search

andreasevers / mongodb-operator-scram-sha-1-mutatingadmissionwebhook

This repository mutates the MongoDB Community Operator's mongodb-config secret to include SCRAM-SHA-1 support for backwards compatibility.
MIT License
1 stars 1 forks source link

Nothing is happening to the secrets #1

Open pinkerltm opened 3 years ago

pinkerltm commented 3 years ago

First of all thanks for this workaround. I build it with Go 1.15 and was able to build the Dockerimage with the resulting Binary. I pushed the image to our own docker registry and deployed it with your script. The logfile of the Container says "starting http server..." so I assume everything is ok.

Its all in the same namespace, but when I create the testsecret it keeps SCRAM-SHA-256 but nothing else...so I am still not able to workaround and get the operator deployed mongo cluster to accept SCRAM-SHA-1.

Do you have any ideas on this issue?

andreasevers commented 3 years ago

Hi @pinkerltm

I've left some log messages commented out in the Go code. I'd suggest enabling them and building another Docker image. The webhook will only act on updates or the creation of secrets, so try changing anything in the mongodb resource, just to trigger the webhook. From that moment on, if it works, you can change the mongodb resource back to its earlier state. Any changes to the secret at that point will be picked up.

There's one edge case you might be interested in. If you drain your nodes for a node upgrade or something, it will redeploy both the MongoDB operator controller, and the webhook. There could be a race condition there. It's crucial that the webhook needs to be deployed before the operator controller. If that doesn't happen, you could still have your secret created without being modified by the webhook.

eddyfussel commented 3 years ago

Hi as @pinkerltm mentioned, thanks for the workaround. :)

I also was able to compile the application, deploy it to the cluster but unfortunately neither the testsecret nor the cluster-config.json of an new mongodb-operator and an corresponding mongodb are changed.

Maybe I miss something? Do I need to reconfigure my kubectl to use the specific webhook? Or should I test with an kubectl inside the cluster? Thanks for tipps!

andreasevers commented 3 years ago

Did you try uncommenting the debug log messages?

Neustradamus commented 2 years ago

@andreasevers, @pinkerltm, @eddyfussel: SCRAM-SHA-1 and SCRAM-SHA-256 have been added: