Skip to content

Commit 269365f

Browse files
JuliaMongojwilliams-mongo
JuliaMongo
authored and
jwilliams-mongo
committed
(DOCSP-21078) X509 and SCRAM for multi-cluster (#880)
* (DOCSP-21078) X509 and SCRAM for multi-cluster * Periodic commit, to check that the stuff is still building correctly * Periodic commit, to check that the stuff is still building correctly * Figuring things out, to be continued * Periodic commit * Periodic commit * Periodic commit * Fixing warnings * Getting ready for review * Fixing build errors * Fixing the build * Trying to fix the inheritance error * Fixing steps * Fixing step refs * Edits, getting ready for a review. Build is clean. * Address review feedback * Added noprevnext, ready for a copy review * Address copy review comments from John W, rearchitect how SCRAM is mentioned * Fixing a build warning. Ready for the final tech review. * Some more edits. Ready for the final tech review.
1 parent 645abe5 commit 269365f

21 files changed

+519
-55
lines changed

‎source/includes/facts/fact-can-change-secret-storage-tool.rst‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1-
This |k8s| |k8s-secret|, along with other |k8s-secrets| that |k8s-op-short|
2-
creates, can later be migrated to a different :ref:`secret storage tool <k8s-set-secret-storage-tool>`
3-
to avoid storing secrets in |k8s|.
1+
.. note::
2+
3+
To avoid storing secrets in |k8s|, you can migrate all |k8s-secrets|
4+
to a :ref:`secret storage tool <k8s-set-secret-storage-tool>`.

‎source/includes/prereqs-secure-resource-x509-multi-cluster.rst‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
Enabling X.509 authentication at the project level configures all
2+
agents to use X.509 client authentication when communicating with
3+
MongoDB deployments.
4+
5+
X.509 client authentication requires one of the following:
6+
7+
- |cloud-short|
8+
- |onprem| 5.0.7 or later

‎source/includes/prereqs/custom-ca-prereqs-multi-cluster-rs-tls-only.rst‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,19 @@
1-
- Generate one |tls| certificate for a ``MongoDBMulti`` resource.
2-
3-
For each |k8s| service corresponding to each Pod in each member cluster,
4-
add |san-dns|\s to the certificate.
5-
6-
In your |tls| certificate, the |san-dns| for each |k8s| service must
1+
- To enable internal cluster authentication, create certificates for
2+
member clusters in the |multi-cluster|.
3+
- Generate one |tls| certificate covering the |san-dns|\s of all the member
4+
clusters in the ``MongoDBMulti`` resource.
5+
- For each |k8s| service that the |k8s-op-short| generates corresponding
6+
to each Pod in each member cluster, add |san-dns|\s to the certificate.
7+
In your |tls| certificate, the |san-dns| for each |k8s| service must
78
use the following format:
89

910
.. include:: /includes/prereqs/san-format-multi-cluster.rst
1011

11-
You must possess the |certauth| certificate and the key that you used
12-
to sign your |tls| certificates.
12+
- Generate one TLS certificate for your project's MongoDB Agents.
13+
14+
.. include:: /includes/prereqs/mdbagent-reqs-multi-cluster.rst
15+
16+
- You must possess the |certauth| certificate and the key that you used to
17+
sign your |tls| certificates.
1318

19+
.. include:: /includes/prereqs/pem-format.rst

‎source/includes/prereqs/mdbagent-reqs-multi-cluster.rst‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
- For the MongoDB Agent |tls| certificate:
2+
3+
- The Common Name in the |tls| certificate must not be empty.
4+
- The combined Organization and Organizational Unit in each |tls|
5+
certificate must differ from the Organization and Organizational
6+
Unit in the |tls| certificate for your replica set members.

‎source/includes/prereqs/san-format-multi-cluster.rst‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,5 +3,3 @@
33
<metadata.name>-<member_cluster_index>-<n>-svc.<namespace>.svc.cluster.local
44
55
where ``n`` ranges from ``0`` to ``clusterSpecList[member_cluster_index].members - 1``.
6-
7-

‎source/includes/steps-add-database-user-scram.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,8 +57,8 @@ content: |
5757
5858
* - ``spec.mongodbResourceRef.name``
5959
- string
60-
- Name of the :ref:`MongoDB resource <k8s-deploy-mdb-resources>` to
61-
which this user is associated.
60+
- Name of the :ref:`MongoDB resource <k8s-deploy-mdb-resources>`
61+
this user is associated with.
6262
- ``my-resource``
6363
6464
* - ``spec.roles.db``

‎source/includes/steps-deploy-k8s-multi-cluster-rs-tls-custom-renew.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11

22
---
33
stepnum: 1
4-
ref: renew-k8s-rs-tls-secret
4+
ref: renew-k8s-rs-secret-tls
55
source:
66
file: steps-multi-cluster-source.yaml
77
ref: renew-mc-rs-tls-secret

‎source/includes/steps-deploy-k8s-multi-cluster-rs-tls-custom.yaml‎

Lines changed: 7 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,18 @@
11
---
22
stepnum: 1
33
ref: create-k8s-mc-rs-tls-secret
4-
title: "Create the secret for the TLS certificate of your ``MongoDBMulti`` custom resource."
5-
level: 4
6-
content: |
7-
Run the ``kubectl`` command to create a new secret that stores the
8-
MongoDB multi-cluster resource's certificate:
9-
10-
.. code-block:: sh
11-
12-
kubectl --context $MDB_CENTRAL_CLUSTER_FULL_NAME \
13-
--namespace=<metadata.namespace> \
14-
create secret tls <prefix>-<metadata.name>-cert \
15-
--cert=<resource-tls-cert> \
16-
--key=<resource-tls-key>
4+
source:
5+
file: steps-multi-cluster-source.yaml
6+
ref: create-k8s-mc-tls-secret
177

188
---
199
stepnum: 2
2010
ref: create-k8s-mc-rs-tls-configmap
21-
title: "Create the ConfigMap to link your CA with your ``MongoDBMulti`` custom resource."
22-
level: 4
23-
content: |
24-
Run the ``kubectl`` command to link your |certauth| to your ``MongoDBMulti`` custom resource:
25-
26-
.. code-block:: sh
27-
28-
kubectl --context $MDB_CENTRAL_CLUSTER_FULL_NAME \
29-
--namespace=<metadata.namespace> \
30-
create configmap custom-ca -from-file=ca-pem
31-
11+
source:
12+
file: steps-multi-cluster-source.yaml
13+
ref: create-k8s-mc-tls-configmap
3214
---
15+
3316
stepnum: 3
3417
ref: update-mongodbmulti-resource
3518
title: "Update your ``MongoDBMulti`` custom resource."

‎source/includes/steps-deploy-k8s-multi-cluster-rs-x509-custom-renew.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
---
2+
stepnum: 1
3+
ref: renew-tls-secret
4+
source:
5+
file: steps-multi-cluster-source.yaml
6+
ref: renew-mc-rs-tls-secret
7+
8+
---
9+
stepnum: 2
10+
ref: renew-multi-cluster-secret-x509-agent
11+
source:
12+
file: steps-multi-cluster-source.yaml
13+
ref: renew-mc-secret-x509-agent
14+
15+
...

‎source/includes/steps-deploy-k8s-multi-cluster-rs-x509-custom.yaml‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
---
2+
stepnum: 1
3+
ref: create-mc-rs-tls-secret
4+
source:
5+
file: steps-multi-cluster-source.yaml
6+
ref: create-k8s-mc-tls-secret
7+
---
8+
stepnum: 2
9+
ref: create-multi-cluster-agent-secret-x509
10+
source:
11+
file: steps-multi-cluster-source.yaml
12+
ref: create-mc-agent-secret-x509
13+
---
14+
stepnum: 3
15+
ref: create-k8s-mc-rs-tls-configmap
16+
source:
17+
file: steps-multi-cluster-source.yaml
18+
ref: create-k8s-mc-tls-configmap
19+
20+
---
21+
stepnum: 4
22+
ref: update-mongodbmulti-resource-x509
23+
title: "Update your ``MongoDBMulti`` custom resource to enable X509 authentication."
24+
level: 4
25+
content: |
26+
27+
:ref:`Update your MongoDB multi-cluster resource <k8s-edit-database-resource>`
28+
with :ref:`security settings <security-settings>` from the |k8s-op-short|
29+
MongoDB resource specification. The resulting configuration should look as
30+
follows:
31+
32+
.. code-block:: yaml
33+
34+
apiVersion: mongodb.com/v1
35+
kind: MongoDBMulti
36+
metadata:
37+
name: multi-replica-set
38+
spec:
39+
version: 4.4.0-ent
40+
type: ReplicaSet
41+
persistent: false
42+
duplicateServiceObjects: true
43+
credentials: my-credentials
44+
opsManager:
45+
configMapRef:
46+
name: my-project
47+
security:
48+
tls:
49+
ca: custom-ca
50+
certsSecretPrefix: <prefix>
51+
authentication:
52+
enabled: true
53+
modes: ["X509"]
54+
agents:
55+
mode: "X509"
56+
clusterSpecList:
57+
clusterSpecs:
58+
- clusterName: ${MDB_CLUSTER_1_FULL_NAME}
59+
members: 3
60+
- clusterName: ${MDB_CLUSTER_2_FULL_NAME}
61+
members: 2
62+
- clusterName: ${MDB_CLUSTER_3_FULL_NAME}
63+
members: 3
64+
65+
The |k8s-op-short| copies the ConfigMap with the |certauth| created in
66+
the central cluster to each member cluster, generates a concatenated
67+
|pem| secret, and distributes it to the member clusters.
68+
69+
---
70+
stepnum: 5
71+
level: 4
72+
ref: verify-mc-resources-tls
73+
source:
74+
file: steps-multi-cluster-source.yaml
75+
ref: verify-mdb-resources-mc
76+
77+
...

0 commit comments

Comments
 (0)