Skip to content

Commit 4883e36

Browse files
Anthony Sansonejwilliams-mongo
Anthony Sansone
authored and
jwilliams-mongo
committed
(DOCSP-8867): Update ConfigMap for TLS, X.509
1 parent 3bc40b4 commit 4883e36

27 files changed

+518
-36
lines changed

‎conf.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@
8585
'.. |bic-short| replace:: :bic:`BI Connector </>`',
8686
'.. |bic| replace:: BI Connector for Atlas',
8787
'.. |bson| replace:: :abbr:`BSON (Binary Javascript Object Notation)`',
88-
'.. |certauth| replace:: Certificate Authority',
88+
'.. |certauth| replace:: :abbr:`CA (Certificate Authority)`',
8989
'.. |cidr| replace:: :abbr:`CIDR (Classless Inter-Domain Routing)`',
9090
'.. |cifs| replace:: :abbr:`CIFS (Common Internet File System)`',
9191
'.. |com| replace:: Cloud Manager or Ops Manager',

‎source/includes/code-examples/yaml-files/configmaps/example-configmap-client-x509-lower.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
sslMMSCAConfigMap: <root-ca-configmap-name>
2+
sslRequireValidMMSServerCertificates: 'true'
3+
4+
authenticationMode: x509
5+
credentials: <my-credentials>
6+
...

‎source/includes/code-examples/yaml-files/configmaps/example-configmap-internal-x509-lower.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
sslMMSCAConfigMap: <root-ca-configmap-name>
2+
sslRequireValidMMSServerCertificates: 'true'
3+
4+
authenticationMode: x509
5+
credentials: <my-credentials>
6+
...

‎source/includes/code-examples/yaml-files/configmaps/example-configmap-tls-full.yaml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: <my-configmap>
6+
namespace: <my-namespace>
7+
data:
8+
projectName: <my-ops-manager-project-name>
9+
orgId: <org-id> # Optional
10+
baseUrl: https://<my-ops-manager-URL>
11+
12+
sslMMSCAConfigMap: <root-ca-configmap-name>
13+
sslRequireValidMMSServerCertificates: 'true'
14+
...

‎source/includes/code-examples/yaml-files/configmaps/example-configmap-tls-lower.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
sslMMSCAConfigMap: <root-ca-configmap-name>
2+
sslRequireValidMMSServerCertificates: ‘true’
3+
...

‎source/includes/code-examples/yaml-files/configmaps/example-configmap-tls-upper.yaml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: <my-configmap>
6+
namespace: <my-namespace>
7+
data:
8+
projectName: <my-ops-manager-project-name>
9+
orgId: <org-id> # Optional
10+
baseUrl: https://<my-ops-manager-URL>
11+

‎source/includes/prereqs-secure-resource-x509.rst

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
Enabling X.509 authentication at the project level configures all
2+
agents to use X.509 client authentication when communicating with
3+
MongoDB deployments.
4+
5+
X.509 client authentication requires one of the following:
6+
7+
- |cloud-short|
8+
- |onprem| 4.1.7 or later
9+
- |onprem| 4.0.11 or later

‎source/includes/steps-deploy-k8s-replica-set-tls-custom.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ replacement:
3939
.. literalinclude:: /includes/code-examples/yaml-files/example-replica-set.yaml
4040
:language: yaml
4141
:linenos:
42-
:lineno-start: 18
42+
:lineno-start: 16
4343
:start-after: START-tls-replset-lower-custom
4444
:end-before: END-tls-replset-lower-custom
4545
:emphasize-lines: 1-4

‎source/includes/steps-deploy-k8s-replica-set-tls.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ replacement:
2626
.. literalinclude:: /includes/code-examples/yaml-files/example-replica-set.yaml
2727
:language: yaml
2828
:linenos:
29-
:lineno-start: 18
29+
:lineno-start: 16
3030
:start-after: START-tls-replset-lower
3131
:end-before: END-tls-replset-lower
3232
:emphasize-lines: 1-3

‎source/includes/steps-deploy-k8s-replica-set-x509-custom.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ replacement:
3838
.. literalinclude:: /includes/code-examples/yaml-files/example-replica-set.yaml
3939
:language: yaml
4040
:linenos:
41-
:lineno-start: 18
41+
:lineno-start: 16
4242
:start-after: START-x509-client-replset-lower-custom
4343
:end-before: END-x509-client-replset-lower-custom
4444
:emphasize-lines: 1-7

‎source/includes/steps-deploy-k8s-replica-set-x509-internal-custom.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ replacement:
4444
.. literalinclude:: /includes/code-examples/yaml-files/example-replica-set.yaml
4545
:language: yaml
4646
:linenos:
47-
:lineno-start: 18
47+
:lineno-start: 16
4848
:start-after: START-x509-internal-replset-lower-custom
4949
:end-before: END-x509-internal-replset-lower-custom
5050
:emphasize-lines: 1-8

‎source/includes/steps-deploy-k8s-replica-set-x509-internal.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ replacement:
2626
.. literalinclude:: /includes/code-examples/yaml-files/example-replica-set.yaml
2727
:language: yaml
2828
:linenos:
29-
:lineno-start: 18
29+
:lineno-start: 16
3030
:start-after: START-x509-internal-replset-lower
3131
:end-before: END-x509-internal-replset-lower
3232
:emphasize-lines: 1-7

‎source/includes/steps-deploy-k8s-replica-set-x509.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ replacement:
2626
.. literalinclude:: /includes/code-examples/yaml-files/example-replica-set.yaml
2727
:language: yaml
2828
:linenos:
29-
:lineno-start: 18
29+
:lineno-start: 16
3030
:start-after: START-x509-client-replset-lower
3131
:end-before: END-x509-client-replset-lower
3232
:emphasize-lines: 1-6

‎source/includes/steps-deploy-k8s-sharded-cluster-tls-custom.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ replacement:
5353
:start-after: START-tls-sharded-lower-custom
5454
:end-before: END-tls-sharded-lower-custom
5555
:linenos:
56-
:lineno-start: 21
56+
:lineno-start: 19
5757
:emphasize-lines: 1-4
5858
5959
---

‎source/includes/steps-deploy-k8s-sharded-cluster-tls.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ replacement:
2828
:start-after: START-tls-sharded-lower
2929
:end-before: END-tls-sharded-lower
3030
:linenos:
31-
:lineno-start: 21
31+
:lineno-start: 19
3232
:emphasize-lines: 1-3
3333
3434
---

‎source/includes/steps-deploy-k8s-sharded-cluster-x509-custom.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ replacement:
4646
:start-after: START-x509-client-sharded-lower-custom
4747
:end-before: END-x509-client-sharded-lower-custom
4848
:linenos:
49-
:lineno-start: 21
49+
:lineno-start: 19
5050
:emphasize-lines: 1-7
5151
5252
---

‎source/includes/steps-deploy-k8s-sharded-cluster-x509-internal-custom.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ replacement:
6464
:start-after: START-x509-internal-sharded-lower-custom
6565
:end-before: END-x509-internal-sharded-lower-custom
6666
:linenos:
67-
:lineno-start: 21
67+
:lineno-start: 19
6868
:emphasize-lines: 1-8
6969
7070
---

‎source/includes/steps-deploy-k8s-sharded-cluster-x509-internal.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ replacement:
2828
:start-after: START-x509-internal-sharded-lower
2929
:end-before: END-x509-internal-sharded-lower
3030
:linenos:
31-
:lineno-start: 21
31+
:lineno-start: 19
3232
:emphasize-lines: 1-7
3333
3434
---

‎source/includes/steps-deploy-k8s-sharded-cluster-x509.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ replacement:
2828
:start-after: START-x509-client-sharded-lower
2929
:end-before: END-x509-client-sharded-lower
3030
:linenos:
31-
:lineno-start: 21
31+
:lineno-start: 19
3232
:emphasize-lines: 1-6
3333
3434
---

‎source/includes/steps-set-configmap-for-client-x509.yaml

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
---
2+
stepnum: 1
3+
level: 4
4+
ref: create-configmap-ca-certs
5+
source:
6+
file: steps-source-configmap-secure.yaml
7+
ref: create-configmap-ca
8+
---
9+
title: "Copy the highlighted section of the following example ``ConfigMap``."
10+
stepnum: 2
11+
level: 4
12+
ref: copy-k8s-configmap-tls
13+
content: |
14+
.. literalinclude:: /includes/code-examples/yaml-files/configmaps/example-configmap-tls-upper.yaml
15+
:language: yaml
16+
:linenos:
17+
:copyable: false
18+
19+
.. literalinclude:: /includes/code-examples/yaml-files/configmaps/example-configmap-client-x509-lower.yaml
20+
:language: yaml
21+
:linenos:
22+
:lineno-start: 11
23+
:emphasize-lines: 1-5
24+
---
25+
stepnum: 3
26+
level: 4
27+
ref: paste-k8s-configmap-tls
28+
source:
29+
file: steps-source-configmap-secure.yaml
30+
ref: paste-k8s-configmap
31+
---
32+
title: "Specify the TLS and X.509 settings"
33+
stepnum: 4
34+
level: 4
35+
ref: configure-project-tls
36+
content: |
37+
Update the following keys with the appropriate values:
38+
39+
.. list-table::
40+
:widths: 20 20 40 20
41+
:header-rows: 1
42+
43+
* - Key
44+
- Type
45+
- Description
46+
- Example
47+
48+
* - ``sslMMSCAConfigMap``
49+
- string
50+
- Name of the |k8s-configmap| created in the first step
51+
containing the root |certauth| certificate used to sign the
52+
|onprem| host's certificate. This mounts the CA certificate
53+
to the |k8s-op-short| and database resources.
54+
- ``my-root-ca``
55+
56+
* - ``sslRequireValidMMSServerCertificates``
57+
- boolean
58+
- Forces the Operator to require a valid |tls| certificate
59+
from |mms|.
60+
61+
.. important::
62+
63+
The value must be enclosed in single quotes or the
64+
operator will throw an error.
65+
66+
- ``'true'``
67+
68+
* - ``data.authenticationMode``
69+
- string
70+
- Requires all agents to use X.509 client authentication when
71+
communicating with MongoDB deployments.
72+
- ``x509``
73+
74+
* - ``data.credentials``
75+
- string
76+
- Name of the |k8s| secret containing the |com| Public and
77+
Private Keys for your desired |svc-api-key|. If you have not
78+
created these credentials yet, see :ref:`create-k8s-secret`.
79+
- ``mycredentials``
80+
---
81+
title: "Save your updated ConfigMap."
82+
stepnum: 5
83+
level: 4
84+
ref: save-k8s-configmap
85+
---
86+
stepnum: 6
87+
level: 4
88+
ref: reapply-k8s-configmap-tls
89+
source:
90+
file: steps-source-configmap-secure.yaml
91+
ref: reapply-k8s-configmap
92+
---
93+
stepnum: 7
94+
level: 4
95+
ref: verify-k8s-configmap-tls
96+
source:
97+
file: steps-source-configmap-secure.yaml
98+
ref: verify-k8s-configmap
99+
...

‎source/includes/steps-set-configmap-for-internal-x509.yaml

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
---
2+
stepnum: 1
3+
level: 4
4+
ref: create-configmap-ca-certs
5+
source:
6+
file: steps-source-configmap-secure.yaml
7+
ref: create-configmap-ca
8+
---
9+
title: "Copy the highlighted section of the following example ``ConfigMap``."
10+
stepnum: 2
11+
level: 4
12+
ref: copy-k8s-configmap-tls
13+
content: |
14+
.. literalinclude:: /includes/code-examples/yaml-files/configmaps/example-configmap-tls-upper.yaml
15+
:language: yaml
16+
:linenos:
17+
:copyable: false
18+
19+
.. literalinclude:: /includes/code-examples/yaml-files/configmaps/example-configmap-internal-x509-lower.yaml
20+
:language: yaml
21+
:linenos:
22+
:lineno-start: 11
23+
:emphasize-lines: 1-5
24+
25+
---
26+
stepnum: 3
27+
level: 4
28+
ref: paste-k8s-configmap-tls
29+
source:
30+
file: steps-source-configmap-secure.yaml
31+
ref: paste-k8s-configmap
32+
---
33+
title: "Specify the TLS and X.509 settings"
34+
stepnum: 4
35+
level: 4
36+
ref: configure-project-tls
37+
content: |
38+
Update the following keys with the appropriate values:
39+
40+
.. list-table::
41+
:widths: 20 20 40 20
42+
:header-rows: 1
43+
44+
* - Key
45+
- Type
46+
- Description
47+
- Example
48+
49+
* - ``sslMMSCAConfigMap``
50+
- string
51+
- Name of the |k8s-configmap| created in the first step
52+
containing the root |certauth| certificate used to sign the
53+
|onprem| host's certificate. This mounts the root |certauth|
54+
certificate to the |k8s-op-short| and database resources.
55+
- ``my-root-ca``
56+
57+
* - ``sslRequireValidMMSServerCertificates``
58+
- boolean
59+
- Forces the Operator to require a valid |tls| certificate
60+
from |mms|.
61+
62+
.. important::
63+
64+
The value must be enclosed in single quotes or the
65+
operator will throw an error.
66+
67+
- ``'true'``
68+
69+
* - ``data.authenticationMode``
70+
- string
71+
- Requires all agents to use X.509 client authentication when
72+
communicating with MongoDB deployments.
73+
- ``x509``
74+
75+
* - ``data.credentials``
76+
- string
77+
- Name of the |k8s| secret containing the |com| Public and Private
78+
Keys for your desired |svc-api-key|. If you have not
79+
created these credentials yet, see :ref:`create-k8s-secret`.
80+
- ``mycredentials``
81+
82+
---
83+
title: "Save your updated ConfigMap."
84+
stepnum: 5
85+
level: 4
86+
ref: save-k8s-configmap
87+
---
88+
stepnum: 6
89+
level: 4
90+
ref: reapply-k8s-configmap-tls
91+
source:
92+
file: steps-source-configmap-secure.yaml
93+
ref: reapply-k8s-configmap
94+
---
95+
stepnum: 7
96+
level: 4
97+
ref: verify-k8s-configmap-tls
98+
source:
99+
file: steps-source-configmap-secure.yaml
100+
ref: verify-k8s-configmap
101+
...

0 commit comments

Comments
 (0)