Allow mongo client to be configured by a tls registry #46293

Malandril · 2025-02-15T20:37:03Z

This PR allows the mongodb client to be configured using a tls registry configuration. This allows simpler ways to configure the trustores, and mtls connections.

By default the mongodb client dost not use the default tls registry.

github-actions · 2025-02-15T21:27:56Z

🙈 The PR is closed and the preview is expired.

Malandril · 2025-02-16T13:43:46Z

extensions/mongodb-client/deployment/src/test/java/io/quarkus/mongodb/MongoTlsRegistryTest.java

+import io.smallrye.certs.junit5.Certificate;
+import io.smallrye.certs.junit5.Certificates;
+
+@DisabledOnOs(value = OS.WINDOWS, disabledReason = "Tests don't pass on windows CI")


The tests on windows CI don't seem to work correctly, I cannot reproduce it, on my local windows.
It may be because the generated certs use relative paths.

Thanks for the report. It might be something related to the Junit 5 plugin generating certificates.

gsmet

This is really nice, thanks!

I added a few minor suggestions and questions. And it's probably a good idea to let @cescoffier have a look.

docs/src/main/asciidoc/mongodb.adoc

gsmet · 2025-02-17T09:03:40Z

docs/src/main/asciidoc/mongodb.adoc


-If you want to use SSL/TLS encryption, you need to add these properties in your `application.properties`:
+You can configure the client to trust servers with certificates with invalid hostnames:

 [source,properties]
 ----
 quarkus.mongodb.tls=true
 quarkus.mongodb.tls-insecure=true # only if TLS certificate cannot be validated


Is this needed when you are using a TLS configuration from the registry? IIRC, it's configured there?

This option configures the mongo builder with the method invalidHostNameAllowed.
The tls registry config is applied after, if the quarkus.mongodb.tls is true, the registry can replace this because it can be configured with quarkus.tls.hostname-verification-algorithm=NONE.

docs/src/main/asciidoc/mongodb.adoc

...sions/mongodb-client/runtime/src/main/java/io/quarkus/mongodb/runtime/MongoClientConfig.java

extensions/mongodb-client/runtime/src/main/java/io/quarkus/mongodb/runtime/MongoClients.java

extensions/mongodb-client/deployment/src/test/java/io/quarkus/mongodb/MongoTestBase.java

...sions/mongodb-client/runtime/src/main/java/io/quarkus/mongodb/runtime/MongoClientConfig.java

cescoffier

Thanks! Looks good! I'm just wondering about the dedicated tls config of Mongo.

docs/src/main/asciidoc/mongodb.adoc

extensions/mongodb-client/deployment/src/test/java/io/quarkus/mongodb/MongoTestBase.java

cescoffier · 2025-02-18T07:10:34Z

extensions/mongodb-client/deployment/src/test/java/io/quarkus/mongodb/MongoTlsRegistryTest.java

+import io.smallrye.certs.junit5.Certificate;
+import io.smallrye.certs.junit5.Certificates;
+
+@DisabledOnOs(value = OS.WINDOWS, disabledReason = "Tests don't pass on windows CI")


Thanks for the report. It might be something related to the Junit 5 plugin generating certificates.

geoand · 2025-02-18T13:24:42Z

When all is done, we'll need to have the commits squashed

test: Disable tls test on windows Apply suggestions from code review Co-authored-by: Guillaume Smet <[email protected]> Deprecate tlsInsecure mongo configuration Review comments, enable tls when configuration name set

quarkus-bot · 2025-02-18T22:10:47Z

Status for workflow `Quarkus Documentation CI`

This is the status report for running Quarkus Documentation CI on commit bc2b0eb.

✅ The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

Warning

There are other workflow runs running, you probably need to wait for their status before merging.

quarkus-bot · 2025-02-19T09:12:14Z

Status for workflow `Quarkus CI`

This is the status report for running Quarkus CI on commit bc2b0eb.

✅ The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

You can consult the Develocity build scans.

quarkus-bot bot added area/documentation area/mongodb labels Feb 15, 2025

Malandril force-pushed the mongo-tls-registry branch from cc96bcf to 30c1fb9 Compare February 15, 2025 20:39

Malandril changed the title ~~Add tls regsitry to mongo client~~ Allow mongo client to be configured by a tls registry Feb 15, 2025

Malandril force-pushed the mongo-tls-registry branch from 30c1fb9 to d5c66d2 Compare February 15, 2025 20:41