From 2b81bcc1e4e9f35f97690308663b7da372ac20fd Mon Sep 17 00:00:00 2001 From: Dan Carley Date: Tue, 23 Oct 2018 04:34:14 +0100 Subject: [PATCH] [stable/mongodb-replicaset] Add OU to cert (#8261) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * [stable/mongodb-replicaset] Add OU to cert Fix the bug reported and diagnosed in #7417. When you set `security.clusterAuthMode: x509` as recommended by the README the nodes will fail to authenticate with the following error: 2018-10-08T13:06:12.767+0000 I ACCESS [conn7] authenticate db: $external { authenticate: 1, mechanism: "MONGODB-X509", user: "CN=circleci-mongodb-1" } 2018-10-08T13:06:12.767+0000 I ACCESS [conn7] Failed to authenticate CN=circleci-mongodb-1@$external with mechanism MONGODB-X509: UserNotFound: Could not find user CN=circleci-mongodb-1@$external 2018-10-08T13:06:12.768+0000 I ACCESS [conn7] Unauthorized: not authorized on admin to execute command { replSetHeartbeat: "rs0", configVersion: 3, from: "circleci-mongodb-1.circleci-mongodb.default.svc.cluster.local:27017", fromId: 1, term: 12 } This is because the MongoDB docs state the following: > The Distinguished Name (DN), found in the member certificate’s > subject, must specify a non-empty value for at least one of the > following attributes: Organization (O), the Organizational Unit (OU) > or the Domain Component (DC). https://docs.mongodb.com/manual/tutorial/configure-x509-member-authentication/#certificate-requirements Setting the OU to the name of the product seems like the most generic solution to this without suggesting that the cert belongs to MongoDB the company. Signed-off-by: Dan Carley * [stable/mongodb-replicaset] Fix CAFile in README The `/ca` directory doesn't exist when the `bootstrap` container is run and this causes the `on-start.sh` script to fail. Whereas the `/data/configdb` directory does existing throughout the process and is the path that people have reported using in other issues. Signed-off-by: Dan Carley --- stable/mongodb-replicaset/Chart.yaml | 2 +- stable/mongodb-replicaset/README.md | 2 +- stable/mongodb-replicaset/init/on-start.sh | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/stable/mongodb-replicaset/Chart.yaml b/stable/mongodb-replicaset/Chart.yaml index fdb8cb17fe..da51322ce9 100644 --- a/stable/mongodb-replicaset/Chart.yaml +++ b/stable/mongodb-replicaset/Chart.yaml @@ -1,6 +1,6 @@ name: mongodb-replicaset home: https://github.com/mongodb/mongo -version: 3.6.1 +version: 3.6.2 appVersion: 3.6 description: NoSQL document-oriented database that stores JSON-like documents with dynamic schemas, simplifying the integration of data in content-driven applications. diff --git a/stable/mongodb-replicaset/README.md b/stable/mongodb-replicaset/README.md index c791b5eb8a..0fb73fde51 100644 --- a/stable/mongodb-replicaset/README.md +++ b/stable/mongodb-replicaset/README.md @@ -137,7 +137,7 @@ configmap: port: 27017 ssl: mode: requireSSL - CAFile: /ca/tls.crt + CAFile: /data/configdb/tls.crt PEMKeyFile: /work-dir/mongo.pem replication: replSetName: rs0 diff --git a/stable/mongodb-replicaset/init/on-start.sh b/stable/mongodb-replicaset/init/on-start.sh index c18997a7f8..ba1bd3aa15 100644 --- a/stable/mongodb-replicaset/init/on-start.sh +++ b/stable/mongodb-replicaset/init/on-start.sh @@ -137,7 +137,7 @@ EOL # Generate the certs openssl genrsa -out mongo.key 2048 - openssl req -new -key mongo.key -out mongo.csr -subj "/CN=$my_hostname" -config openssl.cnf + openssl req -new -key mongo.key -out mongo.csr -subj "/OU=MongoDB/CN=$my_hostname" -config openssl.cnf openssl x509 -req -in mongo.csr \ -CA "$ca_crt" -CAkey "$ca_key" -CAcreateserial \ -out mongo.crt -days 3650 -extensions v3_req -extfile openssl.cnf