Skip to content

Commit b9988a7

Browse files
JuliaMongoJuliaMongo
authored
(DOCSP-23416) Multi-cluster LDAP (#965)
* (DOCSP-23416) Initial commit, seting up the stubs * Fixing the TOC, to be continued * Added steps, fixed the TOC * Removed the LDAP limitation, ready for the initial review with Mircea * Updated the prereqs * Added the multi-cluster steps now * Copy review. Added redirects, added two includes, added a ref to ldap users for multi-clusters to the arch topic * Added info to relnotes about LDAP for multi-clusters
1 parent 39a6991 commit b9988a7

11 files changed

+222
-40
lines changed

‎config/redirects

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,14 @@ symlink: stable -> v1.16
1212
# Base URL
1313
raw: docs/kubernetes-operator/ -> ${base}/stable/
1414

15+
# Add redirects related to the addition of new topics for multi-cluster
16+
# beta security in the Operator v1.16.x, and single cluster LDAP:
17+
18+
[*-v1.15]: docs/kubernetes-operator/${version}/multi-cluster-secure-client-connections -> ${base}/stable/multi-cluster-secure-client-connections
19+
[*-v1.15]: docs/kubernetes-operator/${version}/multi-cluster-secure-ldap-auth -> ${base}/stable/multi-cluster-secure-ldap-auth
20+
[*-v1.15]: docs/kubernetes-operator/${version}/tutorial/secure-client-connections -> ${base}/stable/tutorial/secure-client-connections
21+
[*-v1.15]: docs/kubernetes-operator/${version}/tutorial/secure-ldap-auth -> ${base}/tutorial/secure-ldap-auth
22+
1523
# Add redirects related to the addition of new topics for multi-cluster
1624
# beta in the Operator v1.13.
1725

‎source/includes/facts/ldap-considerations.rst

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
- To configure |ldap| in |k8s-crds|, use the parameters under the
2+
:setting:`spec.security.authentication.ldap` and other
3+
:ref:`security LDAP settings <security-settings>` specific to the
4+
MongoDB Agent, from the |k8s-op-short| MongoDB resource specification.
5+
The procedures in this section describe the required settings and
6+
provide examples of LDAP configuration.
7+
8+
- To improve security, consider :ref:`configuring TLS <secure-tls>`.
9+
Encryption with |tls| is optional. By default, |ldap| traffic is sent
10+
as plain text. This means that username and password are exposed to
11+
network threats. Many modern directory services, such as Microsoft
12+
Active Directory, require encrypted connections. Consider using
13+
|ldap| over |tls-ssl| to encrypt vauthentication requests in your
14+
|k8s-op-short| MongoDB deployments.

‎source/includes/facts/ldap-intro.rst

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
`MongoDB Enterprise <http://www.mongodb.com/products/mongodb-enterprise?jmp=docs>`_
2+
supports:
3+
4+
- Proxying authentication requests to a Lightweight Directory Access
5+
Protocol (LDAP) service.
6+
- Simple and SASL binding to LDAP servers. MongoDB Enterprise can bind
7+
to an LDAP server via ``saslauthd`` or through the operating system
8+
libraries.
9+
10+
To learn more, see the :manual:`LDAP Proxy Authentication </core/security-ldap>`
11+
and :manual:`LDAP Authorization </core/security-ldap-external>` sections
12+
in the MongoDB Server documentation.

‎source/includes/steps-deploy-k8s-multi-cluster-replica-set-ldap.yaml

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
stepnum: 1
2+
ref: create-mc-rs-tls-secret
3+
source:
4+
file: steps-multi-cluster-source.yaml
5+
ref: create-k8s-mc-tls-secret
6+
---
7+
8+
stepnum: 2
9+
ref: create-k8s-mc-rs-tls-configmap
10+
source:
11+
file: steps-multi-cluster-source.yaml
12+
ref: create-k8s-mc-tls-configmap
13+
14+
---
15+
stepnum: 3
16+
ref: update-mongodbmulti-resource-ldap
17+
title: "Update your ``MongoDBMulti`` custom resource to enable |ldap| authentication."
18+
level: 4
19+
content: |
20+
21+
:ref:`Update your MongoDBMulti custom resource <k8s-edit-database-resource>`
22+
with :ref:`security settings <security-settings>` from the |k8s-op-short|
23+
MongoDB resource specification.
24+
25+
To enable |ldap| in your deployment, configure the following
26+
settings in your |k8s| object:
27+
28+
.. include:: /includes/list-tables/ldap-settings.rst
29+
30+
The resulting configuration may look similar to the following
31+
example:
32+
33+
.. code-block:: yaml
34+
35+
security:
36+
authentication:
37+
enabled: true
38+
# Enabled LDAP Authentication Mode
39+
modes:
40+
- "LDAP"
41+
- "SCRAM"
42+
# LDAP related configuration
43+
ldap:
44+
# Specify the hostname:port combination of one or
45+
# more LDAP servers
46+
servers:
47+
- "ldap1.example.com:636"
48+
- "ldap2.example.com:636"
49+
50+
# Set to "tls" to use LDAP over TLS. Leave blank if
51+
# the LDAP server doesn't accept TLS.
52+
transportSecurity: "tls"
53+
54+
# If TLS is enabled, add a reference to a ConfigMap that
55+
# contains a CA certificate that validates the LDAP server's
56+
# TLS certificate.
57+
caConfigMapRef:
58+
name: "<configmap-name>"
59+
key: "<configmap-entry-key>"
60+
61+
# Specify the LDAP Distinguished Name to which
62+
# MongoDB binds when connecting to the LDAP server
63+
bindQueryUser: "cn=admin,dc=example,dc=org"
64+
65+
# Specify the password with which MongoDB binds
66+
# when connecting to an LDAP server. This is a
67+
# reference to a Secret Kubernetes Object containing
68+
# one "password" key.
69+
bindQueryPasswordSecretRef:
70+
name: "<secret-name>"
71+
72+
For a full list of LDAP settings, see :ref:`security settings
73+
<security-settings>` in the |k8s-op-short| MongoDB resource specification.
74+
Also see the :setting:`spec.security.authentication.agents.automationUserName`
75+
setting for the MongoDB Agent user in your LDAP-enabled |k8s-op-short|
76+
deployment.
77+
78+
---
79+
stepnum: 4
80+
level: 4
81+
ref: verify-mc-resources-tls
82+
source:
83+
file: steps-multi-cluster-source.yaml
84+
ref: verify-mdb-resources-mc
85+
86+
...

‎source/includes/steps-multi-cluster-source.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -261,7 +261,7 @@ content: |
261261
262262
kubectl --context $MDB_CENTRAL_CLUSTER_FULL_NAME \
263263
--namespace=<metadata.namespace> \
264-
create secret tls <prefix>-<metadata.name>-cert \
264+
create secret tls <prefix>-<metadata.name>-cert \
265265
--cert=<resource-tls-cert> \
266266
--key=<resource-tls-key>
267267

‎source/multi-cluster-arch.txt

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,6 @@ The following features of the |k8s-op-full| and the underlying |k8s|
2525
clusters are not available in the beta release of the |multi-clusters|:
2626

2727
- Sharded cluster deployments
28-
- LDAP authentication
2928
- |onprem| version earlier than 5.0.7
3029

3130
.. _multi-cluster-capabilities:
@@ -55,10 +54,11 @@ documentation in this guide.
5554
and select the tab :guilabel:`Using the Kubernetes Secret`.
5655

5756
* - Secure database users in |multi-clusters|
58-
- Use these procedures:
57+
- Manage database users using:
5958

60-
- :ref:`Configure database users with SCRAM authentication <k8s-manage-db-users-scram>`
61-
- :ref:`Manage database users in deployments that use TLS and X.509 for internal cluster authentication <k8s-manage-db-users-x509>`
59+
- :ref:`LDAP authentication <k8s-manage-db-users-ldap>`
60+
- :ref:`SCRAM authentication <k8s-manage-db-users-scram>`
61+
- :ref:`TLS and X.509 for internal cluster authentication <k8s-manage-db-users-x509>`
6262

6363
These procedures are the same as for single clusters
6464
deployed with |k8s-op-short|, with the following exceptions:

‎source/multi-cluster-secure.txt

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -17,17 +17,15 @@ Secure Database Resources in Multi-Cluster Deployments
1717
:ref:`multi-cluster-secure-tls`
1818
Secure ``MongoDBMulti`` CustomResources with |tls|.
1919

20-
:ref:`multi-cluster-secure-x509`
21-
Configure x.509 for client authentication in |multi-clusters|.
20+
:ref:`multi-cluster-secure-client-connections`
21+
Configure |ldap| and X.509 for client authentication and X.509 for
22+
internal authentication in your |multi-clusters|.
2223

23-
:ref:`multi-cluster-secure-internal-auth`
24-
Configure |tls| and X.509 for internal authentication in |multi-clusters|.
2524

2625
.. class:: hidden
2726

2827
.. toctree::
2928
:titlesonly:
3029

3130
/tutorial/multi-cluster-secure-tls
32-
/tutorial/multi-cluster-secure-x509
33-
/tutorial/multi-cluster-secure-internal-auth
31+
/tutorial/multi-cluster-secure-client-connections

‎source/release-notes.txt

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,6 @@ Release Notes for |k8s-op-full|
3434
To learn how to upgrade your deployment, see
3535
:ref:`meko-upgrade-mdb-version`.
3636

37-
3837
MongoDB Resource
3938
````````````````
4039

@@ -56,6 +55,16 @@ MongoDBOpsManager Resource
5655
<spec.applicationDatabase>` to configure these
5756
parameters.
5857

58+
MongoDB Multi-Cluster Resource
59+
``````````````````````````````
60+
61+
Added support for :ref:`LDAP client authentication
62+
<multi-cluster-secure-ldap-auth>` and for
63+
:ref:`managing database users with LDAP <multi-cluster-capabilities>`
64+
to |multi-clusters|.
65+
Use the beta release of the |multi-clusters| only in development
66+
environments.
67+
5968
.. _ent_op-1.16.1:
6069

6170
|k8s-op-full| 1.16.1

‎source/tutorial/multi-cluster-secure-client-connections.txt

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
:noprevnext:
2+
3+
.. _multi-cluster-secure-client-connections:
4+
5+
======================================================
6+
Secure Client Connections in Multi-Cluster Deployments
7+
======================================================
8+
9+
.. default-domain:: mongodb
10+
11+
.. contents:: On this page
12+
:local:
13+
:backlinks: none
14+
:depth: 1
15+
:class: singlecol
16+
17+
:ref:`multi-cluster-secure-ldap-auth`
18+
Configure |ldap| for client authentication in |multi-clusters|.
19+
20+
:ref:`multi-cluster-secure-x509`
21+
Configure X.509 for client authentication in |multi-clusters|.
22+
23+
:ref:`multi-cluster-secure-internal-auth`
24+
Configure |tls| and X.509 for internal authentication in
25+
|multi-clusters|.
26+
27+
.. class:: hidden
28+
29+
.. toctree::
30+
:titlesonly:
31+
32+
/tutorial/multi-cluster-secure-ldap-auth
33+
/tutorial/multi-cluster-secure-x509
34+
/tutorial/multi-cluster-secure-internal-auth
35+

‎source/tutorial/multi-cluster-secure-ldap-auth.txt

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
:noprevnext:
2+
3+
.. _multi-cluster-secure-ldap-auth:
4+
5+
===================================================================
6+
Secure Client Authentication with LDAP in Multi-Cluster Deployments
7+
===================================================================
8+
9+
.. include:: /includes/styles/corrections.rst
10+
11+
.. default-domain:: mongodb
12+
13+
.. contents:: On this page
14+
:local:
15+
:backlinks: none
16+
:depth: 2
17+
:class: singlecol
18+
19+
.. include:: /includes/facts/ldap-intro.rst
20+
21+
You can use the |k8s-op-short| to configure LDAP to authenticate your
22+
client applications that connect to your |multi-clusters|. This guide
23+
describes how to configure LDAP authentication from client applications
24+
to your |multi-clusters|.
25+
26+
Considerations
27+
--------------
28+
29+
.. include:: /includes/facts/ldap-considerations.rst
30+
31+
General Prerequisites
32+
---------------------
33+
34+
Before you secure your |multi-cluster| using |tls|
35+
encryption, complete the following tasks:
36+
37+
- Follow the steps in the :ref:`Multi-Cluster Quick Start Prerequisites <multi-cluster-prereqs>`.
38+
- Deploy a multi-cluster using a :ref:`multi-cluster-quick-start-ref`.
39+
40+
Configure LDAP Client Authentication for a Multi-Cluster Replica Set
41+
---------------------------------------------------------------------
42+
43+
.. include:: /includes/steps/deploy-k8s-multi-cluster-replica-set-ldap.rst
44+

0 commit comments

Comments
 (0)