Skip to content

Commit 56285c0

Browse files
P-LouwP-Louw
committed
feat(documentdb): Update test and auth vars
1 parent 7ae4273 commit 56285c0

File tree

5 files changed

+381
-10
lines changed

5 files changed

+381
-10
lines changed

‎charts/cluster/examples/documentdb-auth-examples.yaml‎

Lines changed: 308 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,308 @@
1+
# DocumentDB Authentication Configuration Examples
2+
#
3+
# This file shows different authentication configurations for DocumentDB with FerretDB.
4+
# Users can choose the approach that best fits their security requirements.
5+
6+
###############################################################################
7+
# Option 1: Default Configuration (.pgpass) - Recommended for Dev/Test
8+
###############################################################################
9+
# The chart automatically configures secure authentication using .pgpass file.
10+
# No additional configuration needed!
11+
#
12+
# Security Level: Medium
13+
# Use Case: Development, Testing, Staging
14+
---
15+
type: documentdb
16+
mode: standalone
17+
version:
18+
postgresql: "17"
19+
documentdb: "0.106.0"
20+
ferretdb: "2.5.0"
21+
cluster:
22+
instances: 1
23+
ferretdb:
24+
enabled: true
25+
backups:
26+
enabled: false
27+
28+
###############################################################################
29+
# Option 2: pg_hba Host-Based Authentication - Recommended for Production
30+
###############################################################################
31+
# Configure PostgreSQL to authenticate based on source IP/network.
32+
# This is the most secure and flexible production approach.
33+
#
34+
# Security Level: High
35+
# Use Case: Production, Staging with network isolation
36+
---
37+
type: documentdb
38+
mode: standalone
39+
version:
40+
postgresql: "17"
41+
documentdb: "0.106.0"
42+
ferretdb: "2.5.0"
43+
cluster:
44+
instances: 3
45+
postgresql:
46+
pg_hba:
47+
# Allow connections from pod network with SCRAM-SHA-256 (most secure)
48+
- "hostssl all all 10.244.0.0/16 scram-sha-256"
49+
# Or use md5 for broader compatibility
50+
# - "hostssl all all 10.244.0.0/16 md5"
51+
parameters:
52+
# Enforce strong password encryption
53+
password_encryption: "scram-sha-256"
54+
# Require SSL connections
55+
ssl: "on"
56+
ssl_min_protocol_version: "TLSv1.3"
57+
# Enable connection logging for security auditing
58+
log_connections: "on"
59+
log_disconnections: "on"
60+
ferretdb:
61+
enabled: true
62+
instances: 2
63+
backups:
64+
enabled: true
65+
66+
###############################################################################
67+
# Option 3: Trust Authentication - Local Development ONLY
68+
###############################################################################
69+
# WARNING: This is INSECURE! Use only for local testing.
70+
# No password required - anyone who can reach the database can connect.
71+
#
72+
# Security Level: None
73+
# Use Case: Local development on trusted networks only
74+
---
75+
type: documentdb
76+
mode: standalone
77+
version:
78+
postgresql: "17"
79+
documentdb: "0.106.0"
80+
ferretdb: "2.5.0"
81+
cluster:
82+
instances: 1
83+
postgresql:
84+
pg_hba:
85+
# DANGEROUS: No authentication required!
86+
- "host all all 10.244.0.0/16 trust"
87+
ferretdb:
88+
enabled: true
89+
backups:
90+
enabled: false
91+
92+
###############################################################################
93+
# Option 4: Mixed Authentication Rules
94+
###############################################################################
95+
# Combine multiple pg_hba rules for different access patterns.
96+
#
97+
# Security Level: High (with proper configuration)
98+
# Use Case: Complex environments with different access requirements
99+
---
100+
type: documentdb
101+
mode: standalone
102+
version:
103+
postgresql: "17"
104+
documentdb: "0.106.0"
105+
ferretdb: "2.5.0"
106+
cluster:
107+
instances: 3
108+
postgresql:
109+
pg_hba:
110+
# FerretDB pods from specific subnet with strong auth
111+
- "hostssl all all 10.244.0.0/24 scram-sha-256"
112+
# Allow admin subnet with certificate authentication
113+
- "hostssl all all 10.245.0.0/24 cert"
114+
# Legacy app subnet with md5 (less secure, but compatible)
115+
- "hostssl all all 10.246.0.0/24 md5"
116+
# Reject all other connections explicitly
117+
- "reject all all 0.0.0.0/0"
118+
parameters:
119+
password_encryption: "scram-sha-256"
120+
ssl: "on"
121+
ssl_min_protocol_version: "TLSv1.2"
122+
ferretdb:
123+
enabled: true
124+
instances: 2
125+
126+
###############################################################################
127+
# Option 5: Custom FerretDB Configuration
128+
###############################################################################
129+
# Override FerretDB behavior with custom environment variables
130+
#
131+
# Security Level: Configurable
132+
# Use Case: Custom FerretDB settings, debugging
133+
---
134+
type: documentdb
135+
mode: standalone
136+
version:
137+
postgresql: "17"
138+
documentdb: "0.106.0"
139+
ferretdb: "2.5.0"
140+
cluster:
141+
instances: 2
142+
ferretdb:
143+
enabled: true
144+
instances: 2
145+
# Custom FerretDB image if needed
146+
image: "ghcr.io/ferretdb/ferretdb"
147+
tag: "2.5.0"
148+
# Override resources
149+
resources:
150+
requests:
151+
memory: "512Mi"
152+
cpu: "250m"
153+
limits:
154+
memory: "1Gi"
155+
cpu: "1000m"
156+
# Add custom environment variables
157+
# These can be used to modify FerretDB behavior
158+
env:
159+
- name: FERRETDB_LOG_LEVEL
160+
value: "debug"
161+
- name: FERRETDB_TELEMETRY
162+
value: "disable"
163+
# You can even override the PostgreSQL connection parameters
164+
# But be careful - the chart manages the connection string by default
165+
# - name: FERRETDB_POSTGRESQL_URL
166+
# value: "postgres://custom-connection-string"
167+
168+
###############################################################################
169+
# Option 6: Production Setup with All Security Features
170+
###############################################################################
171+
# Complete production-ready configuration with all security best practices.
172+
#
173+
# Security Level: Maximum
174+
# Use Case: Production deployments
175+
---
176+
type: documentdb
177+
mode: standalone
178+
version:
179+
postgresql: "17"
180+
documentdb: "0.106.0"
181+
ferretdb: "2.5.0"
182+
cluster:
183+
instances: 3
184+
storage:
185+
size: 100Gi
186+
storageClass: fast-ssd
187+
# Enable pod anti-affinity for high availability
188+
affinity:
189+
topologyKey: topology.kubernetes.io/zone
190+
postgresql:
191+
pg_hba:
192+
# Only allow SSL connections from pod network
193+
- "hostssl all all 10.244.0.0/16 scram-sha-256"
194+
# Explicitly reject non-SSL connections
195+
- "reject all all 0.0.0.0/0"
196+
parameters:
197+
# Security parameters
198+
password_encryption: "scram-sha-256"
199+
ssl: "on"
200+
ssl_min_protocol_version: "TLSv1.3"
201+
ssl_prefer_server_ciphers: "on"
202+
# Connection limits
203+
max_connections: 200
204+
superuser_reserved_connections: 3
205+
# Logging for security auditing
206+
log_connections: "on"
207+
log_disconnections: "on"
208+
log_failed_authentication: "on"
209+
log_statement: "ddl" # Log all DDL statements
210+
# Performance tuning
211+
shared_buffers: "4GB"
212+
effective_cache_size: "12GB"
213+
work_mem: "16MB"
214+
# Enable monitoring
215+
monitoring:
216+
enabled: true
217+
podMonitor:
218+
enabled: true
219+
ferretdb:
220+
enabled: true
221+
instances: 3
222+
resources:
223+
requests:
224+
memory: "512Mi"
225+
cpu: "500m"
226+
limits:
227+
memory: "2Gi"
228+
cpu: "2000m"
229+
backups:
230+
enabled: true
231+
provider: s3
232+
s3:
233+
region: us-east-1
234+
bucket: production-backups
235+
path: /documentdb
236+
inheritFromIAMRole: true # Use IAM roles instead of access keys
237+
scheduledBackups:
238+
- name: daily-backup
239+
schedule: "0 0 2 * * *" # Daily at 2 AM
240+
backupOwnerReference: self
241+
retentionPolicy: "30d"
242+
243+
###############################################################################
244+
# How to Find Your Pod Network CIDR
245+
###############################################################################
246+
# To configure pg_hba rules, you need to know your Kubernetes pod network CIDR:
247+
#
248+
# Method 1: Check node pod CIDR allocation
249+
# kubectl get nodes -o jsonpath='{.items[*].spec.podCIDR}'
250+
#
251+
# Method 2: Check existing pod IPs
252+
# kubectl get pods -A -o wide | grep -v "IP" | awk '{print $6}' | sort -u
253+
#
254+
# Method 3: Check CNI configuration
255+
# kubectl get cm kube-proxy -n kube-system -o yaml | grep clusterCIDR
256+
#
257+
# Common pod CIDRs by Kubernetes distribution:
258+
# - kind: 10.244.0.0/16
259+
# - minikube: 172.17.0.0/16
260+
# - GKE: 10.0.0.0/8 (varies)
261+
# - EKS: 10.0.0.0/8 (varies)
262+
# - AKS: 10.244.0.0/16
263+
264+
###############################################################################
265+
# Testing Authentication Configuration
266+
###############################################################################
267+
# After deploying, test your authentication setup:
268+
#
269+
# 1. Test PostgreSQL direct connection:
270+
# kubectl run psql-test --rm -it --image postgres:17 -- \
271+
# psql "$(kubectl get secret documentdb-cluster-app -o jsonpath='{.data.uri}' | base64 -d)"
272+
#
273+
# 2. Test FerretDB MongoDB connection:
274+
# DB_USER=$(kubectl get secret documentdb-cluster-app -o jsonpath='{.data.username}' | base64 -d)
275+
# DB_PASSWORD=$(kubectl get secret documentdb-cluster-app -o jsonpath='{.data.password}' | base64 -d)
276+
# kubectl run mongo-test --rm -it --image mongo:7.0 -- \
277+
# mongosh "mongodb://$DB_USER:$DB_PASSWORD@documentdb-cluster-ferretdb:27017/app"
278+
#
279+
# 3. Check authentication logs:
280+
# kubectl logs -l cnpg.io/cluster=documentdb-cluster | grep -i "authentication\|connection"
281+
#
282+
# 4. View pg_hba configuration:
283+
# kubectl exec documentdb-cluster-1 -- cat /var/lib/postgresql/data/pgdata/pg_hba.conf
284+
285+
###############################################################################
286+
# Troubleshooting
287+
###############################################################################
288+
# Common Issues:
289+
#
290+
# 1. "fe_sendauth: no password supplied"
291+
# - Check that FerretDB can reach PostgreSQL service
292+
# - Verify pg_hba rules allow connections from FerretDB pods
293+
# - Check FerretDB logs: kubectl logs -l app.kubernetes.io/component=ferretdb
294+
#
295+
# 2. "no pg_hba.conf entry for host"
296+
# - Your pg_hba rules don't match the source IP
297+
# - Check actual pod IPs: kubectl get pods -o wide
298+
# - Verify your CIDR includes the FerretDB pod IPs
299+
#
300+
# 3. "SCRAM authentication failed"
301+
# - Password may be incorrect
302+
# - Or password_encryption setting doesn't match pg_hba method
303+
# - Check: kubectl get secret documentdb-cluster-app -o yaml
304+
#
305+
# 4. Connection timeout
306+
# - Check if NetworkPolicy is blocking access
307+
# - Verify FerretDB service: kubectl get svc documentdb-cluster-ferretdb
308+
# - Test connectivity: kubectl exec -it <ferretdb-pod> -- nc -zv documentdb-cluster-rw 5432

‎charts/cluster/templates/ferretdb.yaml‎

Lines changed: 41 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -30,21 +30,55 @@ spec:
3030
- name: mongodb
3131
containerPort: 27017
3232
protocol: TCP
33-
command: ["/ferretdb"]
33+
command: ["/bin/sh"]
3434
args:
35-
- "--listen-addr=:27017"
36-
- "--postgresql-url=postgres://{{ $dbOwner }}@{{ include "cluster.fullname" . }}-rw:5432/{{ $dbName }}"
37-
- "--telemetry=disable"
38-
- "--log-level=info"
35+
- "-c"
36+
- |
37+
{{- $credMethod := .Values.ferretdb.credentialMethod | default "pgpass" }}
38+
{{- if eq $credMethod "pgpass" }}
39+
# Create .pgpass file for secure password handling
40+
echo "{{ include "cluster.fullname" . }}-rw:5432:{{ $dbName }}:{{ $dbOwner }}:${DB_PASSWORD}" > /tmp/.pgpass
41+
chmod 600 /tmp/.pgpass
42+
export PGPASSFILE=/tmp/.pgpass
43+
PG_URL="postgres://{{ $dbOwner }}@{{ include "cluster.fullname" . }}-rw:5432/{{ $dbName }}{{- if .Values.ferretdb.sslMode }}?sslmode={{ .Values.ferretdb.sslMode }}{{- end }}"
44+
{{- else if eq $credMethod "password-in-url" }}
45+
# Using password in URL (less secure, for dev/test only)
46+
PG_URL="postgres://{{ $dbOwner }}:${DB_PASSWORD}@{{ include "cluster.fullname" . }}-rw:5432/{{ $dbName }}{{- if .Values.ferretdb.sslMode }}?sslmode={{ .Values.ferretdb.sslMode }}{{- end }}"
47+
{{- else if eq $credMethod "env" }}
48+
# Using PGPASSWORD environment variable
49+
export PGPASSWORD="${DB_PASSWORD}"
50+
PG_URL="postgres://{{ $dbOwner }}@{{ include "cluster.fullname" . }}-rw:5432/{{ $dbName }}{{- if .Values.ferretdb.sslMode }}?sslmode={{ .Values.ferretdb.sslMode }}{{- end }}"
51+
{{- end }}
52+
53+
exec /ferretdb \
54+
--listen-addr=:27017 \
55+
--postgresql-url="${PG_URL}" \
56+
--telemetry={{ .Values.ferretdb.telemetry | default "disable" }} \
57+
--log-level={{ .Values.ferretdb.logLevel | default "info" }} \
58+
{{- if .Values.ferretdb.auth }}
59+
--auth={{ .Values.ferretdb.auth }} \
60+
{{- end }}
61+
{{- if .Values.ferretdb.mode }}
62+
--mode={{ .Values.ferretdb.mode }} \
63+
{{- end }}
64+
{{- if .Values.ferretdb.debugAddr }}
65+
--debug-addr={{ .Values.ferretdb.debugAddr }} \
66+
{{- end }}
67+
{{- if .Values.ferretdb.otelTracesUrl }}
68+
--otel-traces-url={{ .Values.ferretdb.otelTracesUrl }} \
69+
{{- end }}
70+
{{- range .Values.ferretdb.extraArgs }}
71+
{{ . }} \
72+
{{- end }}
3973
env:
4074
{{- if .Values.cluster.initdb.secret }}
41-
- name: PGPASSWORD
75+
- name: DB_PASSWORD
4276
valueFrom:
4377
secretKeyRef:
4478
name: {{ .Values.cluster.initdb.secret.name }}
4579
key: password
4680
{{- else }}
47-
- name: PGPASSWORD
81+
- name: DB_PASSWORD
4882
valueFrom:
4983
secretKeyRef:
5084
name: {{ include "cluster.fullname" . }}-app

‎charts/cluster/test/documentdb-minio-backup-restore/01-documentdb_cluster.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@ cluster:
1010
storage:
1111
size: 256Mi
1212

13+
ferretdb:
14+
enabled: true
15+
1316
backups:
1417
enabled: true
1518

0 commit comments

Comments
 (0)