|
| 1 | +""" |
| 2 | +CLOUDP-351614: Test that TLS can be disabled on AppDB without breaking monitoring. |
| 3 | +
|
| 4 | +This is a dedicated test file to verify that when TLS is disabled on AppDB, |
| 5 | +the operator correctly clears stale TLS params from the monitoring configuration. |
| 6 | +""" |
| 7 | +from typing import Optional |
| 8 | + |
| 9 | +from kubetester import create_or_update_secret, try_load |
| 10 | +from kubetester.certs import create_ops_manager_tls_certs |
| 11 | +from kubetester.kubetester import fixture as yaml_fixture |
| 12 | +from kubetester.opsmanager import MongoDBOpsManager |
| 13 | +from kubetester.phase import Phase |
| 14 | +from pytest import fixture, mark |
| 15 | +from tests.common.cert.cert_issuer import create_appdb_certs |
| 16 | +from tests.conftest import is_multi_cluster |
| 17 | +from tests.opsmanager.withMonitoredAppDB.conftest import enable_multi_cluster_deployment |
| 18 | + |
| 19 | +OM_NAME = "om-tls-disable-test" |
| 20 | +APPDB_NAME = f"{OM_NAME}-db" |
| 21 | + |
| 22 | + |
| 23 | +@fixture(scope="module") |
| 24 | +def ops_manager_certs(namespace: str, issuer: str): |
| 25 | + return create_ops_manager_tls_certs(issuer, namespace, OM_NAME) |
| 26 | + |
| 27 | + |
| 28 | +@fixture(scope="module") |
| 29 | +def appdb_certs(namespace: str, issuer: str): |
| 30 | + return create_appdb_certs(namespace, issuer, APPDB_NAME) |
| 31 | + |
| 32 | + |
| 33 | +@fixture(scope="module") |
| 34 | +@mark.usefixtures("appdb_certs", "ops_manager_certs", "issuer_ca_configmap") |
| 35 | +def ops_manager( |
| 36 | + namespace: str, |
| 37 | + issuer_ca_configmap: str, |
| 38 | + appdb_certs: str, |
| 39 | + ops_manager_certs: str, |
| 40 | + custom_version: Optional[str], |
| 41 | + custom_appdb_version: str, |
| 42 | +) -> MongoDBOpsManager: |
| 43 | + """Create an Ops Manager with TLS-enabled AppDB for testing TLS disable.""" |
| 44 | + om = MongoDBOpsManager.from_yaml(yaml_fixture("om_appdb_tls_disable.yaml"), namespace=namespace) |
| 45 | + om.set_version(custom_version) |
| 46 | + om.set_appdb_version(custom_appdb_version) |
| 47 | + |
| 48 | + if try_load(om): |
| 49 | + return om |
| 50 | + |
| 51 | + if is_multi_cluster(): |
| 52 | + enable_multi_cluster_deployment(om) |
| 53 | + |
| 54 | + om.update() |
| 55 | + return om |
| 56 | + |
| 57 | + |
| 58 | +@mark.e2e_om_appdb_tls_disable |
| 59 | +def test_om_created_with_tls(ops_manager: MongoDBOpsManager): |
| 60 | + """Verify OM and AppDB are running with TLS enabled.""" |
| 61 | + ops_manager.om_status().assert_reaches_phase(Phase.Running, timeout=900) |
| 62 | + ops_manager.appdb_status().assert_reaches_phase(Phase.Running, timeout=600) |
| 63 | + |
| 64 | + |
| 65 | +@mark.e2e_om_appdb_tls_disable |
| 66 | +def test_appdb_monitoring_works_with_tls(ops_manager: MongoDBOpsManager): |
| 67 | + """Verify monitoring works with TLS enabled before we disable it.""" |
| 68 | + ops_manager.assert_appdb_monitoring_group_was_created() |
| 69 | + ops_manager.assert_monitoring_data_exists(timeout=600, all_hosts=False) |
| 70 | + |
| 71 | + |
| 72 | +@mark.e2e_om_appdb_tls_disable |
| 73 | +def test_disable_tls_on_appdb(ops_manager: MongoDBOpsManager): |
| 74 | + """ |
| 75 | + CLOUDP-351614: Disable TLS on AppDB and verify the operator correctly handles |
| 76 | + the transition without leaving stale TLS params in monitoring config. |
| 77 | + """ |
| 78 | + ops_manager.load() |
| 79 | + |
| 80 | + # Step 1: Transition to allowTLS mode first (required before fully disabling TLS) |
| 81 | + ops_manager["spec"]["applicationDatabase"]["additionalMongodConfig"] = { |
| 82 | + "net": {"tls": {"mode": "allowTLS"}} |
| 83 | + } |
| 84 | + ops_manager.update() |
| 85 | + ops_manager.appdb_status().assert_reaches_phase(Phase.Running, timeout=1200) |
| 86 | + |
| 87 | + # Step 2: Fully disable TLS on AppDB |
| 88 | + # Must remove certsSecretPrefix, disable TLS, and remove additionalMongodConfig |
| 89 | + ops_manager["spec"]["applicationDatabase"]["security"]["certsSecretPrefix"] = None |
| 90 | + ops_manager["spec"]["applicationDatabase"]["security"]["tls"]["enabled"] = False |
| 91 | + del ops_manager["spec"]["applicationDatabase"]["additionalMongodConfig"] |
| 92 | + ops_manager.update() |
| 93 | + |
| 94 | + # Wait for AppDB to reach Running state after TLS disable |
| 95 | + ops_manager.appdb_status().assert_reaches_phase(Phase.Running, timeout=1200) |
| 96 | + |
| 97 | + |
| 98 | +@mark.e2e_om_appdb_tls_disable |
| 99 | +def test_monitoring_works_after_tls_disable(ops_manager: MongoDBOpsManager): |
| 100 | + """ |
| 101 | + CLOUDP-351614: Verify monitoring data can still be collected after TLS disable. |
| 102 | +
|
| 103 | + After TLS is disabled, monitoring agents switch from x509 to SCRAM authentication. |
| 104 | + This test verifies that: |
| 105 | + 1. The operator correctly cleared stale TLS params from monitoring config |
| 106 | + 2. Monitoring agents can reconnect and collect data |
| 107 | + """ |
| 108 | + # Use a longer timeout as monitoring agents need time to reconnect with SCRAM auth |
| 109 | + ops_manager.assert_monitoring_data_exists(timeout=1200, all_hosts=False) |
0 commit comments