Uploaded image for project: 'Percona Operator for MongoDB'
  1. Percona Operator for MongoDB
  2. K8SPSMDB-624

Operator does not grant expected permission to user MONGODB_CLUSTER_MONITOR_USER

Details

    • Bug
    • Status: Done
    • Medium
    • Resolution: Fixed
    • 1.10.0
    • 1.12.0
    • None
    • None
    • Yes
    • Yes

    Description

      Helm charts psmdb-operator-1.10.0 psmdb-db-1.10.1 : could you please align permissions to avoid manual patch on MongoDB databe ? Thanks

      Here are the permission roles granted by the Helm charts: 

      {        "_id" : "admin.clusterMonitor",        "userId" : UUID("1b581b8e-cf06-4c44-b42a-f69ad6bee93f"),        "user" : "clusterMonitor",        "db" : "admin",        "roles" : [                {                        "role" : "clusterMonitor",                        "db" : "admin"                }        ],        "mechanisms" : [                "SCRAM-SHA-1",                "SCRAM-SHA-256"        ]}
      

      Here are the expected permission roles as per Jira case and updated PMM documentation :

       

      db.getSiblingDB("admin").createRole({
          role: "explainRole",
          privileges: [{
              resource: {
                  db: "",
                  collection: ""
                  },
              actions: [
                  "listIndexes",
                  "listCollections",
                  "dbStats",
                  "dbHash",
                  "collStats",
                  "find"
                  ]
              }],
          roles:[]
      })
      
      db.getSiblingDB("admin").createUser({
         user: "pmm_mongodb",
         pwd: "password",
         roles: [
            { role: "explainRole", db: "admin" },
            { role: "clusterMonitor", db: "admin" },
            { role: "read", db: "local" }
         ]
      }
      )
      

       

       

      Attachments

        Issue Links

          Activity

            People

              andrii.dema Andrii Dema
              ORich Richard CARRE
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Smart Checklist