Skip to content

Commit 1e74f86

Browse files
egegunesegegunes
authored
K8SPSMDB-755: Allow users to disallow invalid certificates (#1523)
* K8SPSMDB-755: Allow users to disallow invalid certificates * add tests * increase physical restore timeouts in tests
1 parent c325d88 commit 1e74f86

File tree

13 files changed

+227
-31
lines changed

13 files changed

+227
-31
lines changed

‎config/crd/bases/psmdb.percona.com_perconaservermongodbs.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17296,6 +17296,8 @@ spec:
1729617296
type: object
1729717297
tls:
1729817298
properties:
17299+
allowInvalidCertificates:
17300+
type: boolean
1729917301
certValidityDuration:
1730017302
type: string
1730117303
issuerConf:

‎deploy/bundle.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17969,6 +17969,8 @@ spec:
1796917969
type: object
1797017970
tls:
1797117971
properties:
17972+
allowInvalidCertificates:
17973+
type: boolean
1797217974
certValidityDuration:
1797317975
type: string
1797417976
issuerConf:

‎deploy/cr.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ spec:
1818
# mode: preferTLS
1919
# # 90 days in hours
2020
# certValidityDuration: 2160h
21+
# allowInvalidCertificates: true
2122
# issuerConf:
2223
# name: special-selfsigned-issuer
2324
# kind: ClusterIssuer

‎deploy/crd.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17969,6 +17969,8 @@ spec:
1796917969
type: object
1797017970
tls:
1797117971
properties:
17972+
allowInvalidCertificates:
17973+
type: boolean
1797217974
certValidityDuration:
1797317975
type: string
1797417976
issuerConf:

‎deploy/cw-bundle.yaml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17969,6 +17969,8 @@ spec:
1796917969
type: object
1797017970
tls:
1797117971
properties:
17972+
allowInvalidCertificates:
17973+
type: boolean
1797217974
certValidityDuration:
1797317975
type: string
1797417976
issuerConf:
@@ -18298,7 +18300,7 @@ spec:
1829818300
serviceAccountName: percona-server-mongodb-operator
1829918301
containers:
1830018302
- name: percona-server-mongodb-operator
18301-
image: perconalab/percona-server-mongodb-operator:main
18303+
image: perconalab/percona-server-mongodb-operator:k8spsmdb-755
1830218304
imagePullPolicy: Always
1830318305
livenessProbe:
1830418306
failureThreshold: 3

‎e2e-tests/demand-backup-physical-sharded/run

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -10,32 +10,32 @@ run_backup() {
1010
local storage=$1
1111
local backup_name=$2
1212

13-
cat $test_dir/conf/backup.yml \
14-
| $sed -e "s/name:/name: ${backup_name}/" \
15-
| $sed -e "s/storageName:/storageName: ${storage}/" \
16-
| kubectl_bin apply -f -
13+
cat $test_dir/conf/backup.yml |
14+
$sed -e "s/name:/name: ${backup_name}/" |
15+
$sed -e "s/storageName:/storageName: ${storage}/" |
16+
kubectl_bin apply -f -
1717
}
1818

1919
run_restore() {
2020
local backup_name=$1
2121

22-
cat $test_dir/conf/restore.yml \
23-
| $sed -e "s/name:/name: restore-${backup_name}/" \
24-
| $sed -e "s/backupName:/backupName: ${backup_name}/" \
25-
| kubectl_bin apply -f -
22+
cat $test_dir/conf/restore.yml |
23+
$sed -e "s/name:/name: restore-${backup_name}/" |
24+
$sed -e "s/backupName:/backupName: ${backup_name}/" |
25+
kubectl_bin apply -f -
2626
}
2727

2828
run_recovery_check() {
2929
local backup_name=$1
3030
local compare_suffix=${2:-"_restore"}
3131

32-
wait_restore "${backup_name}" "${cluster}" "requested" "0" "900"
32+
wait_restore "${backup_name}" "${cluster}" "requested" "0" "1200"
3333
echo
3434

3535
compare_kubectl "statefulset/${cluster}-rs0" ${compare_suffix}
3636

3737
# we don't wait for cluster readiness here because the annotation gets removed then
38-
wait_restore "${backup_name}" "${cluster}" "ready" "0" "1600"
38+
wait_restore "${backup_name}" "${cluster}" "ready" "0" "1800"
3939
kubectl_bin get psmdb ${cluster} -o yaml
4040
if [ $(kubectl_bin get psmdb ${cluster} -o yaml | yq '.metadata.annotations."percona.com/resync-pbm"') == null ]; then
4141
echo "psmdb/${cluster} should be annotated with percona.com/resync-pbm after a physical restore"
@@ -77,8 +77,8 @@ wait_for_running ${cluster}-cfg 3
7777
wait_for_running ${cluster}-mongos 3
7878
wait_cluster_consistency ${cluster}
7979

80-
lbEndpoint=$(kubectl_bin get svc $cluster-mongos -o=jsonpath='{.status}' \
81-
| jq -r 'select(.loadBalancer != null and .loadBalancer.ingress != null and .loadBalancer.ingress != []) | .loadBalancer.ingress[0][]')
80+
lbEndpoint=$(kubectl_bin get svc $cluster-mongos -o=jsonpath='{.status}' |
81+
jq -r 'select(.loadBalancer != null and .loadBalancer.ingress != null and .loadBalancer.ingress != []) | .loadBalancer.ingress[0][]')
8282
if [ -z $lbEndpoint ]; then
8383
echo "mongos service not exported correctly"
8484
exit 1

‎e2e-tests/demand-backup-physical/run

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -10,32 +10,32 @@ run_backup() {
1010
local storage=$1
1111
local backup_name=$2
1212

13-
cat $test_dir/conf/backup.yml \
14-
| $sed -e "s/name:/name: ${backup_name}/" \
15-
| $sed -e "s/storageName:/storageName: ${storage}/" \
16-
| kubectl_bin apply -f -
13+
cat $test_dir/conf/backup.yml |
14+
$sed -e "s/name:/name: ${backup_name}/" |
15+
$sed -e "s/storageName:/storageName: ${storage}/" |
16+
kubectl_bin apply -f -
1717
}
1818

1919
run_restore() {
2020
local backup_name=$1
2121

22-
cat $test_dir/conf/restore.yml \
23-
| $sed -e "s/name:/name: restore-${backup_name}/" \
24-
| $sed -e "s/backupName:/backupName: ${backup_name}/" \
25-
| kubectl_bin apply -f -
22+
cat $test_dir/conf/restore.yml |
23+
$sed -e "s/name:/name: restore-${backup_name}/" |
24+
$sed -e "s/backupName:/backupName: ${backup_name}/" |
25+
kubectl_bin apply -f -
2626
}
2727

2828
run_recovery_check() {
2929
local backup_name=$1
3030
local compare_suffix=${2:-"_restore"}
3131

32-
wait_restore "${backup_name}" "${cluster}" "requested" "0" "900"
32+
wait_restore "${backup_name}" "${cluster}" "requested" "0" "1200"
3333
echo
3434

3535
compare_kubectl "statefulset/${cluster}-rs0" ${compare_suffix}
3636

3737
# we don't wait for cluster readiness here because the annotation gets removed then
38-
wait_restore "${backup_name}" "${cluster}" "ready" "0" "1600"
38+
wait_restore "${backup_name}" "${cluster}" "ready" "0" "1800"
3939
kubectl_bin get psmdb ${cluster} -o yaml
4040
if [ $(kubectl_bin get psmdb ${cluster} -o yaml | yq '.metadata.annotations."percona.com/resync-pbm"') == null ]; then
4141
echo "psmdb/${cluster} should be annotated with percona.com/resync-pbm after a physical restore"

‎e2e-tests/version-service/conf/crd.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17969,6 +17969,8 @@ spec:
1796917969
type: object
1797017970
tls:
1797117971
properties:
17972+
allowInvalidCertificates:
17973+
type: boolean
1797217974
certValidityDuration:
1797317975
type: string
1797417976
issuerConf:

‎pkg/apis/psmdb/v1/psmdb_defaults.go

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -84,16 +84,27 @@ func (cr *PerconaServerMongoDB) CheckNSetDefaults(platform version.Platform, log
8484
cr.Spec.Secrets.SSLInternal = cr.Name + "-ssl-internal"
8585
}
8686

87+
t := true
8788
if cr.Spec.TLS == nil {
8889
cr.Spec.TLS = &TLSSpec{
89-
CertValidityDuration: metav1.Duration{Duration: time.Hour * 24 * 90},
90+
Mode: TLSModePrefer,
91+
AllowInvalidCertificates: &t,
92+
CertValidityDuration: metav1.Duration{Duration: time.Hour * 24 * 90},
9093
}
9194
}
9295

9396
if cr.Spec.TLS.Mode == "" {
9497
cr.Spec.TLS.Mode = TLSModePrefer
9598
}
9699

100+
if cr.Spec.TLS.CertValidityDuration.Duration == 0 {
101+
cr.Spec.TLS.CertValidityDuration = metav1.Duration{Duration: time.Hour * 24 * 90}
102+
}
103+
104+
if cr.Spec.TLS.AllowInvalidCertificates == nil {
105+
cr.Spec.TLS.AllowInvalidCertificates = &t
106+
}
107+
97108
if !cr.TLSEnabled() && !cr.Spec.Unsafe.TLS {
98109
return errors.New("TLS must be enabled. Set spec.unsafeFlags.tls to true to disable this check")
99110
}

‎pkg/apis/psmdb/v1/psmdb_defaults_test.go

Lines changed: 168 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,16 @@ package v1_test
33
import (
44
"testing"
55

6-
api "github.com/percona/percona-server-mongodb-operator/pkg/apis/psmdb/v1"
7-
"github.com/percona/percona-server-mongodb-operator/version"
86
"github.com/stretchr/testify/assert"
97
corevs "k8s.io/api/core/v1"
108
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
119
logf "sigs.k8s.io/controller-runtime/pkg/log"
10+
11+
api "github.com/percona/percona-server-mongodb-operator/pkg/apis/psmdb/v1"
12+
"github.com/percona/percona-server-mongodb-operator/version"
1213
)
1314

14-
func TestSetSafeDefault(t *testing.T) {
15+
func TestSetSafeDefaultPre116(t *testing.T) {
1516
type args struct {
1617
replset *api.ReplsetSpec
1718
expected *api.ReplsetSpec
@@ -248,3 +249,167 @@ func TestSetSafeDefault(t *testing.T) {
248249
})
249250
}
250251
}
252+
253+
func TestSetSafeDefault(t *testing.T) {
254+
type args struct {
255+
replset *api.ReplsetSpec
256+
expectedErr string
257+
}
258+
259+
vs := &api.VolumeSpec{
260+
EmptyDir: &corevs.EmptyDirVolumeSource{
261+
Medium: corevs.StorageMediumDefault,
262+
},
263+
}
264+
tests := map[string]args{
265+
"even number": {
266+
&api.ReplsetSpec{
267+
VolumeSpec: vs,
268+
Size: 4,
269+
},
270+
"check safe defaults: replset size must be odd. Set spec.unsafeFlags.replsetSize to true to disable this check",
271+
},
272+
"even number2": {
273+
&api.ReplsetSpec{
274+
VolumeSpec: vs,
275+
Size: 2,
276+
},
277+
"check safe defaults: replset size must be odd. Set spec.unsafeFlags.replsetSize to true to disable this check",
278+
},
279+
"0 w/o arbiter ": {
280+
&api.ReplsetSpec{
281+
VolumeSpec: vs,
282+
Size: 0,
283+
},
284+
"check safe defaults: replset size must be at least 3. Set spec.unsafeFlags.replsetSize to true to disable this check",
285+
},
286+
"0 with arbiter": {
287+
&api.ReplsetSpec{
288+
VolumeSpec: vs,
289+
Size: 0,
290+
Arbiter: api.Arbiter{
291+
Enabled: true,
292+
Size: 1,
293+
},
294+
},
295+
"check safe defaults: replset size must be at least 4 with arbiter. Set spec.unsafeFlags.replsetSize to true to disable this check",
296+
},
297+
"1 w/o arbiter ": {
298+
&api.ReplsetSpec{
299+
VolumeSpec: vs,
300+
Size: 1,
301+
},
302+
"check safe defaults: replset size must be at least 3. Set spec.unsafeFlags.replsetSize to true to disable this check",
303+
},
304+
"1 with arbiter": {
305+
&api.ReplsetSpec{
306+
VolumeSpec: vs,
307+
Size: 1,
308+
Arbiter: api.Arbiter{
309+
Enabled: true,
310+
Size: 1,
311+
},
312+
},
313+
"check safe defaults: replset size must be at least 4 with arbiter. Set spec.unsafeFlags.replsetSize to true to disable this check",
314+
},
315+
"odd with arbiter": {
316+
&api.ReplsetSpec{
317+
VolumeSpec: vs,
318+
Size: 3,
319+
Arbiter: api.Arbiter{
320+
Enabled: true,
321+
Size: 1,
322+
},
323+
},
324+
"check safe defaults: replset size must be at least 4 with arbiter. Set spec.unsafeFlags.replsetSize to true to disable this check",
325+
},
326+
"odd with two arbiters": {
327+
&api.ReplsetSpec{
328+
VolumeSpec: vs,
329+
Size: 3,
330+
Arbiter: api.Arbiter{
331+
Enabled: true,
332+
Size: 2,
333+
},
334+
},
335+
"check safe defaults: arbiter size must be 1. Set spec.unsafeFlags.replsetSize to true to disable this check",
336+
},
337+
"odd with three arbiters": {
338+
&api.ReplsetSpec{
339+
VolumeSpec: vs,
340+
Size: 3,
341+
Arbiter: api.Arbiter{
342+
Enabled: true,
343+
Size: 3,
344+
},
345+
},
346+
"check safe defaults: arbiter size must be 1. Set spec.unsafeFlags.replsetSize to true to disable this check",
347+
},
348+
"even with arbiter": {
349+
&api.ReplsetSpec{
350+
VolumeSpec: vs,
351+
Size: 2,
352+
Arbiter: api.Arbiter{
353+
Enabled: true,
354+
Size: 1,
355+
},
356+
},
357+
"check safe defaults: replset size must be at least 4 with arbiter. Set spec.unsafeFlags.replsetSize to true to disable this check",
358+
},
359+
"even4 with arbiter": {
360+
&api.ReplsetSpec{
361+
VolumeSpec: vs,
362+
Size: 4,
363+
Arbiter: api.Arbiter{
364+
Enabled: true,
365+
Size: 2,
366+
},
367+
},
368+
"check safe defaults: arbiter size must be 1. Set spec.unsafeFlags.replsetSize to true to disable this check",
369+
},
370+
"even with two arbiters": {
371+
&api.ReplsetSpec{
372+
VolumeSpec: vs,
373+
Size: 2,
374+
Arbiter: api.Arbiter{
375+
Enabled: true,
376+
Size: 2,
377+
},
378+
},
379+
"check safe defaults: arbiter size must be 1. Set spec.unsafeFlags.replsetSize to true to disable this check",
380+
},
381+
"even with three arbiters": {
382+
&api.ReplsetSpec{
383+
VolumeSpec: vs,
384+
Size: 2,
385+
Arbiter: api.Arbiter{
386+
Enabled: true,
387+
Size: 3,
388+
},
389+
},
390+
"check safe defaults: arbiter size must be 1. Set spec.unsafeFlags.replsetSize to true to disable this check",
391+
},
392+
}
393+
394+
cr := &api.PerconaServerMongoDB{
395+
ObjectMeta: metav1.ObjectMeta{Name: "psmdb-mock", Namespace: "psmdb"},
396+
Spec: api.PerconaServerMongoDBSpec{
397+
CRVersion: "1.16.0",
398+
Replsets: []*api.ReplsetSpec{{Name: "rs0", Size: 3}, {Name: "rs1", Size: 3}},
399+
Sharding: api.Sharding{Enabled: true, Mongos: &api.MongosSpec{Size: 3}},
400+
},
401+
}
402+
403+
for name, test := range tests {
404+
t.Run(name, func(t *testing.T) {
405+
for _, platform := range []version.Platform{version.PlatformKubernetes, version.PlatformOpenshift} {
406+
err := test.replset.SetDefaults(platform, cr, logf.Log.WithName("TestSetSafeDefault"))
407+
if err == nil {
408+
t.Fatalf("expected error: %v, got nil", test.expectedErr)
409+
}
410+
411+
assert.EqualError(t, err, test.expectedErr)
412+
}
413+
})
414+
}
415+
}

0 commit comments

Comments
 (0)