Support for TLS connections in MongoDB StatefulSet

k8s/mongodb/container/Dockerfile

@@ -4,10 +4,9 @@ WORKDIR /
 RUN apt-get update \
     && apt-get -y upgrade \
     && apt-get autoremove \
-    && apt-get clean \
+    && apt-get clean
-    && mkdir /mongo-ssl
 COPY mongod.conf.template /etc/mongod.conf
 COPY mongod_entrypoint.bash /
-VOLUME /data/db /data/configdb /mongo-ssl
+VOLUME /data/db /data/configdb /etc/mongod/ssl
 EXPOSE 27017
 ENTRYPOINT ["/mongod_entrypoint.bash"]

k8s/mongodb/mongo-ss.yaml

@@ -21,23 +21,37 @@ spec:
       terminationGracePeriodSeconds: 10
       containers:
       - name: mongodb
-        image: bigchaindb/mongodb:3.4.3
+        image: bigchaindb/mongodb:3.4.4
-        imagePullPolicy: IfNotPresent
+        imagePullPolicy: Always
         env:
         - name: MONGODB_FQDN
           valueFrom:
             configMapKeyRef:
-             name: mdb-fqdn
+             name: vars
-             key: fqdn
+             key: mdb-instance-name
         - name: MONGODB_POD_IP
           valueFrom:
             fieldRef:
               fieldPath: status.podIP
+        - name: MONGODB_REPLICA_SET_NAME
+          value: bigchain-rs
+        - name: MONGODB_PORT
+          value: "27017"
         args:
-        - --replica-set-name=bigchain-rs
+        - --mongodb-port
-        - --fqdn=$(MONGODB_FQDN)
+        - $(MONGODB_PORT)
-        - --port=27017
+        - --mongodb-key-file-path
-        - --ip=$(MONGODB_POD_IP)
+        - /etc/mongod/ssl/mdb-instance.pem
+        - --mongodb-ca-file-path
+        - /etc/mongod/ssl/ca.pem
+        - --mongodb-crl-file-path
+        - /etc/mongod/ssl/mdb-crl.pem
+        - --replica-set-name
+        - $(MONGODB_REPLICA_SET_NAME)
+        - --mongodb-fqdn
+        - $(MONGODB_FQDN)
+        - --mongodb-ip
+        - $(MONGODB_POD_IP)
         securityContext:
           capabilities:
             add:
@@ -52,6 +66,9 @@ spec:
           mountPath: /data/db
         - name: mdb-configdb
           mountPath: /data/configdb
+        - name: mdb-certs
+          mountPath: /etc/mongod/ssl/
+          readOnly: true
         resources:
           limits:
             cpu: 200m
@@ -71,3 +88,7 @@ spec:
       - name: mdb-configdb
         persistentVolumeClaim:
           claimName: mongo-configdb-claim
+      - name: mdb-certs
+        secret:
+          secretName: mdb-certs
+          defaultMode: 0400