Skip to content

Commit

Permalink
[cherry-pick] Fix Backup and Restore for TLS enabled mongo (#1805) (#…
Browse files Browse the repository at this point in the history 
…1816)

Signed-off-by: Mohammad Fahim Abrar <fahimabrar@appscode.com>
  • Loading branch information
@1gtm
1gtm committed May 29, 2023
1 parent d39c4f5 commit bc5c567
Show file tree
Hide file tree
Showing 2 changed files with 35 additions and 15 deletions.
28 changes: 20 additions & 8 deletions pkg/backup.go
View file
Expand Up @@ -247,16 +247,24 @@ func (opt *mongoOptions) backupMongoDB(targetRef api_v1beta1.TargetRef) (*restic
return nil, err
}

appBindingSecret, err := opt.kubeClient.CoreV1().Secrets(opt.appBindingNamespace).Get(context.TODO(), appBinding.Spec.Secret.Name, metav1.GetOptions{})
authSecret, err := opt.kubeClient.CoreV1().Secrets(opt.appBindingNamespace).Get(context.TODO(), appBinding.Spec.Secret.Name, metav1.GetOptions{})
if err != nil {
return nil, err
}

err = appBinding.TransformSecret(opt.kubeClient, appBindingSecret.Data)
err = appBinding.TransformSecret(opt.kubeClient, authSecret.Data)
if err != nil {
return nil, err
}

var tlsSecret *core.Secret
if appBinding.Spec.TLSSecret != nil {
tlsSecret, err = opt.kubeClient.CoreV1().Secrets(opt.appBindingNamespace).Get(context.TODO(), appBinding.Spec.TLSSecret.Name, metav1.GetOptions{})
if err != nil {
return nil, err
}
}

hostname, err := appBinding.Hostname()
if err != nil {
return nil, err
Expand Down Expand Up @@ -314,6 +322,10 @@ func (opt *mongoOptions) backupMongoDB(targetRef api_v1beta1.TargetRef) (*restic
}

if appBinding.Spec.ClientConfig.CABundle != nil {
if tlsSecret == nil {
return nil, errors.Wrap(err, "spec.tlsSecret needs to be set in appbinding for TLS secured database.")
}

if err := os.WriteFile(filepath.Join(opt.setupOptions.ScratchDir, MongoTLSCertFileName), appBinding.Spec.ClientConfig.CABundle, os.ModePerm); err != nil {
return nil, err
}
Expand All @@ -331,13 +343,13 @@ func (opt *mongoOptions) backupMongoDB(targetRef api_v1beta1.TargetRef) (*restic
// get certificate secret to get client certificate
var pemBytes []byte
var ok bool
pemBytes, ok = appBindingSecret.Data[MongoClientPemFileName]
pemBytes, ok = tlsSecret.Data[MongoClientPemFileName]
if !ok {
crt, ok := appBindingSecret.Data[core.TLSCertKey]
crt, ok := tlsSecret.Data[core.TLSCertKey]
if !ok {
return nil, errors.Wrap(err, "unable to retrieve tls.crt from secret.")
}
key, ok := appBindingSecret.Data[core.TLSPrivateKeyKey]
key, ok := tlsSecret.Data[core.TLSPrivateKeyKey]
if !ok {
return nil, errors.Wrap(err, "unable to retrieve tls.key from secret.")
}
Expand All @@ -361,8 +373,8 @@ func (opt *mongoOptions) backupMongoDB(targetRef api_v1beta1.TargetRef) (*restic

} else {
userAuth := []interface{}{
fmt.Sprintf("--username=%s", appBindingSecret.Data[MongoUserKey]),
fmt.Sprintf("--password=%s", appBindingSecret.Data[MongoPasswordKey]),
fmt.Sprintf("--username=%s", authSecret.Data[MongoUserKey]),
fmt.Sprintf("--password=%s", authSecret.Data[MongoPasswordKey]),
"--authenticationDatabase", opt.authenticationDatabase,
}
mongoCreds = append(mongoCreds, userAuth...)
Expand Down Expand Up @@ -662,7 +674,7 @@ func lockConfigServer(configSVRDSN, secondaryHost string) error {
"config",
"--host", secondaryHost,
"--quiet",
"--eval", "rs.slaveOk(); db.BackupControl.find({ '_id' : 'BackupControlDocument' }).readConcern('majority');",
"--eval", "rs.secondaryOk(); db.BackupControl.find({ '_id' : 'BackupControlDocument' }).readConcern('majority');",
}, mongoCreds...)

if err := sh.Command(MongoCMD, args...).UnmarshalJSON(&v); err != nil {
Expand Down
22 changes: 15 additions & 7 deletions pkg/restore.go
View file
Expand Up @@ -185,16 +185,24 @@ func (opt *mongoOptions) restoreMongoDB(targetRef api_v1beta1.TargetRef) (*resti
return nil, err
}

appBindingSecret, err := opt.kubeClient.CoreV1().Secrets(opt.appBindingNamespace).Get(context.TODO(), appBinding.Spec.Secret.Name, metav1.GetOptions{})
authSecret, err := opt.kubeClient.CoreV1().Secrets(opt.appBindingNamespace).Get(context.TODO(), appBinding.Spec.Secret.Name, metav1.GetOptions{})
if err != nil {
return nil, err
}

err = appBinding.TransformSecret(opt.kubeClient, appBindingSecret.Data)
err = appBinding.TransformSecret(opt.kubeClient, authSecret.Data)
if err != nil {
return nil, err
}

var tlsSecret *core.Secret
if appBinding.Spec.TLSSecret != nil {
tlsSecret, err = opt.kubeClient.CoreV1().Secrets(opt.appBindingNamespace).Get(context.TODO(), appBinding.Spec.TLSSecret.Name, metav1.GetOptions{})
if err != nil {
return nil, err
}
}

hostname, err := appBinding.Hostname()
if err != nil {
return nil, err
Expand Down Expand Up @@ -262,13 +270,13 @@ func (opt *mongoOptions) restoreMongoDB(targetRef api_v1beta1.TargetRef) (*resti
// get certificate secret to get client certificate
var pemBytes []byte
var ok bool
pemBytes, ok = appBindingSecret.Data[MongoClientPemFileName]
pemBytes, ok = tlsSecret.Data[MongoClientPemFileName]
if !ok {
crt, ok := appBindingSecret.Data[core.TLSCertKey]
crt, ok := tlsSecret.Data[core.TLSCertKey]
if !ok {
return nil, errors.Wrap(err, "unable to retrieve tls.crt from secret.")
}
key, ok := appBindingSecret.Data[core.TLSPrivateKeyKey]
key, ok := tlsSecret.Data[core.TLSPrivateKeyKey]
if !ok {
return nil, errors.Wrap(err, "unable to retrieve tls.key from secret.")
}
Expand All @@ -292,8 +300,8 @@ func (opt *mongoOptions) restoreMongoDB(targetRef api_v1beta1.TargetRef) (*resti

} else {
userAuth := []interface{}{
fmt.Sprintf("--username=%s", appBindingSecret.Data[MongoUserKey]),
fmt.Sprintf("--password=%s", appBindingSecret.Data[MongoPasswordKey]),
fmt.Sprintf("--username=%s", authSecret.Data[MongoUserKey]),
fmt.Sprintf("--password=%s", authSecret.Data[MongoPasswordKey]),
"--authenticationDatabase", opt.authenticationDatabase,
}
mongoCreds = append(mongoCreds, userAuth...)
Expand Down

0 comments on commit bc5c567

Please sign in to comment.