K8SPSMDB-1164: Allow creating user with $external database

config/crd/bases/psmdb.percona.com_perconaservermongodbs.yaml

@@ -18731,7 +18731,6 @@ spec:
                       type: array
                   required:
                   - name
-                  - passwordSecretRef
                   - roles
                   type: object
                 type: array

deploy/bundle.yaml

@@ -19413,7 +19413,6 @@ spec:
                       type: array
                   required:
                   - name
-                  - passwordSecretRef
                   - roles
                   type: object
                 type: array

deploy/crd.yaml

@@ -19413,7 +19413,6 @@ spec:
                       type: array
                   required:
                   - name
-                  - passwordSecretRef
                   - roles
                   type: object
                 type: array

deploy/cw-bundle.yaml

@@ -19413,7 +19413,6 @@ spec:
                       type: array
                   required:
                   - name
-                  - passwordSecretRef
                   - roles
                   type: object
                 type: array

e2e-tests/custom-users-roles/compare/user-external.json

@@ -0,0 +1,20 @@
+switched to db $external
+{
+	"_id" : "$external.user-external",
+	"user" : "user-external",
+	"db" : "$external",
+	"roles" : [
+		{
+			"role" : "clusterAdmin",
+			"db" : "admin"
+		},
+		{
+			"role" : "userAdminAnyDatabase",
+			"db" : "admin"
+		}
+	],
+	"mechanisms" : [
+		"external"
+	]
+}
+bye

e2e-tests/custom-users-roles/compare/user-gen.json

@@ -0,0 +1,21 @@
+switched to db admin
+{
+	"_id" : "admin.user-gen",
+	"user" : "user-gen",
+	"db" : "admin",
+	"roles" : [
+		{
+			"role" : "clusterAdmin",
+			"db" : "admin"
+		},
+		{
+			"role" : "userAdminAnyDatabase",
+			"db" : "admin"
+		}
+	],
+	"mechanisms" : [
+		"SCRAM-SHA-1",
+		"SCRAM-SHA-256"
+	]
+}
+bye

e2e-tests/custom-users-roles/conf/some-name-rs0.yml

@@ -43,6 +43,21 @@ spec:
         db: admin
       - name: userAdminAnyDatabase
         db: admin
+  - name: user-gen
+    db: admin
+    roles:
+      - name: clusterAdmin
+        db: admin
+      - name: userAdminAnyDatabase
+        db: admin
+  - name: user-external
+    db: $external
+    roles:
+      - name: clusterAdmin
+        db: admin
+      - name: userAdminAnyDatabase
+        db: admin
+
   backup:
     enabled: true
     image: perconalab/percona-server-mongodb-operator:1.1.0-backup

e2e-tests/custom-users-roles/run

@@ -46,7 +46,16 @@ userOnePass=$(getSecretData "user-one" "userOnePassKey")
 compare 'admin' 'db.getUser("user-one")' "$mongoUri" "user-one"
 check_mongo_auth "$userOne:$userOnePass@$cluster-0.$cluster.$namespace"
 
-desc 'delete initial user from CR and create a new one'
+generatedUserSecret="$psmdb-custom-user-secret"
+generatedPass=$(kubectl_bin get secret $generatedUserSecret -o jsonpath="{.data.user-gen}" | base64 -d)
+compare 'admin' 'db.getUser("user-gen")' "$mongoUri" "user-gen"
+check_mongo_auth "user-gen:$generatedPass@$cluster-0.$cluster.$namespace"
+
+# Only check if $external.user-external user exists, as the password is not known
+# since we don't have a external provider set in this test
+compare '$external' 'db.getUser("user-external")' "$mongoUri" "user-external"
+
+desc 'delete initial users from CR and create a new one'
 kubectl_bin patch psmdb ${psmdb} --type=merge --patch '{
 		"spec": {"users":[
 			{

e2e-tests/version-service/conf/crd.yaml

@@ -19413,7 +19413,6 @@ spec:
                       type: array
                   required:
                   - name
-                  - passwordSecretRef
                   - roles
                   type: object
                 type: array

pkg/apis/psmdb/v1/psmdb_types.go

@@ -108,10 +108,10 @@ type SecretKeySelector struct {
 }
 
 type User struct {
-	Name              string            `json:"name"`
-	DB                string            `json:"db,omitempty"`
-	PasswordSecretRef SecretKeySelector `json:"passwordSecretRef"`
-	Roles             []UserRole        `json:"roles"`
+	Name              string             `json:"name"`
+	DB                string             `json:"db,omitempty"`
+	PasswordSecretRef *SecretKeySelector `json:"passwordSecretRef,omitempty"`
+	Roles             []UserRole         `json:"roles"`
 }
 
 func (u *User) UserID() string {

pkg/controller/perconaservermongodb/custom_users.go

@@ -11,12 +11,14 @@ import (
 	"github.com/pkg/errors"
 	corev1 "k8s.io/api/core/v1"
 	k8serrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
 
 	api "github.com/percona/percona-server-mongodb-operator/pkg/apis/psmdb/v1"
 	"github.com/percona/percona-server-mongodb-operator/pkg/psmdb/mongo"
+	s "github.com/percona/percona-server-mongodb-operator/pkg/psmdb/secret"
 )
 
 func (r *ReconcilePerconaServerMongoDB) reconcileCustomUsers(ctx context.Context, cr *api.PerconaServerMongoDB) error {
@@ -56,8 +58,19 @@ func (r *ReconcilePerconaServerMongoDB) reconcileCustomUsers(ctx context.Context
 		return nil
 	}
 
+	err = handleUsers(ctx, cr, cli, r.client)
+	if err != nil {
+		return errors.Wrap(err, "handle users")
+	}
+
+	return nil
+}
+
+func handleUsers(ctx context.Context, cr *api.PerconaServerMongoDB, cli mongo.Client, client client.Client) error {
+	log := logf.FromContext(ctx)
+
 	sysUsersSecret := corev1.Secret{}
-	err = r.client.Get(ctx,
+	err := client.Get(ctx,
 		types.NamespacedName{
 			Namespace: cr.Namespace,
 			Name:      api.InternalUserSecretName(cr),
@@ -85,11 +98,20 @@ func (r *ReconcilePerconaServerMongoDB) reconcileCustomUsers(ctx context.Context
 			user.DB = "admin"
 		}
 
-		if user.PasswordSecretRef.Key == "" {
+		if user.PasswordSecretRef != nil && user.PasswordSecretRef.Key == "" {
 			user.PasswordSecretRef.Key = "password"
 		}
 
-		sec, err := getUserSecret(ctx, r.client, cr, user.PasswordSecretRef.Name)
+		defaultUserSecretName := fmt.Sprintf("%s-custom-user-secret", cr.Name)
+
+		userSecretName := defaultUserSecretName
+		userSecretPassKey := user.Name
+		if user.PasswordSecretRef != nil {
+			userSecretName = user.PasswordSecretRef.Name
+			userSecretPassKey = user.PasswordSecretRef.Key
+		}
+
+		sec, err := getCustomUserSecret(ctx, client, cr, userSecretName, defaultUserSecretName, userSecretPassKey)
 		if err != nil {
 			log.Error(err, "failed to get user secret", "user", user)
 			continue
@@ -104,14 +126,14 @@ func (r *ReconcilePerconaServerMongoDB) reconcileCustomUsers(ctx context.Context
 		annotationKey := fmt.Sprintf("percona.com/%s-%s-hash", cr.Name, user.Name)
 
 		if userInfo == nil {
-			err = createUser(ctx, r.client, cli, &user, &sec, annotationKey)
+			err = createUser(ctx, client, cli, &user, sec, annotationKey, userSecretPassKey)
 			if err != nil {
 				return errors.Wrapf(err, "create user %s", user.Name)
 			}
 			continue
 		}
 
-		err = updatePass(ctx, r.client, cli, &user, userInfo, &sec, annotationKey)
+		err = updatePass(ctx, client, cli, &user, userInfo, sec, annotationKey, userSecretPassKey)
 		if err != nil {
 			log.Error(err, "update user pass", "user", user.Name)
 			continue
@@ -261,14 +283,14 @@ func updatePass(
 	user *api.User,
 	userInfo *mongo.User,
 	secret *corev1.Secret,
-	annotationKey string) error {
+	annotationKey, passKey string) error {
 	log := logf.FromContext(ctx)
 
 	if userInfo == nil {
 		return nil
 	}
 
-	newHash := sha256Hash(secret.Data[user.PasswordSecretRef.Key])
+	newHash := sha256Hash(secret.Data[passKey])
 
 	hash, ok := secret.Annotations[annotationKey]
 	if ok && hash == newHash {
@@ -281,7 +303,7 @@ func updatePass(
 
 	log.Info("User password changed, updating it.", "user", user.UserID())
 
-	err := mongoCli.UpdateUserPass(ctx, user.DB, user.Name, string(secret.Data[user.PasswordSecretRef.Key]))
+	err := mongoCli.UpdateUserPass(ctx, user.DB, user.Name, string(secret.Data[passKey]))
 	if err != nil {
 		return errors.Wrapf(err, "update user %s password", user.Name)
 	}
@@ -334,7 +356,7 @@ func createUser(
 	mongoCli mongo.Client,
 	user *api.User,
 	secret *corev1.Secret,
-	annotationKey string) error {
+	annotationKey, passKey string) error {
 	log := logf.FromContext(ctx)
 
 	roles := make([]map[string]interface{}, 0)
@@ -346,7 +368,7 @@ func createUser(
 	}
 
 	log.Info("Creating user", "user", user.UserID())
-	err := mongoCli.CreateUser(ctx, user.DB, user.Name, string(secret.Data[user.PasswordSecretRef.Key]), roles...)
+	err := mongoCli.CreateUser(ctx, user.DB, user.Name, string(secret.Data[passKey]), roles...)
 	if err != nil {
 		return err
 	}
@@ -355,11 +377,56 @@ func createUser(
 		secret.Annotations = make(map[string]string)
 	}
 
-	secret.Annotations[annotationKey] = string(sha256Hash(secret.Data[user.PasswordSecretRef.Key]))
+	secret.Annotations[annotationKey] = string(sha256Hash(secret.Data[passKey]))
 	if err := cli.Update(ctx, secret); err != nil {
 		return err
 	}
 
 	log.Info("User created", "user", user.UserID())
 	return nil
 }
+
+// getCustomUserSecret gets secret by name defined by `user.PasswordSecretRef.Name` or returns a secret
+// with newly generated password if name matches defaultName
+func getCustomUserSecret(ctx context.Context, cl client.Client, cr *api.PerconaServerMongoDB, name, defaultName, passKey string) (*corev1.Secret, error) {
+	log := logf.FromContext(ctx)
+
+	secret := &corev1.Secret{}
+	err := cl.Get(ctx, types.NamespacedName{Name: name, Namespace: cr.Namespace}, secret)
+
+	if err != nil && name != defaultName {
+		return nil, errors.Wrap(err, "failed to get user secret")
+	}
+
+	if err != nil && !k8serrors.IsNotFound(err) && name == defaultName {
+		return nil, errors.Wrap(err, "failed to get user secret")
+	}
+
+	if err != nil && k8serrors.IsNotFound(err) {
+		secret = &corev1.Secret{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      name,
+				Namespace: cr.Namespace,
+			},
+		}
+
+		pass, err := s.GeneratePassword()
+		if err != nil {
+			return nil, errors.Wrap(err, "generate custom user password")
+		}
+
+		if secret.Data == nil {
+			secret.Data = make(map[string][]byte)
+		}
+		secret.Data[passKey] = pass
+
+		err = cl.Create(ctx, secret)
+		if err != nil {
+			return nil, errors.Wrap(err, "create custom users secret")
+		}
+
+		log.Info("Created custom user secrets", "secrets", secret.Name)
+	}
+
+	return secret, nil
+}

pkg/psmdb/mongo/mongo.go

@@ -283,11 +283,16 @@ func (client *mongoClient) GetRole(ctx context.Context, db, role string) (*Role,
 func (client *mongoClient) CreateUser(ctx context.Context, db, user, pwd string, roles ...map[string]interface{}) error {
 	resp := OKResponse{}
 
-	res := client.Database(db).RunCommand(ctx, bson.D{
+	d := bson.D{
 		{Key: "createUser", Value: user},
-		{Key: "pwd", Value: pwd},
 		{Key: "roles", Value: roles},
-	})
+	}
+
+	if db != "$external" {
+		d = append(d, bson.E{Key: "pwd", Value: pwd})
+	}
+
+	res := client.Database(db).RunCommand(ctx, d)
 	if res.Err() != nil {
 		return errors.Wrap(res.Err(), "failed to create user")
 	}