(DOCSP-32647): Added X509 procedure. #1415

corryroot · 2023-10-24T17:36:23Z

@mircea-cosbuc and @nammn, I added the steps to enable X.509 authentication.

All Submissions:

Have you opened an Issue before filing this PR?
Have you signed our CLA?
Have you checked to ensure there aren't other open Pull Requests for the same update/change?
Put closes #XXXX in your comment to auto-close the issue that your PR fixes (if such).

nammn · 2023-11-03T14:22:11Z

docs/x509-auth.md

+   ```
+
+1. To deploy the MongoDB Community Kubernetes Operator, copy and paste 
+   the following command and replaces the `<namespace>` variable with the 


Suggested change

the following command and replaces the `<namespace>` variable with the

the following command and replace the `<namespace>` variable with the

why do we have this command 2 times here?

nammn · 2023-11-03T14:30:08Z

docs/x509-auth.md

+
+   **Note:**
+
+   - For the `spec.security.tls.certificateKeySecretRef.name` parameter,


You can also instead link to this doc explaining the structure and more:

mongodb-kubernetes-operator/config/crd/bases/mongodbcommunity.mongodb.com_mongodbcommunity.yaml

Lines 414 to 424 in 60da4dc

certificateKeySecretRef:

description: CertificateKeySecret is a reference to a Secret

containing a private key and certificate to use for TLS.

The key and cert are expected to be PEM encoded and available

at "tls.key" and "tls.crt". This is the same format used

for the standard "kubernetes.io/tls" Secret type, but no

specific type is required. Alternatively, an entry tls.pem,

containing the concatenation of cert and key, can be provided.

If all of tls.pem, tls.crt and tls.key are present, the

tls.pem one needs to be equal to the concatenation of tls.crt

and tls.key

its a certificate that the server not generates but uses I think

nammn · 2023-11-03T14:31:10Z

docs/x509-auth.md

+
+   **Example:**
+
+   ```


do we have an example we ccan link to instead? otherwise we will have 2 places to keep them up 2 date

mircea-cosbuc

LGTM with one clarifying comment.

mircea-cosbuc · 2023-11-03T17:27:27Z

docs/x509-auth.md

+Operator with X.509 Authentication enabled for the MongoDB Agent and 
+client. To learn more, see [Install the Operator using Helm](https://github.com/mongodb/mongodb-kubernetes-operator/blob/master/docs/install-upgrade.md#install-the-operator-using-helm).
+
+1. To deploy the MongoDB Community Kubernetes Operator, copy and paste 


Since this command does a bit more than install the operator, I think it's worth mentioning here that this will deploy a sample resource with X509 enabled for both client and agent authentication and that it will also create a sample X509 user and the certificate the user can use to authenticate.

sarahsimpers

LGTM with a few small typo fixes

sarahsimpers · 2023-11-03T18:16:43Z

docs/x509-auth.md

+client.
+
+1. To install the MongoDB Community Kubernetes Operator, see 
+   [Install the Operator using kubectl](https://github.com/mongodb/mongodb-kubernetes-operator/blob/master/docs/install-upgrade.md#install-the-operator-using-kubectl)


Suggested change

[Install the Operator using kubectl](https://github.com/mongodb/mongodb-kubernetes-operator/blob/master/docs/install-upgrade.md#install-the-operator-using-kubectl)

[Install the Operator using kubectl](https://github.com/mongodb/mongodb-kubernetes-operator/blob/master/docs/install-upgrade.md#install-the-operator-using-kubectl).

sarahsimpers · 2023-11-03T18:16:56Z

docs/x509-auth.md

+   [Install the Operator using kubectl](https://github.com/mongodb/mongodb-kubernetes-operator/blob/master/docs/install-upgrade.md#install-the-operator-using-kubectl)
+
+1. To create a CA, ConfigMap, secrets, issuer, and certificate, see 
+   [Enable External Access to a MongoDB Deployment](https://github.com/mongodb/mongodb-kubernetes-operator/blob/master/docs/external_access.md)


Suggested change

[Enable External Access to a MongoDB Deployment](https://github.com/mongodb/mongodb-kubernetes-operator/blob/master/docs/external_access.md)

[Enable External Access to a MongoDB Deployment](https://github.com/mongodb/mongodb-kubernetes-operator/blob/master/docs/external_access.md).

sarahsimpers · 2023-11-03T18:22:59Z

docs/x509-auth.md

+   - For the `spec.security.tls.certificateKeySecretRef.name` parameter,
+     specify a reference to the secret that contains the private key and
+     certificate to use for TLS. The operator expects the PEM encoded key 
+     and certidicate available at "tls.key" and "tls.crt". Use the same 


Fix: typo

Suggested change

and certidicate available at "tls.key" and "tls.crt". Use the same

and certificate available at "tls.key" and "tls.crt". Use the same

sarahsimpers · 2023-11-03T18:25:03Z

docs/x509-auth.md

+   ```
+
+1. Create a YAML file for the client certificate. For an example, see 
+   [cert-x509.yaml](https://github.com/mongodb/mongodb-kubernetes-operator/blob/master/config/samples/external_access/certy_x509.yaml).


Fix: typo

Suggested change

[cert-x509.yaml](https://github.com/mongodb/mongodb-kubernetes-operator/blob/master/config/samples/external_access/certy_x509.yaml).

[cert-x509.yaml](https://github.com/mongodb/mongodb-kubernetes-operator/blob/master/config/samples/external_access/cert_x509.yaml).

mircea-cosbuc

LGTM

corryroot requested review from irajdeep, mircea-cosbuc, lsierant, slaskawi and nammn as code owners October 24, 2023 17:36

corryroot force-pushed the DOCSP-32647 branch from e197e24 to 64bd231 Compare October 24, 2023 17:42

nammn reviewed Nov 3, 2023

View reviewed changes

corryroot requested a review from nammn November 3, 2023 15:15

mircea-cosbuc reviewed Nov 3, 2023

View reviewed changes

corryroot requested a review from mircea-cosbuc November 3, 2023 18:06

sarahsimpers approved these changes Nov 3, 2023

View reviewed changes

mircea-cosbuc approved these changes Nov 7, 2023

View reviewed changes

nammn approved these changes Nov 7, 2023

View reviewed changes

corryroot added 4 commits November 7, 2023 08:47

(DOCSP-32647): Added X509 procedure.

da1d74d

(DOCSP-32647): Incorporated Nam's feedback.

c22e611

(DOCSP-32647): Incorporated Mircea's feedback.

df73394

(DOCSP-32647): Incorporated Sarah's feedback.

3d17117

corryroot force-pushed the DOCSP-32647 branch from 7ad484d to 3d17117 Compare November 7, 2023 13:48

corryroot enabled auto-merge (squash) November 7, 2023 13:49

corryroot merged commit b5aae56 into mongodb:master Nov 7, 2023
9 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

(DOCSP-32647): Added X509 procedure. #1415

(DOCSP-32647): Added X509 procedure. #1415

corryroot commented Oct 24, 2023 •

edited

Loading

nammn Nov 3, 2023

nammn Nov 3, 2023

nammn Nov 3, 2023

nammn Nov 3, 2023

mircea-cosbuc left a comment

mircea-cosbuc Nov 3, 2023

sarahsimpers left a comment

sarahsimpers Nov 3, 2023

sarahsimpers Nov 3, 2023

sarahsimpers Nov 3, 2023

sarahsimpers Nov 3, 2023

mircea-cosbuc left a comment

	the following command and replaces the `<namespace>` variable with the
	the following command and replace the `<namespace>` variable with the


		Note:

		- For the `spec.security.tls.certificateKeySecretRef.name` parameter,

	certificateKeySecretRef:
	description: CertificateKeySecret is a reference to a Secret
	containing a private key and certificate to use for TLS.
	The key and cert are expected to be PEM encoded and available
	at "tls.key" and "tls.crt". This is the same format used
	for the standard "kubernetes.io/tls" Secret type, but no
	specific type is required. Alternatively, an entry tls.pem,
	containing the concatenation of cert and key, can be provided.
	If all of tls.pem, tls.crt and tls.key are present, the
	tls.pem one needs to be equal to the concatenation of tls.crt
	and tls.key

	[Install the Operator using kubectl](https://github.com/mongodb/mongodb-kubernetes-operator/blob/master/docs/install-upgrade.md#install-the-operator-using-kubectl)
	[Install the Operator using kubectl](https://github.com/mongodb/mongodb-kubernetes-operator/blob/master/docs/install-upgrade.md#install-the-operator-using-kubectl).

	[Enable External Access to a MongoDB Deployment](https://github.com/mongodb/mongodb-kubernetes-operator/blob/master/docs/external_access.md)
	[Enable External Access to a MongoDB Deployment](https://github.com/mongodb/mongodb-kubernetes-operator/blob/master/docs/external_access.md).

	and certidicate available at "tls.key" and "tls.crt". Use the same
	and certificate available at "tls.key" and "tls.crt". Use the same

	[cert-x509.yaml](https://github.com/mongodb/mongodb-kubernetes-operator/blob/master/config/samples/external_access/certy_x509.yaml).
	[cert-x509.yaml](https://github.com/mongodb/mongodb-kubernetes-operator/blob/master/config/samples/external_access/cert_x509.yaml).

(DOCSP-32647): Added X509 procedure. #1415

(DOCSP-32647): Added X509 procedure. #1415

Conversation

corryroot commented Oct 24, 2023 • edited Loading

All Submissions:

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mircea-cosbuc left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sarahsimpers left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mircea-cosbuc left a comment

Choose a reason for hiding this comment

corryroot commented Oct 24, 2023 •

edited

Loading