Log: /mnt/jenkins/workspace/cloud-psmdb-operator_PR-2436/e2e-tests/logs/tls-clusterissuer-cert-manager.log Warning: version difference between client (1.36) and server (1.33) exceeds the supported minor version skew of +/-1 Warning: version difference between client (1.36) and server (1.33) exceeds the supported minor version skew of +/-1 Warning: version difference between client (1.36) and server (1.33) exceeds the supported minor version skew of +/-1 ----------------------------------------------------------------------------------- get and delete old CRDs and RBAC ----------------------------------------------------------------------------------- grep: warning: stray \ before - grep: warning: stray \ before - error: the server doesn't have a resource type "perconaservermongodbbackups" + kubectl patch perconaservermongodbbackups.psmdb.percona.com -n sh --type=merge -p '{"metadata":{"finalizers":[]}}' error: the server doesn't have a resource type "perconaservermongodbbackups" error: the server doesn't have a resource type "perconaservermongodbclustersyncs" + kubectl patch perconaservermongodbclustersyncs.psmdb.percona.com -n sh --type=merge -p '{"metadata":{"finalizers":[]}}' error: the server doesn't have a resource type "perconaservermongodbclustersyncs" error: the server doesn't have a resource type "perconaservermongodbrestores" + kubectl patch perconaservermongodbrestores.psmdb.percona.com -n sh --type=merge -p '{"metadata":{"finalizers":[]}}' error: the server doesn't have a resource type "perconaservermongodbrestores" error: the server doesn't have a resource type "perconaservermongodbs" + kubectl patch perconaservermongodbs.psmdb.percona.com -n sh --type=merge -p '{"metadata":{"finalizers":[]}}' error: the server doesn't have a resource type "perconaservermongodbs" Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "null" not found Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "null" not found Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "null" not found Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "null" not found ----------------------------------------------------------------------------------- destroy chaos-mesh ----------------------------------------------------------------------------------- error: resource(s) were provided, but no name was specified error: resource(s) were provided, but no name was specified error: resource(s) were provided, but no name was specified error: resource(s) were provided, but no name was specified error: resource(s) were provided, but no name was specified error: resource(s) were provided, but no name was specified ----------------------------------------------------------------------------------- cleaned up all old namespaces ----------------------------------------------------------------------------------- ----------------------------------------------------------------------------------- cleaned up old namespaces psmdb-operator ----------------------------------------------------------------------------------- error: resource(s) were provided, but no name was specified ----------------------------------------------------------------------------------- create namespace psmdb-operator ----------------------------------------------------------------------------------- namespace/psmdb-operator created Context "gke_cloud-dev-112233_us-central1-a_jen-psmdb-2436-3b9a99288-5-cluster10" modified. ----------------------------------------------------------------------------------- start PSMDB operator: docker.io/perconalab/percona-server-mongodb-operator:PR-2436-3b9a99288 ----------------------------------------------------------------------------------- customresourcedefinition.apiextensions.k8s.io/perconaservermongodbbackups.psmdb.percona.com serverside-applied customresourcedefinition.apiextensions.k8s.io/perconaservermongodbclustersyncs.psmdb.percona.com serverside-applied customresourcedefinition.apiextensions.k8s.io/perconaservermongodbrestores.psmdb.percona.com serverside-applied customresourcedefinition.apiextensions.k8s.io/perconaservermongodbs.psmdb.percona.com serverside-applied clusterrole.rbac.authorization.k8s.io/percona-server-mongodb-operator created serviceaccount/percona-server-mongodb-operator created clusterrolebinding.rbac.authorization.k8s.io/service-account-percona-server-mongodb-operator created deployment.apps/percona-server-mongodb-operator created waiting for pod/percona-server-mongodb-operator-7dfbc87bdb-lv45b to be ready.OK Print operator info from log 2026-07-07T10:09:50.860Z INFO setup Manager starting up {"gitCommit": "3b9a9928817950cd8d42718e3ceaa62ef667251f", "gitBranch": "PR-2436-3b9a99288", "buildTime": "", "goVersion": "go1.26.4", "os": "linux", "arch": "amd64"} ----------------------------------------------------------------------------------- destroy chaos-mesh ----------------------------------------------------------------------------------- error: resource(s) were provided, but no name was specified error: resource(s) were provided, but no name was specified error: resource(s) were provided, but no name was specified error: resource(s) were provided, but no name was specified error: resource(s) were provided, but no name was specified error: resource(s) were provided, but no name was specified ----------------------------------------------------------------------------------- cleaned up all old namespaces ----------------------------------------------------------------------------------- ----------------------------------------------------------------------------------- cleaned up old namespaces tls-clusterissuer-cert-manager-24377 ----------------------------------------------------------------------------------- error: resource(s) were provided, but no name was specified ----------------------------------------------------------------------------------- create namespace tls-clusterissuer-cert-manager-24377 ----------------------------------------------------------------------------------- namespace/tls-clusterissuer-cert-manager-24377 created Context "gke_cloud-dev-112233_us-central1-a_jen-psmdb-2436-3b9a99288-5-cluster10" modified. ----------------------------------------------------------------------------------- deploy cert manager ----------------------------------------------------------------------------------- error: the server doesn't have a resource type "clusterissuer" error: the server doesn't have a resource type "clusterissuer" error: the server doesn't have a resource type "clusterissuer" error: the server doesn't have a resource type "clusterissuer" error: the server doesn't have a resource type "certificate" error: the server doesn't have a resource type "certificate" error: the server doesn't have a resource type "certificate" error: the server doesn't have a resource type "certificate" namespace/cert-manager created namespace/cert-manager labeled namespace/cert-manager configured customresourcedefinition.apiextensions.k8s.io/challenges.acme.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/orders.acme.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/certificaterequests.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/certificates.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/clusterissuers.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/issuers.cert-manager.io created serviceaccount/cert-manager-cainjector created serviceaccount/cert-manager created serviceaccount/cert-manager-webhook created clusterrole.rbac.authorization.k8s.io/cert-manager-cainjector created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-issuers created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-clusterissuers created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-certificates created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-orders created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-challenges created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-ingress-shim created clusterrole.rbac.authorization.k8s.io/cert-manager-cluster-view created clusterrole.rbac.authorization.k8s.io/cert-manager-view created clusterrole.rbac.authorization.k8s.io/cert-manager-edit created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-approve:cert-manager-io created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-certificatesigningrequests created clusterrole.rbac.authorization.k8s.io/cert-manager-webhook:subjectaccessreviews created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-cainjector created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-issuers created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-clusterissuers created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-certificates created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-orders created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-challenges created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-ingress-shim created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-approve:cert-manager-io created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-certificatesigningrequests created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-webhook:subjectaccessreviews created role.rbac.authorization.k8s.io/cert-manager-cainjector:leaderelection created role.rbac.authorization.k8s.io/cert-manager:leaderelection created role.rbac.authorization.k8s.io/cert-manager-tokenrequest created role.rbac.authorization.k8s.io/cert-manager-webhook:dynamic-serving created rolebinding.rbac.authorization.k8s.io/cert-manager-cainjector:leaderelection created rolebinding.rbac.authorization.k8s.io/cert-manager:leaderelection created rolebinding.rbac.authorization.k8s.io/cert-manager-tokenrequest created rolebinding.rbac.authorization.k8s.io/cert-manager-webhook:dynamic-serving created service/cert-manager-cainjector created service/cert-manager created service/cert-manager-webhook created deployment.apps/cert-manager-cainjector created deployment.apps/cert-manager created deployment.apps/cert-manager-webhook created mutatingwebhookconfiguration.admissionregistration.k8s.io/cert-manager-webhook created validatingwebhookconfiguration.admissionregistration.k8s.io/cert-manager-webhook created Warning: resource namespaces/cert-manager is missing the kubectl.kubernetes.io/last-applied-configuration annotation which is required by kubectl apply. kubectl apply should only be used on resources created declaratively by either kubectl create --save-config or kubectl apply. The missing annotation will be patched automatically. pod/cert-manager-559d798845-fvmhc condition met pod/cert-manager-cainjector-64958d9c7c-7pcn2 condition met pod/cert-manager-webhook-7fb6f99b56-9dcv9 condition met E0707 10:11:21.036024 1896376 reflector.go:227] "Failed to watch" err="Get \"https://35.253.20.131/api/v1/namespaces/cert-manager/pods?allowWatchBookmarks=true&fieldSelector=metadata.name%3Dcert-manager-cainjector-64958d9c7c-7pcn2&resourceVersion=1783419080652367010&timeoutSeconds=447&watch=true\": context canceled" reflector="k8s.io/client-go/tools/watch/informerwatcher.go:162" type="*unstructured.Unstructured" ----------------------------------------------------------------------------------- step 1: operator preserves user-created certificates when it has RBAC to read ClusterIssuers ----------------------------------------------------------------------------------- clusterrole.rbac.authorization.k8s.io/some-name-psmdb-ca-issuer-reader created clusterrolebinding.rbac.authorization.k8s.io/some-name-psmdb-ca-issuer-reader-tls-clusterissuer-cert-manager-24377 created clusterrole.rbac.authorization.k8s.io/some-name-psmdb-issuer-reader created clusterrolebinding.rbac.authorization.k8s.io/some-name-psmdb-issuer-reader-tls-clusterissuer-cert-manager-24377 created ----------------------------------------------------------------------------------- create secrets and start client ----------------------------------------------------------------------------------- secret/some-users created deployment.apps/psmdb-client created ----------------------------------------------------------------------------------- create custom cert-manager issuers and certificates ----------------------------------------------------------------------------------- certificate.cert-manager.io/some-name-ca-cert created Warning: spec.privateKey.rotationPolicy: In cert-manager >= v1.18.0, the default value changed from `Never` to `Always`. certificate.cert-manager.io/some-name-ssl-internal created Warning: spec.privateKey.rotationPolicy: In cert-manager >= v1.18.0, the default value changed from `Never` to `Always`. certificate.cert-manager.io/some-name-ssl created Warning: spec.privateKey.rotationPolicy: In cert-manager >= v1.18.0, the default value changed from `Never` to `Always`. clusterissuer.cert-manager.io/some-name-psmdb-ca-issuer created clusterissuer.cert-manager.io/some-name-psmdb-issuer created role.rbac.authorization.k8s.io/cmctl created serviceaccount/cmctl created rolebinding.rbac.authorization.k8s.io/service-account-cmctl created deployment.apps/cmctl created ----------------------------------------------------------------------------------- create first PSMDB cluster some-name ----------------------------------------------------------------------------------- perconaservermongodb.psmdb.percona.com/some-name created ----------------------------------------------------------------------------------- check if all Pods started ----------------------------------------------------------------------------------- waiting for pod/some-name-rs0-0 to be ready.............OK waiting for pod/some-name-rs0-1 to be ready...............OK waiting for pod/some-name-rs0-2 to be ready............OK Waiting for cluster readyness...................... waiting for pod/some-name-cfg-0 to be ready.OK waiting for pod/some-name-cfg-1 to be ready.OK waiting for pod/some-name-cfg-2 to be ready.OK waiting for pod/some-name-mongos-0 to be ready.OK waiting for pod/some-name-mongos-1 to be ready.OK waiting for pod/some-name-mongos-2 to be ready.OK Waiting for cluster readyness ----------------------------------------------------------------------------------- compare user certificates are preserved and clusterissuers are not overwritten ----------------------------------------------------------------------------------- [2026-07-07T10:17:49+0000] compare_kubectl: certificate/some-name-ssl OK [2026-07-07T10:17:50+0000] compare_kubectl: certificate/some-name-ssl-internal OK [2026-07-07T10:17:51+0000] compare_kubectl: clusterissuer/some-name-psmdb-ca-issuer OK [2026-07-07T10:17:52+0000] compare_kubectl: clusterissuer/some-name-psmdb-issuer OK ----------------------------------------------------------------------------------- step 2: operator creates certificates using the existing user ClusterIssuer when it has no RBAC to read ClusterIssuers ----------------------------------------------------------------------------------- clusterrolebinding.rbac.authorization.k8s.io "some-name-psmdb-ca-issuer-reader-tls-clusterissuer-cert-manager-24377" deleted clusterrole.rbac.authorization.k8s.io "some-name-psmdb-ca-issuer-reader" deleted clusterrolebinding.rbac.authorization.k8s.io "some-name-psmdb-issuer-reader-tls-clusterissuer-cert-manager-24377" deleted clusterrole.rbac.authorization.k8s.io "some-name-psmdb-issuer-reader" deleted ----------------------------------------------------------------------------------- delete cluster ----------------------------------------------------------------------------------- perconaservermongodb.psmdb.percona.com "some-name" deleted from tls-clusterissuer-cert-manager-24377 namespace waiting for psmdb/some-name to be deletedError from server (NotFound): perconaservermongodbs.psmdb.percona.com "some-name" not found Error from server (NotFound): perconaservermongodbs.psmdb.percona.com "some-name" not found Error from server (NotFound): perconaservermongodbs.psmdb.percona.com "some-name" not found Error from server (NotFound): perconaservermongodbs.psmdb.percona.com "some-name" not found persistentvolumeclaim "mongod-data-some-name-cfg-0" deleted from tls-clusterissuer-cert-manager-24377 namespace persistentvolumeclaim "mongod-data-some-name-cfg-1" deleted from tls-clusterissuer-cert-manager-24377 namespace persistentvolumeclaim "mongod-data-some-name-cfg-2" deleted from tls-clusterissuer-cert-manager-24377 namespace persistentvolumeclaim "mongod-data-some-name-rs0-0" deleted from tls-clusterissuer-cert-manager-24377 namespace persistentvolumeclaim "mongod-data-some-name-rs0-1" deleted from tls-clusterissuer-cert-manager-24377 namespace persistentvolumeclaim "mongod-data-some-name-rs0-2" deleted from tls-clusterissuer-cert-manager-24377 namespace ----------------------------------------------------------------------------------- delete user certificates so operator recreates them using the existing clusterissuer ----------------------------------------------------------------------------------- certificate.cert-manager.io "some-name-ssl" deleted from tls-clusterissuer-cert-manager-24377 namespace certificate.cert-manager.io "some-name-ssl-internal" deleted from tls-clusterissuer-cert-manager-24377 namespace ----------------------------------------------------------------------------------- recreate PSMDB cluster some-name without clusterissuer RBAC ----------------------------------------------------------------------------------- perconaservermongodb.psmdb.percona.com/some-name created ----------------------------------------------------------------------------------- check if all Pods started ----------------------------------------------------------------------------------- waiting for pod/some-name-rs0-0 to be ready..............OK waiting for pod/some-name-rs0-1 to be ready.............OK waiting for pod/some-name-rs0-2 to be ready............OK Waiting for cluster readyness....................... waiting for pod/some-name-cfg-0 to be ready.OK waiting for pod/some-name-cfg-1 to be ready.OK waiting for pod/some-name-cfg-2 to be ready.OK waiting for pod/some-name-mongos-0 to be ready.OK waiting for pod/some-name-mongos-1 to be ready.OK waiting for pod/some-name-mongos-2 to be ready.OK Waiting for cluster readyness ----------------------------------------------------------------------------------- compare custom certificates without clusterissuer RBAC ----------------------------------------------------------------------------------- [2026-07-07T10:21:18+0000] compare_kubectl: certificate/some-name-ssl OK [2026-07-07T10:21:19+0000] compare_kubectl: certificate/some-name-ssl-internal OK ----------------------------------------------------------------------------------- delete cluster ----------------------------------------------------------------------------------- perconaservermongodb.psmdb.percona.com "some-name" deleted from tls-clusterissuer-cert-manager-24377 namespace waiting for psmdb/some-name to be deletedError from server (NotFound): perconaservermongodbs.psmdb.percona.com "some-name" not found Error from server (NotFound): perconaservermongodbs.psmdb.percona.com "some-name" not found Error from server (NotFound): perconaservermongodbs.psmdb.percona.com "some-name" not found Error from server (NotFound): perconaservermongodbs.psmdb.percona.com "some-name" not found persistentvolumeclaim "mongod-data-some-name-cfg-0" deleted from tls-clusterissuer-cert-manager-24377 namespace persistentvolumeclaim "mongod-data-some-name-cfg-1" deleted from tls-clusterissuer-cert-manager-24377 namespace persistentvolumeclaim "mongod-data-some-name-cfg-2" deleted from tls-clusterissuer-cert-manager-24377 namespace persistentvolumeclaim "mongod-data-some-name-rs0-0" deleted from tls-clusterissuer-cert-manager-24377 namespace persistentvolumeclaim "mongod-data-some-name-rs0-1" deleted from tls-clusterissuer-cert-manager-24377 namespace persistentvolumeclaim "mongod-data-some-name-rs0-2" deleted from tls-clusterissuer-cert-manager-24377 namespace ----------------------------------------------------------------------------------- step 3: operator creates its own ClusterIssuer and certificates when no user ClusterIssuer exists ----------------------------------------------------------------------------------- clusterrole.rbac.authorization.k8s.io/some-name-psmdb-ca-issuer-reader created clusterrolebinding.rbac.authorization.k8s.io/some-name-psmdb-ca-issuer-reader-tls-clusterissuer-cert-manager-24377 created clusterrole.rbac.authorization.k8s.io/some-name-psmdb-issuer-reader created clusterrolebinding.rbac.authorization.k8s.io/some-name-psmdb-issuer-reader-tls-clusterissuer-cert-manager-24377 created ----------------------------------------------------------------------------------- delete custom cert-manager issuers and certificates ----------------------------------------------------------------------------------- clusterissuer.cert-manager.io "some-name-psmdb-ca-issuer" deleted clusterissuer.cert-manager.io "some-name-psmdb-issuer" deleted certificate.cert-manager.io "some-name-ca-cert" deleted from cert-manager namespace ----------------------------------------------------------------------------------- recreate PSMDB cluster some-name ----------------------------------------------------------------------------------- perconaservermongodb.psmdb.percona.com/some-name created ----------------------------------------------------------------------------------- check if all Pods started ----------------------------------------------------------------------------------- waiting for pod/some-name-rs0-0 to be ready.............OK waiting for pod/some-name-rs0-1 to be ready...............OK waiting for pod/some-name-rs0-2 to be ready.............OK Waiting for cluster readyness....................... waiting for pod/some-name-cfg-0 to be ready.OK waiting for pod/some-name-cfg-1 to be ready.OK waiting for pod/some-name-cfg-2 to be ready.OK waiting for pod/some-name-mongos-0 to be ready.OK waiting for pod/some-name-mongos-1 to be ready.OK waiting for pod/some-name-mongos-2 to be ready.OK Waiting for cluster readyness [2026-07-07T10:25:29+0000] compare_kubectl: statefulset/some-name-rs0 OK [2026-07-07T10:25:30+0000] compare_kubectl: statefulset/some-name-cfg OK [2026-07-07T10:25:31+0000] compare_kubectl: statefulset/some-name-mongos OK ----------------------------------------------------------------------------------- check if certificates issued with certmanager ----------------------------------------------------------------------------------- ----------------------------------------------------------------------------------- check if certificate issued ----------------------------------------------------------------------------------- [2026-07-07T10:25:36+0000] compare_kubectl: certificate/some-name-ssl OK ----------------------------------------------------------------------------------- check if internal certificate issued ----------------------------------------------------------------------------------- [2026-07-07T10:25:37+0000] compare_kubectl: certificate/some-name-ssl-internal OK E0707 10:25:38.741564 2043404 reflector.go:227] "Failed to watch" err="Get \"https://35.253.20.131/apis/cert-manager.io/v1/namespaces/tls-clusterissuer-cert-manager-24377/certificates?allowWatchBookmarks=true&fieldSelector=metadata.name%3Dsome-name-ssl&resourceVersion=1783419938483742000&timeoutSeconds=583&watch=true\": context canceled" reflector="k8s.io/client-go/tools/watch/informerwatcher.go:162" type="*unstructured.Unstructured" certificate.cert-manager.io/some-name-ssl condition met E0707 10:25:41.058502 2043726 reflector.go:227] "Failed to watch" err="Get \"https://35.253.20.131/apis/cert-manager.io/v1/namespaces/tls-clusterissuer-cert-manager-24377/certificates?allowWatchBookmarks=true&fieldSelector=metadata.name%3Dsome-name-ssl&resourceVersion=1783419938483742000&timeoutSeconds=352&watch=true\": context canceled" reflector="k8s.io/client-go/tools/watch/informerwatcher.go:162" type="*unstructured.Unstructured" certificate.cert-manager.io/some-name-ssl condition met E0707 10:25:43.419164 2044028 reflector.go:227] "Failed to watch" err="Get \"https://35.253.20.131/apis/cert-manager.io/v1/namespaces/tls-clusterissuer-cert-manager-24377/certificates?allowWatchBookmarks=true&fieldSelector=metadata.name%3Dsome-name-ssl&resourceVersion=1783419938483742000&timeoutSeconds=585&watch=true\": context canceled" reflector="k8s.io/client-go/tools/watch/informerwatcher.go:162" type="*unstructured.Unstructured" certificate.cert-manager.io/some-name-ssl condition met E0707 10:25:45.775963 2044289 reflector.go:227] "Failed to watch" err="Get \"https://35.253.20.131/apis/cert-manager.io/v1/namespaces/tls-clusterissuer-cert-manager-24377/certificates?allowWatchBookmarks=true&fieldSelector=metadata.name%3Dsome-name-ssl&resourceVersion=1783419943483756000&timeoutSeconds=502&watch=true\": context canceled" reflector="k8s.io/client-go/tools/watch/informerwatcher.go:162" type="*unstructured.Unstructured" certificate.cert-manager.io/some-name-ssl condition met E0707 10:25:48.106665 2044545 reflector.go:227] "Failed to watch" err="Get \"https://35.253.20.131/apis/cert-manager.io/v1/namespaces/tls-clusterissuer-cert-manager-24377/certificates?allowWatchBookmarks=true&fieldSelector=metadata.name%3Dsome-name-ssl&resourceVersion=1783419943483756000&timeoutSeconds=586&watch=true\": context canceled" reflector="k8s.io/client-go/tools/watch/informerwatcher.go:162" type="*unstructured.Unstructured" certificate.cert-manager.io/some-name-ssl condition met E0707 10:25:50.386808 2044866 reflector.go:227] "Failed to watch" err="Get \"https://35.253.20.131/apis/cert-manager.io/v1/namespaces/tls-clusterissuer-cert-manager-24377/certificates?allowWatchBookmarks=true&fieldSelector=metadata.name%3Dsome-name-ssl&resourceVersion=1783419948483805000&timeoutSeconds=572&watch=true\": context canceled" reflector="k8s.io/client-go/tools/watch/informerwatcher.go:162" type="*unstructured.Unstructured" certificate.cert-manager.io/some-name-ssl condition met E0707 10:25:52.708204 2045100 reflector.go:227] "Failed to watch" err="Get \"https://35.253.20.131/apis/cert-manager.io/v1/namespaces/tls-clusterissuer-cert-manager-24377/certificates?allowWatchBookmarks=true&fieldSelector=metadata.name%3Dsome-name-ssl&resourceVersion=1783419948483805000&timeoutSeconds=317&watch=true\": context canceled" reflector="k8s.io/client-go/tools/watch/informerwatcher.go:162" type="*unstructured.Unstructured" certificate.cert-manager.io/some-name-ssl condition met E0707 10:25:55.054478 2045346 reflector.go:227] "Failed to watch" err="Get \"https://35.253.20.131/apis/cert-manager.io/v1/namespaces/tls-clusterissuer-cert-manager-24377/certificates?allowWatchBookmarks=true&fieldSelector=metadata.name%3Dsome-name-ssl&resourceVersion=1783419953483817000&timeoutSeconds=443&watch=true\": context canceled" reflector="k8s.io/client-go/tools/watch/informerwatcher.go:162" type="*unstructured.Unstructured" certificate.cert-manager.io/some-name-ssl condition met E0707 10:25:57.448162 2045605 reflector.go:227] "Failed to watch" err="Get \"https://35.253.20.131/apis/cert-manager.io/v1/namespaces/tls-clusterissuer-cert-manager-24377/certificates?allowWatchBookmarks=true&fieldSelector=metadata.name%3Dsome-name-ssl&resourceVersion=1783419953483817000&timeoutSeconds=469&watch=true\": context canceled" reflector="k8s.io/client-go/tools/watch/informerwatcher.go:162" type="*unstructured.Unstructured" certificate.cert-manager.io/some-name-ssl condition met E0707 10:25:59.751186 2045801 reflector.go:227] "Failed to watch" err="Get \"https://35.253.20.131/apis/cert-manager.io/v1/namespaces/tls-clusterissuer-cert-manager-24377/certificates?allowWatchBookmarks=true&fieldSelector=metadata.name%3Dsome-name-ssl&resourceVersion=1783419958483833000&timeoutSeconds=363&watch=true\": context canceled" reflector="k8s.io/client-go/tools/watch/informerwatcher.go:162" type="*unstructured.Unstructured" certificate.cert-manager.io/some-name-ssl condition met ----------------------------------------------------------------------------------- renew some-name-ssl ----------------------------------------------------------------------------------- Manually triggered issuance of Certificate tls-clusterissuer-cert-manager-24377/some-name-ssl waiting for pod/some-name-rs0-0 to be ready.OK waiting for pod/some-name-rs0-1 to be ready.OK waiting for pod/some-name-rs0-2 to be ready.OK Waiting for cluster readyness............................................................................................................................................ waiting for pod/some-name-cfg-0 to be ready.OK waiting for pod/some-name-cfg-1 to be ready.OK waiting for pod/some-name-cfg-2 to be ready.OK waiting for pod/some-name-mongos-0 to be ready.OK waiting for pod/some-name-mongos-1 to be ready.OK waiting for pod/some-name-mongos-2 to be ready.OK Waiting for cluster readyness E0707 10:31:48.089719 2082440 reflector.go:227] "Failed to watch" err="Get \"https://35.253.20.131/apis/cert-manager.io/v1/namespaces/tls-clusterissuer-cert-manager-24377/certificates?allowWatchBookmarks=true&fieldSelector=metadata.name%3Dsome-name-ssl-internal&resourceVersion=1783420304101113000&timeoutSeconds=502&watch=true\": context canceled" reflector="k8s.io/client-go/tools/watch/informerwatcher.go:162" type="*unstructured.Unstructured" certificate.cert-manager.io/some-name-ssl-internal condition met E0707 10:31:50.364557 2082571 reflector.go:227] "Failed to watch" err="Get \"https://35.253.20.131/apis/cert-manager.io/v1/namespaces/tls-clusterissuer-cert-manager-24377/certificates?allowWatchBookmarks=true&fieldSelector=metadata.name%3Dsome-name-ssl-internal&resourceVersion=1783420309101122000&timeoutSeconds=570&watch=true\": context canceled" reflector="k8s.io/client-go/tools/watch/informerwatcher.go:162" type="*unstructured.Unstructured" certificate.cert-manager.io/some-name-ssl-internal condition met E0707 10:31:52.685725 2082733 reflector.go:227] "Failed to watch" err="Get \"https://35.253.20.131/apis/cert-manager.io/v1/namespaces/tls-clusterissuer-cert-manager-24377/certificates?allowWatchBookmarks=true&fieldSelector=metadata.name%3Dsome-name-ssl-internal&resourceVersion=1783420309101122000&timeoutSeconds=560&watch=true\": context canceled" reflector="k8s.io/client-go/tools/watch/informerwatcher.go:162" type="*unstructured.Unstructured" certificate.cert-manager.io/some-name-ssl-internal condition met E0707 10:31:55.083891 2082923 reflector.go:227] "Failed to watch" err="Get \"https://35.253.20.131/apis/cert-manager.io/v1/namespaces/tls-clusterissuer-cert-manager-24377/certificates?allowWatchBookmarks=true&fieldSelector=metadata.name%3Dsome-name-ssl-internal&resourceVersion=1783420314101190000&timeoutSeconds=339&watch=true\": context canceled" reflector="k8s.io/client-go/tools/watch/informerwatcher.go:162" type="*unstructured.Unstructured" certificate.cert-manager.io/some-name-ssl-internal condition met E0707 10:31:57.435894 2083084 reflector.go:227] "Failed to watch" err="Get \"https://35.253.20.131/apis/cert-manager.io/v1/namespaces/tls-clusterissuer-cert-manager-24377/certificates?allowWatchBookmarks=true&fieldSelector=metadata.name%3Dsome-name-ssl-internal&resourceVersion=1783420314101190000&timeoutSeconds=368&watch=true\": context canceled" reflector="k8s.io/client-go/tools/watch/informerwatcher.go:162" type="*unstructured.Unstructured" certificate.cert-manager.io/some-name-ssl-internal condition met E0707 10:31:59.764786 2083247 reflector.go:227] "Failed to watch" err="Get \"https://35.253.20.131/apis/cert-manager.io/v1/namespaces/tls-clusterissuer-cert-manager-24377/certificates?allowWatchBookmarks=true&fieldSelector=metadata.name%3Dsome-name-ssl-internal&resourceVersion=1783420319101239000&timeoutSeconds=307&watch=true\": context canceled" reflector="k8s.io/client-go/tools/watch/informerwatcher.go:162" type="*unstructured.Unstructured" certificate.cert-manager.io/some-name-ssl-internal condition met E0707 10:32:02.103753 2083454 reflector.go:227] "Failed to watch" err="Get \"https://35.253.20.131/apis/cert-manager.io/v1/namespaces/tls-clusterissuer-cert-manager-24377/certificates?allowWatchBookmarks=true&fieldSelector=metadata.name%3Dsome-name-ssl-internal&resourceVersion=1783420319101239000&timeoutSeconds=475&watch=true\": context canceled" reflector="k8s.io/client-go/tools/watch/informerwatcher.go:162" type="*unstructured.Unstructured" certificate.cert-manager.io/some-name-ssl-internal condition met E0707 10:32:04.385425 2083654 reflector.go:227] "Failed to watch" err="Get \"https://35.253.20.131/apis/cert-manager.io/v1/namespaces/tls-clusterissuer-cert-manager-24377/certificates?allowWatchBookmarks=true&fieldSelector=metadata.name%3Dsome-name-ssl-internal&resourceVersion=1783420324101332000&timeoutSeconds=558&watch=true\": context canceled" reflector="k8s.io/client-go/tools/watch/informerwatcher.go:162" type="*unstructured.Unstructured" certificate.cert-manager.io/some-name-ssl-internal condition met E0707 10:32:06.676201 2083805 reflector.go:227] "Failed to watch" err="Get \"https://35.253.20.131/apis/cert-manager.io/v1/namespaces/tls-clusterissuer-cert-manager-24377/certificates?allowWatchBookmarks=true&fieldSelector=metadata.name%3Dsome-name-ssl-internal&resourceVersion=1783420324101332000&timeoutSeconds=344&watch=true\": context canceled" reflector="k8s.io/client-go/tools/watch/informerwatcher.go:162" type="*unstructured.Unstructured" certificate.cert-manager.io/some-name-ssl-internal condition met E0707 10:32:08.984379 2083961 reflector.go:227] "Failed to watch" err="Get \"https://35.253.20.131/apis/cert-manager.io/v1/namespaces/tls-clusterissuer-cert-manager-24377/certificates?allowWatchBookmarks=true&fieldSelector=metadata.name%3Dsome-name-ssl-internal&resourceVersion=1783420324101332000&timeoutSeconds=532&watch=true\": context canceled" reflector="k8s.io/client-go/tools/watch/informerwatcher.go:162" type="*unstructured.Unstructured" certificate.cert-manager.io/some-name-ssl-internal condition met ----------------------------------------------------------------------------------- renew some-name-ssl-internal ----------------------------------------------------------------------------------- Manually triggered issuance of Certificate tls-clusterissuer-cert-manager-24377/some-name-ssl-internal waiting for pod/some-name-rs0-0 to be ready.OK waiting for pod/some-name-rs0-1 to be ready.OK waiting for pod/some-name-rs0-2 to be ready.OK Waiting for cluster readyness..................................................................................................................................... waiting for pod/some-name-cfg-0 to be ready.OK waiting for pod/some-name-cfg-1 to be ready.OK waiting for pod/some-name-cfg-2 to be ready.OK waiting for pod/some-name-mongos-0 to be ready.OK waiting for pod/some-name-mongos-1 to be ready.OK waiting for pod/some-name-mongos-2 to be ready.OK Waiting for cluster readyness ----------------------------------------------------------------------------------- check if certificate issued ----------------------------------------------------------------------------------- [2026-07-07T10:37:43+0000] compare_kubectl: certificate/some-name-ssl OK ----------------------------------------------------------------------------------- check if internal certificate issued ----------------------------------------------------------------------------------- [2026-07-07T10:37:44+0000] compare_kubectl: certificate/some-name-ssl-internal OK ----------------------------------------------------------------------------------- disable TLS ----------------------------------------------------------------------------------- Pausing cluster some-name perconaservermongodb.psmdb.percona.com/some-name patched Waiting for psmdb/some-name to reach paused state................................................ [2026-07-07T10:39:23+0000] psmdb/some-name is paused: OK Disabling TLS for cluster some-name perconaservermongodb.psmdb.percona.com/some-name patched Unpausing cluster some-name perconaservermongodb.psmdb.percona.com/some-name patched Waiting for psmdb/some-name to reach ready state.................................................. [2026-07-07T10:41:05+0000] psmdb/some-name is ready: OK [2026-07-07T10:41:06+0000] compare_kubectl: statefulset/some-name-rs0 OK [2026-07-07T10:41:07+0000] compare_kubectl: statefulset/some-name-cfg OK [2026-07-07T10:41:07+0000] compare_kubectl: statefulset/some-name-mongos OK clusterrolebinding.rbac.authorization.k8s.io "some-name-psmdb-ca-issuer-reader-tls-clusterissuer-cert-manager-24377" deleted clusterrole.rbac.authorization.k8s.io "some-name-psmdb-ca-issuer-reader" deleted clusterrolebinding.rbac.authorization.k8s.io "some-name-psmdb-issuer-reader-tls-clusterissuer-cert-manager-24377" deleted clusterrole.rbac.authorization.k8s.io "some-name-psmdb-issuer-reader" deleted ----------------------------------------------------------------------------------- destroy cluster/operator and all other resources ----------------------------------------------------------------------------------- ----------------------------------------------------------------------------------- Delete psmdb-backup ----------------------------------------------------------------------------------- No resources found in tls-clusterissuer-cert-manager-24377 namespace. ----------------------------------------------------------------------------------- get and delete old CRDs and RBAC ----------------------------------------------------------------------------------- customresourcedefinition.apiextensions.k8s.io "perconaservermongodbbackups.psmdb.percona.com" deleted customresourcedefinition.apiextensions.k8s.io "perconaservermongodbclustersyncs.psmdb.percona.com" deleted customresourcedefinition.apiextensions.k8s.io "perconaservermongodbrestores.psmdb.percona.com" deleted customresourcedefinition.apiextensions.k8s.io "perconaservermongodbs.psmdb.percona.com" deleted grep: warning: stray \ before - grep: warning: stray \ before - error: the server doesn't have a resource type "perconaservermongodbbackups" + kubectl patch perconaservermongodbbackups.psmdb.percona.com -n sh --type=merge -p '{"metadata":{"finalizers":[]}}' error: the server doesn't have a resource type "perconaservermongodbbackups" error: the server doesn't have a resource type "perconaservermongodbclustersyncs" + kubectl patch perconaservermongodbclustersyncs.psmdb.percona.com -n sh --type=merge -p '{"metadata":{"finalizers":[]}}' error: the server doesn't have a resource type "perconaservermongodbclustersyncs" error: the server doesn't have a resource type "perconaservermongodbrestores" + kubectl patch perconaservermongodbrestores.psmdb.percona.com -n sh --type=merge -p '{"metadata":{"finalizers":[]}}' error: the server doesn't have a resource type "perconaservermongodbrestores" error: the server doesn't have a resource type "perconaservermongodbs" + kubectl patch perconaservermongodbs.psmdb.percona.com -n sh --type=merge -p '{"metadata":{"finalizers":[]}}' error: the server doesn't have a resource type "perconaservermongodbs" clusterrole.rbac.authorization.k8s.io "percona-server-mongodb-operator" deleted clusterrolebinding.rbac.authorization.k8s.io "service-account-percona-server-mongodb-operator" deleted namespace "cert-manager" deleted customresourcedefinition.apiextensions.k8s.io "challenges.acme.cert-manager.io" deleted customresourcedefinition.apiextensions.k8s.io "orders.acme.cert-manager.io" deleted customresourcedefinition.apiextensions.k8s.io "certificaterequests.cert-manager.io" deleted customresourcedefinition.apiextensions.k8s.io "certificates.cert-manager.io" deleted customresourcedefinition.apiextensions.k8s.io "clusterissuers.cert-manager.io" deleted customresourcedefinition.apiextensions.k8s.io "issuers.cert-manager.io" deleted serviceaccount "cert-manager-cainjector" deleted from cert-manager namespace serviceaccount "cert-manager" deleted from cert-manager namespace serviceaccount "cert-manager-webhook" deleted from cert-manager namespace clusterrole.rbac.authorization.k8s.io "cert-manager-cainjector" deleted clusterrole.rbac.authorization.k8s.io "cert-manager-controller-issuers" deleted clusterrole.rbac.authorization.k8s.io "cert-manager-controller-clusterissuers" deleted clusterrole.rbac.authorization.k8s.io "cert-manager-controller-certificates" deleted clusterrole.rbac.authorization.k8s.io "cert-manager-controller-orders" deleted clusterrole.rbac.authorization.k8s.io "cert-manager-controller-challenges" deleted clusterrole.rbac.authorization.k8s.io "cert-manager-controller-ingress-shim" deleted clusterrole.rbac.authorization.k8s.io "cert-manager-cluster-view" deleted clusterrole.rbac.authorization.k8s.io "cert-manager-view" deleted clusterrole.rbac.authorization.k8s.io "cert-manager-edit" deleted clusterrole.rbac.authorization.k8s.io "cert-manager-controller-approve:cert-manager-io" deleted clusterrole.rbac.authorization.k8s.io "cert-manager-controller-certificatesigningrequests" deleted clusterrole.rbac.authorization.k8s.io "cert-manager-webhook:subjectaccessreviews" deleted clusterrolebinding.rbac.authorization.k8s.io "cert-manager-cainjector" deleted clusterrolebinding.rbac.authorization.k8s.io "cert-manager-controller-issuers" deleted clusterrolebinding.rbac.authorization.k8s.io "cert-manager-controller-clusterissuers" deleted clusterrolebinding.rbac.authorization.k8s.io "cert-manager-controller-certificates" deleted clusterrolebinding.rbac.authorization.k8s.io "cert-manager-controller-orders" deleted clusterrolebinding.rbac.authorization.k8s.io "cert-manager-controller-challenges" deleted clusterrolebinding.rbac.authorization.k8s.io "cert-manager-controller-ingress-shim" deleted clusterrolebinding.rbac.authorization.k8s.io "cert-manager-controller-approve:cert-manager-io" deleted clusterrolebinding.rbac.authorization.k8s.io "cert-manager-controller-certificatesigningrequests" deleted clusterrolebinding.rbac.authorization.k8s.io "cert-manager-webhook:subjectaccessreviews" deleted role.rbac.authorization.k8s.io "cert-manager-cainjector:leaderelection" deleted from kube-system namespace role.rbac.authorization.k8s.io "cert-manager:leaderelection" deleted from kube-system namespace role.rbac.authorization.k8s.io "cert-manager-tokenrequest" deleted from cert-manager namespace role.rbac.authorization.k8s.io "cert-manager-webhook:dynamic-serving" deleted from cert-manager namespace rolebinding.rbac.authorization.k8s.io "cert-manager-cainjector:leaderelection" deleted from kube-system namespace rolebinding.rbac.authorization.k8s.io "cert-manager:leaderelection" deleted from kube-system namespace rolebinding.rbac.authorization.k8s.io "cert-manager-tokenrequest" deleted from cert-manager namespace rolebinding.rbac.authorization.k8s.io "cert-manager-webhook:dynamic-serving" deleted from cert-manager namespace service "cert-manager-cainjector" deleted from cert-manager namespace service "cert-manager" deleted from cert-manager namespace service "cert-manager-webhook" deleted from cert-manager namespace deployment.apps "cert-manager-cainjector" deleted from cert-manager namespace deployment.apps "cert-manager" deleted from cert-manager namespace deployment.apps "cert-manager-webhook" deleted from cert-manager namespace mutatingwebhookconfiguration.admissionregistration.k8s.io "cert-manager-webhook" deleted validatingwebhookconfiguration.admissionregistration.k8s.io "cert-manager-webhook" deleted ----------------------------------------------------------------------------------- test passed -----------------------------------------------------------------------------------