Merge pull request #15 from RocketChat/reconcile_atlas_firewall

Add rancher nodes to atlas firewall

api/v1alpha1/mongodbcluster_types.go

@@ -43,11 +43,14 @@ type MongoDBClusterSpec struct {
  // +kubebuilder:default=mongodb
  PrefixTemplate string `json:"prefixTemplate,omitempty"`
 
- // Append this prefix to all default/generated usernames for this cluster. Will be overriden if "username" is specified.
+ // Append this prefix to all default/generated usernames for this cluster. Will be overridden if "username" is specified.
  UserNamePrefix string `json:"userNamePrefix,omitempty"`
 
  // If this is set, Atlas API will be used instead of the regular mongo auth path.
  UseAtlasApi bool `json:"useAtlasApi,omitempty"`
+
+ // If this is set, along with useAtlasApi, all the kubernetes nodes on the cluster will be added to the Atlas firewall. The only available value right now is "rancher-annotation", which uses the rke.cattle.io/external-ip annotation.
+ AtlasNodeIPAccessStrategy string `json:"atlasNodeIpAccessStrategy,omitempty"`
 }
 
 // MongoDBClusterStatus defines the observed state of MongoDBCluster

config/crd/bases/airlock.cloud.rocket.chat_mongodbclusters.yaml

@@ -41,6 +41,12 @@ spec:
  type: object
  spec:
  properties:
+ atlasNodeIpAccessStrategy:
+ description: If this is set, along with useAtlasApi, all the kubernetes
+ nodes on the cluster will be added to the Atlas firewall. The only
+ available value right now is "rancher-annotation", which uses the
+ rke.cattle.io/external-ip annotation.
+ type: string
  connectionSecret:
  description: Secret in which Airlock will look for a ConnectionString
  or Atlas credentials, that will be used to connect to the cluster.
@@ -70,7 +76,7 @@ spec:
  type: boolean
  userNamePrefix:
  description: Append this prefix to all default/generated usernames
- for this cluster. Will be overriden if "username" is specified.
+ for this cluster. Will be overridden if "username" is specified.
  type: string
  required:
  - connectionSecret

config/samples/airlock_v1alpha1_mongodbcluster.yaml

@@ -35,6 +35,9 @@ spec:
  # Optional. Append this prefix to all default/generated usernames for this cluster. Will be ignored if "username" is already set on the access request.
  userNamePrefix: test-use1-
 
+ # Optional. If this is set, along with useAtlasApi, all the kubernetes nodes on the cluster will be added to the Atlas firewall. The only available value right now is "rancher-annotation", which uses the rke.cattle.io/external-ip annotation.
+ atlasNodeIpAccessStrategy: rancher-annotation
+
 ---
 apiVersion: v1
 kind: Secret

controllers/mongodbcluster_controller.go

@@ -19,9 +19,12 @@ package controllers
 import (
  "context"
  "fmt"
+ "net/http"
+ "strings"
  "time"
 
  "github.com/go-logr/logr"
+ "go.mongodb.org/atlas/mongodbatlas"
  "go.mongodb.org/mongo-driver/bson"
  "go.mongodb.org/mongo-driver/bson/primitive"
  "go.mongodb.org/mongo-driver/mongo"
@@ -120,6 +123,23 @@ func (r *MongoDBClusterReconciler) Reconcile(ctx context.Context, req ctrl.Reque
 
  return ctrl.Result{}, utilerrors.NewAggregate([]error{err, r.Status().Update(ctx, mongodbClusterCR)})
  }
+
+ // Add nodes to Atlas firewall
+ if mongodbClusterCR.Spec.AtlasNodeIPAccessStrategy == "rancher-annotation" {
+ err = r.reconcileAtlasFirewall(ctx, mongodbClusterCR, secret)
+ if err != nil {
+ meta.SetStatusCondition(&mongodbClusterCR.Status.Conditions,
+ metav1.Condition{
+ Type: "Ready",
+ Status: metav1.ConditionFalse,
+ Reason: "AtlasFirewallFailed",
+ LastTransitionTime: metav1.NewTime(time.Now()),
+ Message: fmt.Sprintf("Failed to add nodes to atlas firewall: %s", err.Error()),
+ })
+
+ return ctrl.Result{}, utilerrors.NewAggregate([]error{err, r.Status().Update(ctx, mongodbClusterCR)})
+ }
+ }
  } else {
  err = testMongoConnection(ctx, mongodbClusterCR, secret)
  if err != nil {
@@ -196,6 +216,35 @@ func (r *MongoDBClusterReconciler) SetupWithManager(mgr ctrl.Manager) error {
  handler.EnqueueRequestsFromMapFunc(r.findObjectsForSecret),
  builder.WithPredicates(predicate.ResourceVersionChangedPredicate{}),
  ).
+ Watches(
+ &source.Kind{Type: &corev1.Node{}},
+ handler.EnqueueRequestsFromMapFunc(func(node client.Object) []reconcile.Request {
+ mongodbClusterCR := &airlockv1alpha1.MongoDBClusterList{}
+ listOps := &client.ListOptions{
+ Namespace: "",
+ }
+
+ err := r.List(context.TODO(), mongodbClusterCR, listOps)
+ if err != nil {
+ return []reconcile.Request{}
+ }
+
+ requests := make([]reconcile.Request, 0)
+ for _, item := range mongodbClusterCR.Items {
+ if item.Spec.AtlasNodeIPAccessStrategy != "" {
+ requests = append(requests, reconcile.Request{
+ NamespacedName: types.NamespacedName{
+ Name: item.GetName(),
+ Namespace: item.GetNamespace(),
+ },
+ })
+ }
+ }
+
+ return requests
+ }),
+ builder.WithPredicates(predicate.ResourceVersionChangedPredicate{}),
+ ).
  Complete(r)
 }
 
@@ -332,3 +381,93 @@ func canCreateUsers(logger logr.Logger, roles primitive.A) bool {
 
  return false
 }
+
+func (r *MongoDBClusterReconciler) reconcileAtlasFirewall(ctx context.Context, mongodbClusterCR *airlockv1alpha1.MongoDBCluster, secret *corev1.Secret) error {
+ logger := log.FromContext(ctx)
+
+ AIRLOCK_PREFIX := "Airlock-"
+ IP_ANNOTATION := "rke.cattle.io/external-ip"
+
+ logger.Info("Reconciling atlas firewall for " + mongodbClusterCR.Name)
+
+ client, atlasGroupID, err := getAtlasClientFromSecret(secret)
+ if err != nil {
+ logger.Error(err, "Couldn't get a client for Atlas")
+ return err
+ }
+
+ // Get all nodes in the cluster
+ nodeList := &corev1.NodeList{}
+
+ err = r.List(ctx, nodeList)
+ if err != nil {
+ logger.Error(err, "Couldn't get nodes in the cluster")
+ return err
+ }
+
+ // Get all nodes in the Atlas firewall
+ firewallList, _, err := client.ProjectIPAccessList.List(context.Background(), atlasGroupID, nil)
+ if err != nil {
+ logger.Error(err, "Couldn't get nodes in the Atlas firewall")
+ return err
+ }
+
+ // Look for nodes in atlas firewall that don't match the current nodes
+ for _, entry := range firewallList.Results {
+ found := false
+
+ for _, node := range nodeList.Items {
+ externalIP := node.Annotations[IP_ANNOTATION]
+
+ if externalIP == entry.IPAddress && AIRLOCK_PREFIX+node.Name == entry.Comment {
+ found = true
+ break
+ }
+ }
+
+ // If the node has the airlock prefix but wasn't found locally, remove it from the Atlas firewall
+ if strings.HasPrefix(entry.Comment, AIRLOCK_PREFIX) && !found {
+ logger.Info("Removing node " + entry.Comment + " from the Atlas firewall")
+
+ _, err := client.ProjectIPAccessList.Delete(context.Background(), atlasGroupID, entry.IPAddress)
+ if err != nil {
+ logger.Error(err, "Couldn't remove node "+entry.Comment+" from the Atlas firewall")
+ return err
+ }
+ }
+ }
+
+ // Add missing nodes to the Atlas firewall
+ entriesToAdd := []*mongodbatlas.ProjectIPAccessList{}
+
+ for _, node := range nodeList.Items {
+ externalIP := node.Annotations[IP_ANNOTATION]
+
+ // Check if node already exists in the firewall
+ found := false
+
+ for _, entry := range firewallList.Results {
+ if externalIP == entry.IPAddress && AIRLOCK_PREFIX+node.Name == entry.Comment {
+ found = true
+ break
+ }
+ }
+
+ // If not, add it
+ if !found && externalIP != "" {
+ entriesToAdd = append(entriesToAdd, &mongodbatlas.ProjectIPAccessList{
+ IPAddress: externalIP,
+ Comment: AIRLOCK_PREFIX + node.Name,
+ })
+ logger.Info("Adding node " + node.Name + " to the Atlas firewall")
+ }
+ }
+
+ _, response, err := client.ProjectIPAccessList.Create(context.Background(), atlasGroupID, entriesToAdd)
+ if err != nil || response.StatusCode != http.StatusCreated {
+ logger.Error(err, "Couldn't add nodes to the Atlas firewall")
+ return err
+ }
+
+ return nil
+}