seguidor777
commented
4 years ago Hi,
I would like to see this feature as well. I am currently handling the certificates within a secret, also I have a volume and a volume mount, finally I have a confgmap for specifying the TLS configuration.
mongo.conf
net:
tls:
mode: "requireTLS"
CAFile: "/certificates/ca.pem"
certificateKeyFile: "/certificates/mongodb-combined.pem"When I try to install the chart, both pods (statefulset pod and arbiter) show the message Deploying MongoDB from scratch... and crash.
Please let me know any advance on this feature or any workaround that you know.
dani8art
kwill4026
franklin432
marcosbc
pixie79
binboum
mnmami
sanguis
guillaumelachaud
gbarrett1988
Which chart: bitnami/mongodb
Is your feature request related to a problem? Please describe. In the day and age we are in, TLS support should not be an afterthought and instead the default. I would like if TLS support could be an option in bitnami/mongodb chart using self signed certs at the minimum.
Describe the solution you'd like The bitnami/mongodb chart uses the bitnami /bitnami-docker-mongodb [https://github.com/bitnami/bitnami-docker-mongodb] as the base MongoDB deployment to run on Kubernetes using Helm package manager and has the ability to incorporate TLS. When using the bitnami /bitnami-docker-mongodb with docker or docker-compose, enabling TLS works fine with no problem. The issue comes when attempting to incorporate it with Kubernetes and the helm chart. The way the bitnami/mongodb chart works is when you set the replicaset count to a certain number, say 3, the chart will spin up 3 pods ( 1 master and 2 secondaries). What I would like to see is each pod contain its own mongodb.pem file with the same signed CA. I've tried to get the chart to do all this automatically upon the user performing a helm install of the chart. In such a way that the CA cert and server cert gets created automatically but it seems I will have to manually create the CA cert and its key, put it in a volume mount and create a secret for it, use those certs to generate the server cert and also create a volume for it and secret for it. Since I will be adding extra parameters to the create the server cert I will request the CSR to be generated and sign it using the ca.crt and ca.key. In the end the mongo cert and mongo key I generated will get concatenated to give me the pem file (mongodb.pem) to access the cluster.
Describe alternatives you've considered What I have done so far is generate my own TLS Certificate Authority. In the values-production.yaml file I have included a section to enable TLS.
I generated the CA key and public CA cert manually and place the output in the section above:
I then created the CSR for the nodes. I created a volume and volume mount called "certificates". From the values-production.yaml file, my manually created root CA cert and key will be created as a secret that will be mounted on /certificates. A CSR request for each node (in the replicaset) will be generated in which I will create a cert from that CSR and sign with the ca.crt and ca.key. The private key and the public certificate will be concatenated to output the mongodb.pem file. If I decided to request 3 replicas to be spun up on installing the chart, I would expect each of the replicas to contain a /certificates directory with a mongodb.pem file. In order to get the mongodb.pem generated in each replica node, I decided to create an init script to do this. So basically upon a helm install of the chart the init script will do its job and generate the final product in the /certificates directory.
The ca.crt and ca.key file created earlier gets called from the values-production file and is added as a secret in the secrets.yaml:
The ca.crt and ca.key upon a helm install gets installed into the /certificates directory from the secret.
Now I want the init script containing our mongodb.pem generation to automatically read the /certificates directory, see the ca.crt/ca.key and perform the install into /certificates. However when doing this the pod spits out an error:
Remember in my init script for the server cert creation I am moving into the /certificates directory to create the openssl.conf file
I am not sure how to get around this error because if I choose any other directory I get /docker-entrypoint-initdb.d/..2020_08_07_13_54_33.116378537/my_init_script.sh: line 9: openssl.cnf: Permission denied
I decided to utilize an initContainer to get around this. Not sure if its the correct way but it worked. Basically I changed the volume named certificates which contains the ca.crt and ca.key secret to a volume named certs-volume. I created another volume named certificates with an emptyDir instead. The plan here is to create an initContainer which simply copies the contents from the cert-volume to the certificates volume. And within the initContainer will be a volumeMount for both certs-volume and certificates. It will look like this:
Now when I do a helm install of the chart, I am able to see the mongodb.pem created in the /certificates directory for each replicaset pod. This is good.
Now using the extraFlags field in the values-production.yaml, I plan on enabling SSL/TLS by specifying the correct settings for the mongod to start up with TLS.
I expect the mongod to be configured now to start up with tls by recognizing the ca.crt file which is the same in each replicaset and also recognize the mongodb.pem which is different in each pod but has the same name. However upon installing the chart the pod crashes and displays the following error:
So I did just that. Rebuilt the bitnami /bitnami-docker-mongodb docker image WITHOUT the --fork. Now my error was more specific as I could see this:
It seems as if when the helm chart gets installed, its not recognizing the mongodb.pem file in /certificates. Even though I see it get created in /certificates, it does not recognize it. My belief is that it does not recognize the user that the mongodb.pem file gets created as. Can someone take a look at this and see what I am missing. If needed I can send you the source files directly of my chart.