Skip to content

Commit 330c11e

Browse files
anandsyncsanandsyncs
authored
Search: remove external.tls.enabled (#442)
# Summary This pull request refactors the TLS configuration for MongoDB Search resources by removing the `enabled` boolean flag and relying solely on the presence or absence of TLS configuration objects to determine if TLS should be enabled. It also updates the CRD schemas, controller logic, tests, and documentation to reflect this change, and clarifies the usage of CA certificates for external mongod sources. **API and CRD schema changes:** * Removed the `enabled` boolean from both `spec.security.tls` and `spec.source.external.tls`, making TLS activation dependent on whether the TLS configuration is provided. Updated required fields and descriptions for CA certificates in the CRDs (`config/crd/bases/mongodb.com_mongodbsearch.yaml`, `helm_chart/crds/mongodb.com_mongodbsearch.yaml`, `public/crds.yaml`). [[1]](diffhunk://#diff-8621604e23ddaa9863d6c6e98dda3f3b71bd29740cdab99b8b3fa32177f4c89eL182-R183) [[2]](diffhunk://#diff-8621604e23ddaa9863d6c6e98dda3f3b71bd29740cdab99b8b3fa32177f4c89eL214-R213) [[3]](diffhunk://#diff-8621604e23ddaa9863d6c6e98dda3f3b71bd29740cdab99b8b3fa32177f4c89eL228-R227) [[4]](diffhunk://#diff-dba1285752e5d0324f36d8c959e29913fcbf02c90263cdd7d6d96447180bbe8dL4204-R4205) [[5]](diffhunk://#diff-dba1285752e5d0324f36d8c959e29913fcbf02c90263cdd7d6d96447180bbe8dL4236-R4235) [[6]](diffhunk://#diff-dba1285752e5d0324f36d8c959e29913fcbf02c90263cdd7d6d96447180bbe8dL4250-R4249) * Updated the Go API types to remove the `Enabled` field from `ExternalMongodTLS` and `TLS`, clarified CA certificate documentation, and made `Security.TLS` an optional pointer. (`api/v1/search/mongodbsearch_types.go`) **Controller logic updates:** * Refactored controller code to check for the presence of TLS configuration objects instead of the `Enabled` flag when determining TLS behavior in reconciliation and config generation. (`controllers/operator/mongodbsearch_controller.go`, `controllers/searchcontroller/external_search_source.go`, `controllers/searchcontroller/mongodbsearch_reconcile_helper.go`) [[1]](diffhunk://#diff-ff8b89a9eaadf42605cba2f2884310f60e46bf00162ef5e0173a8d34d1fb466dL73-R73) [[2]](diffhunk://#diff-0f0be42909b701181f9550c76be0b3bcf63ed7c2825a51bbbfc098006c88fc1eL29-R29) [[3]](diffhunk://#diff-9b1183581cc6af6723f6445d7a14ae4ae7b435dc3b93ca5d82247cda13f7ca39L231-R231) [[4]](diffhunk://#diff-9b1183581cc6af6723f6445d7a14ae4ae7b435dc3b93ca5d82247cda13f7ca39L393-R393) **Test and documentation updates:** * Updated tests and documentation to remove references to the `enabled` field in TLS configurations and to use the new structure. (`docker/mongodb-kubernetes-tests/tests/search/search_community_external_mongod_basic.py`, `docker/mongodb-kubernetes-tests/tests/search/search_community_external_mongod_tls.py`, `docker/mongodb-kubernetes-tests/tests/search/search_enterprise_tls.py`, `docs/search/04-search-external-mongod/README.md`, `docs/search/04-search-external-mongod/code_snippets/04_0320_create_mongodb_search_resource.sh`) [[1]](diffhunk://#diff-b2921000399e050cf60a6d3c4abbb21a0c6a9484af6cd4857b6a3217c0a36d1cL74) [[2]](diffhunk://#diff-83229428104eb15a5b4108d84eae1dce6c34940aae703481c902b52e020f1a32L141-R148) [[3]](diffhunk://#diff-7ac66a583299039225a2f886ef60cd00a230029416d6d809e4e68b4d55edc29bL62-R62) [[4]](diffhunk://#diff-78a9bbf913195ad01e7814be0a2937858af6c019f895fa45726b5730974bc78cL185-L186) [[5]](diffhunk://#diff-17ce6ba340db65b4ae7338b809e03258b9e0cf148f4894872fb0dcefd2c41c4cL16-L17) **Evergreen build changes:** * Added a new Evergreen task and included it in the relevant task group to test external mongod search code snippets. (`.evergreen-snippets.yml`) [[1]](diffhunk://#diff-567852169488d3138501958aeebe87ca49e1c19b4b2d5a746e52c93b0fd4dc0eR124-R129) [[2]](diffhunk://#diff-567852169488d3138501958aeebe87ca49e1c19b4b2d5a746e52c93b0fd4dc0eR144) ## Proof of Work Tests pass
1 parent cb20e63 commit 330c11e

File tree

15 files changed

+29
-42
lines changed

15 files changed

+29
-42
lines changed

‎.evergreen-snippets.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,12 @@ tasks:
121121
- func: test_code_snippets
122122
- func: sample_commit_output
123123

124+
- name: test_kind_search_external_mongod_snippets.sh
125+
tags: [ "code_snippets", "patch-run" ]
126+
commands:
127+
- func: test_code_snippets
128+
- func: sample_commit_output
129+
124130
task_groups:
125131
- name: gke_code_snippets_task_group
126132
<<: *setup_and_teardown_group_gke_code_snippets
@@ -135,6 +141,7 @@ task_groups:
135141
tasks:
136142
- test_kind_search_community_snippets.sh
137143
- test_kind_search_enterprise_snippets.sh
144+
- test_kind_search_external_mongod_snippets.sh
138145

139146
buildvariants:
140147
# These variants are used to test the code snippets and each one can be used in patches

‎api/v1/search/mongodbsearch_types.go‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -69,22 +69,20 @@ type ExternalMongoDBSource struct {
6969
}
7070

7171
type ExternalMongodTLS struct {
72-
Enabled bool `json:"enabled"`
73-
// +optional
74-
CA *corev1.LocalObjectReference `json:"ca,omitempty"`
72+
// CA is a reference to a Secret containing the CA certificate that issued mongod's TLS certificate.
73+
// The CA certificate is expected to be PEM encoded and available at the "ca.crt" key.
74+
CA *corev1.LocalObjectReference `json:"ca"`
7575
}
7676

7777
type Security struct {
7878
// +optional
79-
TLS TLS `json:"tls"`
79+
TLS *TLS `json:"tls,omitempty"`
8080
}
8181

8282
type TLS struct {
83-
Enabled bool `json:"enabled"`
8483
// CertificateKeySecret is a reference to a Secret containing a private key and certificate to use for TLS.
8584
// The key and cert are expected to be PEM encoded and available at "tls.key" and "tls.crt".
8685
// This is the same format used for the standard "kubernetes.io/tls" Secret type, but no specific type is required.
87-
// +optional
8886
CertificateKeySecret corev1.LocalObjectReference `json:"certificateKeySecretRef"`
8987
}
9088

‎config/crd/bases/mongodb.com_mongodbsearch.yaml‎

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -179,10 +179,8 @@ spec:
179179
type: string
180180
type: object
181181
x-kubernetes-map-type: atomic
182-
enabled:
183-
type: boolean
184182
required:
185-
- enabled
183+
- certificateKeySecretRef
186184
type: object
187185
type: object
188186
source:
@@ -211,8 +209,8 @@ spec:
211209
properties:
212210
ca:
213211
description: |-
214-
LocalObjectReference contains enough information to let you locate the
215-
referenced object inside the same namespace.
212+
CA is a reference to a Secret containing the CA certificate that issued mongod's TLS certificate.
213+
The CA certificate is expected to be PEM encoded and available at the "ca.crt" key.
216214
properties:
217215
name:
218216
default: ""
@@ -225,10 +223,8 @@ spec:
225223
type: string
226224
type: object
227225
x-kubernetes-map-type: atomic
228-
enabled:
229-
type: boolean
230226
required:
231-
- enabled
227+
- ca
232228
type: object
233229
type: object
234230
mongodbResourceRef:

‎controllers/operator/mongodbsearch_controller.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ func (r *MongoDBSearchReconciler) Reconcile(ctx context.Context, request reconci
7070
}
7171

7272
// Watch our own TLS certificate secret for changes
73-
if mdbSearch.Spec.Security.TLS.Enabled {
73+
if mdbSearch.Spec.Security.TLS != nil {
7474
r.watch.AddWatchedResourceIfNotAdded(mdbSearch.Spec.Security.TLS.CertificateKeySecret.Name, mdbSearch.Namespace, watch.Secret, mdbSearch.NamespacedName())
7575
}
7676

‎controllers/searchcontroller/external_search_source.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ func (r *externalSearchResource) Validate() error {
2626
}
2727

2828
func (r *externalSearchResource) TLSConfig() *TLSSourceConfig {
29-
if r.spec.TLS == nil || !r.spec.TLS.Enabled {
29+
if r.spec.TLS == nil {
3030
return nil
3131
}
3232

‎controllers/searchcontroller/mongodbsearch_reconcile_helper.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -228,7 +228,7 @@ func (r *MongoDBSearchReconcileHelper) ensureMongotConfig(ctx context.Context, l
228228
}
229229

230230
func (r *MongoDBSearchReconcileHelper) ensureIngressTlsConfig(ctx context.Context) (mongot.Modification, statefulset.Modification, error) {
231-
if !r.mdbSearch.Spec.Security.TLS.Enabled {
231+
if r.mdbSearch.Spec.Security.TLS == nil {
232232
mongotModification := func(config *mongot.Config) {
233233
config.Server.Wireproto.TLS.Mode = mongot.ConfigTLSModeDisabled
234234
}
@@ -390,7 +390,7 @@ func createMongotConfig(search *searchv1.MongoDBSearch, db SearchSourceDBResourc
390390

391391
func GetMongodConfigParameters(search *searchv1.MongoDBSearch) map[string]any {
392392
searchTLSMode := automationconfig.TLSModeDisabled
393-
if search.Spec.Security.TLS.Enabled {
393+
if search.Spec.Security.TLS != nil {
394394
searchTLSMode = automationconfig.TLSModeRequired
395395
}
396396
return map[string]any{

‎docker/mongodb-kubernetes-tests/tests/search/search_community_external_mongod_basic.py‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,6 @@ def mdbs(namespace: str, mdbc: MongoDBCommunity) -> MongoDBSearch:
7171
"external": {
7272
"hostAndPorts": seeds,
7373
"keyfileSecretRef": {"name": f"{mdbc.name}-keyfile", "key": "keyfile"},
74-
"tls": {"enabled": False},
7574
},
7675
"passwordSecretRef": {"name": f"{MDBC_RESOURCE_NAME}-{MONGOT_USER_NAME}-password", "key": "password"},
7776
"username": MONGOT_USER_NAME,

‎docker/mongodb-kubernetes-tests/tests/search/search_community_external_mongod_tls.py‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -138,15 +138,14 @@ def test_create_search_resource(mdbs: MongoDBSearch, mdbc: MongoDBCommunity):
138138
"hostAndPorts": seeds,
139139
"keyfileSecretRef": {"name": f"{mdbc.name}-keyfile"},
140140
"tls": {
141-
"enabled": True,
142141
"ca": {"name": f"{mdbc.name}-ca"},
143142
},
144143
},
145144
"passwordSecretRef": {"name": f"{MDBC_RESOURCE_NAME}-{MONGOT_USER_NAME}-password", "key": "password"},
146145
"username": MONGOT_USER_NAME,
147146
}
148147

149-
mdbs["spec"]["security"] = {"tls": {"enabled": True, "certificateKeySecretRef": {"name": MDBS_TLS_SECRET_NAME}}}
148+
mdbs["spec"]["security"] = {"tls": {"certificateKeySecretRef": {"name": MDBS_TLS_SECRET_NAME}}}
150149

151150
mdbs.update()
152151
mdbs.assert_reaches_phase(Phase.Running, timeout=300)

‎docker/mongodb-kubernetes-tests/tests/search/search_enterprise_tls.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ def mdbs(namespace: str) -> MongoDBSearch:
5959
if "spec" not in resource:
6060
resource["spec"] = {}
6161

62-
resource["spec"]["security"] = {"tls": {"enabled": True, "certificateKeySecretRef": {"name": MDBS_TLS_SECRET_NAME}}}
62+
resource["spec"]["security"] = {"tls": {"certificateKeySecretRef": {"name": MDBS_TLS_SECRET_NAME}}}
6363

6464
return resource
6565

‎docs/search/04-search-external-mongod/README.md‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -182,8 +182,6 @@ spec:
182182
keyfileSecretRef:
183183
name: ${MDB_EXTERNAL_KEYFILE_SECRET_NAME}
184184
key: keyfile
185-
tls:
186-
enabled: false
187185
username: search-sync-source
188186
passwordSecretRef:
189187
name: mdbc-rs-search-sync-source-password

0 commit comments

Comments
 (0)