Skip to content

Commit d1c99fa

Browse files
Anthony Sansonejwilliams-mongo
Anthony Sansone
authored and
jwilliams-mongo
committed
(DOCSP-6256): Add Custom CA to TLS, X.509
1 parent e1f46d6 commit d1c99fa

30 files changed

+1706
-32
lines changed

‎conf.py

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,7 @@
164164
'.. |nfs| replace:: :abbr:`NFS (Network File System)`',
165165
'.. |ntp| replace:: :abbr:`NTP (Network Time Protocol)`',
166166
'.. |nvme-clusters| replace:: clusters with local NVMe SSDs',
167+
'.. |pem| replace:: :abbr:`PEM (Privacy-Enhanced Mail)`',
167168
'.. |pit| replace:: :abbr:`PIT (Point in Time)`',
168169
'.. |piv| replace:: :abbr:`PIV (Personal Identity Verification)`',
169170
'.. |rdp| replace:: :abbr:`RDP (Remote Desktop Protocol)`',

‎source/includes/admonitions/cannot-secure-standalone.rst

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
.. note:: You can't secure a Standalone Instance of MongoDB in a |k8s| cluster.

‎source/includes/code-examples/yaml-files/example-replica-set.yaml

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -258,6 +258,7 @@ spec:
258258
...
259259
END-scaled-replset
260260

261+
261262
START-horizon-replset
262263
---
263264
apiVersion: mongodb.com/v1
@@ -378,3 +379,164 @@ START-horizon-addcert-replset-lower-nodeports
378379
- "example-website": "web3.example.com:31185"
379380
...
380381
END-horizon-addcert-replset-lower-nodeports
382+
383+
START-tls-replset-full-custom
384+
---
385+
apiVersion: mongodb.com/v1
386+
kind: MongoDB
387+
metadata:
388+
name: <my-replica-set>
389+
spec:
390+
members: 3
391+
version: 4.2.1
392+
opsManager:
393+
configMapRef:
394+
name: <configMap.metadata.name>
395+
# Must match metadata.name in ConfigMap file
396+
credentials: <mycredentials>
397+
type: ReplicaSet
398+
persistent: true
399+
security:
400+
tls:
401+
enabled: true
402+
ca: <custom-ca>
403+
...
404+
END-tls-replset-full-custom
405+
406+
START-tls-replset-upper-custom
407+
---
408+
apiVersion: mongodb.com/v1
409+
kind: MongoDB
410+
metadata:
411+
name: <my-replica-set>
412+
spec:
413+
members: 3
414+
version: 4.2.1
415+
opsManager:
416+
configMapRef:
417+
name: <configMap.metadata.name>
418+
# Must match metadata.name in ConfigMap file
419+
credentials: <mycredentials>
420+
type: ReplicaSet
421+
persistent: true
422+
END-tls-replset-upper-custom
423+
424+
START-tls-replset-lower-custom
425+
security:
426+
tls:
427+
enabled: true
428+
ca: <custom-ca>
429+
...
430+
END-tls-replset-lower-custom
431+
432+
START-x509-client-replset-full-custom
433+
---
434+
apiVersion: mongodb.com/v1
435+
kind: MongoDB
436+
metadata:
437+
name: <my-replica-set>
438+
spec:
439+
members: 3
440+
version: 4.2.1
441+
opsManager:
442+
configMapRef:
443+
name: <configMap.metadata.name>
444+
# Must match metadata.name in ConfigMap file
445+
credentials: <mycredentials>
446+
type: ReplicaSet
447+
persistent: true
448+
security:
449+
tls:
450+
enabled: true
451+
ca: <custom-ca>
452+
authentication:
453+
enabled: true
454+
modes: ["X509"]
455+
...
456+
END-x509-client-replset-full-custom
457+
458+
START-x509-client-replset-upper-custom
459+
---
460+
apiVersion: mongodb.com/v1
461+
kind: MongoDB
462+
metadata:
463+
name: <my-replica-set>
464+
spec:
465+
members: 3
466+
version: 4.2.1
467+
opsManager:
468+
configMapRef:
469+
name: <configMap.metadata.name>
470+
# Must match metadata.name in ConfigMap file
471+
credentials: <mycredentials>
472+
type: ReplicaSet
473+
persistent: true
474+
END-x509-client-replset-upper-custom
475+
476+
START-x509-client-replset-lower-custom
477+
security:
478+
tls:
479+
enabled: true
480+
ca: <custom-ca>
481+
authentication:
482+
enabled: true
483+
modes: ["X509"]
484+
...
485+
END-x509-client-replset-lower-custom
486+
487+
START-x509-internal-replset-full-custom
488+
---
489+
apiVersion: mongodb.com/v1
490+
kind: MongoDB
491+
metadata:
492+
name: <my-replica-set>
493+
spec:
494+
members: 3
495+
version: 4.2.1
496+
opsManager:
497+
configMapRef:
498+
name: <configMap.metadata.name>
499+
# Must match metadata.name in ConfigMap file
500+
credentials: <mycredentials>
501+
type: ReplicaSet
502+
persistent: true
503+
security:
504+
tls:
505+
enabled: true
506+
ca: <custom-ca>
507+
authentication:
508+
enabled: true
509+
modes: ["X509"]
510+
internalCluster: "X509"
511+
...
512+
END-x509-internal-replset-full-custom
513+
514+
START-x509-internal-replset-upper-custom
515+
---
516+
apiVersion: mongodb.com/v1
517+
kind: MongoDB
518+
metadata:
519+
name: <my-replica-set>
520+
spec:
521+
members: 3
522+
version: 4.2.1
523+
opsManager:
524+
configMapRef:
525+
name: <configMap.metadata.name>
526+
# Must match metadata.name in ConfigMap file
527+
credentials: <mycredentials>
528+
type: ReplicaSet
529+
persistent: true
530+
END-x509-internal-replset-upper-custom
531+
532+
START-x509-internal-replset-lower-custom
533+
security:
534+
tls:
535+
enabled: true
536+
ca: <custom-ca>
537+
authentication:
538+
enabled: true
539+
modes: ["X509"]
540+
internalCluster: "X509"
541+
...
542+
END-x509-internal-replset-lower-custom

‎source/includes/code-examples/yaml-files/example-sharded-cluster.yaml

Lines changed: 181 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -292,6 +292,187 @@ spec:
292292
...
293293
END-scaled-sharded
294294

295+
296+
START-tls-sharded-full-custom
297+
---
298+
apiVersion: mongodb.com/v1
299+
kind: MongoDB
300+
metadata:
301+
name: <my-sharded-cluster>
302+
spec:
303+
shardCount: 2
304+
mongodsPerShardCount: 3
305+
mongosCount: 2
306+
configServerCount: 3
307+
version: 4.2.1
308+
opsManager:
309+
configMapRef:
310+
name: <configMap.metadata.name>
311+
# Must match metadata.name in ConfigMap file
312+
credentials: <mycredentials>
313+
type: ShardedCluster
314+
persistent: true
315+
security:
316+
tls:
317+
enabled: true
318+
ca: <custom-ca>
319+
...
320+
END-tls-sharded-full-custom
321+
322+
START-tls-sharded-upper-custom
323+
---
324+
apiVersion: mongodb.com/v1
325+
kind: MongoDB
326+
metadata:
327+
name: <my-sharded-cluster>
328+
spec:
329+
shardCount: 2
330+
mongodsPerShardCount: 3
331+
mongosCount: 2
332+
configServerCount: 3
333+
version: 4.2.1
334+
opsManager:
335+
configMapRef:
336+
name: <configMap.metadata.name>
337+
# Must match metadata.name in ConfigMap file
338+
credentials: <mycredentials>
339+
type: ShardedCluster
340+
persistent: true
341+
END-tls-sharded-upper-custom
342+
343+
START-tls-sharded-lower-custom
344+
security:
345+
tls:
346+
enabled: true
347+
ca: <custom-ca>
348+
...
349+
END-tls-sharded-lower-custom
350+
351+
START-x509-client-sharded-full-custom
352+
---
353+
apiVersion: mongodb.com/v1
354+
kind: MongoDB
355+
metadata:
356+
name: <my-sharded-cluster>
357+
spec:
358+
shardCount: 2
359+
mongodsPerShardCount: 3
360+
mongosCount: 2
361+
configServerCount: 3
362+
version: 4.2.1
363+
opsManager:
364+
configMapRef:
365+
name: <configMap.metadata.name>
366+
# Must match metadata.name in ConfigMap file
367+
credentials: <mycredentials>
368+
type: ShardedCluster
369+
persistent: true
370+
security:
371+
tls:
372+
enabled: true
373+
ca: <custom-ca>
374+
authentication:
375+
enabled: true
376+
modes: ["X509"]
377+
...
378+
END-x509-client-sharded-full-custom
379+
380+
START-x509-client-sharded-upper-custom
381+
---
382+
apiVersion: mongodb.com/v1
383+
kind: MongoDB
384+
metadata:
385+
name: <my-sharded-cluster>
386+
spec:
387+
shardCount: 2
388+
mongodsPerShardCount: 3
389+
mongosCount: 2
390+
configServerCount: 3
391+
version: 4.2.1
392+
opsManager:
393+
configMapRef:
394+
name: <configMap.metadata.name>
395+
# Must match metadata.name in ConfigMap file
396+
credentials: <mycredentials>
397+
type: ShardedCluster
398+
persistent: true
399+
END-x509-client-sharded-upper-custom
400+
401+
START-x509-client-sharded-lower-custom
402+
security:
403+
tls:
404+
enabled: true
405+
ca: <custom-ca>
406+
authentication:
407+
enabled: true
408+
modes: ["X509"]
409+
...
410+
END-x509-client-sharded-lower-custom
411+
412+
START-x509-internal-sharded-full-custom
413+
---
414+
apiVersion: mongodb.com/v1
415+
kind: MongoDB
416+
metadata:
417+
name: <my-sharded-cluster>
418+
spec:
419+
shardCount: 2
420+
mongodsPerShardCount: 3
421+
mongosCount: 2
422+
configServerCount: 3
423+
version: 4.2.1
424+
opsManager:
425+
configMapRef:
426+
name: <configMap.metadata.name>
427+
# Must match metadata.name in ConfigMap file
428+
credentials: <mycredentials>
429+
type: ShardedCluster
430+
persistent: true
431+
security:
432+
tls:
433+
enabled: true
434+
ca: <custom-ca>
435+
authentication:
436+
enabled: true
437+
modes: ["X509"]
438+
internalCluster: "X509"
439+
...
440+
END-x509-internal-sharded-full-custom
441+
442+
START-x509-internal-sharded-upper-custom
443+
---
444+
apiVersion: mongodb.com/v1
445+
kind: MongoDB
446+
metadata:
447+
name: <my-sharded-cluster>
448+
spec:
449+
shardCount: 2
450+
mongodsPerShardCount: 3
451+
mongosCount: 2
452+
configServerCount: 3
453+
version: 4.2.1
454+
opsManager:
455+
configMapRef:
456+
name: <configMap.metadata.name>
457+
# Must match metadata.name in ConfigMap file
458+
credentials: <mycredentials>
459+
type: ShardedCluster
460+
persistent: true
461+
END-x509-internal-sharded-upper-custom
462+
463+
START-x509-internal-sharded-lower-custom
464+
security:
465+
tls:
466+
enabled: true
467+
ca: <custom-ca>
468+
authentication:
469+
enabled: true
470+
modes: ["X509"]
471+
internalCluster: "X509"
472+
...
473+
END-x509-internal-sharded-lower-custom
474+
475+
295476
START-exposed-sharded-full
296477
---
297478
apiVersion: mongodb.com/v1
@@ -371,4 +552,3 @@ START-exposed-sharded-tls-lower
371552
- "additional-cert-test.com"
372553
...
373554
END-exposed-sharded-tls-lower
374-

0 commit comments

Comments
 (0)