Skip to content
This repository was archived by the owner on Feb 22, 2022. It is now read-only.

[stable/mongodb-replicaset]: Updated environment variables in on-star… #4393

Closed
scottcrespo wants to merge 3 commits into from
Closed

[stable/mongodb-replicaset]: Updated environment variables in on-star… #4393

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9da0a09
[stable/mongodb-replicaset] Updated environment variables in on-start…
Mar 21, 2018
d9d4db8
updated chart version and readme
Mar 21, 2018
165d0e6
Merge branch 'master' into master
Mar 21, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion stable/mongodb-replicaset/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
name: mongodb-replicaset
home: https://github.com/mongodb/mongo
version: 2.3.2
version: 2.3.3
appVersion: 3.6
description: NoSQL document-oriented database that stores JSON-like documents with
dynamic schemas, simplifying the integration of data in content-driven applications.
Expand Down
19 changes: 16 additions & 3 deletions stable/mongodb-replicaset/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,7 @@ The following table lists the configurable parameters of the mongodb chart and t

*MongoDB config file*

The MongoDB config file `mongod.conf` is configured via the `configmap` configuration value. The defaults from
The MongoDB config file `mongod.conf` is configured via the `configmap` configuration value. The defaults from
`values.yaml` are the following:

```yaml
Expand All @@ -90,15 +90,28 @@ $ helm install --name my-release -f values.yaml stable/mongodb-replicaset
Once you have all 3 nodes in running, you can run the "test.sh" script in this directory, which will insert a key into the primary and check the secondaries for output. This script requires that the `$RELEASE_NAME` environment variable be set, in order to access the pods.

## Authentication
By default, this chart creates a MongoDB replica set without authentication.
To enable authentication, you must update **TWO** different sections in `values.yaml` or authentication will not be properly enabled.
These sections are outlined below:

By default, this chart creates a MongoDB replica set without authentication. Authentication can be
enabled using the parameter `auth.enabled`. Once enabled, keyfile access control is set up and an
### 1. auth
Authentication can be enabled using the parameter `auth.enabled`. Once enabled, keyfile access control is set up and an
admin user with root privileges is created. User credentials and keyfile may be specified directly.
Alternatively, existing secrets may be provided. The secret for the admin user must contain the
keys `user` and `password`, that for the key file must contain `key.txt`. The user is created with
full `root` permissions but is restricted to the `admin` database for security purposes. It can be
used to create additional users with more specific permissions.

### 2. security
Towards the bottom of `values.yaml`, you must uncomment and potentially update the `security` section.
- `security.authorization` must be set to `enabled`, and
- `security.keyFile` path must be specified

**Warning**

Without enabling authentication in both the `auth` and `security` sections of `values.yaml`, your database
will not be properly protected, and initialization may fail silently.

## TLS support

To enable full TLS encryption set `tls.enabled` to `true`. It is recommended to create your own CA by executing:
Expand Down
4 changes: 2 additions & 2 deletions stable/mongodb-replicaset/init/files/on-start.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,8 @@ replica_set=$REPLICA_SET
script_name=${0##*/}

if [[ "$AUTH" == "true" ]]; then
admin_user="$ADMIN_USER"
admin_password="$ADMIN_PASSWORD"
admin_user="$MONGO_INITDB_ROOT_USERNAME"
admin_password="$MONGO_INITDB_ROOT_PASSWORD"
Copy link
Member

@unguiculus unguiculus Mar 21, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why did you change these? This doesn't make sense.

Copy link
Author

@scottcrespo scottcrespo Mar 21, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You're right. I dug into things a bit more and it really doesn't make sense.

I grabbed this solution from the thread in #2976 and it "just works." But, it shouldn't be accepted on that basis.

I think the rationale comes from the fact the underlying mongo docker image looks for MONGO_INITDB_ROOT_UESRNAME and MONGO_INITDB_ROOT_PASSWORD to create an initial admin user, and I think this issue might be pertinent to the problem reported in #2976

Perhaps mongodb-replicaset on-start.sh is clashing with underlying docker container's entrypoint script

That's the best I have to offer so far. Do you have an ideas of the root cause of the problem? Specifically, I'm trying to resolve the issue of the user not being properly created (or I can't log in with the user) when supplying a pre-existing secret to values.yaml.

It's bee some time since I first encountered the problem, so I need to go back and verify I can reproduce the issue. Please let me know your thoughts!

Copy link
Member

@unguiculus unguiculus Mar 22, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm currently also looking into this. I'm working on a fix that moves all chart-related options out of the config file and passes them to mongod. This will make configuration much easier and the user won't have to make changes in multiple places.

Copy link
Author

@scottcrespo scottcrespo Mar 22, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Awesome! Then I think I should close this PR. Sound good to you?

I think we both agree this is not the right solution, and it sounds like you're coming up with something much more comprehensive.

admin_auth=(-u "$admin_user" -p "$admin_password")
fi

Expand Down