Skip to content

Commit e6a3ed0

Browse files
m1kolam1kola
committed
fixup! fixup! WIP
1 parent 3326e5e commit e6a3ed0

9 files changed

+50
-39
lines changed

‎api/v1/mdb/mongodb_types.go

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -194,7 +194,7 @@ func (m *MongoDB) GetSecretsMountedIntoDBPod() []string {
194194
secrets = append(secrets, tls)
195195
}
196196
}
197-
agentCerts := m.GetSecurity().AgentClientCertificateSecretName(m.Name).Name
197+
agentCerts := m.GetSecurity().AgentClientCertificateSecretName(m.Name)
198198
if agentCerts != "" {
199199
secrets = append(secrets, agentCerts)
200200
}
@@ -851,7 +851,7 @@ func (s *Security) ShouldUseX509(currentAgentAuthMode string) bool {
851851
// AgentClientCertificateSecretName returns the name of the Secret that holds the agent
852852
// client TLS certificates.
853853
// If no custom name has been defined, it returns the default one.
854-
func (s Security) AgentClientCertificateSecretName(resourceName string) corev1.SecretKeySelector {
854+
func (s Security) AgentClientCertificateSecretName(resourceName string) string {
855855
secretName := util.AgentSecretName
856856

857857
if s.CertificatesSecretsPrefix != "" {
@@ -861,10 +861,7 @@ func (s Security) AgentClientCertificateSecretName(resourceName string) corev1.S
861861
secretName = s.Authentication.Agents.ClientCertificateSecretRefWrap.ClientCertificateSecretRef.Name
862862
}
863863

864-
return corev1.SecretKeySelector{
865-
Key: util.AutomationAgentPemSecretKey,
866-
LocalObjectReference: corev1.LocalObjectReference{Name: secretName},
867-
}
864+
return secretName
868865
}
869866

870867
// The customer has set ClientCertificateSecretRef. This signals that client certs are required,

‎api/v1/mdb/mongodb_types_test.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -382,15 +382,15 @@ func TestAgentClientCertificateSecretName(t *testing.T) {
382382
rs := NewReplicaSetBuilder().SetSecurityTLSEnabled().EnableAuth([]AuthMode{util.X509}).Build()
383383

384384
// Default is the hardcoded "agent-certs"
385-
assert.Equal(t, util.AgentSecretName, rs.GetSecurity().AgentClientCertificateSecretName(rs.Name).Name)
385+
assert.Equal(t, util.AgentSecretName, rs.GetSecurity().AgentClientCertificateSecretName(rs.Name))
386386

387387
// If the top-level prefix is there, we use it
388388
rs.Spec.Security.CertificatesSecretsPrefix = "prefix"
389-
assert.Equal(t, fmt.Sprintf("prefix-%s-%s", rs.Name, util.AgentSecretName), rs.GetSecurity().AgentClientCertificateSecretName(rs.Name).Name)
389+
assert.Equal(t, fmt.Sprintf("prefix-%s-%s", rs.Name, util.AgentSecretName), rs.GetSecurity().AgentClientCertificateSecretName(rs.Name))
390390

391391
// If the name is provided (deprecated) we return it
392392
rs.GetSecurity().Authentication.Agents.ClientCertificateSecretRefWrap.ClientCertificateSecretRef.Name = "foo"
393-
assert.Equal(t, "foo", rs.GetSecurity().AgentClientCertificateSecretName(rs.Name).Name)
393+
assert.Equal(t, "foo", rs.GetSecurity().AgentClientCertificateSecretName(rs.Name))
394394
}
395395

396396
func TestInternalClusterAuthSecretName(t *testing.T) {

‎controllers/operator/common_controller.go

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ import (
3030
"github.com/mongodb/mongodb-kubernetes/controllers/operator/authentication"
3131
"github.com/mongodb/mongodb-kubernetes/controllers/operator/certs"
3232
"github.com/mongodb/mongodb-kubernetes/controllers/operator/construct"
33+
enterprisepem "github.com/mongodb/mongodb-kubernetes/controllers/operator/pem"
3334
"github.com/mongodb/mongodb-kubernetes/controllers/operator/secrets"
3435
"github.com/mongodb/mongodb-kubernetes/controllers/operator/watch"
3536
"github.com/mongodb/mongodb-kubernetes/controllers/operator/workflow"
@@ -231,7 +232,7 @@ func (r *ReconcileCommonController) SetupCommonWatchers(watcherResource WatcherR
231232
} else {
232233
secretNames = []string{security.MemberCertificateSecretName(resourceNameForSecret)}
233234
if security.ShouldUseX509("") {
234-
secretNames = append(secretNames, security.AgentClientCertificateSecretName(resourceNameForSecret).Name)
235+
secretNames = append(secretNames, security.AgentClientCertificateSecretName(resourceNameForSecret))
235236
}
236237
}
237238
r.resourceWatcher.RegisterWatchedTLSResources(objectToReconcile, security.TLSConfig.CA, secretNames)
@@ -449,8 +450,7 @@ func (r *ReconcileCommonController) updateOmAuthentication(ctx context.Context,
449450
ClientCertificates: clientCerts,
450451
AutoUser: scramAgentUserName,
451452
AutoLdapGroupDN: ar.GetSecurity().Authentication.Agents.AutomationLdapGroupDN,
452-
// TODO: add AutoPEMKeyFilePath
453-
CAFilePath: caFilepath,
453+
CAFilePath: caFilepath,
454454
}
455455
var databaseSecretPath string
456456
if r.VaultClient != nil {
@@ -563,6 +563,7 @@ func (r *ReconcileCommonController) configureAgentSubjects(ctx context.Context,
563563
return authentication.Options{}, xerrors.Errorf("error reading agent subjects from secret: %w", err)
564564
}
565565
authOpts.UserOptions = userOpts
566+
authOpts.AutoPEMKeyFilePath = util.PvcMmsHomeMountPath + "/" + util.AgentSecretName + "/" + secretKeySelector.Key
566567
return authOpts, nil
567568
}
568569

@@ -596,18 +597,22 @@ func (r *ReconcileCommonController) readAgentSubjectsFromSecret(ctx context.Cont
596597
}
597598

598599
func (r *ReconcileCommonController) clearProjectAuthenticationSettings(ctx context.Context, conn om.Connection, mdb *mdbv1.MongoDB, processNames []string, log *zap.SugaredLogger) error {
599-
secretKeySelector := mdb.Spec.Security.AgentClientCertificateSecretName(mdb.Name)
600-
// TODO: pass the cert hash in secretKeySelector
600+
agentCertSecretName := mdb.Spec.Security.AgentClientCertificateSecretName(mdb.Name)
601601

602602
agentSecret := &corev1.Secret{}
603-
if err := r.client.Get(ctx, kube.ObjectKey(mdb.Namespace, secretKeySelector.Name), agentSecret); client.IgnoreNotFound(err) != nil {
603+
if err := r.client.Get(ctx, kube.ObjectKey(mdb.Namespace, agentCertSecretName), agentSecret); client.IgnoreNotFound(err) != nil {
604604
return nil
605605
}
606606

607607
if agentSecret.Type == corev1.SecretTypeTLS {
608-
secretKeySelector.Name = fmt.Sprintf("%s%s", secretKeySelector.Name, certs.OperatorGeneratedCertSuffix)
608+
agentCertSecretName = fmt.Sprintf("%s%s", agentCertSecretName, certs.OperatorGeneratedCertSuffix)
609609
}
610610

611+
agentCertHash := enterprisepem.ReadHashFromSecret(ctx, r.SecretClient, mdb.Namespace, agentCertSecretName, "", log)
612+
secretKeySelector := corev1.SecretKeySelector{
613+
LocalObjectReference: corev1.LocalObjectReference{Name: agentCertSecretName},
614+
Key: agentCertHash,
615+
}
611616
userOpts, err := r.readAgentSubjectsFromSecret(ctx, mdb.Namespace, secretKeySelector, log)
612617
err = client.IgnoreNotFound(err)
613618
if err != nil {
@@ -634,7 +639,7 @@ func (r *ReconcileCommonController) ensureX509SecretAndCheckTLSType(ctx context.
634639
if !security.IsTLSEnabled() {
635640
return workflow.Failed(xerrors.Errorf("Authentication mode for project is x509 but this MDB resource is not TLS enabled"))
636641
}
637-
agentSecretName := security.AgentClientCertificateSecretName(configurator.GetName()).Name
642+
agentSecretName := security.AgentClientCertificateSecretName(configurator.GetName())
638643
err := certs.VerifyAndEnsureClientCertificatesForAgentsAndTLSType(ctx, configurator.GetSecretReadClient(), configurator.GetSecretWriteClient(), kube.ObjectKey(configurator.GetNamespace(), agentSecretName), log)
639644
if err != nil {
640645
return workflow.Failed(err)

‎controllers/operator/common_controller_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -418,7 +418,7 @@ func TestSecretWatcherWithAllResources(t *testing.T) {
418418
// TODO: unify the watcher setup with the secret creation/mounting code in database creation
419419
memberCert := rs.GetSecurity().MemberCertificateSecretName(rs.Name)
420420
internalAuthCert := rs.GetSecurity().InternalClusterAuthSecretName(rs.Name)
421-
agentCert := rs.GetSecurity().AgentClientCertificateSecretName(rs.Name).Name
421+
agentCert := rs.GetSecurity().AgentClientCertificateSecretName(rs.Name)
422422

423423
expected := map[watch.Object][]types.NamespacedName{
424424
{ResourceType: watch.ConfigMap, Resource: kube.ObjectKey(mock.TestNamespace, mock.TestProjectConfigMapName)}: {kube.ObjectKey(mock.TestNamespace, rs.Name)},

‎controllers/operator/construct/database_construction.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -377,7 +377,7 @@ func buildVaultDatabaseSecretsToInject(mdb databaseStatefulSetSource, opts Datab
377377
secretsToInject := vault.DatabaseSecretsToInject{Config: opts.VaultConfig}
378378

379379
if mdb.GetSecurity().ShouldUseX509(opts.CurrentAgentAuthMode) || mdb.GetSecurity().ShouldUseClientCertificates() {
380-
secretName := mdb.GetSecurity().AgentClientCertificateSecretName(mdb.GetName()).Name
380+
secretName := mdb.GetSecurity().AgentClientCertificateSecretName(mdb.GetName())
381381
secretName = fmt.Sprintf("%s%s", secretName, certs.OperatorGeneratedCertSuffix)
382382
secretsToInject.AgentCerts = secretName
383383
}

‎controllers/operator/mongodbmultireplicaset_controller.go

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -493,11 +493,11 @@ func (r *ReconcileMongoDbMultiReplicaSet) reconcileStatefulSets(ctx context.Cont
493493
return workflow.Failed(err)
494494
}
495495

496-
agentCertSecretSelector := mrs.GetSecurity().AgentClientCertificateSecretName(mrs.Name)
496+
agentCertSecretName := mrs.GetSecurity().AgentClientCertificateSecretName(mrs.Name)
497497

498498
// get cert hash of tls secret if it exists
499499
certHash := enterprisepem.ReadHashFromSecret(ctx, r.SecretClient, mrs.Namespace, mrsConfig.CertSecretName, "", log)
500-
agentCertHash := enterprisepem.ReadHashFromSecret(ctx, r.SecretClient, mrs.Namespace, agentCertSecretSelector.Name, "", log)
500+
agentCertHash := enterprisepem.ReadHashFromSecret(ctx, r.SecretClient, mrs.Namespace, agentCertSecretName, "", log)
501501
internalCertHash := enterprisepem.ReadHashFromSecret(ctx, r.SecretClient, mrs.Namespace, mrsConfig.InternalClusterSecretName, "", log)
502502
log.Debugf("Creating StatefulSet %s with %d replicas in cluster: %s", mrs.MultiStatefulsetName(clusterNum), replicasThisReconciliation, item.ClusterName)
503503

@@ -761,11 +761,13 @@ func (r *ReconcileMongoDbMultiReplicaSet) updateOmDeploymentRs(ctx context.Conte
761761

762762
caFilePath := fmt.Sprintf("%s/ca-pem", util.TLSCaMountPath)
763763

764-
// TODO: make mrs.GetSecurity().AgentClientCertificateSecretName(mrs.GetName()) return only name
765-
agentCertSecretSelector := mrs.GetSecurity().AgentClientCertificateSecretName(mrs.GetName())
764+
agentCertSecretName := mrs.GetSecurity().AgentClientCertificateSecretName(mrs.GetName())
766765
// TODO: Move hash reads somewhere up the call stack
767-
agentCertHash := enterprisepem.ReadHashFromSecret(ctx, r.SecretClient, mrs.Namespace, agentCertSecretSelector.Name, "", log)
768-
agentCertSecretSelector.Key = agentCertHash
766+
agentCertHash := enterprisepem.ReadHashFromSecret(ctx, r.SecretClient, mrs.Namespace, agentCertSecretName, "", log)
767+
agentCertSecretSelector := corev1.SecretKeySelector{
768+
LocalObjectReference: corev1.LocalObjectReference{Name: agentCertSecretName},
769+
Key: agentCertHash,
770+
}
769771
status, additionalReconciliationRequired := r.updateOmAuthentication(ctx, conn, rs.GetProcessNames(), &mrs, agentCertSecretSelector, caFilePath, internalClusterCertPath, isRecovering, log)
770772
if !status.IsOK() && !isRecovering {
771773
return xerrors.Errorf("failed to enable Authentication for MongoDB Multi Replicaset")

‎controllers/operator/mongodbreplicaset_controller.go

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -200,8 +200,8 @@ func (r *ReconcileMongoDbReplicaSet) Reconcile(ctx context.Context, request reco
200200

201201
tlsCertHash := enterprisepem.ReadHashFromSecret(ctx, r.SecretClient, rs.Namespace, rsCertsConfig.CertSecretName, databaseSecretPath, log)
202202
internalClusterCertHash := enterprisepem.ReadHashFromSecret(ctx, r.SecretClient, rs.Namespace, rsCertsConfig.InternalClusterSecretName, databaseSecretPath, log)
203-
agentCertSecretSelector := rs.GetSecurity().AgentClientCertificateSecretName(rs.Name)
204-
agentCertHash := enterprisepem.ReadHashFromSecret(ctx, r.SecretClient, rs.Namespace, agentCertSecretSelector.Name, databaseSecretPath, log)
203+
agentCertSecretName := rs.GetSecurity().AgentClientCertificateSecretName(rs.Name)
204+
agentCertHash := enterprisepem.ReadHashFromSecret(ctx, r.SecretClient, rs.Namespace, agentCertSecretName, databaseSecretPath, log)
205205

206206
rsConfig := construct.ReplicaSetOptions(
207207
PodEnvVars(newPodVars(conn, projectConfig, rs.Spec.LogLevel)),
@@ -236,10 +236,10 @@ func (r *ReconcileMongoDbReplicaSet) Reconcile(ctx context.Context, request reco
236236
}
237237
}
238238

239-
// TODO: copy maybe?
240-
agentCertSecretSelector.Name += certs.OperatorGeneratedCertSuffix
241-
// TODO: make rs.GetSecurity().AgentClientCertificateSecretName(rs.Name) return only name and add hash later.
242-
agentCertSecretSelector.Key = agentCertHash
239+
agentCertSecretSelector := corev1.SecretKeySelector{
240+
LocalObjectReference: corev1.LocalObjectReference{Name: agentCertSecretName + certs.OperatorGeneratedCertSuffix},
241+
Key: agentCertHash,
242+
}
243243

244244
internalClusterCertPath := ""
245245
if internalClusterCertHash != "" {
@@ -462,6 +462,7 @@ func (r *ReconcileMongoDbReplicaSet) updateOmDeploymentRs(ctx context.Context, c
462462
replicaSet := replicaset.BuildFromStatefulSetWithReplicas(r.imageUrls[mcoConstruct.MongodbImageEnv], r.forceEnterprise, set, rs.GetSpec(), updatedMembers, rs.CalculateFeatureCompatibilityVersion(), tlsCertPath)
463463
processNames := replicaSet.GetProcessNames()
464464

465+
// TODO: Move hash reads somewhere up the call stack
465466
status, additionalReconciliationRequired := r.updateOmAuthentication(ctx, conn, processNames, rs, agentCertSecretSelector, caFilePath, internalClusterCertPath, isRecovering, log)
466467
if !status.IsOK() && !isRecovering {
467468
return status

‎controllers/operator/mongodbshardedcluster_controller.go

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1084,9 +1084,12 @@ func (r *ShardedClusterReconcileHelper) doShardedClusterProcessing(ctx context.C
10841084
return workflowStatus
10851085
}
10861086

1087-
agentCertSecretSelector := sc.GetSecurity().AgentClientCertificateSecretName(sc.Name)
1088-
// TODO: Add a key
1089-
// TODO: Make sc.GetSecurity().AgentClientCertificateSecretName(sc.Name) return only name
1087+
agentCertSecretName := sc.GetSecurity().AgentClientCertificateSecretName(sc.Name)
1088+
agentCertHash := enterprisepem.ReadHashFromSecret(ctx, r.commonController.SecretClient, sc.Namespace, agentCertSecretName, "", log)
1089+
agentCertSecretSelector := corev1.SecretKeySelector{
1090+
LocalObjectReference: corev1.LocalObjectReference{Name: agentCertSecretName},
1091+
Key: agentCertHash,
1092+
}
10901093

10911094
opts = deploymentOptions{
10921095
podEnvVars: podEnvVars,

‎controllers/operator/mongodbstandalone_controller.go

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -243,11 +243,11 @@ func (r *ReconcileMongoDbStandalone) Reconcile(ctx context.Context, request reco
243243
}
244244
}
245245

246-
agentCertSecretSelector := s.GetSecurity().AgentClientCertificateSecretName(s.Name).Name
246+
agentCertSecretName := s.GetSecurity().AgentClientCertificateSecretName(s.Name)
247247

248248
standaloneOpts := construct.StandaloneOptions(
249249
CertificateHash(pem.ReadHashFromSecret(ctx, r.SecretClient, s.Namespace, standaloneCertSecretName, databaseSecretPath, log)),
250-
AgentCertificateHash(pem.ReadHashFromSecret(ctx, r.SecretClient, s.Namespace, agentCertSecretSelector, databaseSecretPath, log)),
250+
AgentCertificateHash(pem.ReadHashFromSecret(ctx, r.SecretClient, s.Namespace, agentCertSecretName, databaseSecretPath, log)),
251251
CurrentAgentAuthMechanism(currentAgentAuthMode),
252252
PodEnvVars(podVars),
253253
WithVaultConfig(vaultConfig),
@@ -322,9 +322,12 @@ func (r *ReconcileMongoDbStandalone) updateOmDeployment(ctx context.Context, con
322322
return workflow.Failed(err)
323323
}
324324

325-
agentCertSecretSelector := s.GetSecurity().AgentClientCertificateSecretName(s.Name)
326-
// TODO: Add a key
327-
// TODO: Make sc.GetSecurity().AgentClientCertificateSecretName(sc.Name) return only name
325+
agentCertSecretName := s.GetSecurity().AgentClientCertificateSecretName(s.Name)
326+
agentCertHash := pem.ReadHashFromSecret(ctx, r.SecretClient, s.Namespace, agentCertSecretName, "", log)
327+
agentCertSecretSelector := corev1.SecretKeySelector{
328+
LocalObjectReference: corev1.LocalObjectReference{Name: agentCertSecretName},
329+
Key: agentCertHash,
330+
}
328331

329332
// TODO standalone PR
330333
status, additionalReconciliationRequired := r.updateOmAuthentication(ctx, conn, []string{set.Name}, s, agentCertSecretSelector, "", "", isRecovering, log)

0 commit comments

Comments
 (0)