Skip to content

Commit 008b382

Browse files
anandsyncsanandsyncs
authored
CLOUDP-358717: Update search external mongod snippets (#585)
# Summary TLS & Certificate Automation: Added cert-manager installation, issuer preparation, and certificate generation scripts Resource TLS Enforcement: Updated MongoDBCommunity and MongoDBSearch manifests to require and reference TLS ## Proof of Work Tests pass
1 parent 540a9e6 commit 008b382

16 files changed

+217
-24
lines changed

‎docs/search/04-search-external-mongod/code_snippets/04_0100_install_operator.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,5 @@ helm upgrade --install --debug --kube-context "${K8S_CTX}" \
22
--create-namespace \
33
--namespace="${MDB_NS}" \
44
mongodb-kubernetes \
5-
--set "${OPERATOR_ADDITIONAL_HELM_VALUES:-"dummy=value"}" \
5+
${OPERATOR_ADDITIONAL_HELM_VALUES:+--set ${OPERATOR_ADDITIONAL_HELM_VALUES}} \
66
"${OPERATOR_HELM_CHART}"

‎docs/search/04-search-external-mongod/code_snippets/04_0110_wait_for_operator_deployment.sh‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
echo "Waiting for operator deployment to be ready..."
2+
kubectl --context "${K8S_CTX}" -n "${MDB_NS}" rollout status --timeout=2m deployment/mongodb-kubernetes-operator
3+
4+
echo "Operator deployment in ${MDB_NS} namespace"
5+
kubectl --context "${K8S_CTX}" -n "${MDB_NS}" get deployments
6+
7+
echo; echo "Operator pod in ${MDB_NS} namespace"
8+
kubectl --context "${K8S_CTX}" -n "${MDB_NS}" get pods -l app=mongodb-kubernetes-operator

‎docs/search/04-search-external-mongod/code_snippets/04_0304_install_cert_manager.sh‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
helm upgrade --install \
2+
cert-manager \
3+
oci://quay.io/jetstack/charts/cert-manager \
4+
--kube-context "${K8S_CTX}" \
5+
--namespace "${CERT_MANAGER_NAMESPACE}" \
6+
--create-namespace \
7+
--set crds.enabled=true
8+
9+
for deployment in cert-manager cert-manager-cainjector cert-manager-webhook; do
10+
kubectl --context "${K8S_CTX}" \
11+
-n "${CERT_MANAGER_NAMESPACE}" \
12+
wait --for=condition=Available "deployment/${deployment}" --timeout=300s
13+
done
14+
15+
echo "cert-manager is ready in namespace ${CERT_MANAGER_NAMESPACE}."

‎docs/search/04-search-external-mongod/code_snippets/04_0305_create_mongodb_community_user_secrets.sh‎

Lines changed: 14 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,16 @@
1-
kubectl --context "${K8S_CTX}" --namespace "${MDB_NS}" \
2-
create secret generic mdb-admin-user-password \
3-
--from-literal=password="${MDB_ADMIN_USER_PASSWORD}"
1+
# Create admin user secret
2+
kubectl create secret generic mdb-admin-user-password \
3+
--from-literal=password="${MDB_ADMIN_USER_PASSWORD}" \
4+
--dry-run=client -o yaml | kubectl apply --context "${K8S_CTX}" --namespace "${MDB_NS}" -f -
45

5-
kubectl --context "${K8S_CTX}" --namespace "${MDB_NS}" \
6-
create secret generic mdbc-rs-search-sync-source-password \
7-
--from-literal=password="${MDB_SEARCH_SYNC_USER_PASSWORD}"
6+
# Create search sync source user secret
7+
kubectl create secret generic "${MDB_RESOURCE_NAME}-search-sync-source-password" \
8+
--from-literal=password="${MDB_SEARCH_SYNC_USER_PASSWORD}" \
9+
--dry-run=client -o yaml | kubectl apply --context "${K8S_CTX}" --namespace "${MDB_NS}" -f -
810

9-
kubectl --context "${K8S_CTX}" --namespace "${MDB_NS}" \
10-
create secret generic mdb-user-password \
11-
--from-literal=password="${MDB_USER_PASSWORD}"
11+
# Create regular user secret
12+
kubectl create secret generic mdb-user-password \
13+
--from-literal=password="${MDB_USER_PASSWORD}" \
14+
--dry-run=client -o yaml | kubectl apply --context "${K8S_CTX}" --namespace "${MDB_NS}" -f -
15+
16+
echo "User secrets created."

‎docs/search/04-search-external-mongod/code_snippets/04_0306_prepare_cert_manager_issuer.sh‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# 1. Self-signed bootstrap issuer
2+
kubectl apply --context "${K8S_CTX}" -f - <<EOF
3+
apiVersion: cert-manager.io/v1
4+
kind: ClusterIssuer
5+
metadata:
6+
name: ${MDB_TLS_SELF_SIGNED_ISSUER}
7+
spec:
8+
selfSigned: {}
9+
EOF
10+
kubectl --context "${K8S_CTX}" wait --for=condition=Ready clusterissuer "${MDB_TLS_SELF_SIGNED_ISSUER}" --timeout=120s
11+
12+
# 2. CA certificate
13+
kubectl apply --context "${K8S_CTX}" -n "${CERT_MANAGER_NAMESPACE}" -f - <<EOF
14+
apiVersion: cert-manager.io/v1
15+
kind: Certificate
16+
metadata:
17+
name: ${MDB_TLS_CA_CERT_NAME}
18+
namespace: ${CERT_MANAGER_NAMESPACE}
19+
spec:
20+
isCA: true
21+
commonName: ${MDB_TLS_CA_CERT_NAME}
22+
secretName: ${MDB_TLS_CA_SECRET_NAME}
23+
privateKey:
24+
algorithm: ECDSA
25+
size: 256
26+
issuerRef:
27+
name: ${MDB_TLS_SELF_SIGNED_ISSUER}
28+
kind: ClusterIssuer
29+
EOF
30+
kubectl --context "${K8S_CTX}" wait --for=condition=Ready -n "${CERT_MANAGER_NAMESPACE}" certificate "${MDB_TLS_CA_CERT_NAME}" --timeout=300s
31+
32+
# 3. CA issuer referencing CA secret
33+
kubectl apply --context "${K8S_CTX}" -f - <<EOF
34+
apiVersion: cert-manager.io/v1
35+
kind: ClusterIssuer
36+
metadata:
37+
name: ${MDB_TLS_CA_ISSUER}
38+
spec:
39+
ca:
40+
secretName: ${MDB_TLS_CA_SECRET_NAME}
41+
EOF
42+
kubectl --context "${K8S_CTX}" wait --for=condition=Ready clusterissuer "${MDB_TLS_CA_ISSUER}" --timeout=120s
43+
44+
# 4. Extract CA cert (only ca.crt) and publish to ConfigMap & Secret
45+
TMP_CA_CERT="$(mktemp)"; trap 'rm -f "${TMP_CA_CERT}"' EXIT
46+
ca_b64="$(kubectl --context "${K8S_CTX}" get secret "${MDB_TLS_CA_SECRET_NAME}" -n "${CERT_MANAGER_NAMESPACE}" -o jsonpath="{.data['ca\\.crt']}")"
47+
[[ -n "${ca_b64}" ]] || { echo "CA certificate key ca.crt missing in secret ${MDB_TLS_CA_SECRET_NAME}" >&2; exit 1; }
48+
printf '%s' "${ca_b64}" | base64 --decode > "${TMP_CA_CERT}"
49+
50+
# Create ConfigMap (MongoDBCommunity) and Secret (external search source) containing CA
51+
kubectl --context "${K8S_CTX}" create configmap "${MDB_TLS_CA_CONFIGMAP}" -n "${MDB_NS}" \
52+
--from-file=ca-pem="${TMP_CA_CERT}" --from-file=mms-ca.crt="${TMP_CA_CERT}" --from-file=ca.crt="${TMP_CA_CERT}" \
53+
--dry-run=client -o yaml | kubectl --context "${K8S_CTX}" apply -f -
54+
55+
kubectl --context "${K8S_CTX}" create secret generic "${MDB_TLS_CA_SECRET_NAME}" -n "${MDB_NS}" \
56+
--from-file=ca.crt="${TMP_CA_CERT}" \
57+
--dry-run=client -o yaml | kubectl --context "${K8S_CTX}" apply -f -
58+
59+
echo "CA issuer and artifacts prepared (ConfigMap: ${MDB_TLS_CA_CONFIGMAP}, Secret: ${MDB_TLS_CA_SECRET_NAME})."

‎docs/search/04-search-external-mongod/code_snippets/04_0307_issue_tls_certificates.sh‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
# Issue server and search certificates
2+
server_certificate="${MDB_RESOURCE_NAME}-server-tls"
3+
search_certificate="${MDB_RESOURCE_NAME}-search-tls"
4+
5+
# DNS names for MongoDB server certificate
6+
mongo_dns_names=()
7+
[[ -n "${MDB_EXTERNAL_HOST_0:-}" ]] && mongo_dns_names+=("${MDB_EXTERNAL_HOST_0%%:*}")
8+
[[ -n "${MDB_EXTERNAL_HOST_1:-}" ]] && mongo_dns_names+=("${MDB_EXTERNAL_HOST_1%%:*}")
9+
[[ -n "${MDB_EXTERNAL_HOST_2:-}" ]] && mongo_dns_names+=("${MDB_EXTERNAL_HOST_2%%:*}")
10+
mongo_dns_names+=("${MDB_RESOURCE_NAME}-svc.${MDB_NS}.svc.cluster.local" "*.${MDB_RESOURCE_NAME}-svc.${MDB_NS}.svc.cluster.local")
11+
[[ ${#mongo_dns_names[@]} -gt 0 ]] || { echo "No MongoDB DNS names generated; set MDB_EXTERNAL_HOST_* vars" >&2; exit 1; }
12+
13+
# DNS names for MongoDB Search certificate
14+
search_dns_names=(
15+
"${MDB_SEARCH_SERVICE_NAME}"
16+
"${MDB_SEARCH_SERVICE_NAME}.${MDB_NS}.svc.cluster.local"
17+
"${MDB_SEARCH_SERVICE_NAME}-search-svc.${MDB_NS}.svc.cluster.local"
18+
"*.${MDB_SEARCH_SERVICE_NAME}-search-svc.${MDB_NS}.svc.cluster.local"
19+
)
20+
[[ -n "${MDB_SEARCH_HOSTNAME}" ]] && search_dns_names+=("${MDB_SEARCH_HOSTNAME}")
21+
22+
mongo_dns_block="$(printf ' - "%s"\n' "${mongo_dns_names[@]}")"
23+
search_dns_block="$(printf ' - "%s"\n' "${search_dns_names[@]}")"
24+
25+
kubectl apply --context "${K8S_CTX}" -n "${MDB_NS}" -f - <<EOF
26+
apiVersion: cert-manager.io/v1
27+
kind: Certificate
28+
metadata:
29+
name: ${server_certificate}
30+
namespace: ${MDB_NS}
31+
spec:
32+
secretName: ${MDB_TLS_SERVER_CERT_SECRET_NAME}
33+
issuerRef:
34+
name: ${MDB_TLS_CA_ISSUER}
35+
kind: ClusterIssuer
36+
duration: 240h0m0s
37+
renewBefore: 120h0m0s
38+
usages:
39+
- digital signature
40+
- key encipherment
41+
- server auth
42+
- client auth
43+
dnsNames:
44+
${mongo_dns_block}
45+
---
46+
apiVersion: cert-manager.io/v1
47+
kind: Certificate
48+
metadata:
49+
name: ${search_certificate}
50+
namespace: ${MDB_NS}
51+
spec:
52+
secretName: ${MDB_SEARCH_TLS_SECRET_NAME}
53+
issuerRef:
54+
name: ${MDB_TLS_CA_ISSUER}
55+
kind: ClusterIssuer
56+
duration: 240h0m0s
57+
renewBefore: 120h0m0s
58+
usages:
59+
- digital signature
60+
- key encipherment
61+
- server auth
62+
- client auth
63+
dnsNames:
64+
${search_dns_block}
65+
EOF
66+
67+
kubectl --context "${K8S_CTX}" -n "${MDB_NS}" wait --for=condition=Ready certificate "${server_certificate}" --timeout=300s
68+
kubectl --context "${K8S_CTX}" -n "${MDB_NS}" wait --for=condition=Ready certificate "${search_certificate}" --timeout=300s
69+
70+
echo "Server and Search TLS certificates issued (Secrets: ${MDB_TLS_SERVER_CERT_SECRET_NAME}, ${MDB_SEARCH_TLS_SECRET_NAME})."

‎docs/search/04-search-external-mongod/code_snippets/04_0310_create_mongodb_community_resource.sh‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,18 @@ kubectl apply --context "${K8S_CTX}" -n "${MDB_NS}" -f - <<EOF
22
apiVersion: mongodbcommunity.mongodb.com/v1
33
kind: MongoDBCommunity
44
metadata:
5-
name: mdbc-rs
5+
name: ${MDB_RESOURCE_NAME}
66
spec:
77
version: ${MDB_VERSION}
88
type: ReplicaSet
99
members: 3
1010
security:
11+
tls:
12+
enabled: true
13+
certificateKeySecretRef:
14+
name: ${MDB_TLS_SERVER_CERT_SECRET_NAME}
15+
caConfigMapRef:
16+
name: ${MDB_TLS_CA_CONFIGMAP}
1117
authentication:
1218
ignoreUnknownUsers: true
1319
modes:
@@ -17,7 +23,7 @@ spec:
1723
mongotHost: ${MDB_SEARCH_HOSTNAME}:27028
1824
searchIndexManagementHostAndPort: ${MDB_SEARCH_HOSTNAME}:27028
1925
skipAuthenticationToSearchIndexManagementServer: false
20-
searchTLSMode: disabled
26+
searchTLSMode: requireTLS
2127
useGrpcForSearch: true
2228
agent:
2329
logLevel: DEBUG
@@ -71,8 +77,8 @@ spec:
7177
db: admin
7278
# a reference to the secret that will be used to generate the user's password
7379
passwordSecretRef:
74-
name: mdbc-rs-search-sync-source-password
75-
scramCredentialsSecretName: mdbc-rs-search-sync-source
80+
name: ${MDB_RESOURCE_NAME}-search-sync-source-password
81+
scramCredentialsSecretName: ${MDB_RESOURCE_NAME}-search-sync-source
7682
roles:
7783
- name: searchCoordinator
7884
db: admin

‎docs/search/04-search-external-mongod/code_snippets/04_0315_wait_for_community_resource.sh‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
echo "Waiting for MongoDBCommunity resource to reach Running phase..."
2-
kubectl --context "${K8S_CTX}" -n "${MDB_NS}" wait \
3-
--for=jsonpath='{.status.phase}'=Running mdbc/mdbc-rs --timeout=400s
2+
3+
kubectl --context "${K8S_CTX}" -n "${MDB_NS}" wait --for=jsonpath='{.status.phase}'=Running mdbc/"${MDB_RESOURCE_NAME}" --timeout=400s
4+
45
echo; echo "MongoDBCommunity resource"
5-
kubectl --context "${K8S_CTX}" -n "${MDB_NS}" get mdbc/mdbc-rs
6+
kubectl --context "${K8S_CTX}" -n "${MDB_NS}" get mdbc/"${MDB_RESOURCE_NAME}"
7+
68
echo; echo "Pods running in cluster ${K8S_CTX}"
79
kubectl --context "${K8S_CTX}" -n "${MDB_NS}" get pods

‎docs/search/04-search-external-mongod/code_snippets/04_0320_create_mongodb_search_resource.sh‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,18 +2,25 @@ kubectl apply --context "${K8S_CTX}" -n "${MDB_NS}" -f - <<EOF
22
apiVersion: mongodb.com/v1
33
kind: MongoDBSearch
44
metadata:
5-
name: mdbs
5+
name: ${MDB_SEARCH_RESOURCE_NAME:-mdbs}
66
spec:
77
source:
88
external:
99
hostAndPorts:
1010
- ${MDB_EXTERNAL_HOST_0}
1111
- ${MDB_EXTERNAL_HOST_1}
1212
- ${MDB_EXTERNAL_HOST_2}
13+
tls:
14+
ca:
15+
name: ${MDB_TLS_CA_SECRET_NAME}
1316
username: search-sync-source
1417
passwordSecretRef:
1518
name: ${MDB_RESOURCE_NAME}-search-sync-source-password
1619
key: password
20+
security:
21+
tls:
22+
certificateKeySecretRef:
23+
name: ${MDB_SEARCH_TLS_SECRET_NAME}
1724
resourceRequirements:
1825
limits:
1926
cpu: "3"

‎docs/search/04-search-external-mongod/code_snippets/04_0322_create_search_loadbalancer_service.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ metadata:
66
spec:
77
type: LoadBalancer
88
selector:
9-
app: mdbs-search-svc
9+
app: ${MDB_SEARCH_RESOURCE_NAME:-mdbs}-search-svc
1010
ports:
1111
- name: mongot
1212
port: 27028

0 commit comments

Comments
 (0)