Repository navigation
Conversation
Adds the oauth-certificate-transfer endpoint (certificate_transfer v1 through
PyPI charmlibs-interfaces-certificate-transfer) on the mongodb charms, the
oauth-peers peer relation on all four charms, the workload bundle path
{ETC}/oauth/certs/oauth-ca.crt and the charm copy oauth.crt in the trust-anchor
directory. OAuthState keeps each unit's CA chain in a unit secret, shaped
like LdapState. The cluster relation gains oauth-ca-secret, which routers
request as a secret field next to int-ca-secret and ext-ca-secret.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Every mongodb unit stores the certificate set it receives over oauth-certificate-transfer, writes the bundle for the workload and a copy for the charm, and removes both with the relation or an empty set; shards ignore the relation (logged). A config-server leader publishes the bundle to every router as oauth-ca-secret and removes it with the relation. Routers copy it into their own chain and bundle file on every start and restart, without a charm copy. The bundle is re-written on start and refresh like the LDAP certificates. Nothing reads the bundle yet and nothing restarts: the OAuth integration renders it as serverCAFile and validates the identity provider through the charm copy. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Each certificate set from oauth-certificate-transfer is parsed as PEM X.509 before it is stored (an entry may hold several certificates). A set that does not parse is not stored: the unit keeps its last valid chain and files and reports Blocked "identity provider CA certificates are not valid PEM" until the provider sends a valid set or the relation goes away. A certificate without the CA basic constraint is only logged: a pinned server certificate is a valid trust anchor for libcurl, which accepts partial chains. A shard with the CA relation now reports Blocked "OAuth is not supported on shards" instead of only logging it. The OAuth manager joins the mongodb components (unit scope, component `oauth`); its statuses come from the relation data, so the status handler's recompute keeps them current. Routers report no status. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🏷️ Type of changes
📝 Description
First half of the OAuth integration (DA287): receive the identity provider's CA certificates. The integration itself (
oauth,serverCAFile, restarts, validation) is out of scope.oauth-certificate-transfer(certificate_transfer v1) on mongodb, and a new peer relationoauth-peerson all charms.{ETC}/oauth/certs/oauth-ca.crtplus a charm copy in/usr/local/share/ca-certificates/oauth.crt.A charm copy in
/usr/local/share/ca-certificates/oauth.crtis needed later to validate thatcurl <issuer_url>/.well-known/openid-configurationworks.oauth-ca-secretoncluster); routers write the same bundle file.Nothing reads the bundle yet, and nothing restarts.
oauth-peers(all four charms) andoauth-certificate-transfer(mongodb, mongodb-k8s).🧪 Manual testing steps
🔬 Automated testing steps
Unit tests:
test_oauth_manager.py,test_oauth_router.py,test_oauth_state.py,test_cluster_manager.py. No integration tests yet; the follow-upoauthPR covers the CA relation end-to-end.