Pooler don't works with custom clientCASecret #2841
Description
Hello!
When I create a Cluster using a certificates.clientCASecret generated using cert-manager (like in the doc), the controller fails if the Cluster has an attached Pooler.
Logs
{
"level": "error",
"ts": "2023-09-21T14:03:45Z",
"msg": "Reconciler error",
"controller": "cluster",
"controllerGroup": "postgresql.cnpg.io",
"controllerKind": "Cluster",
"Cluster": {
"name": "barcnpg-tloubiou-test",
"namespace": "barcnpg-tloubiou-test"
},
"namespace": "barcnpg-tloubiou-test",
"name": "barcnpg-tloubiou-test",
"reconcileID": "8f4e007b-5505-47c6-a73c-c1095994f489",
"error": "cannot create Cluster auxiliary objects: missing ca.key secret data",
"stacktrace": "sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\tpkg/mod/sigs.k8s.io/controller-runtime@v0.15.0/pkg/internal/controller/controller.go:324\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\tpkg/mod/sigs.k8s.io/controller-runtime@v0.15.0/pkg/internal/controller/controller.go:265\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\tpkg/mod/sigs.k8s.io/controller-runtime@v0.15.0/pkg/internal/controller/controller.go:226"
}After looking the source code, I've found the error is raised by the ensureLeafCertificate function which call generateCertificateFromCA which calls certs.ParseCASecret using the clientCASecret generated by cert-manager.
This certificate only contains ca.crt, tls.crt and tls.key.
I think I can use the Pooler.spec.pgbouncer.authQuerySecret field as a workaround, but it would be nice to at least document this behavior.
Removing the pooler fixes the problem.