feat: [DBOPS-928]: SSL Connection issues with MongoDB Database DevOps #9646

hemanthbsridhar · 2025-03-07T13:04:38Z

Thanks for contributing to the Harness Developer Hub! Our code owners will review your submission.

Description

Please describe your changes: __________________________________
Jira/GitHub Issue numbers (if any): ______________________________
Preview links/images (Internal contributors only): __________________

PR lifecycle

We aim to merge PRs within one week or less, but delays happen sometimes.

If your PR is open longer than two weeks without any human activity, please tag a code owner in a comment.

PRs must meet these requirements to be merged:

Successful preview build.
Code owner review.
No merge conflicts.
Release notes/new features docs: Feature/version released to at least one prod environment.

CLAassistant · 2025-03-07T13:04:54Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

archit-harness · 2025-03-07T13:07:26Z

docs/database-devops/use-database-devops/mongo_ssl.md

@@ -0,0 +1,226 @@
+---
+title: DB Devops MongoDB SSL


add this page as subpage for setup connectors

I don't think it is a good idea to add it under setting up of connectors since it is specific to JDBC connectors.

I feel a better approach is to create SSL parent page and Mongo SSL as the sub page.

Let me know your thoughts.

archit-harness · 2025-03-07T13:08:17Z

docs/database-devops/use-database-devops/mongo_ssl.md

+
+### TLS
+
+* `root_ca.crt` file is available


we should have prerequisites section and explain what is root_ca.crt, if not present how he can get it

what is your opinion on creating on the below structure
SSL

Pre-requisites

MongoSSL

pre-requisites will have steps on creation of keys and common delegate configuration

archit-harness · 2025-03-07T13:10:36Z

docs/database-devops/use-database-devops/mongo_ssl.md

+
+#### Secret Configuration
+
+We will create a secret with the `root_ca.crt`


who is we? harnss or customer should do it? if us, customer doesn't care about it

we is the customer.
Will remove the word we to remove confusion

archit-harness · 2025-03-07T13:10:52Z

docs/database-devops/use-database-devops/mongo_ssl.md

+
+#### Delegate Configuration
+
+Ensure that the [common delegate configuration](#common-delegate-configuration) is done before moving on to the next steps


we should mention mount cert from delegate to build pods

archit-harness · 2025-03-07T13:11:44Z

docs/database-devops/use-database-devops/mongo_ssl.md

+
+**IMPORTANT NOTE** : The value of the `DESTINATION_CA_PATH` environment variable has to be : `/etc/ssl/certs/dbops/root_ca.crt`
+
+#### JDBC Test Connection


we should take inspiration from https://developer.harness.io/docs/continuous-integration/use-ci/set-up-build-infrastructure/k8s-build-infrastructure/configure-a-kubernetes-build-farm-to-use-self-signed-certificates/ to clearly know what does customer need to do

bot-gitexp-user · 2025-03-07T13:16:45Z

Please check the Execution Link of the Pipeline for the Website Draft URL. This is located in the Preview Step behind the Harness VPN and also is available in #hdh_alerts. E.g Website Draft URL: https://unique-id--harness-developer.netlify.app. Current Draft URL is: https://67caf11732a614391f2cfb17--harness-developer.netlify.app

bot-gitexp-user · 2025-03-08T12:18:48Z

Please check the Execution Link of the Pipeline for the Website Draft URL. This is located in the Preview Step behind the Harness VPN and also is available in #hdh_alerts. E.g Website Draft URL: https://unique-id--harness-developer.netlify.app. Current Draft URL is: https://67cc34fb32a61449fd2cfae6--harness-developer.netlify.app

bot-gitexp-user · 2025-03-08T12:22:39Z

Please check the Execution Link of the Pipeline for the Website Draft URL. This is located in the Preview Step behind the Harness VPN and also is available in #hdh_alerts. E.g Website Draft URL: https://unique-id--harness-developer.netlify.app. Current Draft URL is: https://67cc35e3e67f894b62eca011--harness-developer.netlify.app

bot-gitexp-user · 2025-03-10T14:00:19Z

Please check the Execution Link of the Pipeline for the Website Draft URL. This is located in the Preview Step behind the Harness VPN and also is available in #hdh_alerts. E.g Website Draft URL: https://unique-id--harness-developer.netlify.app. Current Draft URL is: https://67ceefc9b6fd7e16ba1f7afa--harness-developer.netlify.app

bot-gitexp-user · 2025-03-10T14:13:14Z

Please check the Execution Link of the Pipeline for the Website Draft URL. This is located in the Preview Step behind the Harness VPN and also is available in #hdh_alerts. E.g Website Draft URL: https://unique-id--harness-developer.netlify.app. Current Draft URL is: https://67cef2d2b68a7d006c423000--harness-developer.netlify.app

bot-gitexp-user · 2025-03-10T14:25:48Z

Please check the Execution Link of the Pipeline for the Website Draft URL. This is located in the Preview Step behind the Harness VPN and also is available in #hdh_alerts. E.g Website Draft URL: https://unique-id--harness-developer.netlify.app. Current Draft URL is: https://67cef5c05bca6c007d6df681--harness-developer.netlify.app

archit-harness · 2025-03-11T08:53:11Z

docs/database-devops/use-database-devops/set-up-connectors.md

-| **GOOGLE SPANNER** | `jdbc:cloudspanner:/projects/{project-id}/instances/{instance-id}/databases/{database-name}?lenient=true` |
+| Database           | JDBC URL Format                                                                                                            |
+|--------------------|----------------------------------------------------------------------------------------------------------------------------|
+| **ORACLE**         | `jdbc:oracle:thin:@//host:port/FREEPDB1`                                                                                   |


we should review all connection string because {} are not added at correct places to know what customer needs to replace plus what is constant

archit-harness · 2025-03-11T08:54:09Z

docs/database-devops/use-database-devops/ssl.md

+* `client.crt` and `client.key` is available
+  * To know more about generating client certificates, follow steps: 1 to 3 from [create_client certificate](https://developer.harness.io/docs/platform/delegates/secure-delegates/delegate-mtls-support/#create-a-client-certificate)
+
+### Generating PKCS12


generating pkcs12 for client

lets remove pkcs for ci builds

archit-harness · 2025-03-11T08:55:25Z

docs/database-devops/use-database-devops/ssl.md

+execute the below command to generate pkcs12 file
+
+```shell
+openssl pkcs12 -export -in client.crt -inkey client.key -out client.p12 -name mongo-client -password pass:changeit


can we say this is step1 and base64 encode is step2.
And below step2 you can add note blue color section why we are doing so

archit-harness · 2025-03-11T08:56:07Z

docs/database-devops/use-database-devops/ssl.md

+
+### Secret Configuration
+
+Create a secret using `root_ca.crt` and `client_pkcs12.txt`( base64 encoded value of the `client.p12` file )


this secret needs to be created on delegate?

kubernetes secret used within the delegate and mounted onto the build pods later.

archit-harness · 2025-03-11T08:59:24Z

docs/database-devops/use-database-devops/ssl.md

+Create a secret using `root_ca.crt` and `client_pkcs12.txt`( base64 encoded value of the `client.p12` file )
+
+```shell
+kubectl create secret -n namespace generic db-ops-ssl-secret --from-file root_ca.crt --from-file client_pkcs12.txt


did we check why we cant use this directly?

kubectl create secret -n generic client-certificate
--from-file client.crt=client.crt
--from-file client.key=client.key

we can't upload client crt and client key to the keystore.

we can only upload the pkcs12 file to the keystore.

what if we get both crt and key and create this pkcs on our side? then the steps remain same for customer?

archit-harness · 2025-03-11T09:02:54Z

docs/database-devops/use-database-devops/ssl.md

+For default trustStore and keyStore
+
+```shell
+- name: JAVA_TOOL_OPTIONS


why will we need this? if we are using default truststore and keystore?

Because default keystore is not set by default in the system properties unlike trustStore

then we should mention this path is configurable, default values should be these if you are running jdk >= 17.0.0

give ref to truststore override of delegate

docs/database-devops/use-database-devops/ssl.md

archit-harness · 2025-03-11T13:06:37Z

docs/database-devops/use-database-devops/ssl.md

+  * To know more about generating CA certificates, [create_ca certificate](https://developer.harness.io/docs/platform/delegates/secure-delegates/delegate-mtls-support/#create-a-ca-certificate)
+* `client.crt` and `client.key` is available
+  * To know more about generating client certificates, follow steps: 1 to 3 from [create_client certificate](https://developer.harness.io/docs/platform/delegates/secure-delegates/delegate-mtls-support/#create-a-client-certificate)
+


in prequisites you can mention to use CI_MOUNT_VOLUMES only to copy cert (reason )as we need to different certs and key for mtls

after prequiisites you can add,
ssl for git clone

add steps, and add ref link

Refer to https://developer.harness.io/docs/continuous-integration/use-ci/set-up-build-infrastructure/k8s-build-infrastructure/configure-a-kubernetes-build-farm-to-use-self-signed-certificates/ if you dont mtls for database

archit-harness · 2025-03-11T13:15:47Z

docs/database-devops/use-database-devops/ssl.md

+
+## Pre-requisites
+* `root_ca.crt` file is available
+  * To know more about generating CA certificates, [create_ca certificate](https://developer.harness.io/docs/platform/delegates/secure-delegates/delegate-mtls-support/#create-a-ca-certificate)


add this root_ca.crt into the ca.bundle and give ref to ci docs

archit-harness · 2025-03-11T13:16:21Z

docs/database-devops/use-database-devops/ssl.md

+
+```shell
+- name: ADDITIONAL_CERTS_PATH
+  value: "/opt/harness-delegate/ca-bundle/root_ca.crt"


keep this till bundle path

archit-harness · 2025-03-11T13:16:58Z

docs/database-devops/use-database-devops/ssl.md

+- name: ADDITIONAL_CERTS_PATH
+  value: "/opt/harness-delegate/ca-bundle/root_ca.crt"
+- name: CI_MOUNT_VOLUMES
+  value: "/opt/harness-delegate/ca-bundle/root_ca.crt:/etc/ssl/certs/dbops/root_ca.crt,/opt/harness-delegate/ca-bundle/client_pkcs12.txt:/etc/ssl/certs/dbops/client_pkcs12.txt"


copy bundle into root_ca.crt

archit-harness · 2025-03-11T13:18:07Z

docs/database-devops/use-database-devops/ssl.md

+  value: "/opt/harness-delegate/ca-bundle/root_ca.crt:/etc/ssl/certs/dbops/root_ca.crt,/opt/harness-delegate/ca-bundle/client_pkcs12.txt:/etc/ssl/certs/dbops/client_pkcs12.txt"
+```
+
+**IMPORTANT NOTE**:


info note type

archit-harness · 2025-03-11T13:18:22Z

docs/database-devops/use-database-devops/ssl.md

+
+* The destination paths during mount in `CI_MOUNT_VOLUMES` has to be 
+  * `/etc/ssl/certs/dbops/root_ca.crt`
+  * `/etc/ssl/certs/dbops/client_pkcs12.txt`


client and key

archit-harness · 2025-03-11T13:20:51Z

docs/database-devops/use-database-devops/ssl.md

+  keytool -importcert -file /opt/harness-delegate/ca-bundle/root_ca.crt -keystore $JAVA_HOME/lib/security/cacerts -alias "mongodb_ssl" -storepass changeit -noprompt
+```
+
+The trustStore and keyStore details are added as part of `JAVA_TOOL_OPTIONS` environment variable.


change to use JAVA_OPTS

feat: [DBOPS-928]: SSL Connection issues with MongoDB Database DevOps

f3cc7fb

hemanthbsridhar requested review from stephenatwell, HarnessTheChaos, archit-harness, anshul-harness and ankittiwari-harness as code owners March 7, 2025 13:04

archit-harness reviewed Mar 7, 2025

View reviewed changes

hemanthbsridhar force-pushed the feat/DBOPS-928 branch from 0808269 to a00970c Compare March 8, 2025 12:09

hemanthbsridhar force-pushed the feat/DBOPS-928 branch from a00970c to 12cf4c3 Compare March 10, 2025 13:48

hemanthbsridhar force-pushed the feat/DBOPS-928 branch from 12cf4c3 to d6fca40 Compare March 10, 2025 14:00

feat: [DBOPS-928]: SSL Connection issues with MongoDB Database DevOps

53665f2

hemanthbsridhar force-pushed the feat/DBOPS-928 branch from d6fca40 to 53665f2 Compare March 10, 2025 14:14

archit-harness reviewed Mar 11, 2025

View reviewed changes

docs/database-devops/use-database-devops/ssl.md Show resolved Hide resolved

archit-harness reviewed Mar 11, 2025

View reviewed changes


		#### Secret Configuration

		We will create a secret with the `root_ca.crt`


		#### Delegate Configuration

		Ensure that the [common delegate configuration](#common-delegate-configuration) is done before moving on to the next steps


		IMPORTANT NOTE : The value of the `DESTINATION_CA_PATH` environment variable has to be : `/etc/ssl/certs/dbops/root_ca.crt`

		#### JDBC Test Connection


		### Secret Configuration

		Create a secret using `root_ca.crt` and `client_pkcs12.txt`( base64 encoded value of the `client.p12` file )

feat: [DBOPS-928]: SSL Connection issues with MongoDB Database DevOps #9646

Are you sure you want to change the base?

feat: [DBOPS-928]: SSL Connection issues with MongoDB Database DevOps #9646

Conversation

hemanthbsridhar commented Mar 7, 2025

Description

PR lifecycle

CLAassistant commented Mar 7, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hemanthbsridhar Mar 8, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bot-gitexp-user commented Mar 7, 2025

bot-gitexp-user commented Mar 8, 2025

bot-gitexp-user commented Mar 8, 2025

bot-gitexp-user commented Mar 10, 2025

bot-gitexp-user commented Mar 10, 2025

bot-gitexp-user commented Mar 10, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

archit-harness Mar 11, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hemanthbsridhar Mar 8, 2025 •

edited

Loading

archit-harness Mar 11, 2025 •

edited

Loading