# Using CertManager and TLS with MongoDB Helm charts results in error? **URL:** \ **Category:** Percona Operator for MongoDB\ **Tags:** mongodb\ **Created:** [January 24, 2025, 11:15am UTC](https://forums.percona.com/t/using-certmanager-and-tls-with-mongodb-helm-charts-results-in-error/36326 "2025-01-24T11:15:16Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![thedukedk](https://avatars.discourse-cdn.com/v4/letter/t/4491bb/32.png) [@thedukedk](https://forums.percona.com/u/thedukedk)\ **Post date:** [January 24, 2025, 11:15am UTC](https://forums.percona.com/t/using-certmanager-and-tls-with-mongodb-helm-charts-results-in-error/36326/1 "2025-01-24T11:15:16Z")
## Description: We already have cert-manager deployed and working in our clusters using SmallStep CA as an issuer. Works fine for us. I installed the psmdb-operator with little to no changes to its default values. I try to install a psmdb-db with its helm chart and get an error because the operator tries to create a CA cert that is already controlled by our own CA(SmallStep). Not sure what the proper approach is here. We only want certificates on our clusters that are signed by our own CA and we know get renewed based on our needs and wants. Is there some way to use the certificates generated by certManager from our CA? If we generate internal and external certifcates **prior** to deploying a MongoDB statefulset with the psmdb-db helm chart. Can we just tell it to use the existing certificates by passing it the appropriate secrets? ## Steps to Reproduce: I am using both the psmdb-operator and the psmdb-db Helm charts. Both version _1.19.0_. ### psmdb-operator - replicaCount: **3** in values file - watchAllNamespaces: **true** ### psmdb-db I did a deploy with backup and sharding disabled. I then tried setting the below TLS values but got the same result. - **tls.mode:** allowTLS - **tls.issuerConf.name:** step-cluster-issuer - **tls.issuerConf.kind:** StepClusterIssuer - **tls.issuerConf.group:** certmanager.step.sm The name, kind and group values are ussually what we set when on the **issuerRef** whenever we want a certificate issued. So I figured I would give it a try.. ## Logs: `TLS secrets handler: "create ssl by cert-manager: update cert mangager certs: failed to apply cert-manager certificates: failed to wait for ca cert: set controller reference: Object percona/first-psmdb-psmdb-db-ca-cert is already owned by another Certificate controller first-psmdb-psmdb-db-ca-cert". Please create your TLS secret first-psmdb-psmdb-db-ssl manually or setup cert-manager correctly` ## Expected Result: Valid certificates, generated by certManager with our CA as the issuer, for internal and external communication. MongoDB StatefulSet, Pods, Services, etc are created. ## Actual Result: Certificates get created but the **PerconaServerMongoDB** kind is stuck in an _error_ state with the above error message. No PODS are ever created. ```auto apiVersion: v1 data: ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JS.... tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1J... tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tL... kind: Secret metadata: annotations: cert-manager.io/alt-names: "" cert-manager.io/certificate-name: first-psmdb-psmdb-db-ca-cert cert-manager.io/common-name: first-psmdb-psmdb-db-ca cert-manager.io/ip-sans: "" cert-manager.io/issuer-group: "" cert-manager.io/issuer-kind: Issuer cert-manager.io/issuer-name: first-psmdb-psmdb-db-psmdb-ca-issuer cert-manager.io/uri-sans: "" creationTimestamp: "2025-01-24T10:37:40Z" labels: controller.cert-manager.io/fao: "true" name: first-psmdb-psmdb-db-ca-cert namespace: percona ownerReferences: - apiVersion: cert-manager.io/v1 blockOwnerDeletion: true controller: true kind: Certificate name: first-psmdb-psmdb-db-ca-cert uid: 588823e5-b309-4233-bbe9-e41770ecf7dd resourceVersion: "351676508" uid: 0ecae70c-ec25-4e3c-8643-869fc3e57606 type: kubernetes.io/tls ``` ## Additional Information: … ---
**Author:** ![thedukedk](https://avatars.discourse-cdn.com/v4/letter/t/4491bb/32.png) [@thedukedk](https://forums.percona.com/u/thedukedk)\ **Post date:** [January 24, 2025, 1:35pm UTC](https://forums.percona.com/t/using-certmanager-and-tls-with-mongodb-helm-charts-results-in-error/36326/2 "2025-01-24T13:35:02Z")
As an update I generated two certificates using our standard approach. Then passed those in with the following config for the chart. ```auto tls: mode: allowTLS tls.allowInvalidCertificates: false issuerConf: name: step-cluster-issuer kind: StepClusterIssuer group: certmanager.step.sm secrets: ssl: first-psmdb-ssl-external sslInternal: first-psmdb-ssl-internal encryptionKey: first-psmdb-psmdb-db-mongodb-encryption-key keyFile: first-psmdb-psmdb-db-mongodb-keyfile users: internal-first-psmdb-psmdb-db-users ``` This seems to get me farther. But I now see errors like the below in the statefulsets logs. ```auto first-psmdb-psmdb-db-rs0-0 mongod {"t":{"$date":"2025-01-24T13:34:33.145+00:00"},"s":"I", "c":"ACCESS", "id":5286202, "ctx":"conn3557","msg":"Different user name was supplied to saslSupportedMechs","attr":{"error":{"code":17,"codeName":"ProtocolError","errmsg":"Attempt to switch database target during SASL authentication from clusterAdmin@ to @admin"}}} first-psmdb-psmdb-db-rs0-0 mongod {"t":{"$date":"2025-01-24T13:34:33.242+00:00"},"s":"I", "c":"ACCESS", "id":5286202, "ctx":"conn3561","msg":"Different user name was supplied to saslSupportedMechs","attr":{"error":{"code":17,"codeName":"ProtocolError","errmsg":"Attempt to switch database target during SASL authentication from userAdmin@ to @admin"}}} first-psmdb-psmdb-db-rs0-0 mongod {"t":{"$date":"2025-01-24T13:34:34.289+00:00"},"s":"I", "c":"ACCESS", "id":5286202, "ctx":"conn3564","msg":"Different user name was supplied to saslSupportedMechs","attr":{"error":{"code":17,"codeName":"ProtocolError","errmsg":"Attempt to switch database target during SASL authentication from clusterAdmin@ to @admin"}}} first-psmdb-psmdb-db-rs0-0 mongod {"t":{"$date":"2025-01-24T13:34:34.389+00:00"},"s":"I", "c":"ACCESS", "id":5286202, "ctx":"conn3568","msg":"Different user name was supplied to saslSupportedMechs","attr":{"error":{"code":17,"codeName":"ProtocolError","errmsg":"Attempt to switch database target during SASL authentication from userAdmin@ to @admin"}}} first-psmdb-psmdb-db-rs0-0 mongod {"t":{"$date":"2025-01-24T13:34:35.447+00:00"},"s":"I", "c":"ACCESS", "id":5286202, "ctx":"conn3571","msg":"Different user name was supplied to saslSupportedMechs","attr":{"error":{"code":17,"codeName":"ProtocolError","errmsg":"Attempt to switch database target during SASL authentication from clusterAdmin@ to @admin"}}} first-psmdb-psmdb-db-rs0-0 mongod {"t":{"$date":"2025-01-24T13:34:35.537+00:00"},"s":"I", "c":"ACCESS", "id":5286202, "ctx":"conn3574","msg":"Different user name was supplied to saslSupportedMechs","attr":{"error":{"code":17,"codeName":"ProtocolError","errmsg":"Attempt to switch database target during SASL authentication from userAdmin@ to @admin"}}} first-psmdb-psmdb-db-rs0-0 mongod {"t":{"$date":"2025-01-24T13:34:36.588+00:00"},"s":"I", "c":"ACCESS", "id":5286202, "ctx":"conn3577","msg":"Different user name was supplied to saslSupportedMechs","attr":{"error":{"code":17,"codeName":"ProtocolError","errmsg":"Attempt to switch database target during SASL authentication from clusterAdmin@ to @admin"}}} first-psmdb-psmdb-db-rs0-0 mongod {"t":{"$date":"2025-01-24T13:34:36.686+00:00"},"s":"I", "c":"ACCESS", "id":5286202, "ctx":"conn3579","msg":"Different user name was supplied to saslSupportedMechs","attr":{"error":{"code":17,"codeName":"ProtocolError","errmsg":"Attempt to switch database target during SASL authentication from userAdmin@ to @admin"}}} first-psmdb-psmdb-db-rs0-0 mongod {"t":{"$date":"2025-01-24T13:34:37.788+00:00"},"s":"I", "c":"ACCESS", "id":5286202, "ctx":"conn3584","msg":"Different user name was supplied to saslSupportedMechs","attr":{"error":{"code":17,"codeName":"ProtocolError","errmsg":"Attempt to switch database target during SASL authentication from clusterAdmin@ to @admin"}}} first-psmdb-psmdb-db-rs0-0 mongod {"t":{"$date":"2025-01-24T13:34:37.840+00:00"},"s":"I", "c":"ACCESS", "id":5286202, "ctx":"conn3587","msg":"Different user name was supplied to saslSupportedMechs","attr":{"error":{"code":17,"codeName":"ProtocolError","errmsg":"Attempt to switch database target during SASL authentication from userAdmin@ to @admin"}}} ``` ---
**Author:** ![Julio\_Pasinatto](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/julio_pasinatto/32/17643_2.png) [@Julio\_Pasinatto](https://forums.percona.com/u/Julio_Pasinatto)\ **Post date:** [January 28, 2025, 11:49pm UTC](https://forums.percona.com/t/using-certmanager-and-tls-with-mongodb-helm-charts-results-in-error/36326/3 "2025-01-28T23:49:36Z")
Hi @thedukedk thanks for reporting this issue, I’ll try to reproduce it. In the meantime, you might find these TLS setup docs helpful, if you haven’t already checked them: [Transport encryption (TLS/SSL) - Percona Operator for MongoDB](https://docs.percona.com/percona-operator-for-mongodb/TLS.html) Also, I noticed in your message there might be a typo in the configuration. Please make sure you’re using `allowInvalidCertificates` and not `tls.allowInvalidCertificates`. I’ll get back to you once I have more information. ---
**Author:** ![thedukedk](https://avatars.discourse-cdn.com/v4/letter/t/4491bb/32.png) [@thedukedk](https://forums.percona.com/u/thedukedk)\ **Post date:** [January 29, 2025, 1:05pm UTC](https://forums.percona.com/t/using-certmanager-and-tls-with-mongodb-helm-charts-results-in-error/36326/4 "2025-01-29T13:05:32Z")
Hi @Julio_Pasinatto Many thanks. Been struggling quite a bit to get this running with TLS enabled. We really need **internal** and **external** TLS enabled using our CA. We do **not** want the data encrypted at rest. Generating the certs before deploying the psmdb-db with the helm chart seems to work, when tls.mode is either `perferTLS` or `allowTLS`, with the below configuration. ```auto tls: mode: allowTLS # OR perferTLS allowInvalidCertificates: false issuerConf: name: step-cluster-issuer kind: StepClusterIssuer group: certmanager.step.sm secrets: ssl: first-psmdb-ssl-external sslInternal: first-psmdb-ssl-internal encryptionKey: first-psmdb-psmdb-db-mongodb-encryption-key keyFile: first-psmdb-psmdb-db-mongodb-keyfile users: internal-first-psmdb-psmdb-db-users ``` But I see these errors in the logs. ```auto mongod {"t":{"$date":"2025-01-29T11:46:24.955+00:00"},"s":"I", "c":"ACCESS", "id":5286202, "ctx":"conn427","msg":"Different user name was supplied to saslSupportedMechs","attr":{"error":{"code":17,"codeName":"ProtocolError","errmsg":"Attempt to switch database target during SASL authentication from clusterAdmin@ to @admin"}}} ``` Setting the tls.mode to `requireTLS` does not work at all **unless** i set `allowInvalidCertificates` to `true`. ---
**Author:** ![zkatarn](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/zkatarn/32/20198_2.png) [@zkatarn](https://forums.percona.com/u/zkatarn)\ **Post date:** [February 19, 2025, 3:14pm UTC](https://forums.percona.com/t/using-certmanager-and-tls-with-mongodb-helm-charts-results-in-error/36326/5 "2025-02-19T15:14:44Z")
Hi Same trouble here. We use Percona Operator in 1.16.0 without trouble. This week, i try to upgrade in 1.19.0, and it doesn’t work. I have a conflict between Cert-manager et Percona Operator. **Architecture** We use Google Kubernetes Engine 1.30.9-gke.1009000 with Cert-manager v1.16.2 **TLS Configuration** ```auto tls: mode: preferTLS allowInvalidCertificates: false ``` Logs from Operator ```auto 2025-02-19T15:00:07.905Z INFO createSSLByCertManager updating cert-manager certificates {"controller": "psmdb-controller", "controllerGroup": "psmdb.percona.com", "controllerKind": "PerconaServerMongoDB", "PerconaServerMongoDB": {"name":"mongodb-testvg","namespace":"percona-test"}, "namespace": "percona-test", "name": "mongodb-testvg", "reconcileID": "7dac656b-c75c-4107-ac45-4ea910b180c5"} 2025-02-19T15:00:07.905Z INFO Creating old secrets {"controller": "psmdb-controller", "controllerGroup": "psmdb.percona.com", "controllerKind": "PerconaServerMongoDB", "PerconaServerMongoDB": {"name":"mongodb-testvg","namespace":"percona-test"}, "namespace": "percona-test", "name": "mongodb-testvg", "reconcileID": "7dac656b-c75c-4107-ac45-4ea910b180c5"} 2025-02-19T15:00:07.918Z INFO applying new certificates {"controller": "psmdb-controller", "controllerGroup": "psmdb.percona.com", "controllerKind": "PerconaServerMongoDB", "PerconaServerMongoDB": {"name":"mongodb-testvg","namespace":"percona-test"}, "namespace": "percona-test", "name": "mongodb-testvg", "reconcileID": "7dac656b-c75c-4107-ac45-4ea910b180c5"} 2025-02-19T15:00:08.974Z ERROR Reconciler error {"controller": "psmdb-controller", "controllerGroup": "psmdb.percona.com", "controllerKind": "PerconaServerMongoDB", "PerconaServerMongoDB": {"name":"mongodb-testvg","namespace":"percona-test"}, "namespace": "percona-test", "name": "mongodb-testvg", "reconcileID": "7dac656b-c75c-4107-ac45-4ea910b180c5", "error": "TLS secrets handler: \"create ssl by cert-manager: update cert mangager certs: failed to apply cert-manager certificates: failed to wait for ca cert: set controller reference: Object percona-test/mongodb-testvg-ca-cert is already owned by another Certificate controller mongodb-testvg-ca-cert\". Please create your TLS secret mongodb-testvg-ssl manually or setup cert-manager correctly", "errorVerbose": "TLS secrets handler: \"create ssl by cert-manager: update cert mangager certs: failed to apply cert-manager certificates: failed to wait for ca cert: set controller reference: Object percona-test/mongodb-testvg-ca-cert is already owned by another Certificate controller mongodb-testvg-ca-cert\". Please create your TLS secret mongodb-testvg-ssl manually or setup cert-manager correctly\ngithub.com/percona/percona-server-mongodb-operator/pkg/controller/perconaservermongodb.(*ReconcilePerconaServerMongoDB).Reconcile\n\t/go/src/github.com/percona/percona-server-mongodb-operator/pkg/controller/perconaservermongodb/psmdb_controller.go:389\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.3/pkg/internal/controller/controller.go:116\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.3/pkg/internal/controller/controller.go:303\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.3/pkg/internal/controller/controller.go:263\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.2\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.3/pkg/internal/controller/controller.go:224\nruntime.goexit\n\t/usr/local/go/src/runtime/asm_amd64.s:1700"} sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.3/pkg/internal/controller/controller.go:316 sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.3/pkg/internal/controller/controller.go:263 sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.2 /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.3/pkg/internal/controller/controller.go:224 ``` Logs from Cert-manager ```auto I0219 14:21:20.256396 1 conditions.go:96] Setting lastTransitionTime for Issuer "mongodb-testvg-psmdb-ca-issuer" condition "Ready" to 2025-02-19 14:21:20.25637953 +0000 UTC m=+175707.548230613 I0219 14:21:20.279227 1 conditions.go:203] Setting lastTransitionTime for Certificate "mongodb-testvg-ca-cert" condition "Ready" to 2025-02-19 14:21:20.279216789 +0000 UTC m=+175707.571067862 I0219 14:21:20.279242 1 trigger_controller.go:223] "Certificate must be re-issued" logger="cert-manager.controller" key="percona-test/mongodb-testvg-ca-cert" reason="DoesNotExist" message="Issuing certificate as Secret does not exist" I0219 14:21:20.279408 1 conditions.go:203] Setting lastTransitionTime for Certificate "mongodb-testvg-ca-cert" condition "Issuing" to 2025-02-19 14:21:20.279401129 +0000 UTC m=+175707.571252212 I0219 14:21:20.300669 1 controller.go:152] "re-queuing item due to optimistic locking on resource" logger="cert-manager.controller" error="Operation cannot be fulfilled on certificates.cert-manager.io \"mongodb-testvg-ca-cert\": the object has been modified; please apply your changes to the latest version and try again" I0219 14:21:20.300759 1 conditions.go:203] Setting lastTransitionTime for Certificate "mongodb-testvg-ca-cert" condition "Ready" to 2025-02-19 14:21:20.300752259 +0000 UTC m=+175707.592603332 I0219 14:21:20.606403 1 controller.go:152] "re-queuing item due to optimistic locking on resource" logger="cert-manager.controller" error="Operation cannot be fulfilled on certificates.cert-manager.io \"mongodb-testvg-ca-cert\": the object has been modified; please apply your changes to the latest version and try again" I0219 14:21:20.664148 1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "mongodb-testvg-ca-cert-1" condition "Approved" to 2025-02-19 14:21:20.664138023 +0000 UTC m=+175707.955989097 I0219 14:21:20.704195 1 conditions.go:263] Setting lastTransitionTime for CertificateRequest "mongodb-testvg-ca-cert-1" condition "Ready" to 2025-02-19 14:21:20.704183933 +0000 UTC m=+175707.996035006 I0219 14:21:20.762196 1 conditions.go:192] Found status change for Certificate "mongodb-testvg-ca-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2025-02-19 14:21:20.762186582 +0000 UTC m=+175708.054037655 I0219 14:21:20.785810 1 controller.go:152] "re-queuing item due to optimistic locking on resource" logger="cert-manager.controller" error="Operation cannot be fulfilled on certificates.cert-manager.io \"mongodb-testvg-ca-cert\": the object has been modified; please apply your changes to the latest version and try again" I0219 14:21:20.787056 1 conditions.go:192] Found status change for Certificate "mongodb-testvg-ca-cert" condition "Ready": "False" -> "True"; setting lastTransitionTime to 2025-02-19 14:21:20.787048361 +0000 UTC m=+175708.078899424 I0219 14:21:20.816625 1 controller.go:152] "re-queuing item due to optimistic locking on resource" logger="cert-manager.controller" error="Operation cannot be fulfilled on certificates.cert-manager.io \"mongodb-testvg-ca-cert\": the object has been modified; please apply your changes to the latest version and try again" ``` It’s work until 1.16.1, after that i have always this error. Thanks for your help ---
**Author:** ![Slava\_Sarzhan](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/slava_sarzhan/32/3196_2.png) [@Slava\_Sarzhan](https://forums.percona.com/u/Slava_Sarzhan)\ **Post date:** [March 19, 2025, 9:00pm UTC](https://forums.percona.com/t/using-certmanager-and-tls-with-mongodb-helm-charts-results-in-error/36326/6 "2025-03-19T21:00:17Z")
> [@thedukedk](#): > > StepClusterIssuer I have reproduced it with `StepClusterIssuer` but I can’t with `ClusterIssuer`. @zkatarn do you have `StepClusterIssuer` as well? ---
**Author:** ![Emmanuel\_Smith](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/emmanuel_smith/32/20771_2.png) [@Emmanuel\_Smith](https://forums.percona.com/u/Emmanuel_Smith)\ **Post date:** [April 18, 2025, 7:53am UTC](https://forums.percona.com/t/using-certmanager-and-tls-with-mongodb-helm-charts-results-in-error/36326/7 "2025-04-18T07:53:39Z")
Hi I respond following zkatarn’s message. I tested with the following two settings, but the error message remains the same. With config 1: ```auto Tls: Allow Invalid Certificates: false Issuer Conf: Group: certmanager.step.sm Kind: StepClusterIssuer Name: step-cluster-issuer Mode: allowTLS ``` Error: ```auto Message: TLS secrets handler: "create ssl by cert-manager: update cert mangager certs: failed to apply cert-manager certificates: failed to wait for ca cert: set controller reference: Object data/mongo-cluster-psm-ca-cert is already owned by another Certificate controller mongo-cluster-psm-ca-cert". Please create your TLS secret mongo-cluster-psm-ssl manually or setup cert-manager correctly ``` With config 2: ```auto Tls: Allow Invalid Certificates: false Issuer Conf: Group: cert-manager.io Kind: ClusterIssuer Name: cluster-issuer Mode: allowTLS ``` Error: ```auto Message: TLS secrets handler: "create ssl by cert-manager: update cert mangager certs: failed to apply cert-manager certificates: failed to wait for ca cert: set controller reference: Object data/mongo-cluster-psm-ca-cert is already owned by another Certificate controller mongo-cluster-psm-ca-cert". Please create your TLS secret mongo-cluster-psm-ssl manually or setup cert-manager correctly` ``` Thanks for your help. ---
**Author:** ![amerello](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/amerello/32/21244_2.png) [@amerello](https://forums.percona.com/u/amerello)\ **Post date:** [June 11, 2025, 3:47pm UTC](https://forums.percona.com/t/using-certmanager-and-tls-with-mongodb-helm-charts-results-in-error/36326/8 "2025-06-11T15:47:54Z")
Any update on this issue? I’m experiencing the same problem described by OP with 1.20.1. The certificate gets created by the Operator, but the database fails to initialize because of the certificate conflict error. I got into this situation just following the Quickstart guide with Helm [1] and no modifications to the defaults. [1] [With Helm - Percona Operator for MongoDB](https://docs.percona.com/percona-operator-for-mongodb/helm.html#installation) ---
**Author:** ![Emmanuel\_Smith](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/emmanuel_smith/32/20771_2.png) [@Emmanuel\_Smith](https://forums.percona.com/u/Emmanuel_Smith)\ **Post date:** [June 18, 2025, 7:15am UTC](https://forums.percona.com/t/using-certmanager-and-tls-with-mongodb-helm-charts-results-in-error/36326/9 "2025-06-18T07:15:59Z")
Hello, We still haven’t found a solution. We are stuck on version 1.16.0. ---
**Author:** ![Slava\_Sarzhan](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/slava_sarzhan/32/3196_2.png) [@Slava\_Sarzhan](https://forums.percona.com/u/Slava_Sarzhan)\ **Post date:** [June 30, 2025, 9:14am UTC](https://forums.percona.com/t/using-certmanager-and-tls-with-mongodb-helm-charts-results-in-error/36326/10 "2025-06-30T09:14:56Z")
> [@thedukedk](#): > > `issuerConf` Hi, I have created JIRA task [Jira](https://perconadev.atlassian.net/browse/K8SPSMDB-1413) and we will investigate root of the issue and fix it in PSMDBO 1.22.0 [Jira](https://perconadev.atlassian.net/browse/K8SPSMDB-1413) ---
**Author:** ![ashtonian](https://avatars.discourse-cdn.com/v4/letter/a/34f0e0/32.png) [@ashtonian](https://forums.percona.com/u/ashtonian)\ **Post date:** [September 28, 2025, 6:27am UTC](https://forums.percona.com/t/using-certmanager-and-tls-with-mongodb-helm-charts-results-in-error/36326/11 "2025-09-28T06:27:24Z")
Same Issue, trying to move from bitnami chart to this controller, this is blocking. What version of the chart is not impacted? ---
**Author:** ![Slava\_Sarzhan](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/slava_sarzhan/32/3196_2.png) [@Slava\_Sarzhan](https://forums.percona.com/u/Slava_Sarzhan)\ **Post date:** [September 28, 2025, 1:39pm UTC](https://forums.percona.com/t/using-certmanager-and-tls-with-mongodb-helm-charts-results-in-error/36326/12 "2025-09-28T13:39:41Z")
> [@Emmanuel\_Smith](#): > > `ClusterIssuer` hi @ashtonian , please provide your CR and an example of your Issuer? ---
**Author:** ![ashtonian](https://avatars.discourse-cdn.com/v4/letter/a/34f0e0/32.png) [@ashtonian](https://forums.percona.com/u/ashtonian)\ **Post date:** [September 29, 2025, 3:44am UTC](https://forums.percona.com/t/using-certmanager-and-tls-with-mongodb-helm-charts-results-in-error/36326/13 "2025-09-29T03:44:31Z")
```auto helmCharts: - name: psmdb-operator repo: "https://percona.github.io/percona-helm-charts" version: "1.20.1" includeCRDs: true releaseName: psmdb-operator namespace: data - name: psmdb-db repo: "https://percona.github.io/percona-helm-charts" version: "1.20.1" releaseName: mongo valuesFile: values.yaml namespace: data ``` ```auto users: - name: root db: admin passwordSecretRef: name: psmdb-root key: password roles: - { name: root, db: admin } replsets: rs0: name: rs0 size: 3 volumeSpec: pvc: storageClassName: topolvm-provisioner resources: requests: storage: 16Gi affinity: advanced: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: kubernetes.io/hostname operator: In values: ["rke-a-1","rke-a-2","rke-a-3"] podAntiAffinity: requiredDuringSchedulingIgnoredDuringExecution: - labelSelector: matchExpressions: - key: app.kubernetes.io/component operator: In values: ["mongod"] topologyKey: kubernetes.io/hostname resources: requests: cpu: 500m memory: 4Gi limits: cpu: "2" memory: 8Gi sharding: enabled: true configrs: size: 3 volumeSpec: pvc: storageClassName: topolvm-provisioner resources: requests: storage: 24Gi affinity: advanced: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: kubernetes.io/hostname operator: In values: ["rke-a-1","rke-a-2","rke-a-3"] podAntiAffinity: requiredDuringSchedulingIgnoredDuringExecution: - labelSelector: matchExpressions: - key: app.kubernetes.io/component operator: In values: ["cfg"] topologyKey: kubernetes.io/hostname resources: requests: cpu: 300m memory: 2Gi limits: cpu: "2" memory: 4Gi mongos: size: 2 affinity: advanced: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: kubernetes.io/hostname operator: In values: ["rke-a-1","rke-a-2","rke-a-3"] podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - weight: 100 podAffinityTerm: labelSelector: matchExpressions: - key: app.kubernetes.io/component operator: In values: ["mongos"] topologyKey: kubernetes.io/hostname resources: requests: cpu: 200m memory: 512Mi limits: cpu: "1" memory: 2Gi backup: enabled: false tasks: [] volumeMounts: [] storages: {} pitr: enabled: false ``` ```auto apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: name: acme-issuer namespace: utilities annotations: argocd.argoproj.io/sync-wave: "-8" spec: acme: email: noreply@<::DOMAIN_PUBLIC::> server: "https://acme-v02.api.letsencrypt.org/directory" # https://acme-staging-v02.api.letsencrypt.org/directory privateKeySecretRef: name: acme-issuer-account-key solvers: - dns01: cloudflare: apiTokenSecretRef: name: cf-api-tokens key: internal_domain selector: dnsZones: - '<::DOMAIN_INTERNAL::>' - dns01: cloudflare: apiTokenSecretRef: name: cf-api-tokens key: external_domain selector: dnsZones: - '<::DOMAIN_PUBLIC::>' ``` ```auto 9-29T03:42:08.804Z INFO KubeAPIWarningLogger spec.privateKey.rotationPolicy: In cert-manager >= v1.18.0, the default value changed from `Never` to `Always`. 2025-09-29T03:42:08.818Z INFO KubeAPIWarningLogger spec.privateKey.rotationPolicy: In cert-manager >= v1.18.0, the default value changed from `Never` to `Always`. 2025-09-29T03:42:08.818Z INFO createSSLByCertManager updating cert-manager certificates {"controller": "psmdb-controller", "controllerGroup": "psmdb.percona.com", "controllerKind": "PerconaServerMongoDB", "PerconaServerMongoDB": {"name":"mongo-psmdb-db","namespace":"data"}, "namespace": "data", "name": "mongo-psmdb-db", "reconcileID": "92f975c8-93ba-47c1-a3b8-9a029ea88c51"} 2025-09-29T03:42:08.818Z INFO Creating old secrets {"controller": "psmdb-controller", "controllerGroup": "psmdb.percona.com", "controllerKind": "PerconaServerMongoDB", "PerconaServerMongoDB": {"name":"mongo-psmdb-db","namespace":"data"}, "namespace": "data", "name": "mongo-psmdb-db", "reconcileID": "92f975c8-93ba-47c1-a3b8-9a029ea88c51"} 2025-09-29T03:42:08.826Z INFO applying new certificates {"controller": "psmdb-controller", "controllerGroup": "psmdb.percona.com", "controllerKind": "PerconaServerMongoDB", "PerconaServerMongoDB": {"name":"mongo-psmdb-db","namespace":"data"}, "namespace": "data", "name": "mongo-psmdb-db", "reconcileID": "92f975c8-93ba-47c1-a3b8-9a029ea88c51"} 2025-09-29T03:42:09.856Z ERROR Reconciler error {"controller": "psmdb-controller", "controllerGroup": "psmdb.percona.com", "controllerKind": "PerconaServerMongoDB", "PerconaServerMongoDB": {"name":"mongo-psmdb-db","namespace":"data"}, "namespace": "data", "name": "mongo-psmdb-db", "reconcileID": "92f975c8-93ba-47c1-a3b8-9a029ea88c51", "error": "TLS secrets handler: \"create ssl by cert-manager: update cert mangager certs: failed to apply cert-manager certificates: failed to wait for ca cert: set controller reference: Object data/mongo-psmdb-db-ca-cert is already owned by another Certificate controller mongo-psmdb-db-ca-cert\". Please create your TLS secret mongo-psmdb-db-ssl manually or setup cert-manager correctly", "errorVerbose": "TLS secrets handler: \"create ssl by cert-manager: update cert mangager certs: failed to apply cert-manager certificates: failed to wait for ca cert: set controller reference: Object data/mongo-psmdb-db-ca-cert is already owned by another Certificate controller mongo-psmdb-db-ca-cert\". Please create your TLS secret mongo-psmdb-db-ssl manually or setup cert-manager correctly\ngithub.com/percona/percona-server-mongodb-operator/pkg/controller/perconaservermongodb.(*ReconcilePerconaServerMongoDB).Reconcile\n\t/go/src/github.com/percona/percona-server-mongodb-operator/pkg/controller/perconaservermongodb/psmdb_controller.go:388\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/internal/controller/controller.go:334\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/internal/controller/controller.go:294\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.2\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/internal/controller/controller.go:255\nruntime.goexit\n\t/usr/local/go/src/runtime/asm_amd64.s:1700"} sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/internal/controller/controller.go:347 sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/internal/controller/controller.go:294 sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.2 /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/internal/controller/controller.go:255 ``` Using argo + kustomize to deploy these helm charts. The cert manager helm chart is 1.18.2. ---
**Author:** ![ashtonian](https://avatars.discourse-cdn.com/v4/letter/a/34f0e0/32.png) [@ashtonian](https://forums.percona.com/u/ashtonian)\ **Post date:** [October 31, 2025, 2:17am UTC](https://forums.percona.com/t/using-certmanager-and-tls-with-mongodb-helm-charts-results-in-error/36326/14 "2025-10-31T02:17:53Z")
Any update or additional information I can provide? I updated the operator chart to 1.21.1 and running into the same issue. Using cert manager 1.18.2 chart, verified to be issuing certificates correctly. ---
**Author:** ![Mayank\_Shah](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/mayank_shah/32/15501_2.png) [@Mayank\_Shah](https://forums.percona.com/u/Mayank_Shah)\ **Post date:** [July 8, 2026, 9:25am UTC](https://forums.percona.com/t/using-certmanager-and-tls-with-mongodb-helm-charts-results-in-error/36326/15 "2026-07-08T09:25:04Z")
Hey folks, this will be fixed in 1.23.0. You’ll be able to use ClusterIssuer and External issuers without any issues.