Skip to content

Commit c325d88

Browse files
egegunesegegunes
authored
K8SPSMDB-780: Unsafe improvements (#1504)
* K8SPSMDB-780: Unsafe flags These changes attempt to fix the overloaded `allowUnsafeConfigurations` flag. In previous implementation, `allowUnsafeConfigurations` wasn't just allow unsafe configuration but make everything unsafe by disabling TLS, allowing backups in unhealthy clusters, etc... without user's explicit intent. With these changes, we decouple those things from the unsafe flag and remove all implicit behaviors. We introduce a new section called `unsafeFlags`: ``` unsafeFlags: tls: false replsetSize: false mongosSize: false terminationGracePeriod: false backupIfUnhealthy: false ``` Starting from `v1.16.0`, `allowUnsafeConfigurations` is deprecated and won't have any affect. **TLS Mode** This decoupling required a special attention to the TLS configuration. Before these changes only way to disable TLS is setting `allowUnsafeConfigurations` to true. Now, we introduce a new field: ``` spec: tls: mode: disabled ``` This field accepts the following values: `disabled`, `allowTLS`, `preferTLS` and `requireTLS`. If user sets mode to `disabled`, the operator will throw an error: `TLS must be enabled. Set spec.unsafeFlags.tls to true to disable this check.` Since the use of TLS flags and reconciling TLS secrets depends on `tls.mode` field, we need to block users to set `net.tls.mode` in custom MongoDB configuration. If user sets a custom configuration like: ``` spec: replsets: - name: rs0 size: 3 configuration: | net: tls: mode: allowTLS ``` the operator will throw an error: `tlsMode must be set using spec.tls.mode`. * fix tests * fix tests * fix tests * fix tests * fix tests * fix pvc-resize * fix custom-replset-name * address review comments * fix cluster deletion * comment unsafe flags
1 parent 5bc28b1 commit c325d88

File tree

195 files changed

+980
-486
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

195 files changed

+980
-486
lines changed

‎build/pbm-entry.sh

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,12 @@
22

33
PBM_MONGODB_URI="mongodb://${PBM_AGENT_MONGODB_USERNAME}:${PBM_AGENT_MONGODB_PASSWORD}@localhost:${PBM_MONGODB_PORT}/?replicaSet=${PBM_MONGODB_REPLSET}"
44

5-
MONGO_SSL_DIR=/etc/mongodb-ssl
6-
if [[ -f "${MONGO_SSL_DIR}/tls.crt" ]] && [[ -f "${MONGO_SSL_DIR}/tls.key" ]]; then
7-
PBM_MONGODB_URI="${PBM_MONGODB_URI}&tls=true&tlsCertificateKeyFile=%2Ftmp%2Ftls.pem&tlsCAFile=${MONGO_SSL_DIR}%2Fca.crt&tlsInsecure=true"
8-
cat "${MONGO_SSL_DIR}/tls.key" "${MONGO_SSL_DIR}/tls.crt" > /tmp/tls.pem
5+
if [[ -z ${PBM_AGENT_TLS_ENABLED} ]] || [[ ${PBM_AGENT_TLS_ENABLED} == "true" ]]; then
6+
MONGO_SSL_DIR=/etc/mongodb-ssl
7+
if [[ -f "${MONGO_SSL_DIR}/tls.crt" ]] && [[ -f "${MONGO_SSL_DIR}/tls.key" ]]; then
8+
PBM_MONGODB_URI="${PBM_MONGODB_URI}&tls=true&tlsCertificateKeyFile=%2Ftmp%2Ftls.pem&tlsCAFile=${MONGO_SSL_DIR}%2Fca.crt&tlsInsecure=true"
9+
cat "${MONGO_SSL_DIR}/tls.key" "${MONGO_SSL_DIR}/tls.crt" >/tmp/tls.pem
10+
fi
911
fi
1012

1113
export PBM_MONGODB_URI

‎build/ps-entry.sh

Lines changed: 76 additions & 101 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
#!/bin/bash
22
set -Eeuo pipefail
3+
set -o xtrace
34

45
if [ "${1:0:1}" = '-' ]; then
56
set -- mongod "$@"
@@ -68,9 +69,9 @@ _mongod_hack_have_arg() {
6869
local arg
6970
for arg; do
7071
case "$arg" in
71-
"$checkArg" | "$checkArg"=*)
72-
return 0
73-
;;
72+
"$checkArg" | "$checkArg"=*)
73+
return 0
74+
;;
7475
esac
7576
done
7677
return 1
@@ -83,14 +84,14 @@ _mongod_hack_get_arg_val() {
8384
local arg="$1"
8485
shift
8586
case "$arg" in
86-
"$checkArg")
87-
echo "$1"
88-
return 0
89-
;;
90-
"$checkArg"=*)
91-
echo "${arg#"$checkArg"=}"
92-
return 0
93-
;;
87+
"$checkArg")
88+
echo "$1"
89+
return 0
90+
;;
91+
"$checkArg"=*)
92+
echo "${arg#"$checkArg"=}"
93+
return 0
94+
;;
9495
esac
9596
done
9697
return 1
@@ -131,14 +132,14 @@ _mongod_hack_ensure_no_arg_val() {
131132
local arg="$1"
132133
shift
133134
case "$arg" in
134-
"$ensureNoArg")
135-
shift # also skip the value
136-
continue
137-
;;
138-
"$ensureNoArg"=*)
139-
# value is already included
140-
continue
141-
;;
135+
"$ensureNoArg")
136+
shift # also skip the value
137+
continue
138+
;;
139+
"$ensureNoArg"=*)
140+
# value is already included
141+
continue
142+
;;
142143
esac
143144
mongodHackedArgs+=("$arg")
144145
done
@@ -282,10 +283,10 @@ if [ "$originalArgOne" = 'mongod' ]; then
282283
# if we've got any /docker-entrypoint-initdb.d/* files to parse later, we should initdb
283284
for f in /docker-entrypoint-initdb.d/*; do
284285
case "$f" in
285-
*.sh | *.js) # this should match the set of files we check for below
286-
shouldPerformInitdb="$f"
287-
break
288-
;;
286+
*.sh | *.js) # this should match the set of files we check for below
287+
shouldPerformInitdb="$f"
288+
break
289+
;;
289290
esac
290291
done
291292
fi
@@ -321,20 +322,6 @@ if [ "$originalArgOne" = 'mongod' ]; then
321322
_mongod_hack_ensure_no_arg_val --replSet "${mongodHackedArgs[@]}"
322323
fi
323324

324-
# "BadValue: need sslPEMKeyFile when SSL is enabled" vs "BadValue: need to enable SSL via the sslMode flag when using SSL configuration parameters"
325-
tlsMode='disabled'
326-
if _mongod_hack_have_arg '--tlsCertificateKeyFile' "${mongodHackedArgs[@]}"; then
327-
tlsMode='preferTLS'
328-
elif _mongod_hack_have_arg '--sslPEMKeyFile' "${mongodHackedArgs[@]}"; then
329-
tlsMode='preferSSL'
330-
fi
331-
# 4.2 switched all configuration/flag names from "SSL" to "TLS"
332-
if [ "$tlsMode" = 'preferTLS' ] || mongod --help 2>&1 | grep -q -- ' --tlsMode '; then
333-
_mongod_hack_ensure_arg_val --tlsMode "$tlsMode" "${mongodHackedArgs[@]}"
334-
else
335-
_mongod_hack_ensure_arg_val --sslMode "$tlsMode" "${mongodHackedArgs[@]}"
336-
fi
337-
338325
if stat "/proc/$$/fd/1" >/dev/null && [ -w "/proc/$$/fd/1" ]; then
339326
# https://github.com/mongodb/mongo/blob/38c0eb538d0fd390c6cb9ce9ae9894153f6e8ef5/src/mongo/db/initialize_server_global_state.cpp#L237-L251
340327
# https://github.com/docker-library/mongo/issues/164#issuecomment-293965668
@@ -396,17 +383,17 @@ if [ "$originalArgOne" = 'mongod' ]; then
396383
echo
397384
for f in /docker-entrypoint-initdb.d/*; do
398385
case "$f" in
399-
*.sh)
400-
echo "$0: running $f"
401-
# shellcheck source=/dev/null
402-
. "$f"
403-
;;
404-
*.js)
405-
echo "$0: running $f"
406-
"${mongo[@]}" "$MONGO_INITDB_DATABASE" "$f"
407-
echo
408-
;;
409-
*) echo "$0: ignoring $f" ;;
386+
*.sh)
387+
echo "$0: running $f"
388+
# shellcheck source=/dev/null
389+
. "$f"
390+
;;
391+
*.js)
392+
echo "$0: running $f"
393+
"${mongo[@]}" "$MONGO_INITDB_DATABASE" "$f"
394+
echo
395+
;;
396+
*) echo "$0: ignoring $f" ;;
410397
esac
411398
echo
412399
done
@@ -422,76 +409,64 @@ fi
422409

423410
if [[ $originalArgOne == mongo* ]]; then
424411
mongodHackedArgs=("$@")
425-
MONGO_SSL_DIR=${MONGO_SSL_DIR:-/etc/mongodb-ssl}
426-
CA=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
427-
if [ -f /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt ]; then
428-
CA=/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt
429-
fi
430-
if [ -f "${MONGO_SSL_DIR}/ca.crt" ]; then
431-
CA="${MONGO_SSL_DIR}/ca.crt"
432-
fi
433-
LDAP_SSL_DIR=${LDAP_SSL_DIR:-/etc/openldap/certs}
434-
if [ -f "${LDAP_SSL_DIR}/ca.crt" ]; then
435-
echo "TLS_CACERT ${LDAP_SSL_DIR}/ca.crt" >/etc/openldap/ldap.conf
436-
fi
437-
if [ -f "${MONGO_SSL_DIR}/tls.key" ] && [ -f "${MONGO_SSL_DIR}/tls.crt" ]; then
438-
cat "${MONGO_SSL_DIR}/tls.key" "${MONGO_SSL_DIR}/tls.crt" >/tmp/tls.pem
439-
_mongod_hack_ensure_arg_val --sslPEMKeyFile /tmp/tls.pem "${mongodHackedArgs[@]}"
440-
if [ -f "${CA}" ]; then
441-
_mongod_hack_ensure_arg_val --sslCAFile "${CA}" "${mongodHackedArgs[@]}"
442-
fi
412+
413+
tlsMode=""
414+
# if --tlsMode arg is present, get it
415+
if _mongod_hack_have_arg --tlsMode "${mongodHackedArgs[@]}"; then
416+
tlsMode="$(_mongod_hack_get_arg_val --tlsMode "${mongodHackedArgs[@]}")"
443417
fi
444-
MONGO_SSL_INTERNAL_DIR=${MONGO_SSL_INTERNAL_DIR:-/etc/mongodb-ssl-internal}
445-
if [ -f "${MONGO_SSL_INTERNAL_DIR}/tls.key" ] && [ -f "${MONGO_SSL_INTERNAL_DIR}/tls.crt" ]; then
446-
cat "${MONGO_SSL_INTERNAL_DIR}/tls.key" "${MONGO_SSL_INTERNAL_DIR}/tls.crt" >/tmp/tls-internal.pem
447-
_mongod_hack_ensure_arg_val --sslClusterFile /tmp/tls-internal.pem "${mongodHackedArgs[@]}"
448-
if [ -f "${MONGO_SSL_INTERNAL_DIR}/ca.crt" ]; then
449-
_mongod_hack_ensure_arg_val --sslClusterCAFile "${MONGO_SSL_INTERNAL_DIR}/ca.crt" "${mongodHackedArgs[@]}"
450-
fi
418+
419+
if [[ -z ${tlsMode} ]]; then
420+
# if neither --tlsMode arg or net.tls.mode is present, set it to preferTLS
421+
tlsMode="preferTLS"
451422
fi
452423

453-
# don't add --tlsMode if allowUnsafeConfigurations is true
424+
# don't add --tlsMode if TLS is disabled
454425
if clusterAuthMode="$(_mongod_hack_get_arg_val --clusterAuthMode "${mongodHackedArgs[@]}")"; then
455426
if [[ ${clusterAuthMode} != "keyFile" ]]; then
456-
tlsMode="preferSSL"
457-
# if --config arg is present, try to get tlsMode from it
458-
if _parse_config "${mongodHackedArgs[@]}"; then
459-
tlsMode=$(jq -r '.net.tls.mode // "preferSSL"' "${jsonConfigFile}")
460-
fi
461-
_mongod_hack_ensure_arg_val --sslMode "${tlsMode}" "${mongodHackedArgs[@]}"
427+
_mongod_hack_ensure_arg_val --tlsMode "${tlsMode}" "${mongodHackedArgs[@]}"
428+
else
429+
_mongod_hack_ensure_no_arg --sslAllowInvalidCertificates "${mongodHackedArgs[@]}"
462430
fi
463431
fi
464432

465-
if [ "$MONGODB_VERSION" != 'v4.0' ]; then
466-
467-
_mongod_hack_rename_arg_save_val --sslMode --tlsMode "${mongodHackedArgs[@]}"
468-
469-
if _mongod_hack_have_arg '--tlsMode' "${mongodHackedArgs[@]}"; then
470-
tlsMode="none"
471-
if _mongod_hack_have_arg 'allowSSL' "${mongodHackedArgs[@]}"; then
472-
tlsMode='allowTLS'
473-
elif _mongod_hack_have_arg 'preferSSL' "${mongodHackedArgs[@]}"; then
474-
tlsMode='preferTLS'
475-
elif _mongod_hack_have_arg 'requireSSL' "${mongodHackedArgs[@]}"; then
476-
tlsMode='requireTLS'
433+
if [[ ${tlsMode} != "disabled" ]]; then
434+
MONGO_SSL_DIR=${MONGO_SSL_DIR:-/etc/mongodb-ssl}
435+
CA=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
436+
if [ -f /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt ]; then
437+
CA=/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt
438+
fi
439+
if [ -f "${MONGO_SSL_DIR}/ca.crt" ]; then
440+
CA="${MONGO_SSL_DIR}/ca.crt"
441+
fi
442+
if [ -f "${MONGO_SSL_DIR}/tls.key" ] && [ -f "${MONGO_SSL_DIR}/tls.crt" ]; then
443+
cat "${MONGO_SSL_DIR}/tls.key" "${MONGO_SSL_DIR}/tls.crt" >/tmp/tls.pem
444+
_mongod_hack_ensure_arg_val --sslPEMKeyFile /tmp/tls.pem "${mongodHackedArgs[@]}"
445+
if [ -f "${CA}" ]; then
446+
_mongod_hack_ensure_arg_val --sslCAFile "${CA}" "${mongodHackedArgs[@]}"
477447
fi
478-
479-
if [ "$tlsMode" != "none" ]; then
480-
_mongod_hack_ensure_no_arg_val --tlsMode "${mongodHackedArgs[@]}"
481-
_mongod_hack_ensure_arg_val --tlsMode "$tlsMode" "${mongodHackedArgs[@]}"
448+
fi
449+
MONGO_SSL_INTERNAL_DIR=${MONGO_SSL_INTERNAL_DIR:-/etc/mongodb-ssl-internal}
450+
if [ -f "${MONGO_SSL_INTERNAL_DIR}/tls.key" ] && [ -f "${MONGO_SSL_INTERNAL_DIR}/tls.crt" ]; then
451+
cat "${MONGO_SSL_INTERNAL_DIR}/tls.key" "${MONGO_SSL_INTERNAL_DIR}/tls.crt" >/tmp/tls-internal.pem
452+
_mongod_hack_ensure_arg_val --sslClusterFile /tmp/tls-internal.pem "${mongodHackedArgs[@]}"
453+
if [ -f "${MONGO_SSL_INTERNAL_DIR}/ca.crt" ]; then
454+
_mongod_hack_ensure_arg_val --sslClusterCAFile "${MONGO_SSL_INTERNAL_DIR}/ca.crt" "${mongodHackedArgs[@]}"
482455
fi
483456
fi
484457

485-
_mongod_hack_rename_arg_save_val --sslPEMKeyFile --tlsCertificateKeyFile "${mongodHackedArgs[@]}"
486-
if ! _mongod_hack_have_arg '--tlsMode' "${mongodHackedArgs[@]}"; then
487-
if _mongod_hack_have_arg '--tlsCertificateKeyFile' "${mongodHackedArgs[@]}"; then
488-
_mongod_hack_ensure_arg_val --tlsMode "preferTLS" "${mongodHackedArgs[@]}"
489-
fi
458+
LDAP_SSL_DIR=${LDAP_SSL_DIR:-/etc/openldap/certs}
459+
if [ -f "${LDAP_SSL_DIR}/ca.crt" ]; then
460+
echo "TLS_CACERT ${LDAP_SSL_DIR}/ca.crt" >/etc/openldap/ldap.conf
490461
fi
462+
fi
463+
464+
if [ "$MONGODB_VERSION" != 'v4.0' ]; then
491465
_mongod_hack_rename_arg '--sslAllowInvalidCertificates' '--tlsAllowInvalidCertificates' "${mongodHackedArgs[@]}"
492466
_mongod_hack_rename_arg '--sslAllowInvalidHostnames' '--tlsAllowInvalidHostnames' "${mongodHackedArgs[@]}"
493467
_mongod_hack_rename_arg '--sslAllowConnectionsWithoutCertificates' '--tlsAllowConnectionsWithoutCertificates' "${mongodHackedArgs[@]}"
494468
_mongod_hack_rename_arg '--sslFIPSMode' '--tlsFIPSMode' "${mongodHackedArgs[@]}"
469+
_mongod_hack_rename_arg '--sslMode' '--tlsMode' "${mongodHackedArgs[@]}"
495470

496471
_mongod_hack_rename_arg_save_val --sslPEMKeyPassword --tlsCertificateKeyFilePassword "${mongodHackedArgs[@]}"
497472
_mongod_hack_rename_arg_save_val --sslClusterFile --tlsClusterFile "${mongodHackedArgs[@]}"

‎config/crd/bases/psmdb.percona.com_perconaservermongodbs.yaml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17309,9 +17309,24 @@ spec:
1730917309
required:
1731017310
- name
1731117311
type: object
17312+
mode:
17313+
type: string
1731217314
type: object
1731317315
unmanaged:
1731417316
type: boolean
17317+
unsafeFlags:
17318+
properties:
17319+
backupIfUnhealthy:
17320+
type: boolean
17321+
mongosSize:
17322+
type: boolean
17323+
replsetSize:
17324+
type: boolean
17325+
terminationGracePeriod:
17326+
type: boolean
17327+
tls:
17328+
type: boolean
17329+
type: object
1731517330
updateStrategy:
1731617331
type: string
1731717332
upgradeOptions:

‎deploy/bundle.yaml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17982,9 +17982,24 @@ spec:
1798217982
required:
1798317983
- name
1798417984
type: object
17985+
mode:
17986+
type: string
1798517987
type: object
1798617988
unmanaged:
1798717989
type: boolean
17990+
unsafeFlags:
17991+
properties:
17992+
backupIfUnhealthy:
17993+
type: boolean
17994+
mongosSize:
17995+
type: boolean
17996+
replsetSize:
17997+
type: boolean
17998+
terminationGracePeriod:
17999+
type: boolean
18000+
tls:
18001+
type: boolean
18002+
type: object
1798818003
updateStrategy:
1798918004
type: string
1799018005
upgradeOptions:

‎deploy/cr-minimal.yaml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,9 @@ metadata:
55
spec:
66
crVersion: 1.16.0
77
image: perconalab/percona-server-mongodb-operator:main-mongod6.0
8-
allowUnsafeConfigurations: true
8+
unsafeFlags:
9+
replsetSize: true
10+
mongosSize: true
911
upgradeOptions:
1012
apply: disabled
1113
schedule: "0 2 * * *"

‎deploy/cr.yaml

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ spec:
1515
image: perconalab/percona-server-mongodb-operator:main-mongod7.0
1616
imagePullPolicy: Always
1717
# tls:
18+
# mode: preferTLS
1819
# # 90 days in hours
1920
# certValidityDuration: 2160h
2021
# issuerConf:
@@ -25,7 +26,12 @@ spec:
2526
# - name: private-registry-credentials
2627
# initImage: perconalab/percona-server-mongodb-operator:main
2728
# initContainerSecurityContext: {}
28-
allowUnsafeConfigurations: false
29+
# unsafeFlags:
30+
# tls: false
31+
# replsetSize: false
32+
# mongosSize: false
33+
# terminationGracePeriod: false
34+
# backupIfUnhealthy: false
2935
updateStrategy: SmartUpdate
3036
# ignoreAnnotations:
3137
# - service.beta.kubernetes.io/aws-load-balancer-backend-protocol
@@ -71,9 +77,6 @@ spec:
7177
# - host: 34.124.76.92
7278
# # for more configuration fields refer to https://docs.mongodb.com/manual/reference/configuration-options/
7379
# configuration: |
74-
# net:
75-
# tls:
76-
# mode: preferTLS
7780
# operationProfiling:
7881
# mode: slowOp
7982
# systemLog:

‎deploy/crd.yaml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17982,9 +17982,24 @@ spec:
1798217982
required:
1798317983
- name
1798417984
type: object
17985+
mode:
17986+
type: string
1798517987
type: object
1798617988
unmanaged:
1798717989
type: boolean
17990+
unsafeFlags:
17991+
properties:
17992+
backupIfUnhealthy:
17993+
type: boolean
17994+
mongosSize:
17995+
type: boolean
17996+
replsetSize:
17997+
type: boolean
17998+
terminationGracePeriod:
17999+
type: boolean
18000+
tls:
18001+
type: boolean
18002+
type: object
1798818003
updateStrategy:
1798918004
type: string
1799018005
upgradeOptions:

0 commit comments

Comments
 (0)