Skip to content

Commit 3326e5e

Browse files
m1kolam1kola
committed
fixup! WIP
1 parent 1568f6e commit 3326e5e

File tree

9 files changed

+21
-16
lines changed

9 files changed

+21
-16
lines changed

‎controllers/om/automation_config_test.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -365,7 +365,7 @@ func TestCanResetAgentSSL(t *testing.T) {
365365
ac.AgentSSL = &AgentSSL{
366366
ClientCertificateMode: util.OptionalClientCertficates,
367367
CAFilePath: util.CAFilePathInContainer,
368-
AutoPEMKeyFilePath: util.AutomationAgentPemFilePath,
368+
AutoPEMKeyFilePath: "/fake/path/to/pem",
369369
}
370370

371371
if err := ac.Apply(); err != nil {
@@ -374,7 +374,7 @@ func TestCanResetAgentSSL(t *testing.T) {
374374

375375
tls := cast.ToStringMap(ac.Deployment["tls"])
376376
assert.Equal(t, tls["clientCertificateMode"], util.OptionalClientCertficates)
377-
assert.Equal(t, tls["autoPEMKeyFilePath"], util.AutomationAgentPemFilePath)
377+
assert.Equal(t, tls["autoPEMKeyFilePath"], "/fake/path/to/pem")
378378
assert.Equal(t, tls["CAFilePath"], util.CAFilePathInContainer)
379379

380380
ac.AgentSSL = &AgentSSL{

‎controllers/om/backup_agent_config.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,8 +49,8 @@ func (bac *BackupAgentConfig) UnsetAgentPassword() {
4949
bac.BackupAgentTemplate.Password = util.MergoDelete
5050
}
5151

52-
func (bac *BackupAgentConfig) EnableX509Authentication(backupAgentSubject string) {
53-
bac.BackupAgentTemplate.SSLPemKeyFile = util.AutomationAgentPemFilePath
52+
func (bac *BackupAgentConfig) EnableX509Authentication(backupAgentSubject, automationAgentPemFilePath string) {
53+
bac.BackupAgentTemplate.SSLPemKeyFile = automationAgentPemFilePath
5454
bac.SetAgentUserName(backupAgentSubject)
5555
}
5656

‎controllers/om/backup_agent_test.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ func TestFieldsAreUpdatedBackupConfig(t *testing.T) {
3232

3333
func TestBackupFieldsAreNotLost(t *testing.T) {
3434
config := getTestBackupConfig()
35-
config.EnableX509Authentication("namespace")
35+
config.EnableX509Authentication("namespace", "/fake/path/to/pem")
3636

3737
assert.Contains(t, config.BackingMap, "logPath")
3838
assert.Contains(t, config.BackingMap, "logRotate")
@@ -48,7 +48,7 @@ func TestBackupFieldsAreNotLost(t *testing.T) {
4848
func TestNestedFieldsAreNotLost(t *testing.T) {
4949
config := getTestBackupConfig()
5050

51-
config.EnableX509Authentication("namespace")
51+
config.EnableX509Authentication("namespace", "/fake/path/to/pem")
5252

5353
_ = config.Apply()
5454

‎controllers/om/monitoring_agent_config.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -45,9 +45,9 @@ func (m *MonitoringAgentConfig) UnsetAgentPassword() {
4545
m.MonitoringAgentTemplate.Password = util.MergoDelete
4646
}
4747

48-
func (m *MonitoringAgentConfig) EnableX509Authentication(MonitoringAgentSubject string) {
49-
m.MonitoringAgentTemplate.SSLPemKeyFile = util.AutomationAgentPemFilePath
50-
m.SetAgentUserName(MonitoringAgentSubject)
48+
func (m *MonitoringAgentConfig) EnableX509Authentication(monitoringAgentSubject, automationAgentPemFilePath string) {
49+
m.MonitoringAgentTemplate.SSLPemKeyFile = automationAgentPemFilePath
50+
m.SetAgentUserName(monitoringAgentSubject)
5151
}
5252

5353
func (m *MonitoringAgentConfig) DisableX509Authentication() {

‎controllers/operator/appdbreplicaset_controller.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1660,7 +1660,8 @@ func (r *ReconcileAppDbReplicaSet) tryConfigureMonitoringInOpsManager(ctx contex
16601660
Mechanisms: []string{util.SCRAM},
16611661
ClientCertificates: util.OptionalClientCertficates,
16621662
AutoUser: util.AutomationAgentUserName,
1663-
CAFilePath: util.CAFilePathInContainer,
1663+
// TODO: add AutoPEMKeyFilePath
1664+
CAFilePath: util.CAFilePathInContainer,
16641665
}
16651666
err = authentication.Configure(conn, opts, false, log)
16661667
if err != nil {

‎controllers/operator/authentication/authentication.go

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,8 @@ type Options struct {
4343
// so it is possible to use other auth mechanisms without needing to provide client certs.
4444
ClientCertificates string
4545

46+
AutoPEMKeyFilePath string
47+
4648
CAFilePath string
4749

4850
// Use Agent Client Auth
@@ -348,7 +350,7 @@ func addOrRemoveAgentClientCertificate(conn om.Connection, opts Options, log *za
348350

349351
if opts.AgentsShouldUseClientAuthentication {
350352
ac.AgentSSL = &om.AgentSSL{
351-
AutoPEMKeyFilePath: util.AutomationAgentPemFilePath,
353+
AutoPEMKeyFilePath: opts.AutoPEMKeyFilePath,
352354
CAFilePath: opts.CAFilePath,
353355
ClientCertificateMode: opts.ClientCertificates,
354356
}

‎controllers/operator/authentication/x509.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ func (x *connectionX509) EnableAgentAuthentication(conn om.Connection, opts Opti
2929
auth.KeyFile = util.AutomationAgentKeyFilePathInContainer
3030
auth.KeyFileWindows = util.AutomationAgentWindowsKeyFilePath
3131
ac.AgentSSL = &om.AgentSSL{
32-
AutoPEMKeyFilePath: util.AutomationAgentPemFilePath,
32+
AutoPEMKeyFilePath: opts.AutoPEMKeyFilePath,
3333
CAFilePath: opts.CAFilePath,
3434
ClientCertificateMode: opts.ClientCertificates,
3535
}
@@ -46,7 +46,7 @@ func (x *connectionX509) EnableAgentAuthentication(conn om.Connection, opts Opti
4646

4747
log.Info("Configuring backup agent user")
4848
err = conn.ReadUpdateBackupAgentConfig(func(config *om.BackupAgentConfig) error {
49-
config.EnableX509Authentication(opts.AutomationSubject)
49+
config.EnableX509Authentication(opts.AutomationSubject, opts.AutoPEMKeyFilePath)
5050
config.SetLdapGroupDN(opts.AutoLdapGroupDN)
5151
return nil
5252
}, log)
@@ -56,7 +56,7 @@ func (x *connectionX509) EnableAgentAuthentication(conn om.Connection, opts Opti
5656

5757
log.Info("Configuring monitoring agent user")
5858
return conn.ReadUpdateMonitoringAgentConfig(func(config *om.MonitoringAgentConfig) error {
59-
config.EnableX509Authentication(opts.AutomationSubject)
59+
config.EnableX509Authentication(opts.AutomationSubject, opts.AutoPEMKeyFilePath)
6060
config.SetLdapGroupDN(opts.AutoLdapGroupDN)
6161
return nil
6262
}, log)

‎controllers/operator/common_controller.go

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -449,7 +449,8 @@ func (r *ReconcileCommonController) updateOmAuthentication(ctx context.Context,
449449
ClientCertificates: clientCerts,
450450
AutoUser: scramAgentUserName,
451451
AutoLdapGroupDN: ar.GetSecurity().Authentication.Agents.AutomationLdapGroupDN,
452-
CAFilePath: caFilepath,
452+
// TODO: add AutoPEMKeyFilePath
453+
CAFilePath: caFilepath,
453454
}
454455
var databaseSecretPath string
455456
if r.VaultClient != nil {
@@ -596,6 +597,8 @@ func (r *ReconcileCommonController) readAgentSubjectsFromSecret(ctx context.Cont
596597

597598
func (r *ReconcileCommonController) clearProjectAuthenticationSettings(ctx context.Context, conn om.Connection, mdb *mdbv1.MongoDB, processNames []string, log *zap.SugaredLogger) error {
598599
secretKeySelector := mdb.Spec.Security.AgentClientCertificateSecretName(mdb.Name)
600+
// TODO: pass the cert hash in secretKeySelector
601+
599602
agentSecret := &corev1.Secret{}
600603
if err := r.client.Get(ctx, kube.ObjectKey(mdb.Namespace, secretKeySelector.Name), agentSecret); client.IgnoreNotFound(err) != nil {
601604
return nil

‎pkg/util/constants.go

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -124,7 +124,6 @@ const (
124124

125125
AutomationAgentName = "mms-automation-agent"
126126
AutomationAgentPemSecretKey = AutomationAgentName + "-pem"
127-
AutomationAgentPemFilePath = PvcMmsHomeMountPath + "/" + AgentSecretName + "/" + AutomationAgentPemSecretKey
128127

129128
// Key used in concatenated pem secrets to denote the hash of the latest certificate
130129
LatestHashSecretKey = "latestHash"

0 commit comments

Comments
 (0)