how to make mongod accept only ssl connections...? about mongodb-container

[madvimer]

Any updates on this. we have a requirement to implement ssl. Only option i see right now is to make changes to common.sh and run-mongod. Can this be achieved as asked ?

[omron93]

@madvimer I hope this issue could be solved by using s2i to extend the image. So waiting to #287 to be merged. You can test the code from that PR if that works for you.

@UncleAlbie Can you estimate when you will be ready to review the PR?

[panovotn]

@omron93 I'll review #287 by tomorrow afternoon.

[omron93]

#287 is merged and changes are available in docker.io/centos/mongodb-36-centos7 image already.

You can solve this issue by having folders like this:

myapp/
└── mongodb-ssl
    ├── ca.pem
    └── mongodb.pem

and either using build feature in openshift or invoke s2i manually: s2i build myapp/ centos/mongodb-36-centos7 mongodb-ssl-36-centos7 and use the new image docker run -ti -e MONGODB_ADMIN_PASSWORD=admin mongodb-ssl-36-centos7

@SimonVuong @madvimer Any feedback is welcomed.

[madvimer]

Thank you. I do have a follow up question
I understand that eval was removed and replaced with "-host localhost" option. MongoDB docs specify that with SSL enabled it becomes mandatory to specify hostname( localhost will not work). Is my understanding correct on this or am i missing something

[omron93]

I understand that eval was removed and replaced with "-host localhost" option. MongoDB docs specify that with SSL enabled it becomes mandatory to specify hostname( localhost will not work). Is my understanding correct on this or am i missing something

Thanks, you are right. I've missed it first.

I'm thinking about it and I see no other option than having to specify localhost in SAN of SSL certificate.
Basically in the container 'localhost' and 'hostname` can be resolved. And the hostname often changes with every container start. Also IMHO using real server/certificate domain for "internal" connection isn't good idea (although it could be possible if set up properly). This would be also complicated in openshift because connection ability from outside of the cluster needs to be configured explicitly.

@madvimer Do you have any idea how to solve this?

[hhorak]

mongodb container is not maintained any more in this org. closing.