etcd-io / etcd-io/etcd-operator
Cannot reconcile ETCD cluster when using cert-manager configured with `enableCertificateOwnerRef=true`
- Dominant language
- Go
- Stars
- 164
- Forks
- 72
- Avg merge
- 21h 20m
- Merged PRs (30d)
- 33
Description
# Description
I have identified an issue in the ETCD operator during the reconciliation process of a cluster when using cert-manager as the TLS certificate provider. When cert-manager is configured to automatically manage TLS certificate generation, the reconciliation flow of the ETCD operator attempts to patch the Kubernetes `Secret` resources generated from `Certificate` resources. This patch operation is intended to add an owner reference so that the Secrets are marked as managed by the ETCD controller.
However, when cert-manager is installed with the Helm chart option `enableCertificateOwnerRef=true`, cert-manager already sets its own owner reference on the generated `Secret`resources. This leads to a conflict when the ETCD operator tries to modify the same field, causing the reconciliation process to fail.
# Environment
Kubernetes version: v1.35.1
ETCD Operator version: v0.2.0
cert-manager version: v1.20.0
# Steps to Reproduce
* Install cert-manager using Helm with `enableCertificateOwnerRef: true`
* Deploy the ETCD operator using the YAML file from the releases page.
* Create an ETCD cluster configured to use cert-manager for TLS certificates.
* Observe the reconciliation process.
# Expected Behavior
The ETCD operator should successfully reconcile the cluster even when cert-manager manages the Secrets, without conflicting over owner references.
# Actual Behavior
The reconciliation fails when attempting to patch Secrets generated by cert-manager due to conflicting owner references. Error example:
```
2026-04-08T10:06:14Z ERROR Reconciler error {"controller": "etcdcluster", "controllerGroup": "operator.etcd.io", "controllerKind": "EtcdCluster", "EtcdCluster": {"name":"ptf0000000","namespace"
:"sare0000"}, "namespace": "sare0000", "name": "ptf0000000", "reconcileID": "ed373930-eda5-436a-a2a4-a0ec622a7e50", "error": "patching certificate secret: ptf0000000-server-tls with ownerReference faile
d: Object sare0000/ptf0000000-server-tls is already owned by another Certificate controller ptf0000000-server-tls"}
```
# Proposed solutions
#### Conditional ownership handling
The ETCD operator should detect if a Secret is already managed by cert-manager and avoid overriding or adding conflicting owner references.
#### Configurable behavior via spec parameter
Provide a configuration flag in the ETCD resource to disable `Secret` ownership patching when external certificate managers (like cert-manager) are used.
Contributor guide
Assessment
This issue has not been assessed yet.