K8SPSMDB-1292: set requireTLS for physical restore tests (#2018)

eleo007 · hors · github-actions[bot] · web-flow · commit 5d2e27b23dda · 2025-08-30T19:23:48.000+03:00
* K8SPSMDB-1292: set requireTLS for physical restore tests

* Update e2e-tests/functions

Co-authored-by: github-actions[bot] &lt;41898282+github-actions[bot]@users.noreply.github.com&gt;

---------

Co-authored-by: Viacheslav Sarzhan &lt;slava.sarzhan@percona.com&gt;
Co-authored-by: github-actions[bot] &lt;41898282+github-actions[bot]@users.noreply.github.com&gt;
diff --git a/e2e-tests/demand-backup-physical-minio/compare/statefulset_some-name-rs0_restore-arbiter-nv-oc.yml b/e2e-tests/demand-backup-physical-minio/compare/statefulset_some-name-rs0_restore-arbiter-nv-oc.yml
@@ -51,7 +51,7 @@ spec:
             - --relaxPermChecks
             - --sslAllowInvalidCertificates
             - --clusterAuthMode=x509
-            - --tlsMode=preferTLS
+            - --tlsMode=requireTLS
             - --enableEncryption
             - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key
             - --wiredTigerCacheSizeGB=0.25
diff --git a/e2e-tests/demand-backup-physical-minio/compare/statefulset_some-name-rs0_restore-arbiter-nv.yml b/e2e-tests/demand-backup-physical-minio/compare/statefulset_some-name-rs0_restore-arbiter-nv.yml
@@ -51,7 +51,7 @@ spec:
             - --relaxPermChecks
             - --sslAllowInvalidCertificates
             - --clusterAuthMode=x509
-            - --tlsMode=preferTLS
+            - --tlsMode=requireTLS
             - --enableEncryption
             - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key
             - --wiredTigerCacheSizeGB=0.25
diff --git a/e2e-tests/demand-backup-physical-minio/compare/statefulset_some-name-rs0_restore-oc.yml b/e2e-tests/demand-backup-physical-minio/compare/statefulset_some-name-rs0_restore-oc.yml
@@ -51,7 +51,7 @@ spec:
             - --relaxPermChecks
             - --sslAllowInvalidCertificates
             - --clusterAuthMode=x509
-            - --tlsMode=preferTLS
+            - --tlsMode=requireTLS
             - --enableEncryption
             - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key
             - --wiredTigerCacheSizeGB=0.25
diff --git a/e2e-tests/demand-backup-physical-minio/compare/statefulset_some-name-rs0_restore.yml b/e2e-tests/demand-backup-physical-minio/compare/statefulset_some-name-rs0_restore.yml
@@ -51,7 +51,7 @@ spec:
             - --relaxPermChecks
             - --sslAllowInvalidCertificates
             - --clusterAuthMode=x509
-            - --tlsMode=preferTLS
+            - --tlsMode=requireTLS
             - --enableEncryption
             - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key
             - --wiredTigerCacheSizeGB=0.25
diff --git a/e2e-tests/demand-backup-physical-minio/conf/some-name-arbiter-nv.yml b/e2e-tests/demand-backup-physical-minio/conf/some-name-arbiter-nv.yml
@@ -9,6 +9,8 @@ spec:
   image:
   imagePullPolicy: Always
   updateStrategy: SmartUpdate
+  tls:
+    mode: requireTLS
   backup:
     enabled: true
     image: perconalab/percona-server-mongodb-operator:1.1.0-backup
diff --git a/e2e-tests/demand-backup-physical-minio/conf/some-name.yml b/e2e-tests/demand-backup-physical-minio/conf/some-name.yml
@@ -9,6 +9,8 @@ spec:
   image:
   imagePullPolicy: Always
   updateStrategy: SmartUpdate
+  tls:
+    mode: requireTLS
   backup:
     enabled: true
     image: perconalab/percona-server-mongodb-operator:1.1.0-backup
diff --git a/e2e-tests/demand-backup-physical-minio/run b/e2e-tests/demand-backup-physical-minio/run
@@ -27,17 +27,17 @@ sleep 60 # give time for resync to start
 wait_for_pbm_operations ${cluster}
 
 echo 'Writing test data'
-run_mongo \
+run_mongo_tls \
 	'db.createUser({user:"myApp",pwd:"myPass",roles:[{db:"myApp",role:"readWrite"}]})' \
 	"userAdmin:userAdmin123456@${cluster}-rs0.${namespace}"
 sleep 1
-run_mongo \
+run_mongo_tls \
 	'use myApp\n db.test.insert({ x: 100500 })' \
 	"myApp:myPass@${cluster}-rs0.${namespace}"
 sleep 5
-compare_mongo_cmd "find" "myApp:myPass@${cluster}-rs0-0.${cluster}-rs0.${namespace}"
-compare_mongo_cmd "find" "myApp:myPass@${cluster}-rs0-1.${cluster}-rs0.${namespace}"
-compare_mongo_cmd "find" "myApp:myPass@${cluster}-rs0-2.${cluster}-rs0.${namespace}"
+compare_mongo_cmd "find" "myApp:myPass@${cluster}-rs0-0.${cluster}-rs0.${namespace}" "" "" "" "" "" "true"
+compare_mongo_cmd "find" "myApp:myPass@${cluster}-rs0-1.${cluster}-rs0.${namespace}" "" "" "" "" "" "true"
+compare_mongo_cmd "find" "myApp:myPass@${cluster}-rs0-2.${cluster}-rs0.${namespace}" "" "" "" "" "" "true"
 
 echo 'Running backups'
 backup_name_minio="backup-minio"
@@ -46,11 +46,11 @@ wait_backup "${backup_name_minio}"
 check_backup_in_storage ${backup_name_minio} minio rs0
 
 echo 'Drop collection'
-run_mongo 'use myApp\n db.test.drop()' "myApp:myPass@${cluster}-rs0.${namespace}"
+run_mongo_tls 'use myApp\n db.test.drop()' "myApp:myPass@${cluster}-rs0.${namespace}"
 echo 'check backup and restore -- minio'
 backup_dest_minio=$(get_backup_dest "${backup_name_minio}")
 run_restore ${backup_name_minio}
-run_recovery_check ${backup_name_minio}
+run_recovery_check ${backup_name_minio} "" "" "true"
 
 desc 'Testing with arbiter and non-voting nodes'
 
@@ -66,11 +66,11 @@ wait_backup "${backup_name_minio}"
 check_backup_in_storage ${backup_name_minio} minio rs0
 
 echo 'Drop collection'
-run_mongo 'use myApp\n db.test.drop()' "myApp:myPass@${cluster}-rs0.${namespace}"
+run_mongo_tls 'use myApp\n db.test.drop()' "myApp:myPass@${cluster}-rs0.${namespace}"
 echo 'check backup and restore -- minio'
 backup_dest_minio=$(get_backup_dest "${backup_name_minio}")
 run_restore ${backup_name_minio}
-run_recovery_check ${backup_name_minio} "_restore-arbiter-nv"
+run_recovery_check ${backup_name_minio} "_restore-arbiter-nv" "" "true"
 
 destroy "$namespace"
 
diff --git a/e2e-tests/demand-backup-physical-sharded-minio/compare/statefulset_some-name-rs0_restore_sharded-oc.yml b/e2e-tests/demand-backup-physical-sharded-minio/compare/statefulset_some-name-rs0_restore_sharded-oc.yml
@@ -51,7 +51,7 @@ spec:
             - --relaxPermChecks
             - --sslAllowInvalidCertificates
             - --clusterAuthMode=x509
-            - --tlsMode=preferTLS
+            - --tlsMode=requireTLS
             - --shardsvr
             - --enableEncryption
             - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key
diff --git a/e2e-tests/demand-backup-physical-sharded-minio/compare/statefulset_some-name-rs0_restore_sharded.yml b/e2e-tests/demand-backup-physical-sharded-minio/compare/statefulset_some-name-rs0_restore_sharded.yml
@@ -51,7 +51,7 @@ spec:
             - --relaxPermChecks
             - --sslAllowInvalidCertificates
             - --clusterAuthMode=x509
-            - --tlsMode=preferTLS
+            - --tlsMode=requireTLS
             - --shardsvr
             - --enableEncryption
             - --encryptionKeyFile=/etc/mongodb-encryption/encryption-key
diff --git a/e2e-tests/demand-backup-physical-sharded-minio/conf/some-name-sharded.yml b/e2e-tests/demand-backup-physical-sharded-minio/conf/some-name-sharded.yml
@@ -7,6 +7,8 @@ spec:
   image:
   imagePullPolicy: Always
   updateStrategy: SmartUpdate
+  tls:
+    mode: requireTLS
   backup:
     enabled: true
     image: perconalab/percona-server-mongodb-operator:1.1.0-backup
diff --git a/e2e-tests/demand-backup-physical-sharded-minio/run b/e2e-tests/demand-backup-physical-sharded-minio/run
@@ -33,18 +33,18 @@ if [ -z $lbEndpoint ]; then
 	exit 1
 fi
 
-run_mongos \
+run_mongos_tls \
 	'db.createUser({user:"myApp",pwd:"myPass",roles:[{db:"myApp",role:"readWrite"}]})' \
 	"userAdmin:userAdmin123456@${cluster}-mongos.${namespace}"
 sleep 1
-run_mongos \
+run_mongos_tls \
 	'use myApp\n db.test.insert({ x: 100501 })' \
 	"myApp:myPass@${cluster}-mongos.${namespace}"
 sleep 5
-compare_mongos_cmd "find" "myApp:myPass@${cluster}-mongos.${namespace}" "-sharded"
+compare_mongos_cmd "find" "myApp:myPass@${cluster}-mongos.${namespace}" "-sharded" "" "" "" "" "true"
 
 # wait for stable timestamp in wiredtiger
-echo 'Waiting 60 seconds for stable timestamp in wiredtiger'
+echo 'Waiting 80 seconds for stable timestamp in wiredtiger'
 sleep 80
 
 echo 'Running minio backups'
@@ -54,11 +54,11 @@ wait_backup "${backup_name_minio}"
 check_backup_in_storage ${backup_name_minio} minio rs0
 
 echo "Drop collection"
-run_mongos 'use myApp\n db.test.drop()' "myApp:myPass@${cluster}-mongos.${namespace}"
+run_mongos_tls 'use myApp\n db.test.drop()' "myApp:myPass@${cluster}-mongos.${namespace}"
 echo 'Check backup and restore -- minio'
 backup_dest_minio=$(get_backup_dest "${backup_name_minio}")
 run_restore ${backup_name_minio} "_restore_sharded"
-run_recovery_check ${backup_name_minio} "_restore_sharded" 'sharded'
+run_recovery_check ${backup_name_minio} "_restore_sharded" "sharded" "true"
 
 destroy "$namespace"
 
diff --git a/e2e-tests/functions b/e2e-tests/functions
@@ -832,6 +832,7 @@ run_recovery_check() {
 	local backup_name=$1
 	local compare_suffix=${2:-"_restore"}
 	local is_sharded=${3:-""}
+	local tls=${4:-""}
 
 	wait_restore "${backup_name}" "${cluster}" "requested" "0" "3000"
 	echo
@@ -851,11 +852,11 @@ run_recovery_check() {
 	wait_for_pbm_operations ${cluster}
 
 	if [ -n "$is_sharded" ]; then
-		compare_mongos_cmd "find" "myApp:myPass@${cluster}-mongos.${namespace}" "-sharded"
+		compare_mongos_cmd "find" "myApp:myPass@${cluster}-mongos.${namespace}" "-sharded" "" "" "" "" "$tls"
 	else
-		compare_mongo_cmd "find" "myApp:myPass@${cluster}-rs0-0.${cluster}-rs0.${namespace}"
-		compare_mongo_cmd "find" "myApp:myPass@${cluster}-rs0-1.${cluster}-rs0.${namespace}"
-		compare_mongo_cmd "find" "myApp:myPass@${cluster}-rs0-2.${cluster}-rs0.${namespace}"
+		compare_mongo_cmd "find" "myApp:myPass@${cluster}-rs0-0.${cluster}-rs0.${namespace}" "" "" "" "" "" "$tls"
+		compare_mongo_cmd "find" "myApp:myPass@${cluster}-rs0-1.${cluster}-rs0.${namespace}" "" "" "" "" "" "$tls"
+		compare_mongo_cmd "find" "myApp:myPass@${cluster}-rs0-2.${cluster}-rs0.${namespace}" "" "" "" "" "" "$tls"
 	fi
 }
 
@@ -901,7 +902,7 @@ run_mongo_tls() {
 
 	[[ $uri == *cfg* ]] && replica_set='cfg' || replica_set='rs0'
 	kubectl_bin exec ${client_container} -- \
-		bash -c "printf '$command\n' | mongo $driver://$uri$suffixt/admin?replicaSet=$replica_set --tls --tlsCAFile /etc/mongodb-ssl/ca.crt  --tlsCertificateKeyFile /tmp/tls.pem --tlsAllowInvalidHostnames $mongo_flag"
+		bash -c "printf '$command\n' | mongo $driver://$uri$suffix/admin?replicaSet=$replica_set --tls --tlsCAFile /etc/mongodb-ssl/ca.crt  --tlsCertificateKeyFile /tmp/tls.pem --tlsAllowInvalidHostnames $mongo_flag"
 
 }
 
@@ -925,6 +926,26 @@ run_mongos() {
 		bash -c "printf '$command\n' | ${mongo_bin} $driver://$uri$suffix/admin $mongo_flag"
 }
 
+run_mongos_tls() {
+	local command="$1"
+	local uri="$2"
+	local driver=${3:-mongodb}
+	local suffix=${4:-.svc.cluster.local}
+	local mongo_flag="$5"
+	local port=${6:-"27017"}
+	local mongo_bin=${7:-mongo}
+
+	suffix_port=$(echo "$suffix" | awk -F':' '{print $2}')
+	if [[ -z $suffix_port ]]; then
+		suffix="$suffix:$port"
+	fi
+
+	local client_container=$(kubectl_bin get pods --selector=name=psmdb-client -o 'jsonpath={.items[].metadata.name}')
+
+	kubectl_bin exec ${client_container} -- \
+		bash -c "printf '$command\n' | ${mongo_bin} $driver://$uri$suffix/admin --tls --tlsCAFile /etc/mongodb-ssl/ca.crt  --tlsCertificateKeyFile /tmp/tls.pem --tlsAllowInvalidHostnames $mongo_flag"
+}
+
 run_script_mongos() {
 	local script="$1"
 	local uri="$2"
@@ -985,16 +1006,23 @@ compare_mongo_cmd() {
 	local database="${5:-myApp}"
 	local collection="${6:-test}"
 	local sort="$7"
+	local tls="${8:-false}"
 
 	local full_command="db.${collection}.${command}()"
-	if [[ ! -z ${sort} ]]; then
+	if [[ -n ${sort} ]]; then
 		full_command="${full_command}.${sort}"
 	fi
 
 	log "running ${full_command} in ${database}"
 
-	run_mongo "use ${database}\n ${full_command}" "$uri" "mongodb" "$suffix" \
-		| egrep -v 'I NETWORK|W NETWORK|F NETWORK|Error saving history file|Percona Server for MongoDB|connecting to:|Unable to reach primary for set|Implicit session:|versions do not match|Error saving history file:' \
+	if [[ $tls == "true" ]]; then
+		mongo_command=run_mongo_tls
+	else
+		mongo_command=run_mongo
+	fi
+
+	$mongo_command "use ${database}\n ${full_command}" "$uri" "mongodb" "$suffix" \
+		| egrep -v 'I NETWORK|W NETWORK|F NETWORK|Error saving history file|Percona Server for MongoDB|connecting to:|Unable to reach primary for set|Implicit session:|versions do not match|Error saving history file:|Started a new thread for the timer service' \
 		| $sed -re 's/ObjectId\("[0-9a-f]+"\)//; s/-[0-9]+.svc/-xxx.svc/' \
 			>$tmp_dir/${command}${postfix}
 
@@ -1013,9 +1041,16 @@ compare_mongos_cmd() {
 	local database="${5:-myApp}"
 	local collection="${6:-test}"
 	local port="${7:-27017}"
+	local tls="${8:-false}"
+
+	if [[ $tls == "true" ]]; then
+		mongos_command=run_mongos_tls
+	else
+		mongos_command=run_mongos
+	fi
 
-	run_mongos "use ${database}\n db.${collection}.${command}()" "$uri" "mongodb" "$suffix" "" "$port" \
-		| egrep -v 'I NETWORK|W NETWORK|Error saving history file|Percona Server for MongoDB|connecting to:|Unable to reach primary for set|Implicit session:|versions do not match|Error saving history file:' \
+	$mongos_command "use ${database}\n db.${collection}.${command}()" "$uri" "mongodb" "$suffix" "" "$port" \
+		| egrep -v 'I NETWORK|W NETWORK|Error saving history file|Percona Server for MongoDB|connecting to:|Unable to reach primary for set|Implicit session:|versions do not match|Error saving history file:|Started a new thread for the timer service' \
 		| $sed -re 's/ObjectId\("[0-9a-f]+"\)//; s/-[0-9]+.svc/-xxx.svc/' \
 			>$tmp_dir/${command}${postfix}
 
