Search: remove external.tls.enabled

.evergreen-snippets.yml

@@ -121,6 +121,12 @@ tasks:
       - func: test_code_snippets
       - func: sample_commit_output
 
+  - name: test_kind_search_external_mongod_snippets.sh
+    tags: [ "code_snippets", "patch-run" ]
+    commands:
+      - func: test_code_snippets
+      - func: sample_commit_output
+
 task_groups:
   - name: gke_code_snippets_task_group
     <<: *setup_and_teardown_group_gke_code_snippets
@@ -135,6 +141,7 @@ task_groups:
     tasks:
       - test_kind_search_community_snippets.sh
       - test_kind_search_enterprise_snippets.sh
+      - test_kind_search_external_mongod_snippets.sh
 
 buildvariants:
   # These variants are used to test the code snippets and each one can be used in patches

api/v1/search/mongodbsearch_types.go

@@ -69,22 +69,20 @@ type ExternalMongoDBSource struct {
 }
 
 type ExternalMongodTLS struct {
-	Enabled bool `json:"enabled"`
-	// +optional
-	CA *corev1.LocalObjectReference `json:"ca,omitempty"`
+	// CA is a reference to a Secret containing the CA certificate that issued mongod's TLS certificate.
+	// The CA certificate is expected to be PEM encoded and available at the "ca.crt" key.
+	CA *corev1.LocalObjectReference `json:"ca"`
 }
 
 type Security struct {
 	// +optional
-	TLS TLS `json:"tls"`
+	TLS *TLS `json:"tls,omitempty"`
 }
 
 type TLS struct {
-	Enabled bool `json:"enabled"`
 	// CertificateKeySecret is a reference to a Secret containing a private key and certificate to use for TLS.
 	// The key and cert are expected to be PEM encoded and available at "tls.key" and "tls.crt".
 	// This is the same format used for the standard "kubernetes.io/tls" Secret type, but no specific type is required.
-	// +optional
 	CertificateKeySecret corev1.LocalObjectReference `json:"certificateKeySecretRef"`
 }
 

config/crd/bases/mongodb.com_mongodbsearch.yaml

@@ -179,10 +179,8 @@ spec:
                             type: string
                         type: object
                         x-kubernetes-map-type: atomic
-                      enabled:
-                        type: boolean
                     required:
-                    - enabled
+                      - certificateKeySecretRef
                     type: object
                 type: object
               source:
@@ -211,8 +209,8 @@ spec:
                         properties:
                           ca:
                             description: |-
-                              LocalObjectReference contains enough information to let you locate the
-                              referenced object inside the same namespace.
+                              CA is a reference to a Secret containing the CA certificate that issued mongod's TLS certificate.
+                              The CA certificate is expected to be PEM encoded and available at the "ca.crt" key.
                             properties:
                               name:
                                 default: ""
@@ -225,10 +223,8 @@ spec:
                                 type: string
                             type: object
                             x-kubernetes-map-type: atomic
-                          enabled:
-                            type: boolean
                         required:
-                        - enabled
+                          - ca
                         type: object
                     type: object
                   mongodbResourceRef:

controllers/operator/mongodbsearch_controller.go

@@ -70,7 +70,7 @@ func (r *MongoDBSearchReconciler) Reconcile(ctx context.Context, request reconci
 	}
 
 	// Watch our own TLS certificate secret for changes
-	if mdbSearch.Spec.Security.TLS.Enabled {
+	if mdbSearch.Spec.Security.TLS != nil {
 		r.watch.AddWatchedResourceIfNotAdded(mdbSearch.Spec.Security.TLS.CertificateKeySecret.Name, mdbSearch.Namespace, watch.Secret, mdbSearch.NamespacedName())
 	}
 

controllers/searchcontroller/external_search_source.go

@@ -26,7 +26,7 @@ func (r *externalSearchResource) Validate() error {
 }
 
 func (r *externalSearchResource) TLSConfig() *TLSSourceConfig {
-	if r.spec.TLS == nil || !r.spec.TLS.Enabled {
+	if r.spec.TLS == nil {
 		return nil
 	}
 

controllers/searchcontroller/mongodbsearch_reconcile_helper.go

@@ -228,7 +228,7 @@ func (r *MongoDBSearchReconcileHelper) ensureMongotConfig(ctx context.Context, l
 }
 
 func (r *MongoDBSearchReconcileHelper) ensureIngressTlsConfig(ctx context.Context) (mongot.Modification, statefulset.Modification, error) {
-	if !r.mdbSearch.Spec.Security.TLS.Enabled {
+	if r.mdbSearch.Spec.Security.TLS == nil {
 		mongotModification := func(config *mongot.Config) {
 			config.Server.Wireproto.TLS.Mode = mongot.ConfigTLSModeDisabled
 		}
@@ -390,7 +390,7 @@ func createMongotConfig(search *searchv1.MongoDBSearch, db SearchSourceDBResourc
 
 func GetMongodConfigParameters(search *searchv1.MongoDBSearch) map[string]any {
 	searchTLSMode := automationconfig.TLSModeDisabled
-	if search.Spec.Security.TLS.Enabled {
+	if search.Spec.Security.TLS != nil {
 		searchTLSMode = automationconfig.TLSModeRequired
 	}
 	return map[string]any{

docker/mongodb-kubernetes-tests/tests/search/search_community_external_mongod_basic.py

@@ -71,7 +71,6 @@ def mdbs(namespace: str, mdbc: MongoDBCommunity) -> MongoDBSearch:
             "external": {
                 "hostAndPorts": seeds,
                 "keyfileSecretRef": {"name": f"{mdbc.name}-keyfile", "key": "keyfile"},
-                "tls": {"enabled": False},
             },
             "passwordSecretRef": {"name": f"{MDBC_RESOURCE_NAME}-{MONGOT_USER_NAME}-password", "key": "password"},
             "username": MONGOT_USER_NAME,

docker/mongodb-kubernetes-tests/tests/search/search_community_external_mongod_tls.py

@@ -138,15 +138,14 @@ def test_create_search_resource(mdbs: MongoDBSearch, mdbc: MongoDBCommunity):
             "hostAndPorts": seeds,
             "keyfileSecretRef": {"name": f"{mdbc.name}-keyfile"},
             "tls": {
-                "enabled": True,
                 "ca": {"name": f"{mdbc.name}-ca"},
             },
         },
         "passwordSecretRef": {"name": f"{MDBC_RESOURCE_NAME}-{MONGOT_USER_NAME}-password", "key": "password"},
         "username": MONGOT_USER_NAME,
     }
 
-    mdbs["spec"]["security"] = {"tls": {"enabled": True, "certificateKeySecretRef": {"name": MDBS_TLS_SECRET_NAME}}}
+    mdbs["spec"]["security"] = {"tls": {"certificateKeySecretRef": {"name": MDBS_TLS_SECRET_NAME}}}
 
     mdbs.update()
     mdbs.assert_reaches_phase(Phase.Running, timeout=300)

docker/mongodb-kubernetes-tests/tests/search/search_enterprise_tls.py

@@ -59,7 +59,7 @@ def mdbs(namespace: str) -> MongoDBSearch:
     if "spec" not in resource:
         resource["spec"] = {}
 
-    resource["spec"]["security"] = {"tls": {"enabled": True, "certificateKeySecretRef": {"name": MDBS_TLS_SECRET_NAME}}}
+    resource["spec"]["security"] = {"tls": {"certificateKeySecretRef": {"name": MDBS_TLS_SECRET_NAME}}}
 
     return resource
 

docs/search/04-search-external-mongod/README.md

@@ -182,8 +182,6 @@ spec:
       keyfileSecretRef:
         name: ${MDB_EXTERNAL_KEYFILE_SECRET_NAME}
         key: keyfile
-      tls:
-        enabled: false
     username: search-sync-source
     passwordSecretRef:
       name: mdbc-rs-search-sync-source-password

docs/search/04-search-external-mongod/code_snippets/04_0320_create_mongodb_search_resource.sh

@@ -13,8 +13,6 @@ spec:
       keyfileSecretRef:
         name: ${MDB_EXTERNAL_KEYFILE_SECRET_NAME}
         key: keyfile
-      tls:
-        enabled: false
     username: search-sync-source
     passwordSecretRef:
       name: mdbc-rs-search-sync-source-password

helm_chart/crds/mongodb.com_mongodbsearch.yaml

@@ -179,10 +179,8 @@ spec:
                             type: string
                         type: object
                         x-kubernetes-map-type: atomic
-                      enabled:
-                        type: boolean
                     required:
-                    - enabled
+                      - certificateKeySecretRef
                     type: object
                 type: object
               source:
@@ -211,8 +209,8 @@ spec:
                         properties:
                           ca:
                             description: |-
-                              LocalObjectReference contains enough information to let you locate the
-                              referenced object inside the same namespace.
+                              CA is a reference to a Secret containing the CA certificate that issued mongod's TLS certificate.
+                              The CA certificate is expected to be PEM encoded and available at the "ca.crt" key.
                             properties:
                               name:
                                 default: ""
@@ -225,10 +223,8 @@ spec:
                                 type: string
                             type: object
                             x-kubernetes-map-type: atomic
-                          enabled:
-                            type: boolean
                         required:
-                        - enabled
+                          - ca
                         type: object
                     type: object
                   mongodbResourceRef:

public/crds.yaml

@@ -4201,10 +4201,8 @@ spec:
                             type: string
                         type: object
                         x-kubernetes-map-type: atomic
-                      enabled:
-                        type: boolean
                     required:
-                    - enabled
+                      - certificateKeySecretRef
                     type: object
                 type: object
               source:
@@ -4233,8 +4231,8 @@ spec:
                         properties:
                           ca:
                             description: |-
-                              LocalObjectReference contains enough information to let you locate the
-                              referenced object inside the same namespace.
+                              CA is a reference to a Secret containing the CA certificate that issued mongod's TLS certificate.
+                              The CA certificate is expected to be PEM encoded and available at the "ca.crt" key.
                             properties:
                               name:
                                 default: ""
@@ -4247,10 +4245,8 @@ spec:
                                 type: string
                             type: object
                             x-kubernetes-map-type: atomic
-                          enabled:
-                            type: boolean
                         required:
-                        - enabled
+                          - ca
                         type: object
                     type: object
                   mongodbResourceRef: