Skip to content

Commit 9362369

Browse files
ikheifets-splunkikheifets-splunk
committed
fix: protect mongo and redis by password [run-int-tests]
Signed-off-by: Ilya Kheifets <[email protected]>
1 parent ae117d6 commit 9362369

File tree

5 files changed

+194
-4
lines changed

5 files changed

+194
-4
lines changed

‎charts/splunk-connect-for-snmp/templates/_helpers.tpl‎

Lines changed: 83 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,36 @@
11
{{- define "splunk-connect-for-snmp.mongo_uri" -}}
2+
3+
{{- if or (not (empty .Values.mongodb.auth.existingSecret)) (not (empty .Values.mongodb.auth.rootPassword)) }}
4+
{{- $mongoPassword := "" }}
5+
6+
{{- if (not (empty .Values.mongodb.auth.existingSecret)) }}
7+
{{- $mongoSecretName := .Values.mongodb.auth.existingSecret }}
8+
{{- $mongoSecret := lookup "v1" "Secret" .Release.Namespace $mongoSecretName }}
9+
10+
{{- if not $mongoSecret }}
11+
{{- fail (printf "Secret '%s' not found in namespace '%s'. Please create it before deploying." $mongoSecretName .Release.Namespace) }}
12+
{{- end }}
13+
14+
{{- $mongoPassword = get $mongoSecret.data "mongodb-root-password" | b64dec }}
15+
{{- else }}
16+
{{- $mongoPassword = .Values.mongodb.auth.rootPassword }}
17+
{{- end }}
18+
19+
{{- if eq .Values.mongodb.architecture "replicaset" }}
20+
{{- printf "mongodb+srv://root:%s@%s-mongodb-headless.%s.svc.%s/?tls=false&ssl=false&replicaSet=rs0" $mongoPassword .Release.Name .Release.Namespace .Values.mongodb.clusterDomain}}
21+
{{- else }}
22+
{{- printf "mongodb://root:%s@%s-mongodb:27017" $mongoPassword .Release.Name }}
23+
{{- end }}
24+
{{- else }}
25+
226
{{- if eq .Values.mongodb.architecture "replicaset" }}
327
{{- printf "mongodb+srv://%s-mongodb-headless.%s.svc.%s/?tls=false&ssl=false&replicaSet=rs0" .Release.Name .Release.Namespace .Values.mongodb.clusterDomain}}
428
{{- else }}
529
{{- printf "mongodb://%s-mongodb:27017" .Release.Name }}
6-
{{- end }}
7-
{{- end }}
30+
{{- end }}
31+
32+
{{- end }}
33+
{{- end }}
834

935
{{- define "splunk-connect-for-snmp.mongodbHost" -}}
1036
{{- if .Values.mongodbHost }}
@@ -15,18 +41,73 @@
1541
{{- end }}
1642

1743
{{- define "splunk-connect-for-snmp.celery_url" -}}
44+
45+
{{- if or (not (empty .Values.redis.auth.existingSecret)) (not (empty .Values.redis.auth.password)) }}
46+
47+
{{- $redisPassword := "" }}
48+
49+
{{- if (not (empty .Values.redis.auth.existingSecret)) }}
50+
{{- $redisSecretName := .Values.redis.auth.existingSecret }}
51+
{{- $redisSecret := lookup "v1" "Secret" .Release.Namespace $redisSecretName }}
52+
53+
{{- if not $redisSecret }}
54+
{{- fail (printf "Secret '%s' not found in namespace '%s'. Please create it before deploying." $redisSecretName .Release.Namespace) }}
55+
{{- end }}
56+
57+
{{- $redisPassword = get $redisSecret.data "redis-password" | b64dec }}
58+
{{- else }}
59+
{{- $redisPassword = .Values.redis.auth.password }}
60+
{{- end }}
61+
62+
{{- if and ( eq .Values.redis.architecture "replication" ) .Values.redis.sentinel.enabled }}
63+
{{- printf "redis://:%s@%s-redis:6379/0" $redisPassword .Release.Name }}
64+
{{- else }}
65+
{{- printf "redis://:%s@%s-redis-master:6379/0" $redisPassword .Release.Name }}
66+
{{- end }}
67+
{{- else }}
68+
69+
1870
{{- if and ( eq .Values.redis.architecture "replication" ) .Values.redis.sentinel.enabled }}
1971
{{- printf "redis://%s-redis:6379/0" .Release.Name }}
2072
{{- else }}
2173
{{- printf "redis://%s-redis-master:6379/0" .Release.Name }}
74+
{{- end }}
75+
2276
{{- end }}
2377
{{- end }}
2478

2579
{{- define "splunk-connect-for-snmp.redis_url" -}}
80+
81+
{{- if or (not (empty .Values.redis.auth.existingSecret)) (not (empty .Values.redis.auth.password)) }}
82+
83+
{{- $redisPassword := "" }}
84+
85+
{{- if (not (empty .Values.redis.auth.existingSecret)) }}
86+
{{- $redisSecretName := .Values.redis.auth.existingSecret }}
87+
{{- $redisSecret := lookup "v1" "Secret" .Release.Namespace $redisSecretName }}
88+
89+
{{- if not $redisSecret }}
90+
{{- fail (printf "Secret '%s' not found in namespace '%s'. Please create it before deploying." $redisSecretName .Release.Namespace) }}
91+
{{- end }}
92+
93+
{{- $redisPassword = get $redisSecret.data "redis-password" | b64dec }}
94+
{{- else }}
95+
{{- $redisPassword = .Values.redis.auth.password }}
96+
{{- end }}
97+
98+
{{- if and ( eq .Values.redis.architecture "replication" ) .Values.redis.sentinel.enabled }}
99+
{{- printf "redis://:%s@%s-redis:6379/1" $redisPassword .Release.Name }}
100+
{{- else }}
101+
{{- printf "redis://:%s@%s-redis-master:6379/1" $redisPassword .Release.Name }}
102+
{{- end }}
103+
{{- else }}
104+
26105
{{- if and ( eq .Values.redis.architecture "replication" ) .Values.redis.sentinel.enabled }}
27106
{{- printf "redis://%s-redis:6379/1" .Release.Name }}
28107
{{- else }}
29108
{{- printf "redis://%s-redis-master:6379/1" .Release.Name }}
109+
{{- end }}
110+
30111
{{- end }}
31112
{{- end }}
32113

‎charts/splunk-connect-for-snmp/templates/mongodb-6.0-upgrade-job.yaml‎

Lines changed: 23 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,17 +20,38 @@ spec:
2020
{{- else }}
2121
{{ .Values.mongodb.image.repository }}:{{ .Values.mongodb.image.tag }}
2222
{{- end }}
23+
24+
{{- $mongoPass := lookup "v1" "Secret" .Release.Namespace "snmp-mongodb" }}
25+
{{- $mongoSecret := lookup "v1" "Secret" .Release.Namespace .Values.mongodb.auth.existingSecret }}
26+
27+
{{- if $mongoPass }}
28+
env:
29+
- name: MONGO_PASSWORD
30+
valueFrom:
31+
secretKeyRef:
32+
name: snmp-mongodb
33+
key: mongodb-root-password
34+
{{- end }}
35+
36+
{{- if and $mongoSecret .Values.mongodb.auth.existingSecret}}
37+
env:
38+
- name: MONGO_PASSWORD
39+
valueFrom:
40+
secretKeyRef:
41+
name: {{ .Values.mongodb.auth.existingSecret }}
42+
key: mongodb-root-password
43+
{{- end }}
2344
command:
2445
- /bin/bash
2546
- -c
2647
- |
2748
echo "Checking current mongo FCV"
28-
FCV=$(mongosh --host {{ include "splunk-connect-for-snmp.mongodbHost" . | quote }} --quiet --eval 'db.adminCommand({ getParameter: 1, featureCompatibilityVersion: 1 }).featureCompatibilityVersion.version')
49+
FCV=$(mongosh --host {{ include "splunk-connect-for-snmp.mongodbHost" . | quote }} {{- if or $mongoPass .Values.mongodb.auth.existingSecret }} --username root --password $MONGO_PASSWORD {{- end }} --quiet --eval 'db.adminCommand({ getParameter: 1, featureCompatibilityVersion: 1 }).featureCompatibilityVersion.version')
2950
echo "Current Mongo Feature Compatibility Version: $FCV"
3051
3152
if [[ "$FCV" < "6.0" ]]; then
3253
echo "FCV < 6.0, setting to 6.0"
33-
mongosh --host {{ include "splunk-connect-for-snmp.mongodbHost" . | quote }} --eval 'db.adminCommand({ setFeatureCompatibilityVersion: "6.0" })'
54+
mongosh --host {{ include "splunk-connect-for-snmp.mongodbHost" . | quote }} {{- if or $mongoPass .Values.mongodb.auth.existingSecret }} --username root --password $MONGO_PASSWORD {{- end }} --eval 'db.adminCommand({ setFeatureCompatibilityVersion: "6.0" })'
3455
else
3556
echo "FCV >= 6.0, nothing to be changed"
3657
fi

‎docs/dockercompose/11-protect-by-password.md‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
## Protect Mongo and Redis by password
2+
3+
In your `docker-compose.yaml` [specify](https://hub.docker.com/r/bitnami/redis) for Redis container `REDIS_PASSWORD` or `REDIS_PASSWORD_FILE`:
4+
5+
```
6+
redis:
7+
...
8+
environment:
9+
- REDIS_PASSWORD=...
10+
```
11+
12+
The same thing you to [specify](https://hub.docker.com/r/bitnami/mongodb) for Mongo container using `MONGODB_ROOT_PASSWORD`:
13+
14+
```
15+
mongo:
16+
...
17+
environment:
18+
- MONGODB_ROOT_PASSWORD=...
19+
```
20+
21+
After that just update connection string:
22+
23+
```
24+
REDIS_URL: redis://:pass@redis:6379/1
25+
CELERY_BROKER_URL: redis://:pass@redis:6379/0
26+
MONGO_URI: mongodb://root:pass@mongo:27017/
27+
```
28+
29+
!!! Warning
30+
If you wanna update the password you need to make it manually using `mongo` and `redis` cli.
31+
And only after that you need to update `REDIS_PASSWORD`/ `MONGODB_ROOT_PASSWORD` and connection strings.

‎docs/microk8s/configuration/protect-by-password.md‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# Protect Mongo and Redis by password
2+
3+
## Using secrets
4+
5+
Create secrets for Mongo and Redis:
6+
7+
```
8+
microk8s kubectl create secret generic redis-auth-secret \
9+
--from-literal=redis-password=your_password -n sc4snmp
10+
11+
microk8s kubectl create secret generic mongodb-auth-secret \
12+
--from-literal=mongodb-root-password=your_password -n sc4snmp
13+
```
14+
15+
Reference on this secrets in `values.yaml`:
16+
17+
```
18+
redis:
19+
auth:
20+
enabled: true
21+
existingSecret: "redis-auth-secret"
22+
23+
mongodb:
24+
auth:
25+
enabled: true
26+
existingSecret: "mongodb-auth-secret"
27+
```
28+
29+
Redeploy SC4SNMP
30+
31+
!!! Warning
32+
In case of failing migration jobs, update password manually using `mongosh` CLI.
33+
34+
35+
## Using password
36+
37+
38+
Set passwords in `values.yaml`:
39+
40+
```
41+
redis:
42+
auth:
43+
enabled: true
44+
password: "redis-auth-secret"
45+
46+
mongodb:
47+
auth:
48+
enabled: true
49+
rootPassword: "mongodb-auth-secret"
50+
```
51+
52+
Redeploy SC4SNMP
53+
54+
!!! Warning
55+
In case of failing migration jobs, update password manually using `mongosh` CLI.

‎mkdocs.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@ nav:
5555
- Offline installation: "dockercompose/8-offline-installation.md"
5656
- Sending logs to Splunk: "dockercompose/9-splunk-logging.md"
5757
- Enable IPv6: "dockercompose/10-enable-ipv6.md"
58+
- Protect redis and mongo by password: "dockercompose/11-protect-by-password.md"
5859
- Getting Started with Microk8s:
5960
- Installation:
6061
- Splunk Requirements: "microk8s/splunk-requirements.md"
@@ -80,6 +81,7 @@ nav:
8081
- SNMPv3 configuration: "microk8s/configuration/snmpv3-configuration.md"
8182
- Splunk Infrastructure Monitoring: "microk8s/configuration/sim-configuration.md"
8283
- CoreDNS: "microk8s/configuration/coredns-configuration.md"
84+
- Protect redis and mongo by password: "microk8s/configuration/protect-by-password.md"
8385
- Offline Installation:
8486
- Install Microk8s: "microk8s/offlineinstallation/offline-microk8s.md"
8587
- Install Splunk OpenTelemetry Collector for Kubernetes: "microk8s/offlineinstallation/offline-sck.md"

0 commit comments

Comments
 (0)