K8SPSMDB-1164: Allow creating user with $external database

config/crd/bases/psmdb.percona.com_perconaservermongodbs.yaml

@@ -18764,7 +18764,6 @@ spec:
                       type: array
                   required:
                   - name
-                  - passwordSecretRef
                   - roles
                   type: object
                 type: array

deploy/bundle.yaml

@@ -19460,7 +19460,6 @@ spec:
                       type: array
                   required:
                   - name
-                  - passwordSecretRef
                   - roles
                   type: object
                 type: array

deploy/crd.yaml

@@ -19460,7 +19460,6 @@ spec:
                       type: array
                   required:
                   - name
-                  - passwordSecretRef
                   - roles
                   type: object
                 type: array

deploy/cw-bundle.yaml

@@ -19460,7 +19460,6 @@ spec:
                       type: array
                   required:
                   - name
-                  - passwordSecretRef
                   - roles
                   type: object
                 type: array

e2e-tests/custom-users-roles-sharded/compare/user-external.json

@@ -0,0 +1,20 @@
+switched to db $external
+{
+	"_id" : "$external.user-external",
+	"user" : "user-external",
+	"db" : "$external",
+	"roles" : [
+		{
+			"role" : "clusterAdmin",
+			"db" : "admin"
+		},
+		{
+			"role" : "userAdminAnyDatabase",
+			"db" : "admin"
+		}
+	],
+	"mechanisms" : [
+		"external"
+	]
+}
+bye

e2e-tests/custom-users-roles-sharded/compare/user-gen.json

@@ -0,0 +1,21 @@
+switched to db admin
+{
+	"_id" : "admin.user-gen",
+	"user" : "user-gen",
+	"db" : "admin",
+	"roles" : [
+		{
+			"role" : "clusterAdmin",
+			"db" : "admin"
+		},
+		{
+			"role" : "userAdminAnyDatabase",
+			"db" : "admin"
+		}
+	],
+	"mechanisms" : [
+		"SCRAM-SHA-1",
+		"SCRAM-SHA-256"
+	]
+}
+bye

e2e-tests/custom-users-roles-sharded/conf/some-name-rs0.yml

@@ -43,6 +43,20 @@ spec:
         db: admin
       - name: userAdminAnyDatabase
         db: admin
+  - name: user-gen
+    db: admin
+    roles:
+      - name: clusterAdmin
+        db: admin
+      - name: userAdminAnyDatabase
+        db: admin
+  - name: user-external
+    db: $external
+    roles:
+      - name: clusterAdmin
+        db: admin
+      - name: userAdminAnyDatabase
+        db: admin
 
   backup:
     enabled: false

e2e-tests/custom-users-roles-sharded/run

@@ -74,6 +74,15 @@ userOnePass=$(getSecretData "user-one" "userOnePassKey")
 compare 'admin' 'db.getUser("user-one")' "$mongosUri" "user-one"
 check_auth "$userOne:$userOnePass@$cluster-mongos.$namespace"
 
+generatedUserSecret="$cluster-custom-user-secret"
+generatedPass=$(kubectl_bin get secret $generatedUserSecret -o jsonpath="{.data.user-gen}" | base64 -d)
+compare 'admin' 'db.getUser("user-gen")' "$mongosUri" "user-gen"
+check_auth "user-gen:$generatedPass@$cluster-mongos.$namespace"
+
+# Only check if $external.user-external user exists, as the password is not known
+# since we don't have a external provider set in this test
+compare '$external' 'db.getUser("user-external")' "$mongosUri" "user-external"
+
 desc 'delete initial user from CR and create a new one'
 kubectl_bin patch psmdb ${cluster} --type=merge --patch '{
 		"spec": {"users":[

e2e-tests/custom-users-roles/compare/user-external.json

@@ -0,0 +1,20 @@
+switched to db $external
+{
+	"_id" : "$external.user-external",
+	"user" : "user-external",
+	"db" : "$external",
+	"roles" : [
+		{
+			"role" : "clusterAdmin",
+			"db" : "admin"
+		},
+		{
+			"role" : "userAdminAnyDatabase",
+			"db" : "admin"
+		}
+	],
+	"mechanisms" : [
+		"external"
+	]
+}
+bye

e2e-tests/custom-users-roles/compare/user-gen.json

@@ -0,0 +1,21 @@
+switched to db admin
+{
+	"_id" : "admin.user-gen",
+	"user" : "user-gen",
+	"db" : "admin",
+	"roles" : [
+		{
+			"role" : "clusterAdmin",
+			"db" : "admin"
+		},
+		{
+			"role" : "userAdminAnyDatabase",
+			"db" : "admin"
+		}
+	],
+	"mechanisms" : [
+		"SCRAM-SHA-1",
+		"SCRAM-SHA-256"
+	]
+}
+bye

e2e-tests/custom-users-roles/conf/some-name-rs0.yml

@@ -43,6 +43,21 @@ spec:
         db: admin
       - name: userAdminAnyDatabase
         db: admin
+  - name: user-gen
+    db: admin
+    roles:
+      - name: clusterAdmin
+        db: admin
+      - name: userAdminAnyDatabase
+        db: admin
+  - name: user-external
+    db: $external
+    roles:
+      - name: clusterAdmin
+        db: admin
+      - name: userAdminAnyDatabase
+        db: admin
+
   backup:
     enabled: true
     image: perconalab/percona-server-mongodb-operator:1.1.0-backup

e2e-tests/custom-users-roles/run

@@ -46,7 +46,16 @@ userOnePass=$(getSecretData "user-one" "userOnePassKey")
 compare 'admin' 'db.getUser("user-one")' "$mongoUri" "user-one"
 check_mongo_auth "$userOne:$userOnePass@$cluster-0.$cluster.$namespace"
 
-desc 'delete initial user from CR and create a new one'
+generatedUserSecret="$psmdb-custom-user-secret"
+generatedPass=$(kubectl_bin get secret $generatedUserSecret -o jsonpath="{.data.user-gen}" | base64 -d)
+compare 'admin' 'db.getUser("user-gen")' "$mongoUri" "user-gen"
+check_mongo_auth "user-gen:$generatedPass@$cluster-0.$cluster.$namespace"
+
+# Only check if $external.user-external user exists, as the password is not known
+# since we don't have a external provider set in this test
+compare '$external' 'db.getUser("user-external")' "$mongoUri" "user-external"
+
+desc 'delete initial users from CR and create a new one'
 kubectl_bin patch psmdb ${psmdb} --type=merge --patch '{
 		"spec": {"users":[
 			{

e2e-tests/version-service/conf/crd.yaml

@@ -19460,7 +19460,6 @@ spec:
                       type: array
                   required:
                   - name
-                  - passwordSecretRef
                   - roles
                   type: object
                 type: array

pkg/apis/psmdb/v1/psmdb_types.go

@@ -108,10 +108,10 @@ type SecretKeySelector struct {
 }
 
 type User struct {
-	Name              string            `json:"name"`
-	DB                string            `json:"db,omitempty"`
-	PasswordSecretRef SecretKeySelector `json:"passwordSecretRef"`
-	Roles             []UserRole        `json:"roles"`
+	Name              string             `json:"name"`
+	DB                string             `json:"db,omitempty"`
+	PasswordSecretRef *SecretKeySelector `json:"passwordSecretRef,omitempty"`
+	Roles             []UserRole         `json:"roles"`
 }
 
 func (u *User) UserID() string {