Skip to content

Commit 617d80c

Browse files
fabritsiusfabritsius
authored
CLOUDP-126255: Add encryption at rest (#674)
* Add Encryption at Rest feature with tests for AWS * Make project Reconcile function shorter * Prepare the Release Notes for the release
1 parent 9f39216 commit 617d80c

File tree

23 files changed

+1260
-107
lines changed

23 files changed

+1260
-107
lines changed

‎.github/workflows/cleanup-all.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,8 @@ jobs:
4949
- name: Run cleanup PE
5050
env:
5151
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
52+
AWS_ACCOUNT_ARN_LIST: ${{ secrets.AWS_ACCOUNT_ARN_LIST }}
53+
AWS_KMS_KEY_ID: ${{ secrets.AWS_KMS_KEY_ID }}
5254
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
5355
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
5456
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}

‎.github/workflows/test-e2e.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,7 @@ jobs:
7575
"long-run",
7676
"networkpeering",
7777
"cloud-access-role",
78+
"encryption-at-rest",
7879
"deployment-annotations-ns",
7980
]
8081

@@ -167,6 +168,8 @@ jobs:
167168
OPENSHIFT_USER: ${{ secrets.OPENSHIFT_USER }}
168169
OPENSHIFT_PASS: ${{ secrets.OPENSHIFT_PASS }}
169170
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
171+
AWS_ACCOUNT_ARN_LIST: ${{ secrets.AWS_ACCOUNT_ARN_LIST }}
172+
AWS_KMS_KEY_ID: ${{ secrets.AWS_KMS_KEY_ID }}
170173
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
171174
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
172175
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}

‎bundle/manifests/atlas.mongodb.com_atlasprojects.yaml‎

Lines changed: 239 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,24 @@ spec:
4343
description: AtlasProjectSpec defines the desired state of Project in
4444
Atlas
4545
properties:
46+
cloudProviderAccessRoles:
47+
description: CloudProviderAccessRoles is a list of Cloud Provider
48+
Access Roles configured for the current Project.
49+
items:
50+
properties:
51+
iamAssumedRoleArn:
52+
description: IamAssumedRoleArn is the ARN of the IAM role that
53+
is assumed by the Atlas cluster.
54+
type: string
55+
providerName:
56+
description: ProviderName is the name of the cloud provider.
57+
Currently only AWS is supported.
58+
type: string
59+
required:
60+
- iamAssumedRoleArn
61+
- providerName
62+
type: object
63+
type: array
4664
connectionSecretRef:
4765
description: ConnectionSecret is the name of the Kubernetes Secret
4866
which contains the information about the way to connect to Atlas
@@ -55,6 +73,63 @@ spec:
5573
required:
5674
- name
5775
type: object
76+
encryptionAtRest:
77+
properties:
78+
awsKms:
79+
description: AwsKms specifies AWS KMS configuration details and
80+
whether Encryption at Rest is enabled for an Atlas project.
81+
properties:
82+
accessKeyID:
83+
type: string
84+
customerMasterKeyID:
85+
type: string
86+
enabled:
87+
type: boolean
88+
region:
89+
type: string
90+
roleId:
91+
type: string
92+
secretAccessKey:
93+
type: string
94+
valid:
95+
type: boolean
96+
type: object
97+
azureKeyVault:
98+
description: AzureKeyVault specifies Azure Key Vault configuration
99+
details and whether Encryption at Rest is enabled for an Atlas
100+
project.
101+
properties:
102+
azureEnvironment:
103+
type: string
104+
clientID:
105+
type: string
106+
enabled:
107+
type: boolean
108+
keyIdentifier:
109+
type: string
110+
keyVaultName:
111+
type: string
112+
resourceGroupName:
113+
type: string
114+
secret:
115+
type: string
116+
subscriptionID:
117+
type: string
118+
tenantID:
119+
type: string
120+
type: object
121+
googleCloudKms:
122+
description: GoogleCloudKms specifies GCP KMS configuration details
123+
and whether Encryption at Rest is enabled for an Atlas project.
124+
properties:
125+
enabled:
126+
type: boolean
127+
keyVersionResourceID:
128+
type: string
129+
serviceAccountKey:
130+
type: string
131+
type: object
132+
type: object
58133
integrations:
59134
description: Integrations is a list of MongoDB Atlas integrations
60135
for the project
@@ -267,6 +342,67 @@ spec:
267342
description: Name is the name of the Project that is created in Atlas
268343
by the Operator if it doesn't exist yet.
269344
type: string
345+
networkPeers:
346+
description: NetworkPeers is a list of Network Peers configured for
347+
the current Project.
348+
items:
349+
properties:
350+
accepterRegionName:
351+
description: AccepterRegionName is the provider region name
352+
of user's vpc.
353+
type: string
354+
atlasCidrBlock:
355+
description: Atlas CIDR. It needs to be set if ContainerID is
356+
not set.
357+
type: string
358+
awsAccountId:
359+
description: AccountID of the user's vpc.
360+
type: string
361+
azureDirectoryId:
362+
description: AzureDirectoryID is the unique identifier for an
363+
Azure AD directory.
364+
type: string
365+
azureSubscriptionId:
366+
description: AzureSubscriptionID is the unique identifier of
367+
the Azure subscription in which the VNet resides.
368+
type: string
369+
containerId:
370+
description: ID of the network peer container. If not set, operator
371+
will create a new container with ContainerRegion and AtlasCIDRBlock
372+
input.
373+
type: string
374+
containerRegion:
375+
description: ContainerRegion is the provider region name of
376+
Atlas network peer container. If not set, AccepterRegionName
377+
is used.
378+
type: string
379+
gcpProjectId:
380+
description: User GCP Project ID. Its applicable only for GCP.
381+
type: string
382+
networkName:
383+
description: GCP Network Peer Name. Its applicable only for
384+
GCP.
385+
type: string
386+
providerName:
387+
description: ProviderName is the name of the provider. If not
388+
set, it will be set to "AWS".
389+
type: string
390+
resourceGroupName:
391+
description: ResourceGroupName is the name of your Azure resource
392+
group.
393+
type: string
394+
routeTableCidrBlock:
395+
description: User VPC CIDR.
396+
type: string
397+
vnetName:
398+
description: VNetName is name of your Azure VNet. Its applicable
399+
only for Azure.
400+
type: string
401+
vpcId:
402+
description: AWS VPC ID.
403+
type: string
404+
type: object
405+
type: array
270406
privateEndpoints:
271407
description: PrivateEndpoints is a list of Private Endpoints configured
272408
for the current Project.
@@ -380,6 +516,43 @@ spec:
380516
items:
381517
type: string
382518
type: array
519+
cloudProviderAccessRoles:
520+
description: CloudProviderAccessRoles contains a list of configured
521+
cloud provider access roles. AWS support only
522+
items:
523+
properties:
524+
atlasAWSAccountArn:
525+
type: string
526+
atlasAssumedRoleExternalId:
527+
type: string
528+
authorizedDate:
529+
type: string
530+
createdDate:
531+
type: string
532+
errorMessage:
533+
type: string
534+
featureUsages:
535+
items:
536+
properties:
537+
featureId:
538+
type: string
539+
featureType:
540+
type: string
541+
type: object
542+
type: array
543+
iamAssumedRoleArn:
544+
type: string
545+
providerName:
546+
type: string
547+
roleId:
548+
type: string
549+
status:
550+
type: string
551+
required:
552+
- atlasAssumedRoleExternalId
553+
- providerName
554+
type: object
555+
type: array
383556
conditions:
384557
description: Conditions is the list of statuses showing the current
385558
state of the Atlas Custom Resource
@@ -440,6 +613,72 @@ spec:
440613
id:
441614
description: The ID of the Atlas Project
442615
type: string
616+
networkPeers:
617+
description: The list of network peers that are configured for current
618+
project
619+
items:
620+
properties:
621+
atlasGcpProjectId:
622+
description: ProjectID of Atlas container. Applicable only for
623+
GCP. It's needed to add network peer connection.
624+
type: string
625+
atlasNetworkName:
626+
description: Atlas Network Name. Applicable only for GCP. It's
627+
needed to add network peer connection.
628+
type: string
629+
connectionId:
630+
description: Unique identifier of the network peer connection.
631+
Applicable only for AWS.
632+
type: string
633+
containerId:
634+
description: ContainerID of Atlas network peer container.
635+
type: string
636+
errorMessage:
637+
description: Error state of the network peer. Applicable only
638+
for GCP.
639+
type: string
640+
errorState:
641+
description: Error state of the network peer. Applicable only
642+
for Azure.
643+
type: string
644+
errorStateName:
645+
description: Error state of the network peer. Applicable only
646+
for AWS.
647+
type: string
648+
gcpProjectId:
649+
description: ProjectID of the user's vpc. Applicable only for
650+
GCP.
651+
type: string
652+
id:
653+
description: Unique identifier for NetworkPeer.
654+
type: string
655+
providerName:
656+
description: Cloud provider for which you want to retrieve a
657+
network peer.
658+
type: string
659+
region:
660+
description: Region for which you want to create the network
661+
peer. It isn't needed for GCP
662+
type: string
663+
status:
664+
description: Status of the network peer. Applicable only for
665+
GCP and Azure.
666+
type: string
667+
statusName:
668+
description: Status of the network peer. Applicable only for
669+
AWS.
670+
type: string
671+
vpc:
672+
description: VPC is general purpose field for storing the name
673+
of the VPC. VPC is vpcID for AWS, user networkName for GCP,
674+
and vnetName for Azure.
675+
type: string
676+
required:
677+
- id
678+
- providerName
679+
- region
680+
type: object
681+
type: array
443682
observedGeneration:
444683
description: ObservedGeneration indicates the generation of the resource
445684
specification that the Atlas Operator is aware of. The Atlas Operator

‎config/crd/bases/atlas.mongodb.com_atlasprojects.yaml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,65 @@ spec:
7070
required:
7171
- name
7272
type: object
73+
encryptionAtRest:
74+
description: EncryptionAtRest allows to set encryption for AWS, Azure
75+
and GCP providers
76+
properties:
77+
awsKms:
78+
description: AwsKms specifies AWS KMS configuration details and
79+
whether Encryption at Rest is enabled for an Atlas project.
80+
properties:
81+
accessKeyID:
82+
type: string
83+
customerMasterKeyID:
84+
type: string
85+
enabled:
86+
type: boolean
87+
region:
88+
type: string
89+
roleId:
90+
type: string
91+
secretAccessKey:
92+
type: string
93+
valid:
94+
type: boolean
95+
type: object
96+
azureKeyVault:
97+
description: AzureKeyVault specifies Azure Key Vault configuration
98+
details and whether Encryption at Rest is enabled for an Atlas
99+
project.
100+
properties:
101+
azureEnvironment:
102+
type: string
103+
clientID:
104+
type: string
105+
enabled:
106+
type: boolean
107+
keyIdentifier:
108+
type: string
109+
keyVaultName:
110+
type: string
111+
resourceGroupName:
112+
type: string
113+
secret:
114+
type: string
115+
subscriptionID:
116+
type: string
117+
tenantID:
118+
type: string
119+
type: object
120+
googleCloudKms:
121+
description: GoogleCloudKms specifies GCP KMS configuration details
122+
and whether Encryption at Rest is enabled for an Atlas project.
123+
properties:
124+
enabled:
125+
type: boolean
126+
keyVersionResourceID:
127+
type: string
128+
serviceAccountKey:
129+
type: string
130+
type: object
131+
type: object
73132
integrations:
74133
description: Integrations is a list of MongoDB Atlas integrations
75134
for the project

‎docs/release-notes/release-notes.md‎

Lines changed: 9 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,18 @@
1-
# MongoDB Atlas Operator v1.2.0
2-
3-
## Atlas Operator
4-
5-
* Updated to Go 1.18 #604
1+
# MongoDB Atlas Operator v1.3.0
62

73
## AtlasProject Resource
84

9-
* Added support for Private Endpoints backwards sync #603
5+
* Add network peering feature #620
6+
* Add cloud provider access role feature #645
7+
* Add encryption at rest #674
108

119
## AtlasDeployment Resource
1210

13-
* Refactored the Advanced Deployment Handler #615 (#606)
14-
* Changed autoScaling to a new struct according to Atlas API #592 (#588)
15-
* Fixed diskSizeGB decreasing for normal deployments #634 (#611)
16-
* Fixed panic when Atlas API returns an empty object #593 (#589)
11+
* Fix deployment CR deletion if token invalid #666 (#421)
12+
* Prevent changing instanceSize and diskGB if autoscaling is enabled #672 (#648, #649)
13+
* Fix error message for Delete method #664
14+
* Add test for atlasdeployments with keep annotation #612
1715

1816
*The images can be found in:*
1917

20-
https://quay.io/mongodb/mongodb-atlas-kubernetes-operator
18+
https://quay.io/mongodb/mongodb-atlas-kubernetes-operator

0 commit comments

Comments
 (0)