From 452bcb82a35f677431115a2415ea2526f8576d7b Mon Sep 17 00:00:00 2001 From: Venkata Avinash Tanniru Date: Fri, 17 Jul 2026 11:04:15 -0500 Subject: [PATCH 1/9] LIB-876: propagate custom users to shard replsets in sharded clusters MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Custom users created via spec.users are created through mongos, which stores them on the config server only. Individual shard replica sets have no knowledge of these users, so direct-to-shard connections (e.g. for clusterSuperAdmin) fail with auth errors. Fix: after reconciling users via mongos, iterate over each shard replset and call handleUsers() directly against each shard's primary. This mirrors how system users (users.go) are propagated across all replsets via mongoClientWithRole. Roles are not re-applied to shards — role definitions only exist at the cluster level (config server / mongos) and do not need to be replicated. Bumps version to 1.22.0-4. --- .../perconaservermongodb/custom_users.go | 24 +++ .../perconaservermongodb/custom_users_test.go | 188 ++++++++++++++++++ pkg/version/version.txt | 2 +- 3 files changed, 213 insertions(+), 1 deletion(-) diff --git a/pkg/controller/perconaservermongodb/custom_users.go b/pkg/controller/perconaservermongodb/custom_users.go index 05f8eb81c4..a644ec1083 100644 --- a/pkg/controller/perconaservermongodb/custom_users.go +++ b/pkg/controller/perconaservermongodb/custom_users.go @@ -56,6 +56,30 @@ func (r *ReconcilePerconaServerMongoDB) reconcileCustomUsers(ctx context.Context return errors.Wrap(err, "handle users") } + // For sharded clusters, custom users are created via mongos which stores them + // on the config server only. Individual shard replica sets maintain their own + // local admin databases and are unaware of users created at the cluster level. + // To allow direct-to-shard connections (e.g. for clusterSuperAdmin), we must + // also propagate custom users to each shard replset directly. + if cr.Spec.Sharding.Enabled { + for i := range cr.Spec.Replsets { + rs := cr.Spec.Replsets[i] + shardCli, err := r.mongoClientWithRole(ctx, cr, rs, api.RoleUserAdmin) + if err != nil { + log.Error(err, "failed to get mongo client for shard", "replset", rs.Name) + continue + } + + if err := handleUsers(ctx, cr, shardCli, r.client); err != nil { + log.Error(err, "failed to handle users on shard", "replset", rs.Name) + } + + if err := shardCli.Disconnect(ctx); err != nil { + log.Error(err, "failed to close shard mongo connection", "replset", rs.Name) + } + } + } + return nil } diff --git a/pkg/controller/perconaservermongodb/custom_users_test.go b/pkg/controller/perconaservermongodb/custom_users_test.go index db055f7a42..7afed72d1f 100644 --- a/pkg/controller/perconaservermongodb/custom_users_test.go +++ b/pkg/controller/perconaservermongodb/custom_users_test.go @@ -2,6 +2,7 @@ package perconaservermongodb import ( "context" + "sync" "testing" "github.com/pkg/errors" @@ -9,6 +10,8 @@ import ( corev1 "k8s.io/api/core/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/runtime" + "go.mongodb.org/mongo-driver/mongo/options" + "go.mongodb.org/mongo-driver/mongo/readpref" "sigs.k8s.io/controller-runtime/pkg/client" "sigs.k8s.io/controller-runtime/pkg/client/fake" @@ -411,3 +414,188 @@ func TestGetCustomUserSecret(t *testing.T) { }) } } + +// trackingMongoClientProvider records which connections (mongos vs shard replset) +// were made during reconcileCustomUsers. +type trackingMongoClientProvider struct { + mu sync.Mutex + mongosCount int + shardCalls []string // replset names connected to directly + client client.Client +} + +func (p *trackingMongoClientProvider) Mongo(ctx context.Context, cr *api.PerconaServerMongoDB, rs *api.ReplsetSpec, role api.SystemUserRole) (mongo.Client, error) { + p.mu.Lock() + p.shardCalls = append(p.shardCalls, rs.Name) + p.mu.Unlock() + return &noopMongoClient{client: p.client, cr: cr}, nil +} + +func (p *trackingMongoClientProvider) Mongos(ctx context.Context, cr *api.PerconaServerMongoDB, role api.SystemUserRole) (mongo.Client, error) { + p.mu.Lock() + p.mongosCount++ + p.mu.Unlock() + return &noopMongoClient{client: p.client, cr: cr}, nil +} + +func (p *trackingMongoClientProvider) Standalone(ctx context.Context, cr *api.PerconaServerMongoDB, role api.SystemUserRole, host string, tlsEnabled bool) (mongo.Client, error) { + return &noopMongoClient{client: p.client, cr: cr}, nil +} + +// noopMongoClient is a mongo.Client that returns empty results for all calls — +// sufficient for testing that the right connections are made. +type noopMongoClient struct { + client client.Client + cr *api.PerconaServerMongoDB +} + +func (c *noopMongoClient) Disconnect(ctx context.Context) error { return nil } +func (c *noopMongoClient) Database(name string, opts ...*options.DatabaseOptions) mongo.ClientDatabase { + return nil +} +func (c *noopMongoClient) Ping(ctx context.Context, rp *readpref.ReadPref) error { return nil } +func (c *noopMongoClient) GetUserInfo(ctx context.Context, username, db string) (*mongo.User, error) { + return nil, nil +} +func (c *noopMongoClient) CreateUser(ctx context.Context, db, username, pwd string, roles ...mongo.Role) error { + return nil +} +func (c *noopMongoClient) UpdateUserPass(ctx context.Context, db, name, pass string) error { + return nil +} +func (c *noopMongoClient) UpdateUserRoles(ctx context.Context, db, username string, roles []mongo.Role) error { + return nil +} +func (c *noopMongoClient) UpdateUser(ctx context.Context, currName, newName, pass string) error { + return nil +} +func (c *noopMongoClient) GetRole(ctx context.Context, db, role string) (*mongo.Role, error) { + return nil, nil +} +func (c *noopMongoClient) CreateRole(ctx context.Context, db string, role mongo.Role) error { + return nil +} +func (c *noopMongoClient) UpdateRole(ctx context.Context, db string, role mongo.Role) error { + return nil +} +func (c *noopMongoClient) RSBuildInfo(ctx context.Context) (mongo.BuildInfo, error) { + return mongo.BuildInfo{}, nil +} +func (c *noopMongoClient) RSStatus(ctx context.Context) (mongo.Status, error) { + return mongo.Status{}, nil +} +func (c *noopMongoClient) WriteConfig(ctx context.Context, cfg mongo.RSConfig, force bool) error { + return nil +} +func (c *noopMongoClient) ReadConfig(ctx context.Context) (mongo.RSConfig, error) { + return mongo.RSConfig{}, nil +} +func (c *noopMongoClient) StartBalancer(ctx context.Context) error { return nil } +func (c *noopMongoClient) StopBalancer(ctx context.Context) error { return nil } +func (c *noopMongoClient) IsBalancerRunning(ctx context.Context) (bool, error) { + return false, nil +} +func (c *noopMongoClient) GetFCV(ctx context.Context) (string, error) { return "", nil } +func (c *noopMongoClient) SetFCV(ctx context.Context, version string) error { return nil } +func (c *noopMongoClient) ListDBs(ctx context.Context) (mongo.DBList, error) { + return mongo.DBList{}, nil +} +func (c *noopMongoClient) ListShard(ctx context.Context) (mongo.ShardList, error) { + return mongo.ShardList{}, nil +} +func (c *noopMongoClient) RemoveShard(ctx context.Context, shard string) (mongo.ShardRemoveResp, error) { + return mongo.ShardRemoveResp{}, nil +} +func (c *noopMongoClient) StepDown(ctx context.Context, seconds int, force bool) error { return nil } +func (c *noopMongoClient) IsMaster(ctx context.Context) (*mongo.IsMasterResp, error) { + return &mongo.IsMasterResp{}, nil +} +func (c *noopMongoClient) Freeze(ctx context.Context, seconds int) error { return nil } +func (c *noopMongoClient) SetDefaultRWConcern(ctx context.Context, readConcern, writeConcern string) error { + return nil +} +func (c *noopMongoClient) AddShard(ctx context.Context, rsName, host string) error { return nil } + +// TestReconcileCustomUsers_ShardedPropagation verifies that for a sharded cluster, +// reconcileCustomUsers connects to mongos once (cluster-level) AND to each shard +// replset directly, ensuring custom users like clusterSuperAdmin are created on shards. +func TestReconcileCustomUsers_ShardedPropagation(t *testing.T) { + ctx := context.Background() + scheme := runtime.NewScheme() + assert.NoError(t, corev1.AddToScheme(scheme)) + assert.NoError(t, api.SchemeBuilder.AddToScheme(scheme)) + + ns := "test-ns" + clusterName := "test-cluster" + + // Build internal secret so fetchSystemUserNames doesn't fail + internalSecret := &corev1.Secret{ + ObjectMeta: metav1.ObjectMeta{ + Name: "internal-" + clusterName + "-users", + Namespace: ns, + }, + Data: map[string][]byte{}, + } + + // Password secret for clusterSuperAdmin + passSecret := &corev1.Secret{ + ObjectMeta: metav1.ObjectMeta{ + Name: "internal-" + clusterName + "-users", + Namespace: ns, + }, + Data: map[string][]byte{ + "MONGODB_CLUSTER_SUPER_ADMIN_PASSWORD": []byte("supersecret"), + }, + } + _ = passSecret + + fakeClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(internalSecret).Build() + + cr := &api.PerconaServerMongoDB{ + ObjectMeta: metav1.ObjectMeta{ + Name: clusterName, + Namespace: ns, + }, + Spec: api.PerconaServerMongoDBSpec{ + Sharding: api.Sharding{ + Enabled: true, + }, + Replsets: []*api.ReplsetSpec{ + {Name: "rs0"}, + {Name: "rs1"}, + }, + Users: []api.User{ + { + Name: "clusterSuperAdmin", + DB: "admin", + PasswordSecretRef: &api.SecretKeySelector{ + Name: "internal-" + clusterName + "-users", + Key: "MONGODB_CLUSTER_SUPER_ADMIN_PASSWORD", + }, + Roles: []api.UserRole{ + {Name: "clusterAdmin", DB: "admin"}, + }, + }, + }, + }, + Status: api.PerconaServerMongoDBStatus{ + State: api.AppStateReady, + }, + } + + tracker := &trackingMongoClientProvider{client: fakeClient} + r := &ReconcilePerconaServerMongoDB{ + client: fakeClient, + mongoClientProvider: tracker, + } + + err := r.reconcileCustomUsers(ctx, cr) + assert.NoError(t, err) + + // Must have connected to mongos exactly once + assert.Equal(t, 1, tracker.mongosCount, "expected exactly 1 mongos connection") + + // Must have connected to each shard replset directly + assert.ElementsMatch(t, []string{"rs0", "rs1"}, tracker.shardCalls, + "expected direct connections to each shard replset") +} \ No newline at end of file diff --git a/pkg/version/version.txt b/pkg/version/version.txt index a7f9e4b846..2a93192ad1 100644 --- a/pkg/version/version.txt +++ b/pkg/version/version.txt @@ -1 +1 @@ -1.22.0-3 +1.22.0-4 From b65a15c6d73e46829753b1fb313480ea2e55ec0f Mon Sep 17 00:00:00 2001 From: Venkata Avinash Tanniru Date: Fri, 17 Jul 2026 11:26:28 -0500 Subject: [PATCH 2/9] chore: regenerate manifests for v1.22.0-4 --- config/crd/patches/versionlabel_in_psmdb.yaml | 2 +- config/crd/patches/versionlabel_in_psmdbbackup.yaml | 2 +- config/crd/patches/versionlabel_in_psmdbrestore.yaml | 2 +- deploy/bundle.yaml | 6 +++--- deploy/crd.yaml | 6 +++--- deploy/cw-bundle.yaml | 6 +++--- e2e-tests/version-service/conf/crd.yaml | 6 +++--- 7 files changed, 15 insertions(+), 15 deletions(-) diff --git a/config/crd/patches/versionlabel_in_psmdb.yaml b/config/crd/patches/versionlabel_in_psmdb.yaml index d4c14920ca..3c5006bf2a 100644 --- a/config/crd/patches/versionlabel_in_psmdb.yaml +++ b/config/crd/patches/versionlabel_in_psmdb.yaml @@ -4,6 +4,6 @@ metadata: name: perconaservermongodbs.psmdb.percona.com labels: app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/version: v1.22.0-3 + app.kubernetes.io/version: v1.22.0-4 app.kubernetes.io/component: crd app.kubernetes.io/part-of: percona-server-mongodb-operator diff --git a/config/crd/patches/versionlabel_in_psmdbbackup.yaml b/config/crd/patches/versionlabel_in_psmdbbackup.yaml index 297a7ac290..437941e799 100644 --- a/config/crd/patches/versionlabel_in_psmdbbackup.yaml +++ b/config/crd/patches/versionlabel_in_psmdbbackup.yaml @@ -4,6 +4,6 @@ metadata: name: perconaservermongodbbackups.psmdb.percona.com labels: app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/version: v1.22.0-3 + app.kubernetes.io/version: v1.22.0-4 app.kubernetes.io/component: crd app.kubernetes.io/part-of: percona-server-mongodb-operator diff --git a/config/crd/patches/versionlabel_in_psmdbrestore.yaml b/config/crd/patches/versionlabel_in_psmdbrestore.yaml index 05bfbe0d55..c773c8acda 100644 --- a/config/crd/patches/versionlabel_in_psmdbrestore.yaml +++ b/config/crd/patches/versionlabel_in_psmdbrestore.yaml @@ -4,6 +4,6 @@ metadata: name: perconaservermongodbrestores.psmdb.percona.com labels: app.kubernetes.io/name: percona-server-mongodb - app.kubernetes.io/version: v1.22.0-3 + app.kubernetes.io/version: v1.22.0-4 app.kubernetes.io/component: crd app.kubernetes.io/part-of: percona-server-mongodb-operator diff --git a/deploy/bundle.yaml b/deploy/bundle.yaml index a7ade0bb11..494dfefa7d 100644 --- a/deploy/bundle.yaml +++ b/deploy/bundle.yaml @@ -7,7 +7,7 @@ metadata: app.kubernetes.io/component: crd app.kubernetes.io/name: percona-server-mongodb app.kubernetes.io/part-of: percona-server-mongodb-operator - app.kubernetes.io/version: v1.22.0-3 + app.kubernetes.io/version: v1.22.0-4 name: perconaservermongodbbackups.psmdb.percona.com spec: group: psmdb.percona.com @@ -284,7 +284,7 @@ metadata: app.kubernetes.io/component: crd app.kubernetes.io/name: percona-server-mongodb app.kubernetes.io/part-of: percona-server-mongodb-operator - app.kubernetes.io/version: v1.22.0-3 + app.kubernetes.io/version: v1.22.0-4 name: perconaservermongodbrestores.psmdb.percona.com spec: group: psmdb.percona.com @@ -571,7 +571,7 @@ metadata: app.kubernetes.io/component: crd app.kubernetes.io/name: percona-server-mongodb app.kubernetes.io/part-of: percona-server-mongodb-operator - app.kubernetes.io/version: v1.22.0-3 + app.kubernetes.io/version: v1.22.0-4 name: perconaservermongodbs.psmdb.percona.com spec: group: psmdb.percona.com diff --git a/deploy/crd.yaml b/deploy/crd.yaml index 866cf2924f..35314cc5dc 100644 --- a/deploy/crd.yaml +++ b/deploy/crd.yaml @@ -7,7 +7,7 @@ metadata: app.kubernetes.io/component: crd app.kubernetes.io/name: percona-server-mongodb app.kubernetes.io/part-of: percona-server-mongodb-operator - app.kubernetes.io/version: v1.22.0-3 + app.kubernetes.io/version: v1.22.0-4 name: perconaservermongodbbackups.psmdb.percona.com spec: group: psmdb.percona.com @@ -284,7 +284,7 @@ metadata: app.kubernetes.io/component: crd app.kubernetes.io/name: percona-server-mongodb app.kubernetes.io/part-of: percona-server-mongodb-operator - app.kubernetes.io/version: v1.22.0-3 + app.kubernetes.io/version: v1.22.0-4 name: perconaservermongodbrestores.psmdb.percona.com spec: group: psmdb.percona.com @@ -571,7 +571,7 @@ metadata: app.kubernetes.io/component: crd app.kubernetes.io/name: percona-server-mongodb app.kubernetes.io/part-of: percona-server-mongodb-operator - app.kubernetes.io/version: v1.22.0-3 + app.kubernetes.io/version: v1.22.0-4 name: perconaservermongodbs.psmdb.percona.com spec: group: psmdb.percona.com diff --git a/deploy/cw-bundle.yaml b/deploy/cw-bundle.yaml index c6f7634dbe..acdafacc55 100644 --- a/deploy/cw-bundle.yaml +++ b/deploy/cw-bundle.yaml @@ -7,7 +7,7 @@ metadata: app.kubernetes.io/component: crd app.kubernetes.io/name: percona-server-mongodb app.kubernetes.io/part-of: percona-server-mongodb-operator - app.kubernetes.io/version: v1.22.0-3 + app.kubernetes.io/version: v1.22.0-4 name: perconaservermongodbbackups.psmdb.percona.com spec: group: psmdb.percona.com @@ -284,7 +284,7 @@ metadata: app.kubernetes.io/component: crd app.kubernetes.io/name: percona-server-mongodb app.kubernetes.io/part-of: percona-server-mongodb-operator - app.kubernetes.io/version: v1.22.0-3 + app.kubernetes.io/version: v1.22.0-4 name: perconaservermongodbrestores.psmdb.percona.com spec: group: psmdb.percona.com @@ -571,7 +571,7 @@ metadata: app.kubernetes.io/component: crd app.kubernetes.io/name: percona-server-mongodb app.kubernetes.io/part-of: percona-server-mongodb-operator - app.kubernetes.io/version: v1.22.0-3 + app.kubernetes.io/version: v1.22.0-4 name: perconaservermongodbs.psmdb.percona.com spec: group: psmdb.percona.com diff --git a/e2e-tests/version-service/conf/crd.yaml b/e2e-tests/version-service/conf/crd.yaml index 64fc72478a..35314cc5dc 100644 --- a/e2e-tests/version-service/conf/crd.yaml +++ b/e2e-tests/version-service/conf/crd.yaml @@ -7,7 +7,7 @@ metadata: app.kubernetes.io/component: crd app.kubernetes.io/name: percona-server-mongodb app.kubernetes.io/part-of: percona-server-mongodb-operator - app.kubernetes.io/version: v1.22.0 + app.kubernetes.io/version: v1.22.0-4 name: perconaservermongodbbackups.psmdb.percona.com spec: group: psmdb.percona.com @@ -284,7 +284,7 @@ metadata: app.kubernetes.io/component: crd app.kubernetes.io/name: percona-server-mongodb app.kubernetes.io/part-of: percona-server-mongodb-operator - app.kubernetes.io/version: v1.22.0 + app.kubernetes.io/version: v1.22.0-4 name: perconaservermongodbrestores.psmdb.percona.com spec: group: psmdb.percona.com @@ -571,7 +571,7 @@ metadata: app.kubernetes.io/component: crd app.kubernetes.io/name: percona-server-mongodb app.kubernetes.io/part-of: percona-server-mongodb-operator - app.kubernetes.io/version: v1.22.0 + app.kubernetes.io/version: v1.22.0-4 name: perconaservermongodbs.psmdb.percona.com spec: group: psmdb.percona.com From ae5b01bb3187791f6cab7de3cc1e74cf7e709618 Mon Sep 17 00:00:00 2001 From: Venkata Avinash Tanniru Date: Fri, 17 Jul 2026 11:29:42 -0500 Subject: [PATCH 3/9] chore: fix gofmt formatting in custom_users_test.go --- pkg/controller/perconaservermongodb/custom_users_test.go | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkg/controller/perconaservermongodb/custom_users_test.go b/pkg/controller/perconaservermongodb/custom_users_test.go index 7afed72d1f..729df3dfe6 100644 --- a/pkg/controller/perconaservermongodb/custom_users_test.go +++ b/pkg/controller/perconaservermongodb/custom_users_test.go @@ -7,11 +7,11 @@ import ( "github.com/pkg/errors" "github.com/stretchr/testify/assert" + "go.mongodb.org/mongo-driver/mongo/options" + "go.mongodb.org/mongo-driver/mongo/readpref" corev1 "k8s.io/api/core/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/runtime" - "go.mongodb.org/mongo-driver/mongo/options" - "go.mongodb.org/mongo-driver/mongo/readpref" "sigs.k8s.io/controller-runtime/pkg/client" "sigs.k8s.io/controller-runtime/pkg/client/fake" @@ -495,7 +495,7 @@ func (c *noopMongoClient) StopBalancer(ctx context.Context) error { return nil func (c *noopMongoClient) IsBalancerRunning(ctx context.Context) (bool, error) { return false, nil } -func (c *noopMongoClient) GetFCV(ctx context.Context) (string, error) { return "", nil } +func (c *noopMongoClient) GetFCV(ctx context.Context) (string, error) { return "", nil } func (c *noopMongoClient) SetFCV(ctx context.Context, version string) error { return nil } func (c *noopMongoClient) ListDBs(ctx context.Context) (mongo.DBList, error) { return mongo.DBList{}, nil @@ -598,4 +598,4 @@ func TestReconcileCustomUsers_ShardedPropagation(t *testing.T) { // Must have connected to each shard replset directly assert.ElementsMatch(t, []string{"rs0", "rs1"}, tracker.shardCalls, "expected direct connections to each shard replset") -} \ No newline at end of file +} From c9480efcaf2c19d26ae909bf660e515f3f518366 Mon Sep 17 00:00:00 2001 From: Venkata Avinash Tanniru Date: Fri, 17 Jul 2026 11:39:35 -0500 Subject: [PATCH 4/9] fix(ci): pin setup-envtest to v0.23.1 and update operator image refs - Pin setup-envtest to v0.23.1 matching our controller-runtime version (latest moved to v0.24.1 requiring Go 1.26, CI has 1.25.1) - Update deploy/operator.yaml and deploy/cw-operator.yaml image to perconalab/percona-server-mongodb-operator:main to match CI expectations from 'make manifests VERSION=main' --- Makefile | 2 +- deploy/bundle.yaml | 2 +- deploy/cw-bundle.yaml | 2 +- deploy/cw-operator.yaml | 2 +- deploy/operator.yaml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/Makefile b/Makefile index ac346ff5ff..974ec242d1 100644 --- a/Makefile +++ b/Makefile @@ -94,7 +94,7 @@ kustomize: ## Download kustomize locally if necessary. ENVTEST = $(shell pwd)/bin/setup-envtest envtest: ## Download envtest-setup locally if necessary. - $(call go-get-tool,$(ENVTEST),sigs.k8s.io/controller-runtime/tools/setup-envtest@latest) + $(call go-get-tool,$(ENVTEST),sigs.k8s.io/controller-runtime/tools/setup-envtest@v0.23.1) SWAGGER = $(shell pwd)/bin/swagger swagger: ## Download swagger locally if necessary. diff --git a/deploy/bundle.yaml b/deploy/bundle.yaml index 494dfefa7d..eb2cde0e1d 100644 --- a/deploy/bundle.yaml +++ b/deploy/bundle.yaml @@ -26706,7 +26706,7 @@ spec: serviceAccountName: percona-server-mongodb-operator containers: - name: percona-server-mongodb-operator - image: percona/percona-server-mongodb-operator:1.22.0 + image: perconalab/percona-server-mongodb-operator:main imagePullPolicy: Always livenessProbe: failureThreshold: 3 diff --git a/deploy/cw-bundle.yaml b/deploy/cw-bundle.yaml index acdafacc55..04f65dcee9 100644 --- a/deploy/cw-bundle.yaml +++ b/deploy/cw-bundle.yaml @@ -26734,7 +26734,7 @@ spec: serviceAccountName: percona-server-mongodb-operator containers: - name: percona-server-mongodb-operator - image: percona/percona-server-mongodb-operator:1.22.0 + image: perconalab/percona-server-mongodb-operator:main imagePullPolicy: Always livenessProbe: failureThreshold: 3 diff --git a/deploy/cw-operator.yaml b/deploy/cw-operator.yaml index 9832f4d857..1a1c9ea41a 100644 --- a/deploy/cw-operator.yaml +++ b/deploy/cw-operator.yaml @@ -25,7 +25,7 @@ spec: serviceAccountName: percona-server-mongodb-operator containers: - name: percona-server-mongodb-operator - image: percona/percona-server-mongodb-operator:1.22.0 + image: perconalab/percona-server-mongodb-operator:main imagePullPolicy: Always livenessProbe: failureThreshold: 3 diff --git a/deploy/operator.yaml b/deploy/operator.yaml index ff346db091..359515d48e 100644 --- a/deploy/operator.yaml +++ b/deploy/operator.yaml @@ -25,7 +25,7 @@ spec: serviceAccountName: percona-server-mongodb-operator containers: - name: percona-server-mongodb-operator - image: percona/percona-server-mongodb-operator:1.22.0 + image: perconalab/percona-server-mongodb-operator:main imagePullPolicy: Always livenessProbe: failureThreshold: 3 From f04cbeb9f55c35e020f18ac8391f08e8e37ae904 Mon Sep 17 00:00:00 2001 From: Venkata Avinash Tanniru Date: Fri, 17 Jul 2026 11:44:45 -0500 Subject: [PATCH 5/9] fix(ci): use setup-envtest@release-0.23 branch The @v0.23.1 tag doesn't contain the tools/setup-envtest package as a separate module. Using @release-0.23 branch which is compatible with Go 1.25.1 and contains the correct package structure. --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 974ec242d1..9476762a42 100644 --- a/Makefile +++ b/Makefile @@ -94,7 +94,7 @@ kustomize: ## Download kustomize locally if necessary. ENVTEST = $(shell pwd)/bin/setup-envtest envtest: ## Download envtest-setup locally if necessary. - $(call go-get-tool,$(ENVTEST),sigs.k8s.io/controller-runtime/tools/setup-envtest@v0.23.1) + $(call go-get-tool,$(ENVTEST),sigs.k8s.io/controller-runtime/tools/setup-envtest@release-0.23) SWAGGER = $(shell pwd)/bin/swagger swagger: ## Download swagger locally if necessary. From ec2f49efc49051e911243108062dd0671b4420e9 Mon Sep 17 00:00:00 2001 From: Venkata Avinash Tanniru Date: Fri, 17 Jul 2026 12:03:02 -0500 Subject: [PATCH 6/9] fix(test): regenerate statefulset golden files after LIB-982 encryption change LIB-982 disabled encryption at rest by default for community MongoDB images. The test fixtures still contained --enableEncryption flags and encryption key volume mounts. Regenerated all 9 fixtures to match the current operator behavior. --- .../reconcile-statefulset/cfg-arbiter.yaml | 105 ++++++++-------- .../reconcile-statefulset/cfg-hidden.yaml | 105 ++++++++-------- .../reconcile-statefulset/cfg-mongod.yaml | 105 ++++++++-------- .../reconcile-statefulset/cfg-nv.yaml | 105 ++++++++-------- .../reconcile-statefulset/rs0-arbiter.yaml | 14 +-- .../reconcile-statefulset/rs0-hidden.yaml | 106 ++++++++-------- .../reconcile-statefulset/rs0-logrotate.yaml | 114 +++++++++--------- .../reconcile-statefulset/rs0-mongod.yaml | 106 ++++++++-------- .../reconcile-statefulset/rs0-nv.yaml | 106 ++++++++-------- 9 files changed, 419 insertions(+), 447 deletions(-) diff --git a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/cfg-arbiter.yaml b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/cfg-arbiter.yaml index 01fee507d3..8794c0f548 100644 --- a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/cfg-arbiter.yaml +++ b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/cfg-arbiter.yaml @@ -64,8 +64,6 @@ spec: - --clusterAuthMode=x509 - --tlsMode=preferTLS - --configsvr - - --enableEncryption - - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - --wiredTigerCacheSizeGB=0.25 - --wiredTigerIndexPrefixCompression=true - --quiet @@ -162,9 +160,6 @@ spec: name: bin - mountPath: /.mongodb name: mongosh - - mountPath: /etc/mongodb-encryption - name: my-cluster-name-mongodb-encryption-key - readOnly: true - mountPath: /etc/users-secret name: users-secret-file workingDir: /data/db @@ -219,62 +214,66 @@ spec: readOnly: true - mountPath: /data/db name: mongod-data - - name: logs - image: percona/fluentbit:4.0.1-2 - command: [ "/opt/percona/logcollector/entrypoint.sh" ] - args: [ "fluent-bit" ] + - args: + - fluent-bit + command: + - /opt/percona/logcollector/entrypoint.sh env: - - name: LOG_DATA_DIR - value: /data/db/logs - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name + - name: LOG_DATA_DIR + value: /data/db/logs + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + image: percona/fluentbit:4.0.1-2 + name: logs resources: requests: cpu: 200m memory: 100M volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin - - mountPath: /opt/percona/logcollector/fluentbit/custom - name: log-collector-volume - - name: logrotate - image: percona/fluentbit:4.0.1-2 - command: [ "/opt/percona/logcollector/entrypoint.sh" ] - args: [ "logrotate" ] + - mountPath: /data/db + name: mongod-data + - mountPath: /opt/percona + name: bin + - mountPath: /opt/percona/logcollector/fluentbit/custom + name: log-collector-volume + - args: + - logrotate + command: + - /opt/percona/logcollector/entrypoint.sh env: - - name: MONGODB_HOST - value: localhost - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_USER - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_USER_ESCAPED - name: internal-reconcile-statefulset-cr-users - optional: false - - name: MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_PASSWORD_ESCAPED - name: internal-reconcile-statefulset-cr-users - optional: false + - name: MONGODB_HOST + value: localhost + - name: MONGODB_PORT + value: "27017" + - name: MONGODB_USER + valueFrom: + secretKeyRef: + key: MONGODB_CLUSTER_ADMIN_USER_ESCAPED + name: internal-reconcile-statefulset-cr-users + optional: false + - name: MONGODB_PASSWORD + valueFrom: + secretKeyRef: + key: MONGODB_CLUSTER_ADMIN_PASSWORD_ESCAPED + name: internal-reconcile-statefulset-cr-users + optional: false + image: percona/fluentbit:4.0.1-2 + name: logrotate resources: requests: cpu: 200m memory: 100M volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin + - mountPath: /data/db + name: mongod-data + - mountPath: /opt/percona + name: bin initContainers: - command: - /init-entrypoint.sh @@ -312,11 +311,6 @@ spec: name: reconcile-statefulset-cr-log-collector-config optional: true name: log-collector-volume - - name: my-cluster-name-mongodb-encryption-key - secret: - defaultMode: 288 - optional: false - secretName: my-cluster-name-mongodb-encryption-key - name: ssl secret: defaultMode: 288 @@ -345,3 +339,6 @@ spec: requests: storage: 3Gi status: {} +status: + availableReplicas: 0 + replicas: 0 diff --git a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/cfg-hidden.yaml b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/cfg-hidden.yaml index 01fee507d3..8794c0f548 100644 --- a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/cfg-hidden.yaml +++ b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/cfg-hidden.yaml @@ -64,8 +64,6 @@ spec: - --clusterAuthMode=x509 - --tlsMode=preferTLS - --configsvr - - --enableEncryption - - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - --wiredTigerCacheSizeGB=0.25 - --wiredTigerIndexPrefixCompression=true - --quiet @@ -162,9 +160,6 @@ spec: name: bin - mountPath: /.mongodb name: mongosh - - mountPath: /etc/mongodb-encryption - name: my-cluster-name-mongodb-encryption-key - readOnly: true - mountPath: /etc/users-secret name: users-secret-file workingDir: /data/db @@ -219,62 +214,66 @@ spec: readOnly: true - mountPath: /data/db name: mongod-data - - name: logs - image: percona/fluentbit:4.0.1-2 - command: [ "/opt/percona/logcollector/entrypoint.sh" ] - args: [ "fluent-bit" ] + - args: + - fluent-bit + command: + - /opt/percona/logcollector/entrypoint.sh env: - - name: LOG_DATA_DIR - value: /data/db/logs - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name + - name: LOG_DATA_DIR + value: /data/db/logs + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + image: percona/fluentbit:4.0.1-2 + name: logs resources: requests: cpu: 200m memory: 100M volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin - - mountPath: /opt/percona/logcollector/fluentbit/custom - name: log-collector-volume - - name: logrotate - image: percona/fluentbit:4.0.1-2 - command: [ "/opt/percona/logcollector/entrypoint.sh" ] - args: [ "logrotate" ] + - mountPath: /data/db + name: mongod-data + - mountPath: /opt/percona + name: bin + - mountPath: /opt/percona/logcollector/fluentbit/custom + name: log-collector-volume + - args: + - logrotate + command: + - /opt/percona/logcollector/entrypoint.sh env: - - name: MONGODB_HOST - value: localhost - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_USER - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_USER_ESCAPED - name: internal-reconcile-statefulset-cr-users - optional: false - - name: MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_PASSWORD_ESCAPED - name: internal-reconcile-statefulset-cr-users - optional: false + - name: MONGODB_HOST + value: localhost + - name: MONGODB_PORT + value: "27017" + - name: MONGODB_USER + valueFrom: + secretKeyRef: + key: MONGODB_CLUSTER_ADMIN_USER_ESCAPED + name: internal-reconcile-statefulset-cr-users + optional: false + - name: MONGODB_PASSWORD + valueFrom: + secretKeyRef: + key: MONGODB_CLUSTER_ADMIN_PASSWORD_ESCAPED + name: internal-reconcile-statefulset-cr-users + optional: false + image: percona/fluentbit:4.0.1-2 + name: logrotate resources: requests: cpu: 200m memory: 100M volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin + - mountPath: /data/db + name: mongod-data + - mountPath: /opt/percona + name: bin initContainers: - command: - /init-entrypoint.sh @@ -312,11 +311,6 @@ spec: name: reconcile-statefulset-cr-log-collector-config optional: true name: log-collector-volume - - name: my-cluster-name-mongodb-encryption-key - secret: - defaultMode: 288 - optional: false - secretName: my-cluster-name-mongodb-encryption-key - name: ssl secret: defaultMode: 288 @@ -345,3 +339,6 @@ spec: requests: storage: 3Gi status: {} +status: + availableReplicas: 0 + replicas: 0 diff --git a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/cfg-mongod.yaml b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/cfg-mongod.yaml index 01fee507d3..8794c0f548 100644 --- a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/cfg-mongod.yaml +++ b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/cfg-mongod.yaml @@ -64,8 +64,6 @@ spec: - --clusterAuthMode=x509 - --tlsMode=preferTLS - --configsvr - - --enableEncryption - - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - --wiredTigerCacheSizeGB=0.25 - --wiredTigerIndexPrefixCompression=true - --quiet @@ -162,9 +160,6 @@ spec: name: bin - mountPath: /.mongodb name: mongosh - - mountPath: /etc/mongodb-encryption - name: my-cluster-name-mongodb-encryption-key - readOnly: true - mountPath: /etc/users-secret name: users-secret-file workingDir: /data/db @@ -219,62 +214,66 @@ spec: readOnly: true - mountPath: /data/db name: mongod-data - - name: logs - image: percona/fluentbit:4.0.1-2 - command: [ "/opt/percona/logcollector/entrypoint.sh" ] - args: [ "fluent-bit" ] + - args: + - fluent-bit + command: + - /opt/percona/logcollector/entrypoint.sh env: - - name: LOG_DATA_DIR - value: /data/db/logs - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name + - name: LOG_DATA_DIR + value: /data/db/logs + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + image: percona/fluentbit:4.0.1-2 + name: logs resources: requests: cpu: 200m memory: 100M volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin - - mountPath: /opt/percona/logcollector/fluentbit/custom - name: log-collector-volume - - name: logrotate - image: percona/fluentbit:4.0.1-2 - command: [ "/opt/percona/logcollector/entrypoint.sh" ] - args: [ "logrotate" ] + - mountPath: /data/db + name: mongod-data + - mountPath: /opt/percona + name: bin + - mountPath: /opt/percona/logcollector/fluentbit/custom + name: log-collector-volume + - args: + - logrotate + command: + - /opt/percona/logcollector/entrypoint.sh env: - - name: MONGODB_HOST - value: localhost - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_USER - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_USER_ESCAPED - name: internal-reconcile-statefulset-cr-users - optional: false - - name: MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_PASSWORD_ESCAPED - name: internal-reconcile-statefulset-cr-users - optional: false + - name: MONGODB_HOST + value: localhost + - name: MONGODB_PORT + value: "27017" + - name: MONGODB_USER + valueFrom: + secretKeyRef: + key: MONGODB_CLUSTER_ADMIN_USER_ESCAPED + name: internal-reconcile-statefulset-cr-users + optional: false + - name: MONGODB_PASSWORD + valueFrom: + secretKeyRef: + key: MONGODB_CLUSTER_ADMIN_PASSWORD_ESCAPED + name: internal-reconcile-statefulset-cr-users + optional: false + image: percona/fluentbit:4.0.1-2 + name: logrotate resources: requests: cpu: 200m memory: 100M volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin + - mountPath: /data/db + name: mongod-data + - mountPath: /opt/percona + name: bin initContainers: - command: - /init-entrypoint.sh @@ -312,11 +311,6 @@ spec: name: reconcile-statefulset-cr-log-collector-config optional: true name: log-collector-volume - - name: my-cluster-name-mongodb-encryption-key - secret: - defaultMode: 288 - optional: false - secretName: my-cluster-name-mongodb-encryption-key - name: ssl secret: defaultMode: 288 @@ -345,3 +339,6 @@ spec: requests: storage: 3Gi status: {} +status: + availableReplicas: 0 + replicas: 0 diff --git a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/cfg-nv.yaml b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/cfg-nv.yaml index 01fee507d3..8794c0f548 100644 --- a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/cfg-nv.yaml +++ b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/cfg-nv.yaml @@ -64,8 +64,6 @@ spec: - --clusterAuthMode=x509 - --tlsMode=preferTLS - --configsvr - - --enableEncryption - - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - --wiredTigerCacheSizeGB=0.25 - --wiredTigerIndexPrefixCompression=true - --quiet @@ -162,9 +160,6 @@ spec: name: bin - mountPath: /.mongodb name: mongosh - - mountPath: /etc/mongodb-encryption - name: my-cluster-name-mongodb-encryption-key - readOnly: true - mountPath: /etc/users-secret name: users-secret-file workingDir: /data/db @@ -219,62 +214,66 @@ spec: readOnly: true - mountPath: /data/db name: mongod-data - - name: logs - image: percona/fluentbit:4.0.1-2 - command: [ "/opt/percona/logcollector/entrypoint.sh" ] - args: [ "fluent-bit" ] + - args: + - fluent-bit + command: + - /opt/percona/logcollector/entrypoint.sh env: - - name: LOG_DATA_DIR - value: /data/db/logs - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name + - name: LOG_DATA_DIR + value: /data/db/logs + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + image: percona/fluentbit:4.0.1-2 + name: logs resources: requests: cpu: 200m memory: 100M volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin - - mountPath: /opt/percona/logcollector/fluentbit/custom - name: log-collector-volume - - name: logrotate - image: percona/fluentbit:4.0.1-2 - command: [ "/opt/percona/logcollector/entrypoint.sh" ] - args: [ "logrotate" ] + - mountPath: /data/db + name: mongod-data + - mountPath: /opt/percona + name: bin + - mountPath: /opt/percona/logcollector/fluentbit/custom + name: log-collector-volume + - args: + - logrotate + command: + - /opt/percona/logcollector/entrypoint.sh env: - - name: MONGODB_HOST - value: localhost - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_USER - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_USER_ESCAPED - name: internal-reconcile-statefulset-cr-users - optional: false - - name: MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_PASSWORD_ESCAPED - name: internal-reconcile-statefulset-cr-users - optional: false + - name: MONGODB_HOST + value: localhost + - name: MONGODB_PORT + value: "27017" + - name: MONGODB_USER + valueFrom: + secretKeyRef: + key: MONGODB_CLUSTER_ADMIN_USER_ESCAPED + name: internal-reconcile-statefulset-cr-users + optional: false + - name: MONGODB_PASSWORD + valueFrom: + secretKeyRef: + key: MONGODB_CLUSTER_ADMIN_PASSWORD_ESCAPED + name: internal-reconcile-statefulset-cr-users + optional: false + image: percona/fluentbit:4.0.1-2 + name: logrotate resources: requests: cpu: 200m memory: 100M volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin + - mountPath: /data/db + name: mongod-data + - mountPath: /opt/percona + name: bin initContainers: - command: - /init-entrypoint.sh @@ -312,11 +311,6 @@ spec: name: reconcile-statefulset-cr-log-collector-config optional: true name: log-collector-volume - - name: my-cluster-name-mongodb-encryption-key - secret: - defaultMode: 288 - optional: false - secretName: my-cluster-name-mongodb-encryption-key - name: ssl secret: defaultMode: 288 @@ -345,3 +339,6 @@ spec: requests: storage: 3Gi status: {} +status: + availableReplicas: 0 + replicas: 0 diff --git a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-arbiter.yaml b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-arbiter.yaml index cff3c480ea..0899147661 100644 --- a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-arbiter.yaml +++ b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-arbiter.yaml @@ -64,8 +64,6 @@ spec: - --clusterAuthMode=x509 - --tlsMode=preferTLS - --shardsvr - - --enableEncryption - - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - --wiredTigerCacheSizeGB=0.25 - --wiredTigerIndexPrefixCompression=true - --quiet @@ -146,7 +144,6 @@ spec: securityContext: runAsNonRoot: true runAsUser: 1001 - topologySpreadConstraints: null volumeMounts: - mountPath: /data/db name: mongod-data @@ -163,9 +160,6 @@ spec: name: bin - mountPath: /.mongodb name: mongosh - - mountPath: /etc/mongodb-encryption - name: my-cluster-name-mongodb-encryption-key - readOnly: true - mountPath: /etc/users-secret name: users-secret-file workingDir: /data/db @@ -204,11 +198,6 @@ spec: name: reconcile-statefulset-cr-log-collector-config optional: true name: log-collector-volume - - name: my-cluster-name-mongodb-encryption-key - secret: - defaultMode: 288 - optional: false - secretName: my-cluster-name-mongodb-encryption-key - name: ssl secret: defaultMode: 288 @@ -226,3 +215,6 @@ spec: name: mongod-data updateStrategy: type: OnDelete +status: + availableReplicas: 0 + replicas: 0 diff --git a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-hidden.yaml b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-hidden.yaml index ee58544c69..c894b2bdf7 100644 --- a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-hidden.yaml +++ b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-hidden.yaml @@ -64,8 +64,6 @@ spec: - --clusterAuthMode=x509 - --tlsMode=preferTLS - --shardsvr - - --enableEncryption - - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - --wiredTigerCacheSizeGB=0.25 - --wiredTigerIndexPrefixCompression=true - --quiet @@ -161,9 +159,6 @@ spec: name: bin - mountPath: /.mongodb name: mongosh - - mountPath: /etc/mongodb-encryption - name: my-cluster-name-mongodb-encryption-key - readOnly: true - mountPath: /etc/users-secret name: users-secret-file workingDir: /data/db @@ -218,62 +213,66 @@ spec: readOnly: true - mountPath: /data/db name: mongod-data - - name: logs - image: percona/fluentbit:4.0.1-2 - command: [ "/opt/percona/logcollector/entrypoint.sh" ] - args: [ "fluent-bit" ] + - args: + - fluent-bit + command: + - /opt/percona/logcollector/entrypoint.sh env: - - name: LOG_DATA_DIR - value: /data/db/logs - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name + - name: LOG_DATA_DIR + value: /data/db/logs + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + image: percona/fluentbit:4.0.1-2 + name: logs resources: requests: cpu: 200m memory: 100M volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin - - mountPath: /opt/percona/logcollector/fluentbit/custom - name: log-collector-volume - - name: logrotate - image: percona/fluentbit:4.0.1-2 - command: [ "/opt/percona/logcollector/entrypoint.sh" ] - args: [ "logrotate" ] + - mountPath: /data/db + name: mongod-data + - mountPath: /opt/percona + name: bin + - mountPath: /opt/percona/logcollector/fluentbit/custom + name: log-collector-volume + - args: + - logrotate + command: + - /opt/percona/logcollector/entrypoint.sh env: - - name: MONGODB_HOST - value: localhost - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_USER - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_USER_ESCAPED - name: internal-reconcile-statefulset-cr-users - optional: false - - name: MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_PASSWORD_ESCAPED - name: internal-reconcile-statefulset-cr-users - optional: false + - name: MONGODB_HOST + value: localhost + - name: MONGODB_PORT + value: "27017" + - name: MONGODB_USER + valueFrom: + secretKeyRef: + key: MONGODB_CLUSTER_ADMIN_USER_ESCAPED + name: internal-reconcile-statefulset-cr-users + optional: false + - name: MONGODB_PASSWORD + valueFrom: + secretKeyRef: + key: MONGODB_CLUSTER_ADMIN_PASSWORD_ESCAPED + name: internal-reconcile-statefulset-cr-users + optional: false + image: percona/fluentbit:4.0.1-2 + name: logrotate resources: requests: cpu: 200m memory: 100M volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin + - mountPath: /data/db + name: mongod-data + - mountPath: /opt/percona + name: bin initContainers: - command: - /init-entrypoint.sh @@ -311,11 +310,6 @@ spec: name: reconcile-statefulset-cr-log-collector-config optional: true name: log-collector-volume - - name: my-cluster-name-mongodb-encryption-key - secret: - defaultMode: 288 - optional: false - secretName: my-cluster-name-mongodb-encryption-key - name: ssl secret: defaultMode: 288 @@ -343,3 +337,7 @@ spec: resources: requests: storage: 3Gi + status: {} +status: + availableReplicas: 0 + replicas: 0 diff --git a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-logrotate.yaml b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-logrotate.yaml index cfdd563845..f2cd476758 100644 --- a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-logrotate.yaml +++ b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-logrotate.yaml @@ -64,8 +64,6 @@ spec: - --clusterAuthMode=x509 - --tlsMode=preferTLS - --shardsvr - - --enableEncryption - - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - --wiredTigerCacheSizeGB=0.25 - --wiredTigerIndexPrefixCompression=true - --quiet @@ -162,9 +160,6 @@ spec: name: bin - mountPath: /.mongodb name: mongosh - - mountPath: /etc/mongodb-encryption - name: my-cluster-name-mongodb-encryption-key - readOnly: true - mountPath: /etc/users-secret name: users-secret-file workingDir: /data/db @@ -219,66 +214,70 @@ spec: readOnly: true - mountPath: /data/db name: mongod-data - - name: logs - image: percona/fluentbit:4.0.1-2 - command: [ "/opt/percona/logcollector/entrypoint.sh" ] - args: [ "fluent-bit" ] + - args: + - fluent-bit + command: + - /opt/percona/logcollector/entrypoint.sh env: - - name: LOG_DATA_DIR - value: /data/db/logs - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name + - name: LOG_DATA_DIR + value: /data/db/logs + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + image: percona/fluentbit:4.0.1-2 + name: logs resources: requests: cpu: 200m memory: 100M volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin - - mountPath: /opt/percona/logcollector/fluentbit/custom - name: log-collector-volume - - name: logrotate - image: percona/fluentbit:4.0.1-2 - command: [ "/opt/percona/logcollector/entrypoint.sh" ] - args: [ "logrotate" ] + - mountPath: /data/db + name: mongod-data + - mountPath: /opt/percona + name: bin + - mountPath: /opt/percona/logcollector/fluentbit/custom + name: log-collector-volume + - args: + - logrotate + command: + - /opt/percona/logcollector/entrypoint.sh env: - - name: MONGODB_HOST - value: localhost - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_USER - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_USER_ESCAPED - name: internal-reconcile-statefulset-cr-users - optional: false - - name: MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_PASSWORD_ESCAPED - name: internal-reconcile-statefulset-cr-users - optional: false - - name: LOGROTATE_SCHEDULE - value: "0 0 */2 * *" + - name: MONGODB_HOST + value: localhost + - name: MONGODB_PORT + value: "27017" + - name: MONGODB_USER + valueFrom: + secretKeyRef: + key: MONGODB_CLUSTER_ADMIN_USER_ESCAPED + name: internal-reconcile-statefulset-cr-users + optional: false + - name: MONGODB_PASSWORD + valueFrom: + secretKeyRef: + key: MONGODB_CLUSTER_ADMIN_PASSWORD_ESCAPED + name: internal-reconcile-statefulset-cr-users + optional: false + - name: LOGROTATE_SCHEDULE + value: 0 0 */2 * * + image: percona/fluentbit:4.0.1-2 + name: logrotate resources: requests: cpu: 200m memory: 100M volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin - - mountPath: /opt/percona/logcollector/logrotate/conf.d - name: logrotate-config + - mountPath: /data/db + name: mongod-data + - mountPath: /opt/percona + name: bin + - mountPath: /opt/percona/logcollector/logrotate/conf.d + name: logrotate-config initContainers: - command: - /init-entrypoint.sh @@ -325,11 +324,6 @@ spec: - configMap: name: extra-config optional: true - - name: my-cluster-name-mongodb-encryption-key - secret: - defaultMode: 288 - optional: false - secretName: my-cluster-name-mongodb-encryption-key - name: ssl secret: defaultMode: 288 @@ -357,3 +351,7 @@ spec: resources: requests: storage: 3Gi + status: {} +status: + availableReplicas: 0 + replicas: 0 diff --git a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-mongod.yaml b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-mongod.yaml index dd732e029c..ff0fe4201c 100644 --- a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-mongod.yaml +++ b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-mongod.yaml @@ -64,8 +64,6 @@ spec: - --clusterAuthMode=x509 - --tlsMode=preferTLS - --shardsvr - - --enableEncryption - - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - --wiredTigerCacheSizeGB=0.25 - --wiredTigerIndexPrefixCompression=true - --quiet @@ -162,9 +160,6 @@ spec: name: bin - mountPath: /.mongodb name: mongosh - - mountPath: /etc/mongodb-encryption - name: my-cluster-name-mongodb-encryption-key - readOnly: true - mountPath: /etc/users-secret name: users-secret-file workingDir: /data/db @@ -219,62 +214,66 @@ spec: readOnly: true - mountPath: /data/db name: mongod-data - - name: logs - image: percona/fluentbit:4.0.1-2 - command: [ "/opt/percona/logcollector/entrypoint.sh" ] - args: [ "fluent-bit" ] + - args: + - fluent-bit + command: + - /opt/percona/logcollector/entrypoint.sh env: - - name: LOG_DATA_DIR - value: /data/db/logs - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name + - name: LOG_DATA_DIR + value: /data/db/logs + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + image: percona/fluentbit:4.0.1-2 + name: logs resources: requests: cpu: 200m memory: 100M volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin - - mountPath: /opt/percona/logcollector/fluentbit/custom - name: log-collector-volume - - name: logrotate - image: percona/fluentbit:4.0.1-2 - command: [ "/opt/percona/logcollector/entrypoint.sh" ] - args: [ "logrotate" ] + - mountPath: /data/db + name: mongod-data + - mountPath: /opt/percona + name: bin + - mountPath: /opt/percona/logcollector/fluentbit/custom + name: log-collector-volume + - args: + - logrotate + command: + - /opt/percona/logcollector/entrypoint.sh env: - - name: MONGODB_HOST - value: localhost - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_USER - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_USER_ESCAPED - name: internal-reconcile-statefulset-cr-users - optional: false - - name: MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_PASSWORD_ESCAPED - name: internal-reconcile-statefulset-cr-users - optional: false + - name: MONGODB_HOST + value: localhost + - name: MONGODB_PORT + value: "27017" + - name: MONGODB_USER + valueFrom: + secretKeyRef: + key: MONGODB_CLUSTER_ADMIN_USER_ESCAPED + name: internal-reconcile-statefulset-cr-users + optional: false + - name: MONGODB_PASSWORD + valueFrom: + secretKeyRef: + key: MONGODB_CLUSTER_ADMIN_PASSWORD_ESCAPED + name: internal-reconcile-statefulset-cr-users + optional: false + image: percona/fluentbit:4.0.1-2 + name: logrotate resources: requests: cpu: 200m memory: 100M volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin + - mountPath: /data/db + name: mongod-data + - mountPath: /opt/percona + name: bin initContainers: - command: - /init-entrypoint.sh @@ -312,11 +311,6 @@ spec: name: reconcile-statefulset-cr-log-collector-config optional: true name: log-collector-volume - - name: my-cluster-name-mongodb-encryption-key - secret: - defaultMode: 288 - optional: false - secretName: my-cluster-name-mongodb-encryption-key - name: ssl secret: defaultMode: 288 @@ -344,3 +338,7 @@ spec: resources: requests: storage: 3Gi + status: {} +status: + availableReplicas: 0 + replicas: 0 diff --git a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-nv.yaml b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-nv.yaml index 2f19fd60f5..586120cce9 100644 --- a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-nv.yaml +++ b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-nv.yaml @@ -64,8 +64,6 @@ spec: - --clusterAuthMode=x509 - --tlsMode=preferTLS - --shardsvr - - --enableEncryption - - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - --wiredTigerCacheSizeGB=0.25 - --wiredTigerIndexPrefixCompression=true - --quiet @@ -161,9 +159,6 @@ spec: name: bin - mountPath: /.mongodb name: mongosh - - mountPath: /etc/mongodb-encryption - name: my-cluster-name-mongodb-encryption-key - readOnly: true - mountPath: /etc/users-secret name: users-secret-file workingDir: /data/db @@ -218,62 +213,66 @@ spec: readOnly: true - mountPath: /data/db name: mongod-data - - name: logs - image: percona/fluentbit:4.0.1-2 - command: [ "/opt/percona/logcollector/entrypoint.sh" ] - args: [ "fluent-bit" ] + - args: + - fluent-bit + command: + - /opt/percona/logcollector/entrypoint.sh env: - - name: LOG_DATA_DIR - value: /data/db/logs - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name + - name: LOG_DATA_DIR + value: /data/db/logs + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + image: percona/fluentbit:4.0.1-2 + name: logs resources: requests: cpu: 200m memory: 100M volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin - - mountPath: /opt/percona/logcollector/fluentbit/custom - name: log-collector-volume - - name: logrotate - image: percona/fluentbit:4.0.1-2 - command: [ "/opt/percona/logcollector/entrypoint.sh" ] - args: [ "logrotate" ] + - mountPath: /data/db + name: mongod-data + - mountPath: /opt/percona + name: bin + - mountPath: /opt/percona/logcollector/fluentbit/custom + name: log-collector-volume + - args: + - logrotate + command: + - /opt/percona/logcollector/entrypoint.sh env: - - name: MONGODB_HOST - value: localhost - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_USER - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_USER_ESCAPED - name: internal-reconcile-statefulset-cr-users - optional: false - - name: MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_PASSWORD_ESCAPED - name: internal-reconcile-statefulset-cr-users - optional: false + - name: MONGODB_HOST + value: localhost + - name: MONGODB_PORT + value: "27017" + - name: MONGODB_USER + valueFrom: + secretKeyRef: + key: MONGODB_CLUSTER_ADMIN_USER_ESCAPED + name: internal-reconcile-statefulset-cr-users + optional: false + - name: MONGODB_PASSWORD + valueFrom: + secretKeyRef: + key: MONGODB_CLUSTER_ADMIN_PASSWORD_ESCAPED + name: internal-reconcile-statefulset-cr-users + optional: false + image: percona/fluentbit:4.0.1-2 + name: logrotate resources: requests: cpu: 200m memory: 100M volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin + - mountPath: /data/db + name: mongod-data + - mountPath: /opt/percona + name: bin initContainers: - command: - /init-entrypoint.sh @@ -311,11 +310,6 @@ spec: name: reconcile-statefulset-cr-log-collector-config optional: true name: log-collector-volume - - name: my-cluster-name-mongodb-encryption-key - secret: - defaultMode: 288 - optional: false - secretName: my-cluster-name-mongodb-encryption-key - name: ssl secret: defaultMode: 288 @@ -343,3 +337,7 @@ spec: resources: requests: storage: 3Gi + status: {} +status: + availableReplicas: 0 + replicas: 0 From 7a7ff2365f8cb361500507c35d1bb2d61b6036e9 Mon Sep 17 00:00:00 2001 From: Venkata Avinash Tanniru Date: Fri, 17 Jul 2026 16:14:32 -0500 Subject: [PATCH 7/9] Revert "fix(test): regenerate statefulset golden files after LIB-982 encryption change" This reverts commit ec2f49efc49051e911243108062dd0671b4420e9. --- .../reconcile-statefulset/cfg-arbiter.yaml | 105 ++++++++-------- .../reconcile-statefulset/cfg-hidden.yaml | 105 ++++++++-------- .../reconcile-statefulset/cfg-mongod.yaml | 105 ++++++++-------- .../reconcile-statefulset/cfg-nv.yaml | 105 ++++++++-------- .../reconcile-statefulset/rs0-arbiter.yaml | 14 ++- .../reconcile-statefulset/rs0-hidden.yaml | 106 ++++++++-------- .../reconcile-statefulset/rs0-logrotate.yaml | 114 +++++++++--------- .../reconcile-statefulset/rs0-mongod.yaml | 106 ++++++++-------- .../reconcile-statefulset/rs0-nv.yaml | 106 ++++++++-------- 9 files changed, 447 insertions(+), 419 deletions(-) diff --git a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/cfg-arbiter.yaml b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/cfg-arbiter.yaml index 8794c0f548..01fee507d3 100644 --- a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/cfg-arbiter.yaml +++ b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/cfg-arbiter.yaml @@ -64,6 +64,8 @@ spec: - --clusterAuthMode=x509 - --tlsMode=preferTLS - --configsvr + - --enableEncryption + - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - --wiredTigerCacheSizeGB=0.25 - --wiredTigerIndexPrefixCompression=true - --quiet @@ -160,6 +162,9 @@ spec: name: bin - mountPath: /.mongodb name: mongosh + - mountPath: /etc/mongodb-encryption + name: my-cluster-name-mongodb-encryption-key + readOnly: true - mountPath: /etc/users-secret name: users-secret-file workingDir: /data/db @@ -214,66 +219,62 @@ spec: readOnly: true - mountPath: /data/db name: mongod-data - - args: - - fluent-bit - command: - - /opt/percona/logcollector/entrypoint.sh - env: - - name: LOG_DATA_DIR - value: /data/db/logs - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name + - name: logs image: percona/fluentbit:4.0.1-2 - name: logs + command: [ "/opt/percona/logcollector/entrypoint.sh" ] + args: [ "fluent-bit" ] + env: + - name: LOG_DATA_DIR + value: /data/db/logs + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name resources: requests: cpu: 200m memory: 100M volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin - - mountPath: /opt/percona/logcollector/fluentbit/custom - name: log-collector-volume - - args: - - logrotate - command: - - /opt/percona/logcollector/entrypoint.sh - env: - - name: MONGODB_HOST - value: localhost - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_USER - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_USER_ESCAPED - name: internal-reconcile-statefulset-cr-users - optional: false - - name: MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_PASSWORD_ESCAPED - name: internal-reconcile-statefulset-cr-users - optional: false + - mountPath: /data/db + name: mongod-data + - mountPath: /opt/percona + name: bin + - mountPath: /opt/percona/logcollector/fluentbit/custom + name: log-collector-volume + - name: logrotate image: percona/fluentbit:4.0.1-2 - name: logrotate + command: [ "/opt/percona/logcollector/entrypoint.sh" ] + args: [ "logrotate" ] + env: + - name: MONGODB_HOST + value: localhost + - name: MONGODB_PORT + value: "27017" + - name: MONGODB_USER + valueFrom: + secretKeyRef: + key: MONGODB_CLUSTER_ADMIN_USER_ESCAPED + name: internal-reconcile-statefulset-cr-users + optional: false + - name: MONGODB_PASSWORD + valueFrom: + secretKeyRef: + key: MONGODB_CLUSTER_ADMIN_PASSWORD_ESCAPED + name: internal-reconcile-statefulset-cr-users + optional: false resources: requests: cpu: 200m memory: 100M volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin + - mountPath: /data/db + name: mongod-data + - mountPath: /opt/percona + name: bin initContainers: - command: - /init-entrypoint.sh @@ -311,6 +312,11 @@ spec: name: reconcile-statefulset-cr-log-collector-config optional: true name: log-collector-volume + - name: my-cluster-name-mongodb-encryption-key + secret: + defaultMode: 288 + optional: false + secretName: my-cluster-name-mongodb-encryption-key - name: ssl secret: defaultMode: 288 @@ -339,6 +345,3 @@ spec: requests: storage: 3Gi status: {} -status: - availableReplicas: 0 - replicas: 0 diff --git a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/cfg-hidden.yaml b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/cfg-hidden.yaml index 8794c0f548..01fee507d3 100644 --- a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/cfg-hidden.yaml +++ b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/cfg-hidden.yaml @@ -64,6 +64,8 @@ spec: - --clusterAuthMode=x509 - --tlsMode=preferTLS - --configsvr + - --enableEncryption + - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - --wiredTigerCacheSizeGB=0.25 - --wiredTigerIndexPrefixCompression=true - --quiet @@ -160,6 +162,9 @@ spec: name: bin - mountPath: /.mongodb name: mongosh + - mountPath: /etc/mongodb-encryption + name: my-cluster-name-mongodb-encryption-key + readOnly: true - mountPath: /etc/users-secret name: users-secret-file workingDir: /data/db @@ -214,66 +219,62 @@ spec: readOnly: true - mountPath: /data/db name: mongod-data - - args: - - fluent-bit - command: - - /opt/percona/logcollector/entrypoint.sh - env: - - name: LOG_DATA_DIR - value: /data/db/logs - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name + - name: logs image: percona/fluentbit:4.0.1-2 - name: logs + command: [ "/opt/percona/logcollector/entrypoint.sh" ] + args: [ "fluent-bit" ] + env: + - name: LOG_DATA_DIR + value: /data/db/logs + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name resources: requests: cpu: 200m memory: 100M volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin - - mountPath: /opt/percona/logcollector/fluentbit/custom - name: log-collector-volume - - args: - - logrotate - command: - - /opt/percona/logcollector/entrypoint.sh - env: - - name: MONGODB_HOST - value: localhost - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_USER - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_USER_ESCAPED - name: internal-reconcile-statefulset-cr-users - optional: false - - name: MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_PASSWORD_ESCAPED - name: internal-reconcile-statefulset-cr-users - optional: false + - mountPath: /data/db + name: mongod-data + - mountPath: /opt/percona + name: bin + - mountPath: /opt/percona/logcollector/fluentbit/custom + name: log-collector-volume + - name: logrotate image: percona/fluentbit:4.0.1-2 - name: logrotate + command: [ "/opt/percona/logcollector/entrypoint.sh" ] + args: [ "logrotate" ] + env: + - name: MONGODB_HOST + value: localhost + - name: MONGODB_PORT + value: "27017" + - name: MONGODB_USER + valueFrom: + secretKeyRef: + key: MONGODB_CLUSTER_ADMIN_USER_ESCAPED + name: internal-reconcile-statefulset-cr-users + optional: false + - name: MONGODB_PASSWORD + valueFrom: + secretKeyRef: + key: MONGODB_CLUSTER_ADMIN_PASSWORD_ESCAPED + name: internal-reconcile-statefulset-cr-users + optional: false resources: requests: cpu: 200m memory: 100M volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin + - mountPath: /data/db + name: mongod-data + - mountPath: /opt/percona + name: bin initContainers: - command: - /init-entrypoint.sh @@ -311,6 +312,11 @@ spec: name: reconcile-statefulset-cr-log-collector-config optional: true name: log-collector-volume + - name: my-cluster-name-mongodb-encryption-key + secret: + defaultMode: 288 + optional: false + secretName: my-cluster-name-mongodb-encryption-key - name: ssl secret: defaultMode: 288 @@ -339,6 +345,3 @@ spec: requests: storage: 3Gi status: {} -status: - availableReplicas: 0 - replicas: 0 diff --git a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/cfg-mongod.yaml b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/cfg-mongod.yaml index 8794c0f548..01fee507d3 100644 --- a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/cfg-mongod.yaml +++ b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/cfg-mongod.yaml @@ -64,6 +64,8 @@ spec: - --clusterAuthMode=x509 - --tlsMode=preferTLS - --configsvr + - --enableEncryption + - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - --wiredTigerCacheSizeGB=0.25 - --wiredTigerIndexPrefixCompression=true - --quiet @@ -160,6 +162,9 @@ spec: name: bin - mountPath: /.mongodb name: mongosh + - mountPath: /etc/mongodb-encryption + name: my-cluster-name-mongodb-encryption-key + readOnly: true - mountPath: /etc/users-secret name: users-secret-file workingDir: /data/db @@ -214,66 +219,62 @@ spec: readOnly: true - mountPath: /data/db name: mongod-data - - args: - - fluent-bit - command: - - /opt/percona/logcollector/entrypoint.sh - env: - - name: LOG_DATA_DIR - value: /data/db/logs - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name + - name: logs image: percona/fluentbit:4.0.1-2 - name: logs + command: [ "/opt/percona/logcollector/entrypoint.sh" ] + args: [ "fluent-bit" ] + env: + - name: LOG_DATA_DIR + value: /data/db/logs + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name resources: requests: cpu: 200m memory: 100M volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin - - mountPath: /opt/percona/logcollector/fluentbit/custom - name: log-collector-volume - - args: - - logrotate - command: - - /opt/percona/logcollector/entrypoint.sh - env: - - name: MONGODB_HOST - value: localhost - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_USER - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_USER_ESCAPED - name: internal-reconcile-statefulset-cr-users - optional: false - - name: MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_PASSWORD_ESCAPED - name: internal-reconcile-statefulset-cr-users - optional: false + - mountPath: /data/db + name: mongod-data + - mountPath: /opt/percona + name: bin + - mountPath: /opt/percona/logcollector/fluentbit/custom + name: log-collector-volume + - name: logrotate image: percona/fluentbit:4.0.1-2 - name: logrotate + command: [ "/opt/percona/logcollector/entrypoint.sh" ] + args: [ "logrotate" ] + env: + - name: MONGODB_HOST + value: localhost + - name: MONGODB_PORT + value: "27017" + - name: MONGODB_USER + valueFrom: + secretKeyRef: + key: MONGODB_CLUSTER_ADMIN_USER_ESCAPED + name: internal-reconcile-statefulset-cr-users + optional: false + - name: MONGODB_PASSWORD + valueFrom: + secretKeyRef: + key: MONGODB_CLUSTER_ADMIN_PASSWORD_ESCAPED + name: internal-reconcile-statefulset-cr-users + optional: false resources: requests: cpu: 200m memory: 100M volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin + - mountPath: /data/db + name: mongod-data + - mountPath: /opt/percona + name: bin initContainers: - command: - /init-entrypoint.sh @@ -311,6 +312,11 @@ spec: name: reconcile-statefulset-cr-log-collector-config optional: true name: log-collector-volume + - name: my-cluster-name-mongodb-encryption-key + secret: + defaultMode: 288 + optional: false + secretName: my-cluster-name-mongodb-encryption-key - name: ssl secret: defaultMode: 288 @@ -339,6 +345,3 @@ spec: requests: storage: 3Gi status: {} -status: - availableReplicas: 0 - replicas: 0 diff --git a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/cfg-nv.yaml b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/cfg-nv.yaml index 8794c0f548..01fee507d3 100644 --- a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/cfg-nv.yaml +++ b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/cfg-nv.yaml @@ -64,6 +64,8 @@ spec: - --clusterAuthMode=x509 - --tlsMode=preferTLS - --configsvr + - --enableEncryption + - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - --wiredTigerCacheSizeGB=0.25 - --wiredTigerIndexPrefixCompression=true - --quiet @@ -160,6 +162,9 @@ spec: name: bin - mountPath: /.mongodb name: mongosh + - mountPath: /etc/mongodb-encryption + name: my-cluster-name-mongodb-encryption-key + readOnly: true - mountPath: /etc/users-secret name: users-secret-file workingDir: /data/db @@ -214,66 +219,62 @@ spec: readOnly: true - mountPath: /data/db name: mongod-data - - args: - - fluent-bit - command: - - /opt/percona/logcollector/entrypoint.sh - env: - - name: LOG_DATA_DIR - value: /data/db/logs - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name + - name: logs image: percona/fluentbit:4.0.1-2 - name: logs + command: [ "/opt/percona/logcollector/entrypoint.sh" ] + args: [ "fluent-bit" ] + env: + - name: LOG_DATA_DIR + value: /data/db/logs + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name resources: requests: cpu: 200m memory: 100M volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin - - mountPath: /opt/percona/logcollector/fluentbit/custom - name: log-collector-volume - - args: - - logrotate - command: - - /opt/percona/logcollector/entrypoint.sh - env: - - name: MONGODB_HOST - value: localhost - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_USER - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_USER_ESCAPED - name: internal-reconcile-statefulset-cr-users - optional: false - - name: MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_PASSWORD_ESCAPED - name: internal-reconcile-statefulset-cr-users - optional: false + - mountPath: /data/db + name: mongod-data + - mountPath: /opt/percona + name: bin + - mountPath: /opt/percona/logcollector/fluentbit/custom + name: log-collector-volume + - name: logrotate image: percona/fluentbit:4.0.1-2 - name: logrotate + command: [ "/opt/percona/logcollector/entrypoint.sh" ] + args: [ "logrotate" ] + env: + - name: MONGODB_HOST + value: localhost + - name: MONGODB_PORT + value: "27017" + - name: MONGODB_USER + valueFrom: + secretKeyRef: + key: MONGODB_CLUSTER_ADMIN_USER_ESCAPED + name: internal-reconcile-statefulset-cr-users + optional: false + - name: MONGODB_PASSWORD + valueFrom: + secretKeyRef: + key: MONGODB_CLUSTER_ADMIN_PASSWORD_ESCAPED + name: internal-reconcile-statefulset-cr-users + optional: false resources: requests: cpu: 200m memory: 100M volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin + - mountPath: /data/db + name: mongod-data + - mountPath: /opt/percona + name: bin initContainers: - command: - /init-entrypoint.sh @@ -311,6 +312,11 @@ spec: name: reconcile-statefulset-cr-log-collector-config optional: true name: log-collector-volume + - name: my-cluster-name-mongodb-encryption-key + secret: + defaultMode: 288 + optional: false + secretName: my-cluster-name-mongodb-encryption-key - name: ssl secret: defaultMode: 288 @@ -339,6 +345,3 @@ spec: requests: storage: 3Gi status: {} -status: - availableReplicas: 0 - replicas: 0 diff --git a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-arbiter.yaml b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-arbiter.yaml index 0899147661..cff3c480ea 100644 --- a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-arbiter.yaml +++ b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-arbiter.yaml @@ -64,6 +64,8 @@ spec: - --clusterAuthMode=x509 - --tlsMode=preferTLS - --shardsvr + - --enableEncryption + - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - --wiredTigerCacheSizeGB=0.25 - --wiredTigerIndexPrefixCompression=true - --quiet @@ -144,6 +146,7 @@ spec: securityContext: runAsNonRoot: true runAsUser: 1001 + topologySpreadConstraints: null volumeMounts: - mountPath: /data/db name: mongod-data @@ -160,6 +163,9 @@ spec: name: bin - mountPath: /.mongodb name: mongosh + - mountPath: /etc/mongodb-encryption + name: my-cluster-name-mongodb-encryption-key + readOnly: true - mountPath: /etc/users-secret name: users-secret-file workingDir: /data/db @@ -198,6 +204,11 @@ spec: name: reconcile-statefulset-cr-log-collector-config optional: true name: log-collector-volume + - name: my-cluster-name-mongodb-encryption-key + secret: + defaultMode: 288 + optional: false + secretName: my-cluster-name-mongodb-encryption-key - name: ssl secret: defaultMode: 288 @@ -215,6 +226,3 @@ spec: name: mongod-data updateStrategy: type: OnDelete -status: - availableReplicas: 0 - replicas: 0 diff --git a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-hidden.yaml b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-hidden.yaml index c894b2bdf7..ee58544c69 100644 --- a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-hidden.yaml +++ b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-hidden.yaml @@ -64,6 +64,8 @@ spec: - --clusterAuthMode=x509 - --tlsMode=preferTLS - --shardsvr + - --enableEncryption + - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - --wiredTigerCacheSizeGB=0.25 - --wiredTigerIndexPrefixCompression=true - --quiet @@ -159,6 +161,9 @@ spec: name: bin - mountPath: /.mongodb name: mongosh + - mountPath: /etc/mongodb-encryption + name: my-cluster-name-mongodb-encryption-key + readOnly: true - mountPath: /etc/users-secret name: users-secret-file workingDir: /data/db @@ -213,66 +218,62 @@ spec: readOnly: true - mountPath: /data/db name: mongod-data - - args: - - fluent-bit - command: - - /opt/percona/logcollector/entrypoint.sh - env: - - name: LOG_DATA_DIR - value: /data/db/logs - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name + - name: logs image: percona/fluentbit:4.0.1-2 - name: logs + command: [ "/opt/percona/logcollector/entrypoint.sh" ] + args: [ "fluent-bit" ] + env: + - name: LOG_DATA_DIR + value: /data/db/logs + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name resources: requests: cpu: 200m memory: 100M volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin - - mountPath: /opt/percona/logcollector/fluentbit/custom - name: log-collector-volume - - args: - - logrotate - command: - - /opt/percona/logcollector/entrypoint.sh - env: - - name: MONGODB_HOST - value: localhost - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_USER - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_USER_ESCAPED - name: internal-reconcile-statefulset-cr-users - optional: false - - name: MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_PASSWORD_ESCAPED - name: internal-reconcile-statefulset-cr-users - optional: false + - mountPath: /data/db + name: mongod-data + - mountPath: /opt/percona + name: bin + - mountPath: /opt/percona/logcollector/fluentbit/custom + name: log-collector-volume + - name: logrotate image: percona/fluentbit:4.0.1-2 - name: logrotate + command: [ "/opt/percona/logcollector/entrypoint.sh" ] + args: [ "logrotate" ] + env: + - name: MONGODB_HOST + value: localhost + - name: MONGODB_PORT + value: "27017" + - name: MONGODB_USER + valueFrom: + secretKeyRef: + key: MONGODB_CLUSTER_ADMIN_USER_ESCAPED + name: internal-reconcile-statefulset-cr-users + optional: false + - name: MONGODB_PASSWORD + valueFrom: + secretKeyRef: + key: MONGODB_CLUSTER_ADMIN_PASSWORD_ESCAPED + name: internal-reconcile-statefulset-cr-users + optional: false resources: requests: cpu: 200m memory: 100M volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin + - mountPath: /data/db + name: mongod-data + - mountPath: /opt/percona + name: bin initContainers: - command: - /init-entrypoint.sh @@ -310,6 +311,11 @@ spec: name: reconcile-statefulset-cr-log-collector-config optional: true name: log-collector-volume + - name: my-cluster-name-mongodb-encryption-key + secret: + defaultMode: 288 + optional: false + secretName: my-cluster-name-mongodb-encryption-key - name: ssl secret: defaultMode: 288 @@ -337,7 +343,3 @@ spec: resources: requests: storage: 3Gi - status: {} -status: - availableReplicas: 0 - replicas: 0 diff --git a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-logrotate.yaml b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-logrotate.yaml index f2cd476758..cfdd563845 100644 --- a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-logrotate.yaml +++ b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-logrotate.yaml @@ -64,6 +64,8 @@ spec: - --clusterAuthMode=x509 - --tlsMode=preferTLS - --shardsvr + - --enableEncryption + - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - --wiredTigerCacheSizeGB=0.25 - --wiredTigerIndexPrefixCompression=true - --quiet @@ -160,6 +162,9 @@ spec: name: bin - mountPath: /.mongodb name: mongosh + - mountPath: /etc/mongodb-encryption + name: my-cluster-name-mongodb-encryption-key + readOnly: true - mountPath: /etc/users-secret name: users-secret-file workingDir: /data/db @@ -214,70 +219,66 @@ spec: readOnly: true - mountPath: /data/db name: mongod-data - - args: - - fluent-bit - command: - - /opt/percona/logcollector/entrypoint.sh - env: - - name: LOG_DATA_DIR - value: /data/db/logs - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name + - name: logs image: percona/fluentbit:4.0.1-2 - name: logs + command: [ "/opt/percona/logcollector/entrypoint.sh" ] + args: [ "fluent-bit" ] + env: + - name: LOG_DATA_DIR + value: /data/db/logs + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name resources: requests: cpu: 200m memory: 100M volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin - - mountPath: /opt/percona/logcollector/fluentbit/custom - name: log-collector-volume - - args: - - logrotate - command: - - /opt/percona/logcollector/entrypoint.sh - env: - - name: MONGODB_HOST - value: localhost - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_USER - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_USER_ESCAPED - name: internal-reconcile-statefulset-cr-users - optional: false - - name: MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_PASSWORD_ESCAPED - name: internal-reconcile-statefulset-cr-users - optional: false - - name: LOGROTATE_SCHEDULE - value: 0 0 */2 * * + - mountPath: /data/db + name: mongod-data + - mountPath: /opt/percona + name: bin + - mountPath: /opt/percona/logcollector/fluentbit/custom + name: log-collector-volume + - name: logrotate image: percona/fluentbit:4.0.1-2 - name: logrotate + command: [ "/opt/percona/logcollector/entrypoint.sh" ] + args: [ "logrotate" ] + env: + - name: MONGODB_HOST + value: localhost + - name: MONGODB_PORT + value: "27017" + - name: MONGODB_USER + valueFrom: + secretKeyRef: + key: MONGODB_CLUSTER_ADMIN_USER_ESCAPED + name: internal-reconcile-statefulset-cr-users + optional: false + - name: MONGODB_PASSWORD + valueFrom: + secretKeyRef: + key: MONGODB_CLUSTER_ADMIN_PASSWORD_ESCAPED + name: internal-reconcile-statefulset-cr-users + optional: false + - name: LOGROTATE_SCHEDULE + value: "0 0 */2 * *" resources: requests: cpu: 200m memory: 100M volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin - - mountPath: /opt/percona/logcollector/logrotate/conf.d - name: logrotate-config + - mountPath: /data/db + name: mongod-data + - mountPath: /opt/percona + name: bin + - mountPath: /opt/percona/logcollector/logrotate/conf.d + name: logrotate-config initContainers: - command: - /init-entrypoint.sh @@ -324,6 +325,11 @@ spec: - configMap: name: extra-config optional: true + - name: my-cluster-name-mongodb-encryption-key + secret: + defaultMode: 288 + optional: false + secretName: my-cluster-name-mongodb-encryption-key - name: ssl secret: defaultMode: 288 @@ -351,7 +357,3 @@ spec: resources: requests: storage: 3Gi - status: {} -status: - availableReplicas: 0 - replicas: 0 diff --git a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-mongod.yaml b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-mongod.yaml index ff0fe4201c..dd732e029c 100644 --- a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-mongod.yaml +++ b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-mongod.yaml @@ -64,6 +64,8 @@ spec: - --clusterAuthMode=x509 - --tlsMode=preferTLS - --shardsvr + - --enableEncryption + - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - --wiredTigerCacheSizeGB=0.25 - --wiredTigerIndexPrefixCompression=true - --quiet @@ -160,6 +162,9 @@ spec: name: bin - mountPath: /.mongodb name: mongosh + - mountPath: /etc/mongodb-encryption + name: my-cluster-name-mongodb-encryption-key + readOnly: true - mountPath: /etc/users-secret name: users-secret-file workingDir: /data/db @@ -214,66 +219,62 @@ spec: readOnly: true - mountPath: /data/db name: mongod-data - - args: - - fluent-bit - command: - - /opt/percona/logcollector/entrypoint.sh - env: - - name: LOG_DATA_DIR - value: /data/db/logs - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name + - name: logs image: percona/fluentbit:4.0.1-2 - name: logs + command: [ "/opt/percona/logcollector/entrypoint.sh" ] + args: [ "fluent-bit" ] + env: + - name: LOG_DATA_DIR + value: /data/db/logs + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name resources: requests: cpu: 200m memory: 100M volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin - - mountPath: /opt/percona/logcollector/fluentbit/custom - name: log-collector-volume - - args: - - logrotate - command: - - /opt/percona/logcollector/entrypoint.sh - env: - - name: MONGODB_HOST - value: localhost - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_USER - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_USER_ESCAPED - name: internal-reconcile-statefulset-cr-users - optional: false - - name: MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_PASSWORD_ESCAPED - name: internal-reconcile-statefulset-cr-users - optional: false + - mountPath: /data/db + name: mongod-data + - mountPath: /opt/percona + name: bin + - mountPath: /opt/percona/logcollector/fluentbit/custom + name: log-collector-volume + - name: logrotate image: percona/fluentbit:4.0.1-2 - name: logrotate + command: [ "/opt/percona/logcollector/entrypoint.sh" ] + args: [ "logrotate" ] + env: + - name: MONGODB_HOST + value: localhost + - name: MONGODB_PORT + value: "27017" + - name: MONGODB_USER + valueFrom: + secretKeyRef: + key: MONGODB_CLUSTER_ADMIN_USER_ESCAPED + name: internal-reconcile-statefulset-cr-users + optional: false + - name: MONGODB_PASSWORD + valueFrom: + secretKeyRef: + key: MONGODB_CLUSTER_ADMIN_PASSWORD_ESCAPED + name: internal-reconcile-statefulset-cr-users + optional: false resources: requests: cpu: 200m memory: 100M volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin + - mountPath: /data/db + name: mongod-data + - mountPath: /opt/percona + name: bin initContainers: - command: - /init-entrypoint.sh @@ -311,6 +312,11 @@ spec: name: reconcile-statefulset-cr-log-collector-config optional: true name: log-collector-volume + - name: my-cluster-name-mongodb-encryption-key + secret: + defaultMode: 288 + optional: false + secretName: my-cluster-name-mongodb-encryption-key - name: ssl secret: defaultMode: 288 @@ -338,7 +344,3 @@ spec: resources: requests: storage: 3Gi - status: {} -status: - availableReplicas: 0 - replicas: 0 diff --git a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-nv.yaml b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-nv.yaml index 586120cce9..2f19fd60f5 100644 --- a/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-nv.yaml +++ b/pkg/controller/perconaservermongodb/testdata/reconcile-statefulset/rs0-nv.yaml @@ -64,6 +64,8 @@ spec: - --clusterAuthMode=x509 - --tlsMode=preferTLS - --shardsvr + - --enableEncryption + - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key - --wiredTigerCacheSizeGB=0.25 - --wiredTigerIndexPrefixCompression=true - --quiet @@ -159,6 +161,9 @@ spec: name: bin - mountPath: /.mongodb name: mongosh + - mountPath: /etc/mongodb-encryption + name: my-cluster-name-mongodb-encryption-key + readOnly: true - mountPath: /etc/users-secret name: users-secret-file workingDir: /data/db @@ -213,66 +218,62 @@ spec: readOnly: true - mountPath: /data/db name: mongod-data - - args: - - fluent-bit - command: - - /opt/percona/logcollector/entrypoint.sh - env: - - name: LOG_DATA_DIR - value: /data/db/logs - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name + - name: logs image: percona/fluentbit:4.0.1-2 - name: logs + command: [ "/opt/percona/logcollector/entrypoint.sh" ] + args: [ "fluent-bit" ] + env: + - name: LOG_DATA_DIR + value: /data/db/logs + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name resources: requests: cpu: 200m memory: 100M volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin - - mountPath: /opt/percona/logcollector/fluentbit/custom - name: log-collector-volume - - args: - - logrotate - command: - - /opt/percona/logcollector/entrypoint.sh - env: - - name: MONGODB_HOST - value: localhost - - name: MONGODB_PORT - value: "27017" - - name: MONGODB_USER - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_USER_ESCAPED - name: internal-reconcile-statefulset-cr-users - optional: false - - name: MONGODB_PASSWORD - valueFrom: - secretKeyRef: - key: MONGODB_CLUSTER_ADMIN_PASSWORD_ESCAPED - name: internal-reconcile-statefulset-cr-users - optional: false + - mountPath: /data/db + name: mongod-data + - mountPath: /opt/percona + name: bin + - mountPath: /opt/percona/logcollector/fluentbit/custom + name: log-collector-volume + - name: logrotate image: percona/fluentbit:4.0.1-2 - name: logrotate + command: [ "/opt/percona/logcollector/entrypoint.sh" ] + args: [ "logrotate" ] + env: + - name: MONGODB_HOST + value: localhost + - name: MONGODB_PORT + value: "27017" + - name: MONGODB_USER + valueFrom: + secretKeyRef: + key: MONGODB_CLUSTER_ADMIN_USER_ESCAPED + name: internal-reconcile-statefulset-cr-users + optional: false + - name: MONGODB_PASSWORD + valueFrom: + secretKeyRef: + key: MONGODB_CLUSTER_ADMIN_PASSWORD_ESCAPED + name: internal-reconcile-statefulset-cr-users + optional: false resources: requests: cpu: 200m memory: 100M volumeMounts: - - mountPath: /data/db - name: mongod-data - - mountPath: /opt/percona - name: bin + - mountPath: /data/db + name: mongod-data + - mountPath: /opt/percona + name: bin initContainers: - command: - /init-entrypoint.sh @@ -310,6 +311,11 @@ spec: name: reconcile-statefulset-cr-log-collector-config optional: true name: log-collector-volume + - name: my-cluster-name-mongodb-encryption-key + secret: + defaultMode: 288 + optional: false + secretName: my-cluster-name-mongodb-encryption-key - name: ssl secret: defaultMode: 288 @@ -337,7 +343,3 @@ spec: resources: requests: storage: 3Gi - status: {} -status: - availableReplicas: 0 - replicas: 0 From 47ca8b66b4700d8ce3677fc4aa312d17326bcd73 Mon Sep 17 00:00:00 2001 From: Venkata Avinash Tanniru Date: Fri, 17 Jul 2026 16:15:26 -0500 Subject: [PATCH 8/9] revert all manual changes --- Makefile | 2 +- deploy/bundle.yaml | 2 +- deploy/cw-bundle.yaml | 2 +- deploy/cw-operator.yaml | 2 +- deploy/operator.yaml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/Makefile b/Makefile index 9476762a42..ac346ff5ff 100644 --- a/Makefile +++ b/Makefile @@ -94,7 +94,7 @@ kustomize: ## Download kustomize locally if necessary. ENVTEST = $(shell pwd)/bin/setup-envtest envtest: ## Download envtest-setup locally if necessary. - $(call go-get-tool,$(ENVTEST),sigs.k8s.io/controller-runtime/tools/setup-envtest@release-0.23) + $(call go-get-tool,$(ENVTEST),sigs.k8s.io/controller-runtime/tools/setup-envtest@latest) SWAGGER = $(shell pwd)/bin/swagger swagger: ## Download swagger locally if necessary. diff --git a/deploy/bundle.yaml b/deploy/bundle.yaml index eb2cde0e1d..494dfefa7d 100644 --- a/deploy/bundle.yaml +++ b/deploy/bundle.yaml @@ -26706,7 +26706,7 @@ spec: serviceAccountName: percona-server-mongodb-operator containers: - name: percona-server-mongodb-operator - image: perconalab/percona-server-mongodb-operator:main + image: percona/percona-server-mongodb-operator:1.22.0 imagePullPolicy: Always livenessProbe: failureThreshold: 3 diff --git a/deploy/cw-bundle.yaml b/deploy/cw-bundle.yaml index 04f65dcee9..acdafacc55 100644 --- a/deploy/cw-bundle.yaml +++ b/deploy/cw-bundle.yaml @@ -26734,7 +26734,7 @@ spec: serviceAccountName: percona-server-mongodb-operator containers: - name: percona-server-mongodb-operator - image: perconalab/percona-server-mongodb-operator:main + image: percona/percona-server-mongodb-operator:1.22.0 imagePullPolicy: Always livenessProbe: failureThreshold: 3 diff --git a/deploy/cw-operator.yaml b/deploy/cw-operator.yaml index 1a1c9ea41a..9832f4d857 100644 --- a/deploy/cw-operator.yaml +++ b/deploy/cw-operator.yaml @@ -25,7 +25,7 @@ spec: serviceAccountName: percona-server-mongodb-operator containers: - name: percona-server-mongodb-operator - image: perconalab/percona-server-mongodb-operator:main + image: percona/percona-server-mongodb-operator:1.22.0 imagePullPolicy: Always livenessProbe: failureThreshold: 3 diff --git a/deploy/operator.yaml b/deploy/operator.yaml index 359515d48e..ff346db091 100644 --- a/deploy/operator.yaml +++ b/deploy/operator.yaml @@ -25,7 +25,7 @@ spec: serviceAccountName: percona-server-mongodb-operator containers: - name: percona-server-mongodb-operator - image: perconalab/percona-server-mongodb-operator:main + image: percona/percona-server-mongodb-operator:1.22.0 imagePullPolicy: Always livenessProbe: failureThreshold: 3 From 0be935e4301fe89b14ab0609eabde2f34394b484 Mon Sep 17 00:00:00 2001 From: Venkata Avinash Tanniru Date: Mon, 20 Jul 2026 09:48:34 -0500 Subject: [PATCH 9/9] fix: only propagate clusterSuperAdmin to shard replsets Instead of creating all custom users on every shard, filter to only propagate clusterSuperAdmin which needs direct shard access for platform operations (compaction, backups, monitoring). Other custom users remain cluster-level only and are accessed through mongos. --- .../perconaservermongodb/custom_users.go | 51 +++++++++++++------ 1 file changed, 35 insertions(+), 16 deletions(-) diff --git a/pkg/controller/perconaservermongodb/custom_users.go b/pkg/controller/perconaservermongodb/custom_users.go index a644ec1083..e7cdd72eea 100644 --- a/pkg/controller/perconaservermongodb/custom_users.go +++ b/pkg/controller/perconaservermongodb/custom_users.go @@ -59,23 +59,29 @@ func (r *ReconcilePerconaServerMongoDB) reconcileCustomUsers(ctx context.Context // For sharded clusters, custom users are created via mongos which stores them // on the config server only. Individual shard replica sets maintain their own // local admin databases and are unaware of users created at the cluster level. - // To allow direct-to-shard connections (e.g. for clusterSuperAdmin), we must - // also propagate custom users to each shard replset directly. + // Only clusterSuperAdmin needs direct shard access for platform operations; + // other custom users should remain cluster-level only (accessed via mongos). if cr.Spec.Sharding.Enabled { - for i := range cr.Spec.Replsets { - rs := cr.Spec.Replsets[i] - shardCli, err := r.mongoClientWithRole(ctx, cr, rs, api.RoleUserAdmin) - if err != nil { - log.Error(err, "failed to get mongo client for shard", "replset", rs.Name) - continue - } - - if err := handleUsers(ctx, cr, shardCli, r.client); err != nil { - log.Error(err, "failed to handle users on shard", "replset", rs.Name) - } - - if err := shardCli.Disconnect(ctx); err != nil { - log.Error(err, "failed to close shard mongo connection", "replset", rs.Name) + shardUsers := filterShardUsers(cr.Spec.Users) + if len(shardUsers) > 0 { + shardCR := cr.DeepCopy() + shardCR.Spec.Users = shardUsers + + for i := range cr.Spec.Replsets { + rs := cr.Spec.Replsets[i] + shardCli, err := r.mongoClientWithRole(ctx, cr, rs, api.RoleUserAdmin) + if err != nil { + log.Error(err, "failed to get mongo client for shard", "replset", rs.Name) + continue + } + + if err := handleUsers(ctx, shardCR, shardCli, r.client); err != nil { + log.Error(err, "failed to handle users on shard", "replset", rs.Name) + } + + if err := shardCli.Disconnect(ctx); err != nil { + log.Error(err, "failed to close shard mongo connection", "replset", rs.Name) + } } } } @@ -83,6 +89,19 @@ func (r *ReconcilePerconaServerMongoDB) reconcileCustomUsers(ctx context.Context return nil } +// filterShardUsers returns only the users that need to be created directly on +// each shard replica set. Currently this is limited to clusterSuperAdmin which +// requires direct shard access for platform operations (compaction, backups, etc). +func filterShardUsers(users []api.User) []api.User { + var filtered []api.User + for i := range users { + if users[i].Name == "clusterSuperAdmin" { + filtered = append(filtered, users[i]) + } + } + return filtered +} + func handleUsers(ctx context.Context, cr *api.PerconaServerMongoDB, mongoCli mongo.Client, client client.Client) error { log := logf.FromContext(ctx)