Transport layer security (TLS)

The Percona Operator for PostgreSQL uses Transport Layer Security (TLS) cryptographic protocol for the following types of communication:

• Internal - communication between PostgreSQL instances in the cluster
• External - communication between the client application and the cluster

The internal certificate is also used as an authorization method for PostgreSQL Replica instances.

You can configure TLS in these ways:

• Have the Operator generate certificates automatically during cluster creation,
• Use the cert-manager to manage certificates and their lifecycle,
• Generate certificates manually.

You can migrate your running cluster to cert-manager to benefit from automatic renewal and centralized management.

Additionally, you can force your database cluster to use only encrypted channels for both internal and external communications. To do this, set the tlsOnly Custom Resource option to true.

Automatic certificate generation by the Operator

The Operator can generate long-term certificates automatically and enable encryption automatically during cluster creation.

Upon cluster creation, the Operator reviews the Custom Resource configuration to determine the TLS approach:

• If you created custom certificate Secrets and referenced them in the cluster spec, the Operator uses them for TLS.
• If custom Secrets are not specified but cert-manager is installed, the Operator generates certificates and issuer and delegates certificate lifecycle management to cert-manager.
• If neither condition is met, the Operator generates the necessary certificates and Secrets itself.

Note

Beginning with version 2.5.0, the Operator creates a dedicated root CA for each cluster. Earlier versions used a single generated root CA for all database clusters.

TLS configuration

The following sections provide guidelines how to:

• Configure TLS security with the Operator using cert-manager
• Migrate from Operator-generated certificates to cert-manager
• Generate certificates manually
• Update certificates
• Check TLS communication to a cluster

Keep certificates after deleting the cluster

When you delete the cluster, the Operator handles SSL objects (Secrets, certificates, and issuer) as follows:

• The Operator doesn’t delete TLS Secrets, certificates, and issuer it generated by default.
• The Operator removes the cert-manager Issuers and Certificates it created but keeps the Secrets.

If you want to clean up SSL objects, set the finalizers.percona.com/delete-ssl finalizer in the Custom Resource. The Operator deletes the all SSL objects.

---

Last update: March 26, 2026
Created: July 12, 2022