Skip to content

Commit dcc31ae

Browse files
t-yrkahorspooknullinelpandzic
authored
K8SPSMDB-813: Fail TLS configuration if provided certificates do not exist (#1254)
* Fail TLS configuration if provided certificates do not exist * Skip TLS config for probe when using unsafe config * Remove healthcheck ssl config from e2e where it was not expected * Revert ssl config removal for 'some-name' rs 'allowUnsafeConfigurations' is set for 'another-name' rs only * compare version fixes --------- Co-authored-by: Viacheslav Sarzhan <[email protected]> Co-authored-by: Andrii Dema <[email protected]> Co-authored-by: Inel Pandzic <[email protected]>
1 parent 3c58298 commit dcc31ae

10 files changed

+128
-88
lines changed

‎e2e-tests/init-deploy/compare/statefulset_another-name-rs0-4-oc.yml

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -76,12 +76,6 @@ spec:
7676
- /opt/percona/mongodb-healthcheck
7777
- k8s
7878
- liveness
79-
- --ssl
80-
- --sslInsecure
81-
- --sslCAFile
82-
- /etc/mongodb-ssl/ca.crt
83-
- --sslPEMKeyFile
84-
- /tmp/tls.pem
8579
- --startupDelaySeconds
8680
- "7200"
8781
failureThreshold: 4

‎e2e-tests/init-deploy/compare/statefulset_another-name-rs0-oc.yml

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -76,12 +76,6 @@ spec:
7676
- /opt/percona/mongodb-healthcheck
7777
- k8s
7878
- liveness
79-
- --ssl
80-
- --sslInsecure
81-
- --sslCAFile
82-
- /etc/mongodb-ssl/ca.crt
83-
- --sslPEMKeyFile
84-
- /tmp/tls.pem
8579
- --startupDelaySeconds
8680
- "7200"
8781
failureThreshold: 4

‎e2e-tests/init-deploy/compare/statefulset_another-name-rs0.yml

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -76,12 +76,6 @@ spec:
7676
- /opt/percona/mongodb-healthcheck
7777
- k8s
7878
- liveness
79-
- --ssl
80-
- --sslInsecure
81-
- --sslCAFile
82-
- /etc/mongodb-ssl/ca.crt
83-
- --sslPEMKeyFile
84-
- /tmp/tls.pem
8579
- --startupDelaySeconds
8680
- "7200"
8781
failureThreshold: 4

‎e2e-tests/one-pod/compare/statefulset_one-pod-rs0-oc.yml

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -86,12 +86,6 @@ spec:
8686
- /opt/percona/mongodb-healthcheck
8787
- k8s
8888
- liveness
89-
- --ssl
90-
- --sslInsecure
91-
- --sslCAFile
92-
- /etc/mongodb-ssl/ca.crt
93-
- --sslPEMKeyFile
94-
- /tmp/tls.pem
9589
- --startupDelaySeconds
9690
- "7200"
9791
failureThreshold: 4

‎e2e-tests/one-pod/compare/statefulset_one-pod-rs0-secret-oc.yml

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -86,12 +86,6 @@ spec:
8686
- /opt/percona/mongodb-healthcheck
8787
- k8s
8888
- liveness
89-
- --ssl
90-
- --sslInsecure
91-
- --sslCAFile
92-
- /etc/mongodb-ssl/ca.crt
93-
- --sslPEMKeyFile
94-
- /tmp/tls.pem
9589
- --startupDelaySeconds
9690
- "7200"
9791
failureThreshold: 4

‎e2e-tests/one-pod/compare/statefulset_one-pod-rs0-secret.yml

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -86,12 +86,6 @@ spec:
8686
- /opt/percona/mongodb-healthcheck
8787
- k8s
8888
- liveness
89-
- --ssl
90-
- --sslInsecure
91-
- --sslCAFile
92-
- /etc/mongodb-ssl/ca.crt
93-
- --sslPEMKeyFile
94-
- /tmp/tls.pem
9589
- --startupDelaySeconds
9690
- "7200"
9791
failureThreshold: 4

‎e2e-tests/one-pod/compare/statefulset_one-pod-rs0.yml

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -86,12 +86,6 @@ spec:
8686
- /opt/percona/mongodb-healthcheck
8787
- k8s
8888
- liveness
89-
- --ssl
90-
- --sslInsecure
91-
- --sslCAFile
92-
- /etc/mongodb-ssl/ca.crt
93-
- --sslPEMKeyFile
94-
- /tmp/tls.pem
9589
- --startupDelaySeconds
9690
- "7200"
9791
failureThreshold: 4

‎healthcheck/tools/db/ssl.go

Lines changed: 28 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -48,56 +48,49 @@ func LastSSLError() error {
4848
}
4949

5050
func (cnf *Config) configureTLS() error {
51-
config := &tls.Config{
52-
InsecureSkipVerify: cnf.SSL.Insecure,
53-
}
54-
55-
if len(cnf.SSL.PEMKeyFile) == 0 || len(cnf.SSL.CAFile) == 0 {
51+
if !cnf.SSL.Enabled {
5652
return nil
5753
}
5854

59-
pemOk, err := isFileExists(cnf.SSL.PEMKeyFile)
60-
if err != nil {
61-
return errors.Wrapf(err, "check if file with name %s exists", cnf.SSL.PEMKeyFile)
62-
}
63-
64-
caOk, err := isFileExists(cnf.SSL.CAFile)
65-
if err != nil {
66-
return errors.Wrapf(err, "check if file with name %s exists", cnf.SSL.CAFile)
55+
config := &tls.Config{
56+
InsecureSkipVerify: cnf.SSL.Insecure,
6757
}
6858

69-
if !pemOk || !caOk {
70-
cnf.SSL = nil
71-
return nil
72-
}
59+
// Configure client cert
60+
if len(cnf.SSL.PEMKeyFile) != 0 {
61+
if err := isFileExists(cnf.SSL.PEMKeyFile); err != nil {
62+
return errors.Wrapf(err, "check if file with name %s exists", cnf.SSL.PEMKeyFile)
63+
}
7364

74-
log.Debugf("Loading SSL/TLS PEM certificate: %s", cnf.SSL.PEMKeyFile)
65+
log.Debugf("Loading SSL/TLS PEM certificate: %s", cnf.SSL.PEMKeyFile)
66+
certificates, err := tls.LoadX509KeyPair(cnf.SSL.PEMKeyFile, cnf.SSL.PEMKeyFile)
67+
if err != nil {
68+
return errors.Wrapf(err, "load key pair from '%s' to connect to server '%s'", cnf.SSL.PEMKeyFile, cnf.Hosts)
69+
}
7570

76-
certificates, err := tls.LoadX509KeyPair(cnf.SSL.PEMKeyFile, cnf.SSL.PEMKeyFile)
77-
if err != nil {
78-
return errors.Wrapf(err, "load key pair from '%s' to connect to server '%s'", cnf.SSL.PEMKeyFile, cnf.Hosts)
71+
config.Certificates = []tls.Certificate{certificates}
7972
}
8073

81-
config.Certificates = []tls.Certificate{certificates}
74+
// Configure CA cert
75+
if len(cnf.SSL.CAFile) != 0 {
76+
if err := isFileExists(cnf.SSL.CAFile); err != nil {
77+
return errors.Wrapf(err, "check if file with name %s exists", cnf.SSL.CAFile)
78+
}
8279

83-
log.Debugf("Loading SSL/TLS Certificate Authority: %s", cnf.SSL.CAFile)
84-
ca, err := cnf.SSL.loadCaCertificate()
85-
if err != nil {
86-
return errors.Wrapf(err, "load client CAs from %s", cnf.SSL.CAFile)
80+
log.Debugf("Loading SSL/TLS Certificate Authority: %s", cnf.SSL.CAFile)
81+
ca, err := cnf.SSL.loadCaCertificate()
82+
if err != nil {
83+
return errors.Wrapf(err, "load client CAs from %s", cnf.SSL.CAFile)
84+
}
85+
86+
config.RootCAs = ca
8787
}
8888

89-
config.RootCAs = ca
9089
cnf.TLSConf = config
91-
9290
return nil
9391
}
9492

95-
func isFileExists(name string) (bool, error) {
93+
func isFileExists(name string) error {
9694
_, err := os.Stat(name)
97-
if os.IsNotExist(err) {
98-
return false, nil
99-
} else if err != nil {
100-
return false, err
101-
}
102-
return true, nil
95+
return err
10396
}

‎healthcheck/tools/db/ssl_test.go

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
package db
2+
3+
import (
4+
"fmt"
5+
"testing"
6+
)
7+
8+
const (
9+
notExistingFilePath = "not-existing-file-path"
10+
)
11+
12+
func TestSSLNotEnabled(t *testing.T) {
13+
cfg := &Config{
14+
SSL: &SSLConfig{
15+
Enabled: false,
16+
},
17+
}
18+
19+
if err := cfg.configureTLS(); err != nil {
20+
t.Fatalf("TLS configuration failed: %s", err)
21+
}
22+
23+
if cfg.TLSConf != nil {
24+
t.Error("Expected TLSConf to be nil")
25+
}
26+
}
27+
28+
func TestSSLEnabled(t *testing.T) {
29+
cfg := &Config{
30+
SSL: &SSLConfig{
31+
Enabled: true,
32+
},
33+
}
34+
35+
if err := cfg.configureTLS(); err != nil {
36+
t.Fatalf("TLS configuration failed: %s", err)
37+
}
38+
39+
if cfg.TLSConf == nil {
40+
t.Error("Expected TLSConf to not be nil")
41+
}
42+
}
43+
44+
func TestPEMKeyFileDoesNotExists(t *testing.T) {
45+
cfg := &Config{
46+
SSL: &SSLConfig{
47+
Enabled: true,
48+
PEMKeyFile: notExistingFilePath,
49+
},
50+
}
51+
52+
err := cfg.configureTLS()
53+
if err == nil {
54+
t.Fatal("Expected TLS config to fail, but it returned no error")
55+
}
56+
57+
expectedErrorMessage := fmt.Sprintf(
58+
"check if file with name %s exists: stat %s: no such file or directory",
59+
notExistingFilePath, notExistingFilePath,
60+
)
61+
if err.Error() != expectedErrorMessage {
62+
t.Errorf("error message '%s' does not match expected '%s'", err.Error(), expectedErrorMessage)
63+
}
64+
}
65+
66+
func TestCAFileDoesNotExists(t *testing.T) {
67+
cfg := &Config{
68+
SSL: &SSLConfig{
69+
Enabled: true,
70+
CAFile: notExistingFilePath,
71+
},
72+
}
73+
74+
err := cfg.configureTLS()
75+
if err == nil {
76+
t.Fatal("Expected TLS config to fail, but it returned no error")
77+
}
78+
79+
expectedErrorMessage := fmt.Sprintf(
80+
"check if file with name %s exists: stat %s: no such file or directory",
81+
notExistingFilePath, notExistingFilePath,
82+
)
83+
if err.Error() != expectedErrorMessage {
84+
t.Errorf("error message '%s' does not match expected '%s'", err.Error(), expectedErrorMessage)
85+
}
86+
}

‎pkg/apis/psmdb/v1/psmdb_defaults.go

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -191,7 +191,8 @@ func (cr *PerconaServerMongoDB) CheckNSetDefaults(platform version.Platform, log
191191
},
192192
}
193193

194-
if cr.CompareVersion("1.7.0") >= 0 {
194+
if (cr.CompareVersion("1.7.0") >= 0 && cr.CompareVersion("1.15.0") < 0) ||
195+
cr.CompareVersion("1.15.0") >= 0 && !cr.Spec.UnsafeConf {
195196
cr.Spec.Sharding.Mongos.LivenessProbe.Exec.Command =
196197
append(cr.Spec.Sharding.Mongos.LivenessProbe.Exec.Command,
197198
"--ssl", "--sslInsecure",
@@ -236,7 +237,8 @@ func (cr *PerconaServerMongoDB) CheckNSetDefaults(platform version.Platform, log
236237
},
237238
}
238239

239-
if cr.CompareVersion("1.7.0") >= 0 {
240+
if (cr.CompareVersion("1.7.0") >= 0 && cr.CompareVersion("1.15.0") < 0) ||
241+
cr.CompareVersion("1.15.0") >= 0 && !cr.Spec.UnsafeConf {
240242
cr.Spec.Sharding.Mongos.ReadinessProbe.Exec.Command =
241243
append(cr.Spec.Sharding.Mongos.ReadinessProbe.Exec.Command,
242244
"--ssl", "--sslInsecure",
@@ -362,7 +364,8 @@ func (cr *PerconaServerMongoDB) CheckNSetDefaults(platform version.Platform, log
362364

363365
if cr.CompareVersion("1.6.0") >= 0 {
364366
replset.LivenessProbe.Probe.Exec.Command[0] = "/data/db/mongodb-healthcheck"
365-
if cr.CompareVersion("1.7.0") >= 0 {
367+
if (cr.CompareVersion("1.7.0") >= 0 && cr.CompareVersion("1.15.0") < 0) ||
368+
cr.CompareVersion("1.15.0") >= 0 && !cr.Spec.UnsafeConf {
366369
replset.LivenessProbe.Probe.Exec.Command =
367370
append(replset.LivenessProbe.Probe.Exec.Command,
368371
"--ssl", "--sslInsecure",
@@ -643,14 +646,14 @@ func (nv *NonVotingSpec) SetDefaults(cr *PerconaServerMongoDB, rs *ReplsetSpec)
643646
}
644647
if nv.LivenessProbe.ProbeHandler.Exec == nil {
645648
nv.LivenessProbe.Probe.ProbeHandler.Exec = &corev1.ExecAction{
646-
Command: []string{
647-
"/data/db/mongodb-healthcheck",
648-
"k8s",
649-
"liveness",
650-
"--ssl", "--sslInsecure",
651-
"--sslCAFile", "/etc/mongodb-ssl/ca.crt",
652-
"--sslPEMKeyFile", "/tmp/tls.pem",
653-
},
649+
Command: []string{"/data/db/mongodb-healthcheck", "k8s", "liveness"},
650+
}
651+
652+
if !cr.Spec.UnsafeConf || cr.CompareVersion("1.15.0") < 0 {
653+
nv.LivenessProbe.Probe.ProbeHandler.Exec.Command = append(
654+
nv.LivenessProbe.Probe.ProbeHandler.Exec.Command,
655+
"--ssl", "--sslInsecure", "--sslCAFile", "/etc/mongodb-ssl/ca.crt", "--sslPEMKeyFile", "/tmp/tls.pem",
656+
)
654657
}
655658

656659
if cr.CompareVersion("1.14.0") >= 0 {

0 commit comments

Comments
 (0)