Skip to content

Mongodb TLS support #587

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Mongodb TLS support #587

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3847d2e
ui: add tls support for mongodb connections
MemberIT Jun 6, 2025
2260416
config: add sni parameter
MemberIT Jun 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions collector/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ type ApplicationInstrumentation struct {
Type model.ApplicationType `json:"type"`
Host string `json:"host"`
Port string `json:"port"`
Sni string `json:"sni"`
Credentials model.Credentials `json:"credentials"`
Params map[string]string `json:"params"`
Instance string `json:"instance"`
Expand Down Expand Up @@ -131,6 +132,7 @@ func (c *Collector) Config(w http.ResponseWriter, r *http.Request) {
i := ApplicationInstrumentation{
Type: instrumentation.Type,
Host: ip.String(),
Sni: instance.NodeName(),
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why do we need to set an SNI manually?

Copy link
Contributor Author

@MemberIT MemberIT Jun 11, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When the collector connects to instrumented applications via TLS, it needs to specify what hostname it will connect to the MongoDB driver. The server's TLS certificate must match this hostname, which is required for external MongoDB hosts deployed outside of the kubernetes cluster. Otherwise, the MongoDB driver in the coroot cluster-agent operates on the host's IP address and a TLS error occurs. Further here, if MongoDB is deployed inside the kubernetes cluster, the SNI is overridden to pod.Id.Name. Since MongoDB is usually deployed in a cluster as a statefulSet (other options are dangerous due to data loss), the host name is fixed and contains an increment by the number of statefulSet replicas

Perhaps I should extend the settings in coroot for MongoDB TLS, if you find it necessary, by adding support for the option:

  • MinVersion, so as not to hardcode it here
  • InsecureSkipVerify, so that self-signed certificates work without specifying a CA
  • caCertPool, so that self-signed certificates are validated

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I understand how SNI works, but you're suggesting we try to guess the SNI configured on the server. I think it should either be explicitly defined by the user or left empty with InsecureSkipVerify. For monitoring purposes, it's usually enough that the traffic between the agent and the server is encrypted—certificate validation isn’t always necessary.

Can we keep the config as simple as possible? Something like:
tls=true|false,InsecureSkipVerify=true|false

Copy link
Contributor Author

@MemberIT MemberIT Jun 11, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let me describe the case I’m trying to solve.

I have several MongoDB 8.0.x hosts that are not inside a Kubernetes cluster, under the domain example.com (for example). Each host has an FQDN like:

  • mongo1.example.com
  • mongo2.example.com
  • ...
  • mongoX.example.com

I issue Let's Encrypt certificates for these hosts using a DNS challenge, for the wildcard *.example.com. It’s important for me that certificate verification is enforced (InsecureSkipVerify=false), to prevent MITM attacks.

Ideally, I’d like to have an option to explicitly specify the SNI hostname as a parameter. That way, even if in the future I add a second domain like example2.com or a third like example3.com with new MongoDB hosts, I can issue a universal certificate covering all domains (although due to some security concerns this might be problematic—in such cases, using separate Coroot projects or installations would be acceptable).

The issue is that if I enable TLS for MongoDB without SNI support, the connection fails due to a SAN error, since the connection goes via IP address, which is not listed in the certificate’s SAN. However, I believe that if the FQDN of the host or container inside the pod were used automatically, it would be the correct approach.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I propose the following solution to avoid overloading Coroot’s web interface:

  • TLS: false|true (default: false)
  • InsecureSkipVerify: true|false (default: true) - editable only if TLS is set to true
  • CApath: absolute_path (default: "" - system/container CA is used) - editable only if InsecureSkipVerify is set to false
  • ServerName: string (default: "" - the FQDN of the host or container is used) - editable only if InsecureSkipVerify is set to false

The same applies to annotations in Kubernetes.

As an example, I’m using the configuration approach recommended by the Percona MongoDB Operator for self-signed certificates.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think we should rely on container or host names extracted from metrics. The user should either explicitly define ServerName or leave it empty, in which case the client will likely fall back to using the IP address.

Regarding CAPath, how is the CA file supposed to get into the cluster-agent container?

Port: instrumentation.Port,
Credentials: instrumentation.Credentials,
Params: instrumentation.Params,
Expand Down
4 changes: 3 additions & 1 deletion docs/docs/databases/mongodb.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,9 @@ coroot.com/mongodb-scrape-credentials-password: "<PASSWORD>"
coroot.com/mongodb-scrape-credentials-secret-name: "mongodb-secret"
coroot.com/mongodb-scrape-credentials-secret-username-key: "username"
coroot.com/mongodb-scrape-credentials-secret-password-key: "password"

# client TLS options: true, false (default: false)
coroot.com/mongodb-scrape-param-tls: "false"
```

Note that Coroot checks only **Pod** annotations, not higher-level Kubernetes objects like Deployments or StatefulSets.
Expand All @@ -48,7 +51,6 @@ Then, switch to `Manual Configuration`, complete the form, and click `Save`.
Coroot-cluster-agent updates its configuration every minute and also takes some time to collect metrics.
Please wait a few minutes for telemetry to appear.


## Troubleshooting

Check the coroot-cluster-agent logs if you encounter any issues.
21 changes: 21 additions & 0 deletions front/src/components/ApplicationInstrumentation.vue
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,6 +131,9 @@ coroot.com/mongodb-scrape-credentials-password: "&lt;PASSWORD&gt;"
coroot.com/mongodb-scrape-credentials-secret-name: "mongodb-secret"
coroot.com/mongodb-scrape-credentials-secret-username-key: "username"
coroot.com/mongodb-scrape-credentials-secret-password-key: "password"

# client TLS options: true, false (default: false)
coroot.com/mongodb-scrape-param-tls: "false"
</pre>
<pre v-if="type === 'memcached'">
coroot.com/memcached-scrape: "true"
Expand Down Expand Up @@ -178,6 +181,18 @@ coroot.com/memcached-scrape-port: "11211"
/>
</div>

<div v-if="type === 'mongodb'">
<div class="subtitle-1 mt-3">TLS</div>
<v-select
v-model="tls"
:items="['false', 'true']"
outlined
dense
hide-details
:menu-props="{ offsetY: true }"
/>
</div>

<v-checkbox v-model="config.enabled" label="Enabled" dense hide-details class="my-3" />

<v-alert v-if="error" color="red" icon="mdi-alert-octagon-outline" outlined text class="mt-4">
Expand Down Expand Up @@ -255,6 +270,9 @@ export default {
if (this.type === 'postgres' && this.config.params && this.config.params['sslmode']) {
this.sslmode = this.config.params['sslmode'];
}
if (this.type === 'mongodb' && this.config.params && this.config.params['tls']) {
this.tls = this.config.params['tls'];
}
});
},
save() {
Expand All @@ -268,6 +286,9 @@ export default {
if (this.type === 'mysql') {
form.params = { tls: this.tls };
}
if (this.type === 'mongodb') {
form.params = { tls: this.tls };
}
this.$api.saveInstrumentationSettings(this.appId, this.type, form, (data, error) => {
this.loading = false;
if (error) {
Expand Down
Loading