From 64e9b727196454f9a40342f571bd2370e9ac7136 Mon Sep 17 00:00:00 2001
From: Zoe Roux <zoe.roux@zoriya.dev>
Date: Wed, 16 Jul 2025 14:03:33 +0200
Subject: [PATCH] New try of cert manager with cnpg

---
 apps/postgres/ca.yaml      | 25 ++++++++++++++++++++++
 apps/postgres/certs.yaml   | 44 ++++++++++++++------------------------
 apps/postgres/cluster.yaml |  4 +++-
 3 files changed, 44 insertions(+), 29 deletions(-)
 create mode 100644 apps/postgres/ca.yaml

diff --git a/apps/postgres/ca.yaml b/apps/postgres/ca.yaml
new file mode 100644
index 0000000..0cd8d9b
--- /dev/null
+++ b/apps/postgres/ca.yaml
@@ -0,0 +1,25 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: postgres-ca
+  namespace: postgres
+spec:
+  isCA: true
+  commonName: postgres-ca
+  secretName: postgres-ca
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+  issuerRef:
+    name: selfsigned
+    kind: ClusterIssuer
+    group: cert-manager.io
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: postgres-ca
+  namespace: postgres
+spec:
+  ca:
+    secretName: postgres-ca
diff --git a/apps/postgres/certs.yaml b/apps/postgres/certs.yaml
index 1480a53..0c5f057 100644
--- a/apps/postgres/certs.yaml
+++ b/apps/postgres/certs.yaml
@@ -1,36 +1,10 @@
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
-  name: postgres-ca
+  name: postgres-server-cert
   namespace: postgres
 spec:
-  isCA: true
-  commonName: postgres-ca
-  secretName: postgres-ca
-  privateKey:
-    algorithm: ECDSA
-    size: 256
-  issuerRef:
-    name: selfsigned
-    kind: ClusterIssuer
-    group: cert-manager.io
----
-apiVersion: cert-manager.io/v1
-kind: Issuer
-metadata:
-  name: postgres-ca
-  namespace: postgres
-spec:
-  ca:
-    secretName: postgres-ca
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: postgres-replication-cert
-  namespace: postgres
-spec:
-  secretName: postgres-replication-cert
+  secretName: postgres-server-cert
   secretTemplate:
     labels:
       cnpg.io/reload: ""
@@ -50,3 +24,17 @@ spec:
     name: postgres-ca
     kind: Issuer
     group: cert-manager.io
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: postgres-replication-cert
+spec:
+  secretName: postgres-replication-cert
+  usages:
+    - client auth
+  commonName: streaming_replica
+  issuerRef:
+    name: postgres-ca
+    kind: Issuer
+    group: cert-manager.io
diff --git a/apps/postgres/cluster.yaml b/apps/postgres/cluster.yaml
index 6daa0bc..198b29f 100644
--- a/apps/postgres/cluster.yaml
+++ b/apps/postgres/cluster.yaml
@@ -10,7 +10,9 @@ spec:
     size: 10Gi
 
   certificates:
-    clientCASecret: postgres-ca
+    serverTLSSecret: postgres-ca
+    serverCASecret: postgres-ca
+    clientCASecret: postgres-server-cert
     replicationTLSSecret: postgres-replication-cert
 
   # this is here because no `Role` crd exsists yet.