CLOUDP-353160 [Search] Implement gRPC and mTLS #527

fealebenpae · 2025-10-13T12:54:49Z

Summary

This updates the mongod->mongot communication to use the gRPC protocol as the Wire Protocol server is deprecated in mongot.

Proof of Work

Checklist

Have you linked a jira ticket and/or is the ticket in the title?
Have you checked whether your jira ticket required DOCSP changes?
Have you added changelog file?
- use skip-changelog label if not needed
- refer to Changelog files and Release Notes section in CONTRIBUTING.md for more details

github-actions · 2025-10-13T12:55:39Z

⚠️ (this preview might not be accurate if the PR is not rebased on current master branch)

MCK 1.6.0 Release Notes

New Features

MongoDBCommunity: Added support to configure custom cluster domain via newly introduced spec.clusterDomain resource field. If spec.clusterDomain is not set, environment variable CLUSTER_DOMAIN is used as cluster domain. If the environment variable CLUSTER_DOMAIN is also not set, operator falls back to cluster.local as default cluster domain.
Helm Chart: Introduced two new helm fields operator.podSecurityContext and operator.securityContext that can be used to configure securityContext for Operator deployment through Helm Chart.
MongoDBSearch: Switch to gRPC and mTLS for internal communication
Since MCK 1.4 the mongod and mongot processess communicated using the MongoDB Wire Protocol and used keyfile authentication. This release switches that to gRPC with mTLS authentication. gRPC will allow for load-balancing search queries against multiple mongot processes in the future, and mTLS decouples the internal cluster authentication mode and credentials among mongod processes from the connection to the mongot process. The Operator will automatically enable gRPC for existing and new workloads, and will enable mTLS authentication if both Database Server and MongoDBSearch resource are configured for TLS.

Bug Fixes

Fixed parsing of the customEnvVars Helm value when values contain = characters.
ReplicaSet: Blocked disabling TLS and changing member count simultaneously. These operations must now be applied separately to prevent configuration inconsistencies.

Other Changes

kubectl-mongodb plugin: cosign, the signing tool that is used to sign kubectl-mongodb plugin binaries, has been updated to version 3.0.2. With this change, released binaries will be bundled with .bundle files containing both signature and certificate information. For more information on how to verify signatures using new cosign version please refer to -> https://github.com/sigstore/cosign/blob/v3.0.2/doc/cosign_verify-blob.md

lsierant · 2025-10-13T15:12:57Z

controllers/searchcontroller/mongodbsearch_reconcile_helper.go


 	serviceBuilder.AddPort(&corev1.ServicePort{
-		Name:       "mongot",
+		Name:       "mongot-wireproto",


could we add service port only if we force wireproto?

controllers/searchcontroller/mongodbsearch_reconcile_helper.go

lsierant · 2025-10-13T15:17:41Z

docker/mongodb-kubernetes-tests/tests/search/search_community_tls.py



-@mark.e2e_search_community_tls
-def test_validate_tls_connections(mdbc: MongoDBCommunity, mdbs: MongoDBSearch, namespace: str, issuer_ca_filepath: str):


we don't attempt to validate connections here anymore?

I wasn't able to find a simple way to call the gRPC service in mongot from Python that didn't involve a lot of boilerplate, so I opted to remove this altogether.

anandsyncs · 2025-10-16T09:14:08Z

controllers/operator/mongodbsearch_controller_test.go

 			DataPath: searchcontroller.MongotDataPath,
 		},
 		Server: mongot.ConfigServer{
-			Wireproto: &mongot.ConfigWireproto{


Should we still keep a wireproto test as long as it is possible to enabled it?

anandsyncs · 2025-10-16T09:39:03Z

controllers/operator/mongodbsearch_controller.go

 	}

-	r.watch.AddWatchedResourceIfNotAdded(searchSource.KeyfileSecretName(), mdbSearch.Namespace, watch.Secret, mdbSearch.NamespacedName())
+	if mdbSearch.IsWireprotoForced() {


Instead of all these if statements, would it make sense to abstract the wireproto stuff away in a struct and then it's also easier to just remove it.

anandsyncs · 2025-10-16T09:41:24Z

controllers/searchcontroller/mongodbsearch_reconcile_helper.go

+		"searchIndexManagementHostAndPort":                mongotHostAndPort(search),
+		"skipAuthenticationToSearchIndexManagementServer": false,
+		"searchTLSMode":                                   string(searchTLSMode),
+		"useGrpcForSearch":                                !search.IsWireprotoForced(),


What is the meaning of this, don't we always enable this by default?

The server doesn't enable useGrpcForSearch by default, no. We enable it only when the force-wireproto annotation is not set, but in essenceuseGrpcForSearch will be turned on by default, unless the annotation requests otherwise.

…grpc # Conflicts: # controllers/searchcontroller/mongodbsearch_reconcile_helper.go

vinilage

LGMT!

vinilage · 2025-10-31T16:42:07Z

changelog/20251030_feature_update_mongodb_search_to_use_grpc_and_mtls_for.md

+---
+kind: feature
+date: 2025-10-30
+---
+
+* **MongoDBSearch**: Switch to gRPC and mTLS for internal communication
+  Since MCK 1.4 the `mongod` and `mongot` processess communicated using the MongoDB Wire Protocol and used keyfile authentication. This release switches that to gRPC with mTLS authentication. gRPC will allow for load-balancing search queries against multiple `mongot` processes in the future, and mTLS decouples the internal cluster authentication mode and credentials among `mongod` processes from the connection to the `mongot` process. The Operator will automatically enable gRPC for existing and new workloads, and will enable mTLS authentication if both Database Server and `MongoDBSearch` resource are configured for TLS.


fealebenpae self-assigned this Oct 13, 2025

[Search] Implement gRPC and mTLS

3ec055e

fealebenpae force-pushed the fealebenpae/search-grpc branch from 5cc67a1 to 3ec055e Compare October 13, 2025 13:09

lsierant reviewed Oct 13, 2025

View reviewed changes

controllers/searchcontroller/mongodbsearch_reconcile_helper.go Show resolved Hide resolved

lsierant reviewed Oct 13, 2025

View reviewed changes

controllers/searchcontroller/mongodbsearch_reconcile_helper.go Show resolved Hide resolved

lsierant reviewed Oct 13, 2025

View reviewed changes

anandsyncs reviewed Oct 16, 2025

View reviewed changes

fealebenpae added 11 commits October 16, 2025 12:06

Merge remote-tracking branch 'origin/master' into fealebenpae/search-…

6593b18

…grpc # Conflicts: # controllers/searchcontroller/mongodbsearch_reconcile_helper.go

fix external tests and snippets

b791c36

try fix enterprise tests

53e9334

update unit tests for wireproto annotation

cdc55d4

bump version of mongod in external snippets

83e9b33

try fix external tests take 2

14bedcf

cheat linter

8dc3d81

remove searchCoordinator polyfill from external snippets

f4a1a34

update the port in external snippets

75c83de

remove upgrade test

83d91a0

expand on the wireproto override

ab1718f

fealebenpae changed the title ~~[Search] Implement gRPC and mTLS~~ CLOUDP-353160 [Search] Implement gRPC and mTLS Oct 30, 2025

fealebenpae force-pushed the fealebenpae/search-grpc branch from ef87f24 to fc149a0 Compare October 30, 2025 13:40

changelog

cb83dbc

fealebenpae force-pushed the fealebenpae/search-grpc branch from fc149a0 to cb83dbc Compare October 30, 2025 13:42

fealebenpae and others added 2 commits October 30, 2025 15:58

Merge branch 'master' into fealebenpae/search-grpc

326ad85

rename force-wireproto annotation

aa0dc82

fealebenpae marked this pull request as ready for review October 30, 2025 13:58

fealebenpae requested a review from vinilage as a code owner October 30, 2025 13:58

fealebenpae requested a review from a team as a code owner October 30, 2025 13:58

fealebenpae requested review from mircea-cosbuc and viveksinghggits October 30, 2025 13:58

lsierant approved these changes Oct 30, 2025

View reviewed changes

vinilage approved these changes Oct 31, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

CLOUDP-353160 [Search] Implement gRPC and mTLS #527

CLOUDP-353160 [Search] Implement gRPC and mTLS #527

Uh oh!

fealebenpae commented Oct 13, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Oct 13, 2025 •

edited

Loading

Uh oh!

lsierant Oct 13, 2025

Uh oh!

Uh oh!

Uh oh!

lsierant Oct 13, 2025

Uh oh!

fealebenpae Oct 13, 2025

Uh oh!

anandsyncs Oct 16, 2025

Uh oh!

anandsyncs Oct 16, 2025

Uh oh!

anandsyncs Oct 16, 2025

Uh oh!

fealebenpae Oct 16, 2025

Uh oh!

vinilage left a comment

Uh oh!

vinilage Oct 31, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants



		@mark.e2e_search_community_tls
		def test_validate_tls_connections(mdbc: MongoDBCommunity, mdbs: MongoDBSearch, namespace: str, issuer_ca_filepath: str):

CLOUDP-353160 [Search] Implement gRPC and mTLS #527

Are you sure you want to change the base?

CLOUDP-353160 [Search] Implement gRPC and mTLS #527

Uh oh!

Conversation

fealebenpae commented Oct 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Proof of Work

Checklist

Uh oh!

github-actions bot commented Oct 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

MCK 1.6.0 Release Notes

New Features

Bug Fixes

Other Changes

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vinilage left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

fealebenpae commented Oct 13, 2025 •

edited

Loading

github-actions bot commented Oct 13, 2025 •

edited

Loading