Log: /mnt/jenkins/workspace/cloud-pxc-operator_PR-2539/e2e-tests/logs/tls-issue-cert-manager-8-0.log Warning: version difference between client (1.36) and server (1.33) exceeds the supported minor version skew of +/-1 Warning: version difference between client (1.36) and server (1.33) exceeds the supported minor version skew of +/-1 No resources found No resources found No resources found error: resource(s) were provided, but no name was specified error: resource(s) were provided, but no name was specified error: resource(s) were provided, but no name was specified error: resource(s) were provided, but no name was specified error: resource(s) were provided, but no name was specified error: resource(s) were provided, but no name was specified ----------------------------------------------------------------------------------- cleaned up all old namespaces ----------------------------------------------------------------------------------- ----------------------------------------------------------------------------------- cleaned up old namespaces pxc-operator ----------------------------------------------------------------------------------- error: resource(s) were provided, but no name was specified namespace "pxc-operator" deleted waiting for namespace/pxc-operator to be deletedError from server (NotFound): namespaces "pxc-operator" not found ----------------------------------------------------------------------------------- create namespace pxc-operator ----------------------------------------------------------------------------------- namespace/pxc-operator created Context "gke_cloud-dev-112233_us-central1-a_jen-pxc-2539-dcdf1e8a-1-cluster4" modified. ----------------------------------------------------------------------------------- start PXC operator ----------------------------------------------------------------------------------- customresourcedefinition.apiextensions.k8s.io/perconaxtradbclusterbackups.pxc.percona.com serverside-applied customresourcedefinition.apiextensions.k8s.io/perconaxtradbclusterrestores.pxc.percona.com serverside-applied customresourcedefinition.apiextensions.k8s.io/perconaxtradbclusters.pxc.percona.com serverside-applied customresourcedefinition.apiextensions.k8s.io/perconaxtradbclusters.pxc.percona.com condition met E0702 04:53:35.783769 14664 reflector.go:227] "Failed to watch" err="Get \"https://34.172.197.9/apis/apiextensions.k8s.io/v1/customresourcedefinitions?allowWatchBookmarks=true&fieldSelector=metadata.name%3Dperconaxtradbclusters.pxc.percona.com&resourceVersion=1782968012068157000&timeoutSeconds=594&watch=true\": context canceled" reflector="k8s.io/client-go/tools/watch/informerwatcher.go:162" type="*unstructured.Unstructured" customresourcedefinition.apiextensions.k8s.io/perconaxtradbclusterbackups.pxc.percona.com condition met E0702 04:53:37.849740 14982 reflector.go:227] "Failed to watch" err="Get \"https://34.172.197.9/apis/apiextensions.k8s.io/v1/customresourcedefinitions?allowWatchBookmarks=true&fieldSelector=metadata.name%3Dperconaxtradbclusterbackups.pxc.percona.com&resourceVersion=1782968017068232000&timeoutSeconds=463&watch=true\": context canceled" reflector="k8s.io/client-go/tools/watch/informerwatcher.go:162" type="*unstructured.Unstructured" customresourcedefinition.apiextensions.k8s.io/perconaxtradbclusterrestores.pxc.percona.com condition met E0702 04:53:39.413466 15277 reflector.go:227] "Failed to watch" err="Get \"https://34.172.197.9/apis/apiextensions.k8s.io/v1/customresourcedefinitions?allowWatchBookmarks=true&fieldSelector=metadata.name%3Dperconaxtradbclusterrestores.pxc.percona.com&resourceVersion=1782968017068232000&timeoutSeconds=503&watch=true\": context canceled" reflector="k8s.io/client-go/tools/watch/informerwatcher.go:162" type="*unstructured.Unstructured" clusterrole.rbac.authorization.k8s.io/percona-xtradb-cluster-operator unchanged serviceaccount/percona-xtradb-cluster-operator created clusterrolebinding.rbac.authorization.k8s.io/service-account-percona-xtradb-cluster-operator unchanged deployment.apps/percona-xtradb-cluster-operator created service/percona-xtradb-cluster-operator created pod/percona-xtradb-cluster-operator-65b5d85575-4qcjj condition met E0702 04:53:57.527701 17725 reflector.go:227] "Failed to watch" err="Get \"https://34.172.197.9/api/v1/namespaces/pxc-operator/pods?allowWatchBookmarks=true&fieldSelector=metadata.name%3Dpercona-xtradb-cluster-operator-65b5d85575-4qcjj&resourceVersion=1782968037167856000&timeoutSeconds=431&watch=true\": context canceled" reflector="k8s.io/client-go/tools/watch/informerwatcher.go:162" type="*unstructured.Unstructured" pod/percona-xtradb-cluster-operator-65b5d85575-4qcjj condition met E0702 04:54:01.745593 18416 reflector.go:227] "Failed to watch" err="Get \"https://34.172.197.9/api/v1/namespaces/pxc-operator/pods?allowWatchBookmarks=true&fieldSelector=metadata.name%3Dpercona-xtradb-cluster-operator-65b5d85575-4qcjj&resourceVersion=1782968040232264000&timeoutSeconds=476&watch=true\": context canceled" reflector="k8s.io/client-go/tools/watch/informerwatcher.go:162" type="*unstructured.Unstructured" waiting for pod/percona-xtradb-cluster-operator-65b5d85575-4qcjj to become Ready.Ok error: resource(s) were provided, but no name was specified error: resource(s) were provided, but no name was specified error: resource(s) were provided, but no name was specified error: resource(s) were provided, but no name was specified error: resource(s) were provided, but no name was specified error: resource(s) were provided, but no name was specified ----------------------------------------------------------------------------------- cleaned up all old namespaces ----------------------------------------------------------------------------------- ----------------------------------------------------------------------------------- cleaned up old namespaces tls-issue-cert-manager-7922 ----------------------------------------------------------------------------------- Error from server (NotFound): namespaces "tls-issue-cert-manager-7922" not found waiting for namespace/tls-issue-cert-manager-7922 to be deletederror: resource(s) were provided, but no name was specified Error from server (NotFound): namespaces "tls-issue-cert-manager-7922" not found ----------------------------------------------------------------------------------- create namespace tls-issue-cert-manager-7922 ----------------------------------------------------------------------------------- namespace/tls-issue-cert-manager-7922 created Context "gke_cloud-dev-112233_us-central1-a_jen-pxc-2539-dcdf1e8a-1-cluster4" modified. ----------------------------------------------------------------------------------- create secrets for cloud storages ----------------------------------------------------------------------------------- secret/minio-secret created secret/aws-s3-secret created secret/do-spaces-secret created secret/gcp-cs-secret created secret/azure-secret created ----------------------------------------------------------------------------------- deploy cert manager ----------------------------------------------------------------------------------- namespace/cert-manager created namespace/cert-manager labeled namespace/cert-manager configured customresourcedefinition.apiextensions.k8s.io/challenges.acme.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/orders.acme.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/certificaterequests.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/certificates.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/clusterissuers.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/issuers.cert-manager.io created serviceaccount/cert-manager-cainjector created serviceaccount/cert-manager created serviceaccount/cert-manager-webhook created clusterrole.rbac.authorization.k8s.io/cert-manager-cainjector created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-issuers created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-clusterissuers created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-certificates created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-orders created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-challenges created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-ingress-shim created clusterrole.rbac.authorization.k8s.io/cert-manager-cluster-view created clusterrole.rbac.authorization.k8s.io/cert-manager-view created clusterrole.rbac.authorization.k8s.io/cert-manager-edit created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-approve:cert-manager-io created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-certificatesigningrequests created clusterrole.rbac.authorization.k8s.io/cert-manager-webhook:subjectaccessreviews created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-cainjector created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-issuers created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-clusterissuers created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-certificates created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-orders created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-challenges created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-ingress-shim created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-approve:cert-manager-io created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-certificatesigningrequests created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-webhook:subjectaccessreviews created role.rbac.authorization.k8s.io/cert-manager-cainjector:leaderelection created role.rbac.authorization.k8s.io/cert-manager:leaderelection created role.rbac.authorization.k8s.io/cert-manager-tokenrequest created role.rbac.authorization.k8s.io/cert-manager-webhook:dynamic-serving created rolebinding.rbac.authorization.k8s.io/cert-manager-cainjector:leaderelection created rolebinding.rbac.authorization.k8s.io/cert-manager:leaderelection created rolebinding.rbac.authorization.k8s.io/cert-manager-tokenrequest created rolebinding.rbac.authorization.k8s.io/cert-manager-webhook:dynamic-serving created service/cert-manager-cainjector created service/cert-manager created service/cert-manager-webhook created deployment.apps/cert-manager-cainjector created deployment.apps/cert-manager created deployment.apps/cert-manager-webhook created mutatingwebhookconfiguration.admissionregistration.k8s.io/cert-manager-webhook created validatingwebhookconfiguration.admissionregistration.k8s.io/cert-manager-webhook created Warning: resource namespaces/cert-manager is missing the kubectl.kubernetes.io/last-applied-configuration annotation which is required by kubectl apply. kubectl apply should only be used on resources created declaratively by either kubectl create --save-config or kubectl apply. The missing annotation will be patched automatically. Waiting for deployment "cert-manager" rollout to finish: 0 of 1 updated replicas are available... deployment "cert-manager" successfully rolled out deployment "cert-manager-cainjector" successfully rolled out Waiting for deployment "cert-manager-webhook" rollout to finish: 0 of 1 updated replicas are available... deployment "cert-manager-webhook" successfully rolled out [2026-07-02T04:54:57+0000] waiting for cert-manager webhook caBundle to be injected [2026-07-02T04:54:58+0000] probing cert-manager webhook ----------------------------------------------------------------------------------- wait for cert-manager to be ready ----------------------------------------------------------------------------------- deployment.apps/cert-manager condition met E0702 04:55:01.118595 26612 reflector.go:227] "Failed to watch" err="Get \"https://34.172.197.9/apis/apps/v1/namespaces/cert-manager/deployments?allowWatchBookmarks=true&fieldSelector=metadata.name%3Dcert-manager&resourceVersion=1782968097085839013&timeoutSeconds=326&watch=true\": context canceled" reflector="k8s.io/client-go/tools/watch/informerwatcher.go:162" type="*unstructured.Unstructured" deployment.apps/cert-manager-cainjector condition met E0702 04:55:02.764030 26791 reflector.go:227] "Failed to watch" err="Get \"https://34.172.197.9/apis/apps/v1/namespaces/cert-manager/deployments?allowWatchBookmarks=true&fieldSelector=metadata.name%3Dcert-manager-cainjector&resourceVersion=1782968102090182000&timeoutSeconds=568&watch=true\": context canceled" reflector="k8s.io/client-go/tools/watch/informerwatcher.go:162" type="*unstructured.Unstructured" deployment.apps/cert-manager-webhook condition met E0702 04:55:04.236631 27044 reflector.go:227] "Failed to watch" err="Get \"https://34.172.197.9/apis/apps/v1/namespaces/cert-manager/deployments?allowWatchBookmarks=true&fieldSelector=metadata.name%3Dcert-manager-webhook&resourceVersion=1782968102090182000&timeoutSeconds=395&watch=true\": context canceled" reflector="k8s.io/client-go/tools/watch/informerwatcher.go:162" type="*unstructured.Unstructured" issuer.cert-manager.io/cert-manager-readiness-check created issuer.cert-manager.io "cert-manager-readiness-check" deleted from tls-issue-cert-manager-7922 namespace ----------------------------------------------------------------------------------- create pxc cluster ----------------------------------------------------------------------------------- secret/my-cluster-secrets created deployment.apps/pxc-client created perconaxtradbcluster.pxc.percona.com/some-name-tls-issue created ----------------------------------------------------------------------------------- wait for cluster to be ready ----------------------------------------------------------------------------------- ----------------------------------------------------------------------------------- Waiting for 1 running pods for some-name-tls-issue-haproxy ----------------------------------------------------------------------------------- Error from server (NotFound): pods "some-name-tls-issue-haproxy-0" not found waiting for pod/some-name-tls-issue-haproxy-0 to become Ready.............................Ok ----------------------------------------------------------------------------------- Waiting for 3 running pods for some-name-tls-issue-pxc ----------------------------------------------------------------------------------- pod/some-name-tls-issue-pxc-0 condition met E0702 04:56:56.559355 11553 reflector.go:227] "Failed to watch" err="Get \"https://34.172.197.9/api/v1/namespaces/tls-issue-cert-manager-7922/pods?allowWatchBookmarks=true&fieldSelector=metadata.name%3Dsome-name-tls-issue-pxc-0&resourceVersion=1782968216178207017&timeoutSeconds=478&watch=true\": context canceled" reflector="k8s.io/client-go/tools/watch/informerwatcher.go:162" type="*unstructured.Unstructured" waiting for pod/some-name-tls-issue-pxc-0 to become Ready.Ok pod/some-name-tls-issue-pxc-1 condition met waiting for pod/some-name-tls-issue-pxc-1 to become Ready.Ok pod/some-name-tls-issue-pxc-2 condition met waiting for pod/some-name-tls-issue-pxc-2 to become Ready.Ok ----------------------------------------------------------------------------------- wait cluster consistency ----------------------------------------------------------------------------------- waiting for pxc/some-name-tls-issue to be ready ----------------------------------------------------------------------------------- check if certificates issued with certmanager ----------------------------------------------------------------------------------- ----------------------------------------------------------------------------------- check if CA issuer created ----------------------------------------------------------------------------------- ----------------------------------------------------------------------------------- compare issuer/some-name-tls-issue-pxc-ca-issuer- ----------------------------------------------------------------------------------- [2026-07-02T04:59:57+0000] compare_kubectl: issuer/some-name-tls-issue-pxc-ca-issuer OK ----------------------------------------------------------------------------------- check if issuer created ----------------------------------------------------------------------------------- ----------------------------------------------------------------------------------- compare issuer/some-name-tls-issue-pxc-issuer- ----------------------------------------------------------------------------------- [2026-07-02T04:59:58+0000] compare_kubectl: issuer/some-name-tls-issue-pxc-issuer OK ----------------------------------------------------------------------------------- check if certificate issued ----------------------------------------------------------------------------------- ----------------------------------------------------------------------------------- compare certificate/some-name-tls-issue-ssl- ----------------------------------------------------------------------------------- [2026-07-02T05:00:00+0000] compare_kubectl: certificate/some-name-tls-issue-ssl OK ----------------------------------------------------------------------------------- check ssl-internal certificate using PXC ----------------------------------------------------------------------------------- mysql: [Warning] Using a password on the command line interface can be insecure. ----------------------------------------------------------------------------------- check ssl-internal certificate using HAProxy ----------------------------------------------------------------------------------- mysql: [Warning] Using a password on the command line interface can be insecure. ----------------------------------------------------------------------------------- trigger CA rotation and verify leaf cert re-issuance ----------------------------------------------------------------------------------- ----------------------------------------------------------------------------------- set rotationPolicy=Always on CA certificate ----------------------------------------------------------------------------------- certificate.cert-manager.io/some-name-tls-issue-ca-cert patched ----------------------------------------------------------------------------------- capture current CA fingerprint ----------------------------------------------------------------------------------- old CA: SHA256 Fingerprint=BD:27:EB:6B:60:5B:67:92:94:D9:AD:66:B8:60:71:67:B9:4C:C4:7F:8F:42:E0:40:34:AF:BC:03:44:1B:ED:95 ----------------------------------------------------------------------------------- trigger CA renewal via status condition patch ----------------------------------------------------------------------------------- certificate.cert-manager.io/some-name-tls-issue-ca-cert replaced ----------------------------------------------------------------------------------- wait for cert-manager to issue new CA ----------------------------------------------------------------------------------- new CA: SHA256 Fingerprint=89:F2:F3:DB:5B:59:C8:5E:EA:69:44:EC:DD:15:BB:8F:B5:8D:C6:5D:41:1E:D5:74:D7:AE:D0:41:3B:78:F6:1B ----------------------------------------------------------------------------------- trigger operator reconcile to detect CA mismatch ----------------------------------------------------------------------------------- perconaxtradbcluster.pxc.percona.com/some-name-tls-issue annotated ----------------------------------------------------------------------------------- wait for operator to re-issue leaf certs with new CA ----------------------------------------------------------------------------------- ----------------------------------------------------------------------------------- verify leaf secrets have new CA ----------------------------------------------------------------------------------- leaf certs re-issued with new CA ----------------------------------------------------------------------------------- restart all PXC and HAProxy pods to pick up new certs simultaneously ----------------------------------------------------------------------------------- pod "some-name-tls-issue-haproxy-0" force deleted from tls-issue-cert-manager-7922 namespace pod "some-name-tls-issue-haproxy-1" force deleted from tls-issue-cert-manager-7922 namespace pod "some-name-tls-issue-pxc-0" force deleted from tls-issue-cert-manager-7922 namespace pod "some-name-tls-issue-pxc-1" force deleted from tls-issue-cert-manager-7922 namespace pod "some-name-tls-issue-pxc-2" force deleted from tls-issue-cert-manager-7922 namespace Warning: Immediate deletion does not wait for confirmation that the running resource has been terminated. The resource may continue to run on the cluster indefinitely. ----------------------------------------------------------------------------------- wait for cluster to recover after full restart ----------------------------------------------------------------------------------- ----------------------------------------------------------------------------------- wait cluster consistency ----------------------------------------------------------------------------------- waiting for pxc/some-name-tls-issue to be ready...................... ----------------------------------------------------------------------------------- check ssl-internal certificate using PXC after CA rotation ----------------------------------------------------------------------------------- mysql: [Warning] Using a password on the command line interface can be insecure. ----------------------------------------------------------------------------------- check ssl-internal certificate using HAProxy after CA rotation ----------------------------------------------------------------------------------- mysql: [Warning] Using a password on the command line interface can be insecure. ----------------------------------------------------------------------------------- destroy cluster/operator and all other resources ----------------------------------------------------------------------------------- perconaxtradbcluster.pxc.percona.com/some-name-tls-issue patched perconaxtradbcluster.pxc.percona.com "some-name-tls-issue" deleted from tls-issue-cert-manager-7922 namespace No resources found validatingwebhookconfiguration.admissionregistration.k8s.io "percona-xtradbcluster-webhook" deleted namespace "cert-manager" deleted customresourcedefinition.apiextensions.k8s.io "challenges.acme.cert-manager.io" deleted customresourcedefinition.apiextensions.k8s.io "orders.acme.cert-manager.io" deleted customresourcedefinition.apiextensions.k8s.io "certificaterequests.cert-manager.io" deleted customresourcedefinition.apiextensions.k8s.io "certificates.cert-manager.io" deleted customresourcedefinition.apiextensions.k8s.io "clusterissuers.cert-manager.io" deleted customresourcedefinition.apiextensions.k8s.io "issuers.cert-manager.io" deleted serviceaccount "cert-manager-cainjector" deleted from cert-manager namespace serviceaccount "cert-manager" deleted from cert-manager namespace serviceaccount "cert-manager-webhook" deleted from cert-manager namespace clusterrole.rbac.authorization.k8s.io "cert-manager-cainjector" deleted clusterrole.rbac.authorization.k8s.io "cert-manager-controller-issuers" deleted clusterrole.rbac.authorization.k8s.io "cert-manager-controller-clusterissuers" deleted clusterrole.rbac.authorization.k8s.io "cert-manager-controller-certificates" deleted clusterrole.rbac.authorization.k8s.io "cert-manager-controller-orders" deleted clusterrole.rbac.authorization.k8s.io "cert-manager-controller-challenges" deleted clusterrole.rbac.authorization.k8s.io "cert-manager-controller-ingress-shim" deleted clusterrole.rbac.authorization.k8s.io "cert-manager-cluster-view" deleted clusterrole.rbac.authorization.k8s.io "cert-manager-view" deleted clusterrole.rbac.authorization.k8s.io "cert-manager-edit" deleted clusterrole.rbac.authorization.k8s.io "cert-manager-controller-approve:cert-manager-io" deleted clusterrole.rbac.authorization.k8s.io "cert-manager-controller-certificatesigningrequests" deleted clusterrole.rbac.authorization.k8s.io "cert-manager-webhook:subjectaccessreviews" deleted clusterrolebinding.rbac.authorization.k8s.io "cert-manager-cainjector" deleted clusterrolebinding.rbac.authorization.k8s.io "cert-manager-controller-issuers" deleted clusterrolebinding.rbac.authorization.k8s.io "cert-manager-controller-clusterissuers" deleted clusterrolebinding.rbac.authorization.k8s.io "cert-manager-controller-certificates" deleted clusterrolebinding.rbac.authorization.k8s.io "cert-manager-controller-orders" deleted clusterrolebinding.rbac.authorization.k8s.io "cert-manager-controller-challenges" deleted clusterrolebinding.rbac.authorization.k8s.io "cert-manager-controller-ingress-shim" deleted clusterrolebinding.rbac.authorization.k8s.io "cert-manager-controller-approve:cert-manager-io" deleted clusterrolebinding.rbac.authorization.k8s.io "cert-manager-controller-certificatesigningrequests" deleted clusterrolebinding.rbac.authorization.k8s.io "cert-manager-webhook:subjectaccessreviews" deleted role.rbac.authorization.k8s.io "cert-manager-cainjector:leaderelection" deleted from kube-system namespace role.rbac.authorization.k8s.io "cert-manager:leaderelection" deleted from kube-system namespace role.rbac.authorization.k8s.io "cert-manager-tokenrequest" deleted from cert-manager namespace role.rbac.authorization.k8s.io "cert-manager-webhook:dynamic-serving" deleted from cert-manager namespace rolebinding.rbac.authorization.k8s.io "cert-manager-cainjector:leaderelection" deleted from kube-system namespace rolebinding.rbac.authorization.k8s.io "cert-manager:leaderelection" deleted from kube-system namespace rolebinding.rbac.authorization.k8s.io "cert-manager-tokenrequest" deleted from cert-manager namespace rolebinding.rbac.authorization.k8s.io "cert-manager-webhook:dynamic-serving" deleted from cert-manager namespace service "cert-manager-cainjector" deleted from cert-manager namespace service "cert-manager" deleted from cert-manager namespace service "cert-manager-webhook" deleted from cert-manager namespace deployment.apps "cert-manager-cainjector" deleted from cert-manager namespace deployment.apps "cert-manager" deleted from cert-manager namespace deployment.apps "cert-manager-webhook" deleted from cert-manager namespace mutatingwebhookconfiguration.admissionregistration.k8s.io "cert-manager-webhook" deleted validatingwebhookconfiguration.admissionregistration.k8s.io "cert-manager-webhook" deleted namespace "tls-issue-cert-manager-7922" force deleted Warning: Immediate deletion does not wait for confirmation that the running resource has been terminated. The resource may continue to run on the cluster indefinitely. ----------------------------------------------------------------------------------- test passed -----------------------------------------------------------------------------------