Kubernetes api with intermediate CA not supported

PostgreSQL Percona Operator for PostgreSQL
1

Description:

We using multiple kubernetes cluster signed by our own CA. Each cluster have ICA certificate.
Since the root CA cert not trusted in postgres pod it fails to start.
There is no option in the CRD to add the ca bundle as volume also configure Petroni via env to use it.

Steps to Reproduce:

Default install in a kubernetes that have ICA.

Version:

2.2.0

Logs:

2023-07-13 11:45:03,521 WARNING: Retrying (Retry(total=0, connect=None, read=None, redirect=0, status=None)) after connection broken by ‘SSLError(SSLError(1, ‘[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:897)’),)’: /api/v1/namespaces/admin/pods?labelSelector=postgres-operator.crunchydata.com%2Fcluster%3Dawx%2Cpostgres-operator.crunchydata.com%2Fpatroni%3Dawx-ha

2023-07-13 11:45:03,522 WARNING: Retrying (Retry(total=0, connect=None, read=None, redirect=0, status=None)) after connection broken by ‘SSLError(SSLError(1, ‘[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:897)’),)’: /api/v1/namespaces/admin/endpoints?labelSelector=postgres-operator.crunchydata.com%2Fcluster%3Dawx%2Cpostgres-operator.crunchydata.com%2Fpatroni%3Dawx-ha

2023-07-13 11:45:03,528 ERROR: Request to server https://172.23.8.1:443 failed: MaxRetryError(“HTTPSConnectionPool(host=‘172.23.8.1’, port=443): Max retries exceeded with url: /api/v1/namespaces/admin/pods?labelSelector=postgres-operator.crunchydata.com%2Fcluster%3Dawx%2Cpostgres-operator.crunchydata.com%2Fpatroni%3Dawx-ha (Caused by SSLError(SSLError(1, ‘[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:897)’),))”,)

2023-07-13 11:45:03,529 ERROR: Request to server https://172.23.8.1:443 failed: MaxRetryError(“HTTPSConnectionPool(host=‘172.23.8.1’, port=443): Max retries exceeded with url: /api/v1/namespaces/admin/endpoints?labelSelector=postgres-operator.crunchydata.com%2Fcluster%3Dawx%2Cpostgres-operator.crunchydata.com%2Fpatroni%3Dawx-ha (Caused by SSLError(SSLError(1, ‘[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:897)’),))”,)

2023-07-13 11:45:04,529 ERROR: ObjectCache.run K8sConnectionFailed(‘No more API server nodes in the cluster’,)

Expected Result:

Postgres cluster starts normally.

Actual Result:

Pods in crashloop.

Additional Information:

2

For quick-fix the postgres image can be modified, but I can’t find the dockerfile for it. Can somebody tell where can I find it?

3

Finally I created a new image using the base image, because in the CRD the image can be changed.
My dockerfile looks like this:

FROM percona/percona-postgresql-operator:2.2.0-ppg15-postgres
ENV PATRONI_KUBERNETES_CACERT=/ca.crt
USER 0
COPY ca.crt /ca.crt
RUN trust anchor --store /ca.crt && update-ca-trust
USER 1001

But… it would be great if we doesn’t need to recreate the image. If we can add volume/volumemounts and env variables to the CRD this problem can be solved easily while we retain the original image for easier upgrades in the future.
Can somebody in the percona staff help on this?