Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

catch errors based on missing authentication to allow creation of admin user on replicaset setup #479

Closed
wants to merge 12 commits into from

Conversation

Henning-B
Copy link
Contributor

Pull Request (PR) description

When setting up a new replica set with authentication enabled the puppet run fails because some exceptions were not caught properly, when getting the user and database instances. When checking if the mongodb is a primary node a recheck without authentication is done to be able to create the admin user.

This Pull Request (PR) fixes the following issues

if mongorc_file
res = mongo_cmd(db, conn_string, mongorc_file + cmd_ismaster).to_s.chomp
end
if res.match(/Authentication failed/) or not mongorc_file
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perhaps you should switch these around because res will not be defined if mongorc_file is false.

new(name: db['name'],
ensure: :present)
end
rescue
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we log anything about why it failed? Otherwise debugging might be very hard.

ensure: :present)
end
rescue
{}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shouldn't this be a list?

@Henning-B
Copy link
Contributor Author

I adapted the code as requested and fixed some issue. Do you need anything else to merge?

cmd_ismaster
end
res = mongo_cmd(db, conn_string, full_command).to_s.chomp
if res =~ %r{Authentication failed}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You retry the same command twice if there's an authentication failure (previous iteration didn't have this). You probably want to change this to if !mongorc_file && res =~ %r{Authentication failed} to get the same result.

@Henning-B
Copy link
Contributor Author

Should work now

Copy link
Member

@ekohl ekohl left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm a bit hesitant about the self.instances changes. When would such an error happen and why shouldn't it be fatal?

res = mongo_cmd(db, conn_string, full_command).to_s.chomp

# Retry command without authentication when mongorc_file is set and authentication failed
if mongorc_file && res =~ %r{Authentication failed}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Rubocop doesn't like the double space here

@Henning-B
Copy link
Contributor Author

The issue happens when setting up a new replicaset with authentication enabled. The self.instances get an authentication error, because neither the admin database nor the administrative user have been created, yet. So the whole catalog fails.

Copy link
Member

@ekohl ekohl left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That is on the db_ismaster code. I'm not sure about the self.instances and if it's still needed after that. I'm too unfamiliar with mongodb and authentication to give a good opinion on that.

@@ -6,11 +6,16 @@

def self.instances
require 'json'
dbs = JSON.parse mongo_eval('printjson(db.getMongo().getDBs())')
begin
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No need for this indenting. You can write

def self.instances
  # code
rescue
  # code
end

@Henning-B
Copy link
Contributor Author

All fixes were to ensure a puppet run on a bare system to setup a new replicaset.
When Authentication is enabled in mongodb configuration you're allowed to create one admin user. Before this user has been created it is not possible to access the databases or users. So self.instances fail before is_master gets relevant, which is when the database / user ought to be created.

@ekohl
Copy link
Member

ekohl commented Oct 7, 2018

I'm working on a big update that enables spec tests again (#491). Currently I'm at the point that I've verified the problem but after a full day my brain is done with it. Tomorrow I'm going to take a stab at integrating this into it.

@ekohl
Copy link
Member

ekohl commented Oct 20, 2018

Could you rebase this on the current master? I put in a lot of effort to at least get acceptance tests working on CentOS7 (mongodb 2.6). With this fix I think we should also be able to get tests working on Debian and Ubuntu (mongodb 3.x).

@vox-pupuli-tasks
Copy link

Dear @Henning-B, thanks for the PR!

This is pccibot, your friendly Vox Pupuli GitHub Bot. I noticed that your pull request contains merge conflict. Can you please rebase?

You can find my sourcecode at voxpupuli/vox-pupuli-tasks

1 similar comment
@vox-pupuli-tasks
Copy link

Dear @Henning-B, thanks for the PR!

This is pccibot, your friendly Vox Pupuli GitHub Bot. I noticed that your pull request contains merge conflict. Can you please rebase?

You can find my sourcecode at voxpupuli/vox-pupuli-tasks

@vox-pupuli-tasks
Copy link

Dear @Henning-B, thanks for the PR!

This is pccibot, your friendly Vox Pupuli GitHub Bot. I noticed that your pull request contains merge conflict. Can you please rebase?

You can find my sourcecode at voxpupuli/vox-pupuli-tasks

@vox-pupuli-tasks
Copy link

Dear @Henning-B, thanks for the PR!

This is pccibot, your friendly Vox Pupuli GitHub Bot. I noticed that your pull request contains merge conflict. Can you please rebase?

You can find my sourcecode at voxpupuli/vox-pupuli-tasks

@witjoh
Copy link
Contributor

witjoh commented Mar 28, 2024

This should be handled by #703... We can close this.

@witjoh witjoh closed this Mar 28, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants