate rotation brings the sharded cluster down.

Cause:
Cert-Manager detects certs would expire soon and triggers certificate rotation. The operator starts smartUpdate, which fails and leaves the mongos in the CrashLoopBackoff state.

Solution:
We should switch from self-signed certificates to CA-signed ones. The operator should create a self-signed issuer, a self-signed certificate, and use that certificate to create a CA issuer, which will be used to create certificates.

Additional fixes:

• Updated github.com/jetstack/cert-manager v1.6.1 to github.com/cert-manager/cert-manager v1.12.3
• Added tls-issue-cert-manager test
• Removed isCA: true from mongo certificates

CHECKLIST

Jira

• Is the Jira ticket created and referenced properly?
• Does the Jira ticket have the proper statuses for documentation (Needs Doc) and QA (Needs QA)?
• Does the Jira ticket link to the proper milestone (Fix Version field)?

Tests

• Is an E2E test/test case added for the new feature/change?
• Are unit tests added where appropriate?
• Are OpenShift compare files changed for E2E tests (compare/*-oc.yml)?

Config/Logging/Testability

• Are all needed new/changed options added to default YAML files?
• Are the manifests (crd/bundle) regenerated if needed?
• Did we add proper logging messages for operator actions?
• Did we ensure compatibility with the previous version or cluster upgrade process?
• Does the change support oldest and newest supported MongoDB version?
• Does the change support oldest and newest supported Kubernetes version?

[github-actions]

[shfmt] _{reported by reviewdog 🐶}

Suggested change

[hors]

@pooknull please check tls-issue-cert-manager test

[egegunes]

please also update the bundle.yaml

[hors]

We should not have it at all. It is needed only for test.

[JNKPercona]

Test name	Status
arbiter	passed
balancer	passed
cross-site-sharded	passed
data-at-rest-encryption	passed
data-sharded	passed
demand-backup	passed
demand-backup-eks-credentials	passed
demand-backup-physical	passed
demand-backup-physical-sharded	passed
demand-backup-sharded	passed
expose-sharded	passed
ignore-labels-annotations	passed
init-deploy	passed
finalizer	passed
limits	passed
liveness	passed
mongod-major-upgrade	passed
mongod-major-upgrade-sharded	passed
monitoring-2-0	passed
multi-cluster-service	passed
non-voting	passed
one-pod	passed
operator-self-healing-chaos	passed
pitr	passed
pitr-sharded	passed
pitr-physical	passed
recover-no-primary	passed
rs-shard-migration	passed
scaling	passed
scheduled-backup	passed
security-context	passed
self-healing-chaos	passed
service-per-pod	passed
serviceless-external-nodes	passed
smart-update	passed
storage	passed
tls-issue-cert-manager	passed
upgrade	passed
upgrade-consistency	passed
upgrade-consistency-sharded	passed
upgrade-sharded	passed
users	passed
version-service	passed
We run 43 out of 43

commit: 021f368
image: perconalab/percona-server-mongodb-operator:PR-1287-021f368c