Skip to content

Commit 51674da

Browse files
m1kolam1kola
committed
Add agent cert hash annotation to the STS
1 parent cc73fde commit 51674da

6 files changed

+25
-3
lines changed

‎controllers/operator/construct/database_construction.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,7 @@ type DatabaseStatefulSetOptions struct {
9595
PodVars *env.PodEnvVars
9696
CurrentAgentAuthMode string
9797
CertificateHash string
98+
AgentCertificateHash string
9899
PrometheusTLSCertHash string
99100
InternalClusterHash string
100101
ServicePort int32

‎controllers/operator/database_statefulset_options.go

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,13 @@ func CertificateHash(hash string) func(options *construct.DatabaseStatefulSetOpt
5454
}
5555
}
5656

57+
// AgentCertificateHash will assign the given AgentCertificateHash during StatefulSet construction.
58+
func AgentCertificateHash(hash string) func(options *construct.DatabaseStatefulSetOptions) {
59+
return func(options *construct.DatabaseStatefulSetOptions) {
60+
options.AgentCertificateHash = hash
61+
}
62+
}
63+
5764
// InternalClusterHash will assign the given InternalClusterHash during StatefulSet construction.
5865
func InternalClusterHash(hash string) func(options *construct.DatabaseStatefulSetOptions) {
5966
return func(options *construct.DatabaseStatefulSetOptions) {

‎controllers/operator/mongodbmultireplicaset_controller.go

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -493,8 +493,11 @@ func (r *ReconcileMongoDbMultiReplicaSet) reconcileStatefulSets(ctx context.Cont
493493
return workflow.Failed(err)
494494
}
495495

496+
agentCertSecretSelector := mrs.GetSecurity().AgentClientCertificateSecretName(mrs.Name).Name
497+
496498
// get cert hash of tls secret if it exists
497499
certHash := enterprisepem.ReadHashFromSecret(ctx, r.SecretClient, mrs.Namespace, mrsConfig.CertSecretName, "", log)
500+
agentCertHash := enterprisepem.ReadHashFromSecret(ctx, r.SecretClient, mrs.Namespace, agentCertSecretSelector, "", log)
498501
internalCertHash := enterprisepem.ReadHashFromSecret(ctx, r.SecretClient, mrs.Namespace, mrsConfig.InternalClusterSecretName, "", log)
499502
log.Debugf("Creating StatefulSet %s with %d replicas in cluster: %s", mrs.MultiStatefulsetName(clusterNum), replicasThisReconciliation, item.ClusterName)
500503

@@ -524,6 +527,7 @@ func (r *ReconcileMongoDbMultiReplicaSet) reconcileStatefulSets(ctx context.Cont
524527
PodEnvVars(newPodVars(conn, projectConfig, mrs.Spec.LogLevel)),
525528
CurrentAgentAuthMechanism(currentAgentAuthMode),
526529
CertificateHash(certHash),
530+
AgentCertificateHash(agentCertHash),
527531
InternalClusterHash(internalCertHash),
528532
WithLabels(mrs.GetOwnerLabels()),
529533
WithAdditionalMongodConfig(mrs.Spec.GetAdditionalMongodConfig()),
@@ -757,8 +761,8 @@ func (r *ReconcileMongoDbMultiReplicaSet) updateOmDeploymentRs(ctx context.Conte
757761

758762
caFilePath := fmt.Sprintf("%s/ca-pem", util.TLSCaMountPath)
759763

760-
agentCertSecretName := mrs.GetSecurity().AgentClientCertificateSecretName(mrs.GetName())
761-
status, additionalReconciliationRequired := r.updateOmAuthentication(ctx, conn, rs.GetProcessNames(), &mrs, agentCertSecretName, caFilePath, internalClusterCertPath, isRecovering, log)
764+
agentCertSecretSelector := mrs.GetSecurity().AgentClientCertificateSecretName(mrs.GetName())
765+
status, additionalReconciliationRequired := r.updateOmAuthentication(ctx, conn, rs.GetProcessNames(), &mrs, agentCertSecretSelector, caFilePath, internalClusterCertPath, isRecovering, log)
762766
if !status.IsOK() && !isRecovering {
763767
return xerrors.Errorf("failed to enable Authentication for MongoDB Multi Replicaset")
764768
}

‎controllers/operator/mongodbreplicaset_controller.go

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -200,12 +200,15 @@ func (r *ReconcileMongoDbReplicaSet) Reconcile(ctx context.Context, request reco
200200

201201
tlsCertHash := enterprisepem.ReadHashFromSecret(ctx, r.SecretClient, rs.Namespace, rsCertsConfig.CertSecretName, databaseSecretPath, log)
202202
internalClusterCertHash := enterprisepem.ReadHashFromSecret(ctx, r.SecretClient, rs.Namespace, rsCertsConfig.InternalClusterSecretName, databaseSecretPath, log)
203+
agentCertSecretSelector := rs.GetSecurity().AgentClientCertificateSecretName(rs.Name)
204+
agentCertHash := enterprisepem.ReadHashFromSecret(ctx, r.SecretClient, rs.Namespace, agentCertSecretSelector.Name, databaseSecretPath, log)
203205

204206
rsConfig := construct.ReplicaSetOptions(
205207
PodEnvVars(newPodVars(conn, projectConfig, rs.Spec.LogLevel)),
206208
CurrentAgentAuthMechanism(currentAgentAuthMode),
207209
CertificateHash(tlsCertHash),
208210
InternalClusterHash(internalClusterCertHash),
211+
AgentCertificateHash(agentCertHash),
209212
PrometheusTLSCertHash(prometheusCertHash),
210213
WithVaultConfig(vaultConfig),
211214
WithLabels(rs.Labels),
@@ -233,7 +236,7 @@ func (r *ReconcileMongoDbReplicaSet) Reconcile(ctx context.Context, request reco
233236
}
234237
}
235238

236-
agentCertSecretSelector := rs.GetSecurity().AgentClientCertificateSecretName(rs.Name)
239+
// TODO: copy maybe?
237240
agentCertSecretSelector.Name += certs.OperatorGeneratedCertSuffix
238241

239242
internalClusterCertPath := ""

‎controllers/operator/mongodbshardedcluster_controller.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1950,6 +1950,7 @@ func (r *ShardedClusterReconcileHelper) publishDeployment(ctx context.Context, c
19501950

19511951
logDiffOfProcessNames(opts.processNames, healthyProcessesToWaitForReadyState, log.With("ctx", "updateOmAuthentication"))
19521952

1953+
// TODO: Check if opts.agentCertSecretSelector is correct here. It is non-pem suffixed secret name.
19531954
workflowStatus, additionalReconciliationRequired := r.commonController.updateOmAuthentication(ctx, conn, healthyProcessesToWaitForReadyState, sc, opts.agentCertSecretSelector, opts.caFilePath, "", isRecovering, log)
19541955
if !workflowStatus.IsOK() {
19551956
if !isRecovering {
@@ -2280,6 +2281,7 @@ func (r *ShardedClusterReconcileHelper) getConfigServerOptions(ctx context.Conte
22802281
PodEnvVars(opts.podEnvVars),
22812282
CurrentAgentAuthMechanism(opts.currentAgentAuthMode),
22822283
CertificateHash(enterprisepem.ReadHashFromSecret(ctx, r.commonController.SecretClient, sc.Namespace, certSecretName, databaseSecretPath, log)),
2284+
AgentCertificateHash(enterprisepem.ReadHashFromSecret(ctx, r.commonController.SecretClient, sc.Namespace, opts.agentCertSecretSelector.Name, databaseSecretPath, log)),
22832285
InternalClusterHash(enterprisepem.ReadHashFromSecret(ctx, r.commonController.SecretClient, sc.Namespace, internalClusterSecretName, databaseSecretPath, log)),
22842286
PrometheusTLSCertHash(opts.prometheusCertHash),
22852287
WithVaultConfig(vaultConfig),
@@ -2311,6 +2313,7 @@ func (r *ShardedClusterReconcileHelper) getMongosOptions(ctx context.Context, sc
23112313
PodEnvVars(opts.podEnvVars),
23122314
CurrentAgentAuthMechanism(opts.currentAgentAuthMode),
23132315
CertificateHash(enterprisepem.ReadHashFromSecret(ctx, r.commonController.SecretClient, sc.Namespace, certSecretName, vaultConfig.DatabaseSecretPath, log)),
2316+
AgentCertificateHash(enterprisepem.ReadHashFromSecret(ctx, r.commonController.SecretClient, sc.Namespace, opts.agentCertSecretSelector.Name, vaultConfig.DatabaseSecretPath, log)),
23142317
InternalClusterHash(enterprisepem.ReadHashFromSecret(ctx, r.commonController.SecretClient, sc.Namespace, internalClusterSecretName, vaultConfig.DatabaseSecretPath, log)),
23152318
PrometheusTLSCertHash(opts.prometheusCertHash),
23162319
WithVaultConfig(vaultConfig),
@@ -2341,6 +2344,7 @@ func (r *ShardedClusterReconcileHelper) getShardOptions(ctx context.Context, sc
23412344
PodEnvVars(opts.podEnvVars),
23422345
CurrentAgentAuthMechanism(opts.currentAgentAuthMode),
23432346
CertificateHash(enterprisepem.ReadHashFromSecret(ctx, r.commonController.SecretClient, sc.Namespace, certSecretName, databaseSecretPath, log)),
2347+
AgentCertificateHash(enterprisepem.ReadHashFromSecret(ctx, r.commonController.SecretClient, sc.Namespace, opts.agentCertSecretSelector.Name, databaseSecretPath, log)),
23442348
InternalClusterHash(enterprisepem.ReadHashFromSecret(ctx, r.commonController.SecretClient, sc.Namespace, internalClusterSecretName, databaseSecretPath, log)),
23452349
PrometheusTLSCertHash(opts.prometheusCertHash),
23462350
WithVaultConfig(vaultConfig),

‎controllers/operator/mongodbstandalone_controller.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -243,8 +243,11 @@ func (r *ReconcileMongoDbStandalone) Reconcile(ctx context.Context, request reco
243243
}
244244
}
245245

246+
agentCertSecretSelector := s.GetSecurity().AgentClientCertificateSecretName(s.Name).Name
247+
246248
standaloneOpts := construct.StandaloneOptions(
247249
CertificateHash(pem.ReadHashFromSecret(ctx, r.SecretClient, s.Namespace, standaloneCertSecretName, databaseSecretPath, log)),
250+
AgentCertificateHash(pem.ReadHashFromSecret(ctx, r.SecretClient, s.Namespace, agentCertSecretSelector, databaseSecretPath, log)),
248251
CurrentAgentAuthMechanism(currentAgentAuthMode),
249252
PodEnvVars(podVars),
250253
WithVaultConfig(vaultConfig),

0 commit comments

Comments
 (0)