feat(ci): issue srql-fixture TLS with cert-manager and a live CA

[mfreeman451]

Describe your changes

The srql-fixtures CNPG CA/server certs were a 90-day operator pair expiring 2026-08-31, with a copied PEM injected into CI as SRQL_TEST_DATABASE_CA_CERT. That snapshot is gone.

• cert-manager issues a 10-year CA and 90-day server cert; CNPG consumes them in user-provided mode.
• Live CA fetch: kubectl when RBAC exists, otherwise a published bundle.
• GitHub ARC (arc-runner-set in carverauto) uses http://srql-fixture-ca-incluster.srql-fixtures.svc.cluster.local/ca.crt.
• BuildBuddy uses https://srql-fixture-ca.serviceradar.cloud/ca.crt.
• DSNs stay in GitHub secrets. The stale SRQL_TEST_DATABASE_CA_CERT secret has been deleted.
• Cluster is already cut over (2/2 healthy). verify-full succeeds with the new CA.

Does not grant ARC get on srql-fixture-server-ca — that Secret also holds the CA private key.

Issue ticket number and link

n/a (OpenSpec add-srql-fixture-cert-manager-tls)

Code checklist before requesting a review

• I have signed the DCO?
• Focused config tests pass (buildbuddy_cache_proxy_config_test.py 19/19)
• Full make test not run on this branch
• openspec validate add-srql-fixture-cert-manager-tls --strict

[strix-security]

Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here.

So far, Strix has reviewed 16 pull requests across this workspace.

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[Copilot]

Pull request overview

This PR updates the SRQL fixture TLS and CI wiring to eliminate the brittle “snapshot CA PEM in CI secrets” approach by switching the fixture’s server-side TLS issuance to cert-manager and having CI fetch the CA from live sources at job start.

Changes:

• Introduces cert-manager–managed SRQL fixture server CA + server certificate and switches CNPG to user-provided server TLS secrets.
• Adds a published CA bundle endpoint (plus an in-cluster HTTP path for ARC) and updates CI/setup tooling to fetch the CA live (kubectl when permitted, otherwise URL).
• Updates CI workflows, tests, and documentation to remove reliance on SRQL_TEST_DATABASE_CA_CERT stored secrets and to codify the new contract.

Reviewed changes

Copilot reviewed 22 out of 22 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
scripts/ci/configure-srql-fixture.sh	Fetch SRQL fixture CA live (kubectl or URL) and export CA/paths into CI env.
rust/integration-db/README.md	Updates fixture CA delivery documentation to reflect live fetch.
openspec/notes/bazel-bb-ci.md	Documents live CA fetching and removal of stored CA secret usage.
openspec/changes/add-srql-fixture-cert-manager-tls/tasks.md	Adds implementation checklist for cert-manager TLS + CI live CA wiring.
openspec/changes/add-srql-fixture-cert-manager-tls/specs/srql-fixture-tls/spec.md	New spec defining requirements and scenarios for fixture TLS issuance/delivery.
openspec/changes/add-srql-fixture-cert-manager-tls/proposal.md	Proposal describing motivation, scope, and impact of the change.
openspec/changes/add-srql-fixture-cert-manager-tls/design.md	Design decisions for issuance/delivery split and live CA sourcing order.
k8s/srql-fixtures/README.md	Updates fixture deployment/maintenance docs for cert-manager TLS + CA bundle URL.
k8s/srql-fixtures/kustomization.yaml	Adds cert-manager + CA bundle resources to the kustomization.
k8s/srql-fixtures/cnpg-cluster.yaml	Switches CNPG server TLS to cert-manager secrets; adds scheduling/pull safeguards.
k8s/srql-fixtures/cert-manager.yaml	Adds cert-manager Issuers/Certificates for server CA and server leaf cert.
k8s/srql-fixtures/ca-bundle.yaml	Adds nginx publisher for ca.crt (public LB + in-cluster ClusterIP).
docs/docs/armis-dire-e2e.md	Updates e2e docs to reflect live CA fetching (no stored CA secret).
buildbuddy.yaml	Updates BuildBuddy workflow commentary to reflect live CA + DSN sourcing model.
buildbuddy_setup_fixture_env.sh	Fetches CA live (kubectl/URL) and removes stored-PEM fallback semantics.
buildbuddy_cache_proxy_config_test.py	Extends config tests to validate live-CA behavior and ARC workflow invariants.
BUILD.bazel	Updates target comments to reflect live CA fetch contract.
.github/workflows/elixir-integration-sr-core.yml	Adds ARC-based GitHub workflow using in-cluster CA URL and guarded DB lifecycle.
.forgejo/workflows/elixir-quality.yml	Switches baseline gate to fetch CA live via URL instead of secret PEM.
.forgejo/workflows/elixir-integration-sr-core.yml	Removes stored CA secret requirement; relies on live CA via configure script.
.forgejo/workflows/armis-dire-e2e.yml	Switches e2e job to fetch CA live via URL rather than secret PEM.
.agents/skills/srql-fixtures-db-tests/SKILL.md	Updates local skill instructions to read CA from the new cert-manager Secret.

Suppressed comments (1)

k8s/srql-fixtures/ca-bundle.yaml:130

• The livenessProbe is also a TCP socket check only. Switching to an HTTPS httpGet on /ca.crt will detect cases where the TLS secret isn’t mounted/loaded correctly, instead of just checking that the port is open.

          livenessProbe:
            tcpSocket:
              port: https
            periodSeconds: 20

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.