isaactwong · Oct 20, 2026 · Oct 20, 2026 · NishanthNalluri · Oct 31, 2026 · NishanthNalluri
diff --git a/cockroachdb-legacy/CHANGELOG.md b/cockroachdb-legacy/CHANGELOG.md
@@ -11,6 +11,20 @@ All notable changes to the CockroachDB Helm chart will be documented in this fil
 ### Changed
 - Updated the self-signer image to `1.11` for operator-managed certificate rotation fixes.
 
+### Fixed
+- The self-signer certificate-rotation CronJobs now render with the same pod and container
+  `securityContext` as the install Job, require `tls.enabled` like the install Job, and the rotation
+  Role grants the same rules as the install Role. Previously the rotation pods ran without a
+  securityContext, so namespaces enforcing Pod Security Admission `restricted` rejected them,
+  rotation never ran and certificates eventually expired.
+
+### Upgrade notes
+- On OpenShift, if you granted a SecurityContextConstraint to the self-signer install
+  ServiceAccount so that it can run as user 1000, grant the same SCC to the rotation
+  ServiceAccount (`<release>-cockroachdb-rotate-self-signer`), or set
+  `tls.certs.selfSigner.securityContext.enabled=false`. The rotation CronJobs now set the same
+  `securityContext` as the install Job.
+
 ## [22.0.4] 2026-09-23
 ### Changed
   - Updated the default CockroachDB image version from `v26.3.1` to `v26.3.2`.

diff --git a/cockroachdb-legacy/templates/_helpers.tpl b/cockroachdb-legacy/templates/_helpers.tpl
@@ -130,6 +130,54 @@ Define the default values for the certificate selfSigner inputs
   {{- printf "%s-client" $base -}}
 {{- end -}}
 
+{{/*
+The self-signer install Job, the pre-delete cleaner Job and the two rotation CronJobs run the same
+image against the same resources. They take their gate, pod security and RBAC from the templates
+below so that the four cannot drift apart. The gate also guards the self-signer Role, RoleBinding
+and ServiceAccount templates.
+*/}}
+{{- define "selfcerts.enabled" -}}
+  {{- if and .Values.tls.enabled .Values.tls.certs.selfSigner.enabled -}}true{{- end -}}
+{{- end -}}
+
+{{- define "selfcerts.podSecurityContext" -}}
+  {{- if .Values.tls.certs.selfSigner.securityContext.enabled -}}
+securityContext:
+  seccompProfile:
+    type: "RuntimeDefault"
+  runAsGroup: 1000
+  runAsUser: 1000
+  fsGroup: 1000
+  runAsNonRoot: true
+  {{- end }}
+{{- end -}}
+
+{{- define "selfcerts.containerSecurityContext" -}}
+  {{- if .Values.tls.certs.selfSigner.securityContext.enabled -}}
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop: ["ALL"]
+  {{- end }}
+{{- end -}}
+
+{{- define "selfcerts.roleRules" -}}
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["create", "get", "update", "delete"]
+- apiGroups: ["apps"]
+  resources: ["statefulsets"]
+  verbs: ["get"]
+  resourceNames:
+    - {{ template "cockroachdb.fullname" . }}
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["delete", "get"]
+- apiGroups: [""]
+  resources: ["configmaps"]
+  verbs: ["create", "get", "update", "delete"]
+{{- end -}}
+
 {{- define "selfcerts.minimumCertDuration" -}}
   {{- if .Values.tls.certs.selfSigner.minimumCertDuration -}}
     {{- print (.Values.tls.certs.selfSigner.minimumCertDuration | trimSuffix "h") -}}

diff --git a/cockroachdb-legacy/templates/cronjob-ca-certSelfSigner.yaml b/cockroachdb-legacy/templates/cronjob-ca-certSelfSigner.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.tls.enabled (and .Values.tls.certs.selfSigner.enabled (not .Values.tls.certs.selfSigner.caProvided)) }}
+{{- if and (include "selfcerts.enabled" .) (not .Values.tls.certs.selfSigner.caProvided) }}
   {{- if .Values.tls.certs.selfSigner.rotateCerts }}
     {{- if .Capabilities.APIVersions.Has "batch/v1/CronJob" }}
 apiVersion: batch/v1
@@ -31,6 +31,9 @@ spec:
         {{- if and .Values.tls.enabled .Values.tls.selfSigner.image.credentials }}
           imagePullSecrets:
             - name: {{ template "cockroachdb.fullname" . }}.init-certs.registry
+        {{- end }}
+        {{- with include "selfcerts.podSecurityContext" . }}
+          {{- . | nindent 10 }}
         {{- end }}
           restartPolicy: Never
         {{- with .Values.tls.selfSigner.affinity }}
@@ -61,6 +64,9 @@ spec:
               value: {{ .Release.Namespace }}
             - name: CLUSTER_DOMAIN
               value: {{ .Values.clusterDomain}}
+            {{- with include "selfcerts.containerSecurityContext" . }}
+              {{- . | nindent 12 }}
+            {{- end }}
           serviceAccountName: {{ template "rotatecerts.fullname" . }}
   {{- end }}
 {{- end }}
diff --git a/cockroachdb-legacy/templates/cronjob-client-node-certSelfSigner.yaml b/cockroachdb-legacy/templates/cronjob-client-node-certSelfSigner.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.tls.certs.selfSigner.enabled .Values.tls.certs.selfSigner.rotateCerts }}
+{{- if and (include "selfcerts.enabled" .) .Values.tls.certs.selfSigner.rotateCerts }}
   {{- if .Capabilities.APIVersions.Has "batch/v1/CronJob" }}
 apiVersion: batch/v1
   {{- else }}
@@ -31,6 +31,9 @@ spec:
           imagePullSecrets:
             - name: {{ template "cockroachdb.fullname" . }}.init-certs.registry
           {{- end }}
+        {{- with include "selfcerts.podSecurityContext" . }}
+          {{- . | nindent 10 }}
+        {{- end }}
           restartPolicy: Never
         {{- with .Values.tls.selfSigner.affinity }}
           affinity: {{- toYaml . | nindent 12 }}
@@ -73,5 +76,8 @@ spec:
             - name: ADDITIONAL_SANS
               value: {{ .Values.tls.certs.selfSigner.additionalSANs | join "," | quote }}
             {{- end }}
+            {{- with include "selfcerts.containerSecurityContext" . }}
+              {{- . | nindent 12 }}
+            {{- end }}
           serviceAccountName: {{ template "rotatecerts.fullname" . }}
   {{- end}}
diff --git a/cockroachdb-legacy/templates/job-certSelfSigner.yaml b/cockroachdb-legacy/templates/job-certSelfSigner.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.tls.enabled .Values.tls.certs.selfSigner.enabled }}
+{{- if include "selfcerts.enabled" . }}
 apiVersion: batch/v1
 kind: Job
 metadata:
@@ -35,14 +35,8 @@ spec:
       imagePullSecrets:
       - name: {{ template "cockroachdb.fullname" . }}.init-certs.registry
     {{- end }}
-    {{- if and .Values.tls.certs.selfSigner.securityContext.enabled }}
-      securityContext:
-        seccompProfile:
-          type: "RuntimeDefault"
-        runAsGroup: 1000
-        runAsUser: 1000
-        fsGroup: 1000
-        runAsNonRoot: true
+    {{- with include "selfcerts.podSecurityContext" . }}
+      {{- . | nindent 6 }}
     {{- end }}
       restartPolicy: Never
     {{- with .Values.tls.selfSigner.affinity }}
@@ -84,11 +78,8 @@ spec:
           - name: ADDITIONAL_SANS
             value: {{ .Values.tls.certs.selfSigner.additionalSANs | join "," | quote }}
           {{- end }}
-        {{- if and .Values.tls.certs.selfSigner.securityContext.enabled }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop: ["ALL"]
+        {{- with include "selfcerts.containerSecurityContext" . }}
+          {{- . | nindent 10 }}
         {{- end }}
       serviceAccountName: {{ template "selfcerts.fullname" . }}
 {{- end}}
diff --git a/cockroachdb-legacy/templates/job-cleaner.yaml b/cockroachdb-legacy/templates/job-cleaner.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.tls.enabled .Values.tls.certs.selfSigner.enabled }}
+{{- if include "selfcerts.enabled" . }}
 apiVersion: batch/v1
 kind: Job
 metadata:
@@ -31,14 +31,8 @@ spec:
       annotations: {{- toYaml . | nindent 8 }}
     {{- end }}
     spec:
-    {{- if and .Values.tls.certs.selfSigner.securityContext.enabled }}
-      securityContext:
-        seccompProfile:
-          type: "RuntimeDefault"
-        runAsGroup: 1000
-        runAsUser: 1000
-        fsGroup: 1000
-        runAsNonRoot: true
+    {{- with include "selfcerts.podSecurityContext" . }}
+      {{- . | nindent 6 }}
     {{- end }}
     {{- if and .Values.tls.enabled .Values.tls.selfSigner.image.credentials }}
       imagePullSecrets:
@@ -64,11 +58,8 @@ spec:
           env:
           - name: STATEFULSET_NAME
             value: {{ template "cockroachdb.fullname" . }}
-        {{- if and .Values.tls.certs.selfSigner.securityContext.enabled }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop: ["ALL"]
+        {{- with include "selfcerts.containerSecurityContext" . }}
+          {{- . | nindent 10 }}
         {{- end }}
       serviceAccountName: {{ template "rotatecerts.fullname" . }}
 {{- end}}
diff --git a/cockroachdb-legacy/templates/role-certRotateSelfSigner.yaml b/cockroachdb-legacy/templates/role-certRotateSelfSigner.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.tls.enabled .Values.tls.certs.selfSigner.enabled }}
+{{- if include "selfcerts.enabled" . }}
 kind: Role
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
@@ -13,15 +13,5 @@ metadata:
     {{- toYaml . | nindent 4 }}
   {{- end }}
 rules:
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["create", "get", "update", "delete"]
-  - apiGroups: ["apps"]
-    resources: ["statefulsets"]
-    verbs: ["get"]
-    resourceNames:
-      - {{ template "cockroachdb.fullname" . }}
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["delete", "get"]
+{{- include "selfcerts.roleRules" . | nindent 2 }}
 {{- end }}
diff --git a/cockroachdb-legacy/templates/role-certSelfSigner.yaml b/cockroachdb-legacy/templates/role-certSelfSigner.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.tls.enabled .Values.tls.certs.selfSigner.enabled }}
+{{- if include "selfcerts.enabled" . }}
 kind: Role
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
@@ -19,18 +19,5 @@ metadata:
     {{- toYaml . | nindent 4 }}
   {{- end }}
 rules:
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["create", "get", "update", "delete"]
-  - apiGroups: ["apps"]
-    resources: ["statefulsets"]
-    verbs: ["get"]
-    resourceNames:
-      - {{ template "cockroachdb.fullname" . }}
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["delete", "get"]
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["create", "get", "update", "delete"]
+{{- include "selfcerts.roleRules" . | nindent 2 }}
 {{- end }}
diff --git a/cockroachdb-legacy/templates/rolebinding-certRotateSelfSigner.yaml b/cockroachdb-legacy/templates/rolebinding-certRotateSelfSigner.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.tls.enabled .Values.tls.certs.selfSigner.enabled }}
+{{- if include "selfcerts.enabled" . }}
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:

diff --git a/cockroachdb-legacy/templates/rolebinding-certSelfSigner.yaml b/cockroachdb-legacy/templates/rolebinding-certSelfSigner.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.tls.enabled .Values.tls.certs.selfSigner.enabled }}
+{{- if include "selfcerts.enabled" . }}
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:

diff --git a/cockroachdb-legacy/templates/serviceaccount-certRotateSelfSigner.yaml b/cockroachdb-legacy/templates/serviceaccount-certRotateSelfSigner.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.tls.enabled .Values.tls.certs.selfSigner.enabled }}
+{{- if include "selfcerts.enabled" . }}
   {{ template "cockroachdb.tls.certs.selfSigner.validation" . }}
 kind: ServiceAccount
 apiVersion: v1

diff --git a/cockroachdb-legacy/templates/serviceaccount-certSelfSigner.yaml b/cockroachdb-legacy/templates/serviceaccount-certSelfSigner.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.tls.enabled .Values.tls.certs.selfSigner.enabled }}
+{{- if include "selfcerts.enabled" . }}
   {{ template "cockroachdb.tls.certs.selfSigner.validation" . }}
 kind: ServiceAccount
 apiVersion: v1

diff --git a/cockroachdb-operator/charts/cockroachdb/CHANGELOG.md b/cockroachdb-operator/charts/cockroachdb/CHANGELOG.md
@@ -12,6 +12,13 @@
   leaving the CA ConfigMap stale, and attempting StatefulSet restarts in deployments
   that do not use StatefulSets.
 - Updated the self-signer image to `1.11`, which includes these fixes.
+- The self-signer certificate-rotation CronJobs now render with the same pod and container
+  `securityContext` as the install Job, and the rotation Role grants the same rules as the install
+  Role, including the OpenShift `securitycontextconstraints` rule. Previously the rotation pods ran
+  without a securityContext, so namespaces enforcing Pod Security Admission `restricted` rejected
+  them, rotation never ran and certificates eventually expired. The rotation ServiceAccount now
+  holds the `securitycontextconstraints` `use` grant permanently, as the install ServiceAccount
+  does for the duration of the pre-install hook.
 
 ### Upgrade notes
 - Node certificates rotated by affected self-signer versions may be missing join-service

diff --git a/cockroachdb-operator/charts/cockroachdb/templates/_helpers.tpl b/cockroachdb-operator/charts/cockroachdb/templates/_helpers.tpl
@@ -85,6 +85,57 @@ Define the default values for the certificate selfSigner inputs
   {{- printf "%s-client" $base -}}
 {{- end -}}
 
+{{/*
+The self-signer install Job, the pre-delete cleaner Job and the two rotation CronJobs run the same
+image against the same resources. They take their gate, pod security and RBAC from the templates
+below so that the four cannot drift apart. The gate also guards the self-signer Role, RoleBinding
+and ServiceAccount templates. The securitycontextconstraints rule is specific to this chart; the
+legacy chart grants none.
+*/}}
+{{- define "selfcerts.enabled" -}}
+  {{- if and .Values.cockroachdb.tls.enabled .Values.cockroachdb.tls.selfSigner.enabled -}}true{{- end -}}
+{{- end -}}
+
+{{- define "selfcerts.podSecurityContext" -}}
+  {{- if .Values.cockroachdb.tls.selfSigner.securityContext.enabled -}}
+securityContext:
+  seccompProfile:
+    type: "RuntimeDefault"
+  runAsGroup: 1000
+  runAsUser: 1000
+  fsGroup: 1000
+  runAsNonRoot: true
+  {{- end }}
+{{- end -}}
+
+{{- define "selfcerts.containerSecurityContext" -}}
+  {{- if .Values.cockroachdb.tls.selfSigner.securityContext.enabled -}}
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop: ["ALL"]
+  {{- end }}
+{{- end -}}
+
+{{- define "selfcerts.roleRules" -}}
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["create", "get", "update", "delete"]
+- apiGroups: ["apps"]
+  resources: ["statefulsets"]
+  verbs: ["get"]
+  resourceNames:
+    - {{ template "cockroachdb.fullname" . }}
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["delete", "get"]
+- apiGroups: [""]
+  resources: ["configmaps"]
+  verbs: ["create", "get", "update", "delete"]
+- apiGroups: [ "security.openshift.io" ]
+  resources: [ "securitycontextconstraints" ]
+  verbs: [ "use" ]
+{{- end -}}
 
 {{- define "selfcerts.minimumCertDuration" -}}
   {{- if .Values.cockroachdb.tls.selfSigner.minimumCertDuration -}}

diff --git a/cockroachdb-operator/charts/cockroachdb/templates/cronjob-ca-certSelfSigner.yaml b/cockroachdb-operator/charts/cockroachdb/templates/cronjob-ca-certSelfSigner.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.cockroachdb.tls.enabled (and .Values.cockroachdb.tls.selfSigner.enabled (not .Values.cockroachdb.tls.selfSigner.caProvided)) }}
+{{- if and (include "selfcerts.enabled" .) (not .Values.cockroachdb.tls.selfSigner.caProvided) }}
   {{- if .Values.cockroachdb.tls.selfSigner.rotateCerts }}
 apiVersion: batch/v1
 kind: CronJob
@@ -27,6 +27,9 @@ spec:
         {{- if and .Values.cockroachdb.tls.enabled .Values.cockroachdb.tls.selfSigner.image.credentials }}
           imagePullSecrets:
             - name: {{ template "cockroachdb.fullname" . }}.init-certs.registry
+        {{- end }}
+        {{- with include "selfcerts.podSecurityContext" . }}
+          {{- . | nindent 10 }}
         {{- end }}
           restartPolicy: Never
         {{- with .Values.cockroachdb.tls.selfSigner.affinity }}
@@ -58,6 +61,9 @@ spec:
                   value: {{ .Release.Namespace }}
                 - name: CLUSTER_DOMAIN
                   value: {{ .Values.cockroachdb.clusterDomain}}
+              {{- with include "selfcerts.containerSecurityContext" . }}
+                {{- . | nindent 14 }}
+              {{- end }}
           serviceAccountName: {{ template "rotatecerts.fullname" . }}
   {{- end }}
 {{- end }}
diff --git a/cockroachdb-operator/charts/cockroachdb/templates/cronjob-client-node-certSelfSigner.yaml b/cockroachdb-operator/charts/cockroachdb/templates/cronjob-client-node-certSelfSigner.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.cockroachdb.tls.selfSigner.enabled .Values.cockroachdb.tls.selfSigner.rotateCerts }}
+{{- if and (include "selfcerts.enabled" .) .Values.cockroachdb.tls.selfSigner.rotateCerts }}
 apiVersion: batch/v1
 kind: CronJob
 metadata:
@@ -27,6 +27,9 @@ spec:
           imagePullSecrets:
             - name: {{ template "cockroachdb.fullname" . }}.init-certs.registry
           {{- end }}
+        {{- with include "selfcerts.podSecurityContext" . }}
+          {{- . | nindent 10 }}
+        {{- end }}
           restartPolicy: Never
         {{- with .Values.cockroachdb.tls.selfSigner.affinity }}
           affinity: {{- toYaml . | nindent 12 }}
@@ -70,5 +73,8 @@ spec:
                 - name: ADDITIONAL_SANS
                   value: {{ .Values.cockroachdb.tls.selfSigner.additionalSANs | join "," | quote }}
                 {{- end }}
+              {{- with include "selfcerts.containerSecurityContext" . }}
+                {{- . | nindent 14 }}
+              {{- end }}
           serviceAccountName: {{ template "rotatecerts.fullname" . }}
   {{- end}}