Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit cc22eef

Browse files
LeoSpykeLeoSpyke
authored
feat: allow connections without certificates (ansible-collections#609)
* feat(mongod): support to allowConnectionsWithoutCertificates * feat(mongos): support to allowConnectionsWithoutCertificates * feat(config): support to allowConnectionsWithoutCertificates * docs(mongos): fix typos and format default values * docs(mongod): format default values * docs(config): format default values
1 parent 13ab305 commit cc22eef

File tree

9 files changed

+61
-46
lines changed

9 files changed

+61
-46
lines changed

‎roles/mongodb_config/README.md‎

Lines changed: 16 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -6,26 +6,27 @@ A simple role to aid in setting up a CSRS Config Server Replicaset for a MongoDB
66
Role Variables
77
--------------
88

9-
* `config_port`: The port used by the mongos process. Default 27019.
10-
* `mongod_service`: The name of the mongod service. Default mongod.
11-
* `mongodb_user`: The Linux OS user for MongoDB. Default mongod.
12-
* `mongodb_group`: The Linux OS user group for MongoDB. Default mongod.
13-
* `pid_file`: The pid file for mongos. Default /run/mongodb/mongos.pid.
14-
* `log_path`: Path of the log file. Default /var/log/mongodb/mongod.log.
15-
* `bind_ip`: The IP address mongod will bind to. Default 0.0.0.0.
16-
* `bind_ip_all`: Have mongod bind to all IP addresses instead of specifying `bind_ip`. Default false.
17-
* `config_repl_set_name`: The replicaset name for the config servers. Default cfg.
18-
* `authorization`: Enable authorization. Default enabled.
9+
* `config_port`: The port used by the mongos process. Default `27019`.
10+
* `mongod_service`: The name of the mongod service. Default `mongod`.
11+
* `mongodb_user`: The Linux OS user for MongoDB. Default `mongod`.
12+
* `mongodb_group`: The Linux OS user group for MongoDB. Default `mongod`.
13+
* `pid_file`: The pid file for mongos. Default `/run/mongodb/mongos.pid`.
14+
* `log_path`: Path of the log file. Default `/var/log/mongodb/mongod.log`.
15+
* `bind_ip`: The IP address mongod will bind to. Default `0.0.0.0`.
16+
* `bind_ip_all`: Have mongod bind to all IP addresses instead of specifying `bind_ip`. Default `false`.
17+
* `config_repl_set_name`: The replicaset name for the config servers. Default `cfg`.
18+
* `authorization`: Enable authorization. Default `enabled`.
1919
* `openssl_keyfile_content`: The kexfile content that MongoDB uses to authenticate within a replicaset. Generate with cmd: openssl rand -base64 756.
20-
* `openssl_keyfile_path`: Put the openssl_keyfile at this path. Default: /etc/keyfile
21-
* `mongod_package`: The name of the mongod installation package. Default mongodb-org-server.
22-
replicaset: When enabled add a replication section to the configuration. Default true.
20+
* `openssl_keyfile_path`: Put the openssl_keyfile at this path. Default: `/etc/keyfile`.
21+
* `mongod_package`: The name of the mongod installation package. Default `mongodb-org-server`.
22+
replicaset: When enabled add a replication section to the configuration. Default `true`.
2323
* `net_compressors`: If this is set, this sets `net.compression.compressors` in mongod.conf.
24-
* `mongod_config_template`: If defined allows to override path to mongod config template with custom configuration. Default "mongod.conf.j2"
24+
* `mongod_config_template`: If defined allows to override path to mongod config template with custom configuration. Default `mongod.conf.j2`.
2525
* `skip_restart`: If set to `true` will skip restarting mongod service when config file or the keyfile content changes. Default `true`.
2626
* `db_path`: Path to database data location. Default `/var/lib/mongodb` on Debian based distributions, `/var/lib/mongo` for others.
27-
* `mongodb_use_tls`: Wether to use tls. Default false.
27+
* `mongodb_use_tls`: Whether to use tls. Default `false`.
2828
* `mongodb_disabled_tls_protocols`: The tls protocols to be disabled. Leave blank to let MongoDB decide which protocols to allow according to the ones available on the system; check the [official docs](https://www.mongodb.com/docs/v6.0/reference/configuration-options/#mongodb-setting-net.tls.disabledProtocols) for details. Default "".
29+
* `mongodb_allow_connections_without_certificates`: When enabled allows to bypass the certificate validation for clients that do not present a certificate, if a certificate is provided it _must_ be valid. Default `false`.
2930
* `mongodb_certificate_key_file`: Path to the PEM-file containing the certficate and private key.
3031
* `mongodb_certificate_ca_file`: Path to the CA-file.
3132

‎roles/mongodb_config/defaults/main.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,3 +33,4 @@ skip_restart: true
3333
db_path: "{{ '/var/lib/mongodb' if ansible_os_family == 'Debian' else '/var/lib/mongo' if ansible_os_family == 'RedHat' else '/var/lib/mongo' }}"
3434
mongodb_use_tls: false
3535
mongodb_disabled_tls_protocols: ""
36+
mongodb_allow_connections_without_certificates: false

‎roles/mongodb_config/templates/configsrv.conf.j2‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,9 @@ net:
4444
{% if mongodb_disabled_tls_protocols != "" %}
4545
disabledProtocols: {{ mongodb_disabled_tls_protocols }}
4646
{% endif %}
47+
{% if mongodb_allow_connections_without_certificates %}
48+
allowConnectionsWithoutCertificates: true
49+
{% endif %}
4750
{% endif %}
4851

4952
{% if authorization == "enabled" %}

‎roles/mongodb_mongod/README.md‎

Lines changed: 18 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -6,28 +6,29 @@ A simple role to aid in the setup of a MongoDB replicaset.
66
Role Variables
77
--------------
88

9-
* `mongod_port`: The port used by the mongod process. Default 27017.
10-
* `mongod_service`: The name of the mongod service. Default mongod.
11-
* `mongodb_user`: The Linux OS user for MongoDB. Default mongod.
12-
* `mongodb_group`: The Linux OS user group for MongoDB. Default mongod.
13-
* `bind_ip`: The IP address mongod will bind to. Default 0.0.0.0.
14-
* `bind_ip_all`: Have mongod bind to all IP addresses instead of specifying `bind_ip`. Default false.
15-
* `log_path`: Path of the log file. Default: /var/log/mongodb/mongod.log.
16-
* `repl_set_name`: The name of the replicaset the member will participate in. Default rs0.
17-
* `authorization`: Enable authorization. Default enabled.
9+
* `mongod_port`: The port used by the mongod process. Default `27017`.
10+
* `mongod_service`: The name of the mongod service. Default `mongod`.
11+
* `mongodb_user`: The Linux OS user for MongoDB. Default `mongod`.
12+
* `mongodb_group`: The Linux OS user group for MongoDB. Default `mongod`.
13+
* `bind_ip`: The IP address mongod will bind to. Default `0.0.0.0`.
14+
* `bind_ip_all`: Have mongod bind to all IP addresses instead of specifying `bind_ip`. Default `false`.
15+
* `log_path`: Path of the log file. Default: `/var/log/mongodb/mongod.log`.
16+
* `repl_set_name`: The name of the replicaset the member will participate in. Default `rs0`.
17+
* `authorization`: Enable authorization. Default `enabled`.
1818
* `openssl_keyfile_content`: The keyfile content that MongoDB uses to authenticate within a replicaset. Generate with cmd: openssl rand -base64 756.
19-
* `openssl_keyfile_path`: Put the openssl_keyfile at this path. Default: /etc/keyfile
20-
* `mongodb_admin_user`: MongoDB admin username. Default admin.
21-
* `mongodb_admin_pwd`: MongoDB admin password. Default admin.
22-
* `mongod_package`: The mongod package to install. Default mongodb-org-server.
23-
* `replicaset`: When enabled add a replication section to the configuration. Default true.
24-
* `sharding`: If this replicaset member will form part of a sharded cluster. Default false.
19+
* `openssl_keyfile_path`: Put the openssl_keyfile at this path. Default: `/etc/keyfile`.
20+
* `mongodb_admin_user`: MongoDB admin username. Default `admin`.
21+
* `mongodb_admin_pwd`: MongoDB admin password. Default `admin`.
22+
* `mongod_package`: The mongod package to install. Default `mongodb-org-server`.
23+
* `replicaset`: When enabled add a replication section to the configuration. Default `true`.
24+
* `sharding`: If this replicaset member will form part of a sharded cluster. Default `false`.
2525
* `net_compressors`: If this is set, this sets `net.compression.compressors` in mongod.conf.
26-
* `mongod_config_template`: If defined allows to override path to mongod config template with custom configuration. Default "mongod.conf.j2"
26+
* `mongod_config_template`: If defined allows to override path to mongod config template with custom configuration. Default `mongod.conf.j2`.
2727
* `skip_restart`: If set to `true` will skip restarting mongod service when config file or the keyfile content changes. Default `true`.
2828
* `db_path`: Path to database data location. Default `/var/lib/mongodb` on Debian based distributions, `/var/lib/mongo` for others.
29-
* `mongodb_use_tls`: Wether to use tls. Default false.
29+
* `mongodb_use_tls`: Whether to use tls. Default `false`.
3030
* `mongodb_disabled_tls_protocols`: The tls protocols to be disabled. Leave blank to let MongoDB decide which protocols to allow according to the ones available on the system; check the [official docs](https://www.mongodb.com/docs/v6.0/reference/configuration-options/#mongodb-setting-net.tls.disabledProtocols) for details. Default "".
31+
* `mongodb_allow_connections_without_certificates`: When enabled allows to bypass the certificate validation for clients that do not present a certificate, if a certificate is provided it _must_ be valid. Default `false`.
3132
* `mongodb_certificate_key_file`: Path to the PEM-file containing the certficate and private key.
3233
* `mongodb_certificate_ca_file`: Path to the CA-file.
3334
* `mongodb_logrotate_enabled`: Add logrotate configuration. Default: `false`.

‎roles/mongodb_mongod/defaults/main.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,5 +35,6 @@ skip_restart: true
3535
db_path: "{{ '/var/lib/mongodb' if ansible_os_family == 'Debian' else '/var/lib/mongo' if ansible_os_family == 'RedHat' else '/var/lib/mongo' }}"
3636
mongodb_use_tls: false
3737
mongodb_disabled_tls_protocols: ""
38+
mongodb_allow_connections_without_certificates: false
3839
mongodb_logrotate_enabled: false
3940
mongodb_logrotate_template: "mongodb.logrotate.j2"

‎roles/mongodb_mongod/templates/mongod.conf.j2‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,9 @@ net:
4747
{% if mongodb_disabled_tls_protocols != "" %}
4848
disabledProtocols: {{ mongodb_disabled_tls_protocols }}
4949
{% endif %}
50+
{% if mongodb_allow_connections_without_certificates %}
51+
allowConnectionsWithoutCertificates: true
52+
{% endif %}
5053
{% endif %}
5154

5255
{% if authorization == "enabled" %}

‎roles/mongodb_mongos/README.md‎

Lines changed: 15 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -13,25 +13,26 @@ good idea to mention in this section that the boto package is required.
1313
Role Variables
1414
--------------
1515

16-
* `mongos_port`: The port used by the mongos process. Default 27017.
17-
* `mongos_service`: The name of the mongos service. Default mongos.
18-
* `mongodb_user`: The Linux OS user for MongoDB. Default mongod.
19-
* `mongodb_group`: The Linux OS user group for MongoDB. Default mongod.
20-
* `pid_file`: The pid file for mongos. Default /run/mongodb/mongos.pid.
21-
* `bind_ip`: The IP address mongos will bind to. Default 0.0.0.0.
22-
* `bind_ip_all`: Have mongos bind to all IP addresses instead of specifying `bind_ip`. Default false.
23-
* `log_path`: Path of the log file. Default: /var/log/mongodb/mongos.log.
24-
* `mypy`: Python interpretor. Default python
25-
* `mongos_package`: The name of the mongos installation package. Default mongodb-org-mongos.
26-
* `config_repl_set_name`: The name of the config server replicaset. Default cfg.
16+
* `mongos_port`: The port used by the mongos process. Default `27017`.
17+
* `mongos_service`: The name of the mongos service. Default `mongos`.
18+
* `mongodb_user`: The Linux OS user for MongoDB. Default `mongod`.
19+
* `mongodb_group`: The Linux OS user group for MongoDB. Default `mongod`.
20+
* `pid_file`: The pid file for mongos. Default `/run/mongodb/mongos.pid`.
21+
* `bind_ip`: The IP address mongos will bind to. Default `0.0.0.0`.
22+
* `bind_ip_all`: Have mongos bind to all IP addresses instead of specifying `bind_ip`. Default `false`.
23+
* `log_path`: Path of the log file. Default: `/var/log/mongodb/mongos.log`.
24+
* `mypy`: Python interpretor. Default `python`.
25+
* `mongos_package`: The name of the mongos installation package. Default `mongodb-org-mongos`.
26+
* `config_repl_set_name`: The name of the config server replicaset. Default `cfg`.
2727
* `config_servers`: "config1:27019, config2:27019, config3:27019"
2828
* `openssl_keyfile_content`: The kexfile content that MongoDB uses to authenticate within a replicaset. Generate with cmd: openssl rand -base64 756.
29-
* `openssl_keyfile_path`: Put the openssl_keyfile at this path. Default: /etc/keyfile
29+
* `openssl_keyfile_path`: Put the openssl_keyfile at this path. Default: `/etc/keyfile`.
3030
* `net_compressors`: If this is set, this sets `net.compression.compressors` in mongos.conf.
31-
* `mongos_config_template`: If defined allows to override path to mongod config template with custom configuration. Default "mongos.conf.j2"
31+
* `mongos_config_template`: If defined allows to override path to mongod config template with custom configuration. Default `mongos.conf.j2`.
3232
* `skip_restart`: If set to `true` will skip restarting mongos service when config file or the keyfile content changes. Default `true`.
33-
* `mongodb_use_tls`: Wether to use tls. Default false.
33+
* `mongodb_use_tls`: Whether to use tls. Default `false`.
3434
* `mongodb_disabled_tls_protocols`: The tls protocols to be disabled. Leave blank to let MongoDB decide which protocols to allow according to the ones available on the system; check the [official docs](https://www.mongodb.com/docs/v6.0/reference/configuration-options/#mongodb-setting-net.tls.disabledProtocols) for details. Default "".
35+
* `mongodb_allow_connections_without_certificates`: When enabled allows to bypass the certificate validation for clients that do not present a certificate, if a certificate is provided it _must_ be valid. Default `false`.
3536
* `mongodb_certificate_key_file`: Path to the PEM-file containing the certficate and private key.
3637
* `mongodb_certificate_ca_file`: Path to the CA-file.
3738

‎roles/mongodb_mongos/defaults/main.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,3 +32,4 @@ mongos_config_template: "mongos.conf.j2"
3232
skip_restart: true
3333
mongodb_use_tls: false
3434
mongodb_disabled_tls_protocols: ""
35+
mongodb_allow_connections_without_certificates: false

‎roles/mongodb_mongos/templates/mongos.conf.j2‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,9 @@ net:
2222
{% if mongodb_disabled_tls_protocols != "" %}
2323
disabledProtocols: {{ mongodb_disabled_tls_protocols }}
2424
{% endif %}
25+
{% if mongodb_allow_connections_without_certificates %}
26+
allowConnectionsWithoutCertificates: true
27+
{% endif %}
2528
{% endif %}
2629
sharding:
2730
configDB: "{{ config_repl_set_name }}/{{ config_servers }}"

0 commit comments

Comments
 (0)