{"action":"created","issue":{"url":"https://api.github.com/repos/cvallance/mongo-k8s-sidecar/issues/82","repository_url":"https://api.github.com/repos/cvallance/mongo-k8s-sidecar","labels_url":"https://api.github.com/repos/cvallance/mongo-k8s-sidecar/issues/82/labels{/name}","comments_url":"https://api.github.com/repos/cvallance/mongo-k8s-sidecar/issues/82/comments","events_url":"https://api.github.com/repos/cvallance/mongo-k8s-sidecar/issues/82/events","html_url":"https://github.com/cvallance/mongo-k8s-sidecar/issues/82","id":319682710,"number":82,"title":"Simple Authentication always fails ","user":{"login":"cescoferraro","id":6259987,"avatar_url":"https://avatars3.githubusercontent.com/u/6259987?v=4","gravatar_id":"","url":"https://api.github.com/users/cescoferraro","html_url":"https://github.com/cescoferraro","followers_url":"https://api.github.com/users/cescoferraro/followers","following_url":"https://api.github.com/users/cescoferraro/following{/other_user}","gists_url":"https://api.github.com/users/cescoferraro/gists{/gist_id}","starred_url":"https://api.github.com/users/cescoferraro/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cescoferraro/subscriptions","organizations_url":"https://api.github.com/users/cescoferraro/orgs","repos_url":"https://api.github.com/users/cescoferraro/repos","events_url":"https://api.github.com/users/cescoferraro/events{/privacy}","received_events_url":"https://api.github.com/users/cescoferraro/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-05-02T19:30:39Z","updated_at":"2018-05-24T01:29:54Z","closed_at":null,"author_association":"NONE","body":"I am running kops on AWS. I can get the mongo  cluster to work without authentication, but as soon as I try to secure it with simple user/password the nodes fail to connect.\r\n\r\nI am creating the user like\r\n`db.createUser( { user: \"cesco\", pwd: \"mypassword\", roles:[{role:\"root\", db:\"admin\"}] })`\r\nthen deleting the statefulset and creating back again uncommenting the below commented lines\r\n\r\n```\r\n---\r\napiVersion: v1\r\nkind: Service\r\nmetadata:\r\n  name: mongodb-service\r\n  labels:\r\n    name: mongo\r\nspec:\r\n  ports:\r\n  - port: 27017\r\n    targetPort: 27017\r\n  clusterIP: None\r\n  selector:\r\n    role: mongo\r\n---\r\napiVersion: apps/v1beta1\r\nkind: StatefulSet\r\nmetadata:\r\n  name: mongod\r\nspec:\r\n  serviceName: mongodb-service\r\n  replicas: 3\r\n  template:\r\n    metadata:\r\n      labels:\r\n        role: mongo\r\n        environment: development\r\n    spec:\r\n      terminationGracePeriodSeconds: 10\r\n      containers:\r\n        - name: mongod-container\r\n          image: mongo:3.6\r\n          command:\r\n            - mongod\r\n            - \"--replSet\"\r\n            - rs0\r\n            - \"--bind_ip\"\r\n            - 0.0.0.0\r\n            - \"--smallfiles\"\r\n            - \"--noprealloc\"\r\n            # - \"--auth\"\r\n          ports:\r\n            - containerPort: 27017\r\n          volumeMounts:\r\n            - name: mongo-persistent-storage\r\n              mountPath: /data/db\r\n        - name: mongo-sidecar\r\n          image: cvallance/mongo-k8s-sidecar\r\n          env:\r\n            - name: MONGO_SIDECAR_POD_LABELS\r\n              value: \"role=mongo\"\r\n            - name: KUBERNETES_MONGO_SERVICE_NAME\r\n              value: \"mongodb-service\"\r\n            # - name: MONGODB_USERNAME\r\n            #   value: \"cesco\"\r\n            # - name: MONGODB_PASSWORD\r\n            #   value: \"mypassword\"\r\n            # - name: MONGODB_DATABASE\r\n            #   value: \"admin\"\r\n  volumeClaimTemplates:\r\n  - metadata:\r\n      name: mongo-persistent-storage\r\n      annotations:\r\n        volume.beta.kubernetes.io/storage-class: \"fast\"\r\n    spec:\r\n      accessModes: [ \"ReadWriteOnce\" ]\r\n      resources:\r\n        requests:\r\n          storage: 4Gi\r\n```\r\n\r\nOn the sidecar-log i get\r\n```\r\nDb.prototype.authenticate method will no longer be available in the next major release 3.x as MongoDB 3.6 will only allow auth against users in the admin db and will no longer allow multiple credentials on a socket. Please authenticate using MongoClient.connect with auth credentials.\r\nError in workloop { MongoError: Authentication failed.\r\n    at Function.MongoError.create (/opt/cvallance/mongo-k8s-sidecar/node_modules/mongodb-core/lib/error.js:31:11)\r\n    at /opt/cvallance/mongo-k8s-sidecar/node_modules/mongodb-core/lib/connection/pool.js:497:72\r\n    at authenticateStragglers (/opt/cvallance/mongo-k8s-sidecar/node_modules/mongodb-core/lib/connection/pool.js:443:16)\r\n    at Connection.messageHandler (/opt/cvallance/mongo-k8s-sidecar/node_modules/mongodb-core/lib/connection/pool.js:477:5)\r\n    at Socket.<anonymous> (/opt/cvallance/mongo-k8s-sidecar/node_modules/mongodb-core/lib/connection/connection.js:333:22)\r\n    at Socket.emit (events.js:180:13)\r\n    at addChunk (_stream_readable.js:269:12)\r\n    at readableAddChunk (_stream_readable.js:256:11)\r\n    at Socket.Readable.push (_stream_readable.js:213:10)\r\n    at TCP.onread (net.js:578:20)\r\n  name: 'MongoError',\r\n  message: 'Authentication failed.',\r\n  ok: 0,\r\n  errmsg: 'Authentication failed.',\r\n  code: 18,\r\n  codeName: 'AuthenticationFailed',\r\n  operationTime: Timestamp { _bsontype: 'Timestamp', low_: 1, high_: 1525288116 },\r\n  '$clusterTime': \r\n   { clusterTime: Timestamp { _bsontype: 'Timestamp', low_: 1, high_: 1525288116 },\r\n     signature: { hash: [Binary], keyId: [Long] } } }\r\n```\r\n\r\nI can exec into the mongod-0 pod and run `mongo -u cesco -p mypassword` and log in just right.As well as running `use admin` `db.auth(\"cesco\",\"mypassord\")` I get 1\r\n\r\nLogs show \r\n\r\n```\r\n2018-05-02T19:13:22.851+0000 I ACCESS   [conn12] Unauthorized: not authorized on admin to execute command { replSetHeartbeat: \"rs0\", configVersion: 5, hbv: 1, from: \"mongod-2.mongodb-service.default.svc.cluster.local:27017\", fromId: 2, term: 1, $replData: 1, $clusterTime: { clusterTime: Timestamp(1525288116, 1), signature: { hash: BinData(0, 259E9B3067A93809C76C1DC5B31CA15C0B2814DF), keyId: 6551044020938735618 } }, $db: \"admin\" }\r\n2018-05-02T19:13:23.039+0000 I REPL_HB  [replexec-0] Error in heartbeat (requestId: 817) to mongod-2.mongodb-service.default.svc.cluster.local:27017, response status: Unauthorized: not authorized on admin to execute command { replSetHeartbeat: \"rs0\", configVersion: 5, hbv: 1, from: \"mongod-0.mongodb-service.default.svc.cluster.local:27017\", fromId: 0, term: 1, $replData: 1, $clusterTime: { clusterTime: Timestamp(1525288116, 1), signature: { hash: BinData(0, 259E9B3067A93809C76C1DC5B31CA15C0B2814DF), keyId: 6551044020938735618 } }, $db: \"admin\" }\r\n2018-05-02T19:13:23.063+0000 I NETWORK  [listener] connection accepted from 127.0.0.1:54200 #13 (11 connections now open)\r\n2018-05-02T19:13:23.063+0000 I NETWORK  [conn13] received client metadata from 127.0.0.1:54200 conn13: { driver: { name: \"nodejs\", version: \"2.2.35\" }, os: { type: \"Linux\", name: \"linux\", architecture: \"x64\", version: \"4.4.115-k8s\" }, platform: \"Node.js v9.8.0, LE, mongodb-core: 2.1.19\" }\r\n2018-05-02T19:13:23.064+0000 I ACCESS   [conn13] SCRAM-SHA-1 authentication failed for cesco on admin from client 127.0.0.1:54200 ; UserNotFound: Could not find user cesco@admin\r\n2018-05-02T19:13:23.122+0000 I REPL_HB  [replexec-2] Error in heartbeat (requestId: 819) to mongod-1.mongodb-service.default.svc.cluster.local:27017, response status: Unauthorized: not authorized on admin to execute command { replSetHeartbeat: \"rs0\", configVersion: 5, hbv: 1, from: \"mongod-0.mongodb-service.default.svc.cluster.local:27017\", fromId: 0, term: 1, $replData: 1, $clusterTime: { clusterTime: Timestamp(1525288116, 1), signature: { hash: BinData(0, 259E9B3067A93809C76C1DC5B31CA15C0B2814DF), keyId: 6551044020938735618 } }, $db: \"admin\" }\r\n2018-05-02T19:13:23.191+0000 I ACCESS   [conn6] Unauthorized: not authorized on admin to execute command { replSetHeartbeat: \"rs0\", configVersion: 5, hbv: 1, from: \"mongod-1.mongodb-service.default.svc.cluster.local:27017\", fromId: 1, term: 1, $replData: 1, $clusterTime: { clusterTime: Timestamp(1525288116, 1), signature: { hash: BinData(0, 259E9B3067A93809C76C1DC5B31CA15C0B2814DF), keyId: 6551044020938735618 } }, $db: \"admin\" }\r\n2018-05-02T19:13:23.352+0000 I ACCESS   [conn12] Unauthorized: not authorized on admin to execute command { replSetHeartbeat: \"rs0\", configVersion: 5, hbv: 1, from: \"mongod-2.mongodb-service.default.svc.cluster.local:27017\", fromId: 2, term: 1, $replData: 1, $clusterTime: { clusterTime: Timestamp(1525288116, 1), signature: { hash: BinData(0, 259E9B3067A93809C76C1DC5B31CA15C0B2814DF), keyId: 6551044020938735618 } }, $db: \"admin\" }\r\n2018-05-02T19:13:23.539+0000 I REPL_HB  [replexec-1] Error in heartbeat (requestId: 821) to mongod-2.mongodb-service.default.svc.cluster.local:27017, response status: Unauthorized: not authorized on admin to execute command { replSetHeartbeat: \"rs0\", configVersion: 5, hbv: 1, from: \"mongod-0.mongodb-service.default.svc.cluster.local:27017\", fromId: 0, term: 1, $replData: 1, $clusterTime: { clusterTime: Timestamp(1525288116, 1), signature: { hash: BinData(0, 259E9B3067A93809C76C1DC5B31CA15C0B2814DF), keyId: 6551044020938735618 } }, $db: \"admin\" }\r\n2018-05-02T19:13:23.623+0000 I REPL_HB  [replexec-0] Error in heartbeat (requestId: 823) to mongod-1.mongodb-service.default.svc.cluster.local:27017, response status: Unauthorized: not authorized on admin to execute command { replSetHeartbeat: \"rs0\", configVersion: 5, hbv: 1, from: \"mongod-0.mongodb-service.default.svc.cluster.local:27017\", fromId: 0, term: 1, $replData: 1, $clusterTime: { clusterTime: Timestamp(1525288116, 1), signature: { hash: BinData(0, 259E9B3067A93809C76C1DC5B31CA15C0B2814DF), keyId: 6551044020938735618 } }, $db: \"admin\" }\r\n2018-05-02T19:13:23.692+0000 I ACCESS   [conn6] Unauthorized: not authorized on admin to execute command { replSetHeartbeat: \"rs0\", configVersion: 5, hbv: 1, from: \"mongod-1.mongodb-service.default.svc.cluster.local:27017\", fromId: 1, term: 1, $replData: 1, $clusterTime: { clusterTime: Timestamp(1525288116, 1), signature: { hash: BinData(0, 259E9B3067A93809C76C1DC5B31CA15C0B2814DF), keyId: 6551044020938735618 } }, $db: \"admin\" }\r\n2018-05-02T19:13:23.852+0000 I ACCESS   [conn12] Unauthorized: not authorized on admin to execute command { replSetHeartbeat: \"rs0\", configVersion: 5, hbv: 1, from: \"mongod-2.mongodb-service.default.svc.cluster.local:27017\", fromId: 2, term: 1, $replData: 1, $clusterTime: { clusterTime: Timestamp(1525288116, 1), signature: { hash: BinData(0, 259E9B3067A93809C76C1DC5B31CA15C0B2814DF), keyId: 6551044020938735618 } }, $db: \"admin\" }\r\n2018-05-02T19:13:24.040+0000 I REPL_HB  [replexec-2] Error in heartbeat (requestId: 825) to mongod-2.mongodb-service.default.svc.cluster.local:27017, response status: Unauthorized: not authorized on admin to execute command { replSetHeartbeat: \"rs0\", configVersion: 5, hbv: 1, from: \"mongod-0.mongodb-service.default.svc.cluster.local:27017\", fromId: 0, term: 1, $replData: 1, $clusterTime: { clusterTime: Timestamp(1525288116, 1), signature: { hash: BinData(0, 259E9B3067A93809C76C1DC5B31CA15C0B2814DF), keyId: 6551044020938735618 } }, $db: \"admin\" }\r\n2018-05-02T19:13:24.124+0000 I REPL_HB  [replexec-1] Error in heartbeat (requestId: 827) to mongod-1.mongodb-service.default.svc.cluster.local:27017, response status: Unauthorized: not authorized on admin to execute command { replSetHeartbeat: \"rs0\", configVersion: 5, hbv: 1, from: \"mongod-0.mongodb-service.default.svc.cluster.local:27017\", fromId: 0, term: 1, $replData: 1, $clusterTime: { clusterTime: Timestamp(1525288116, 1), signature: { hash: BinData(0, 259E9B3067A93809C76C1DC5B31CA15C0B2814DF), keyId: 6551044020938735618 } }, $db: \"admin\" }\r\n2018-05-02T19:13:24.193+0000 I ACCESS   [conn6] Unauthorized: not authorized on admin to execute command { replSetHeartbeat: \"rs0\", configVersion: 5, hbv: 1, from: \"mongod-1.mongodb-service.default.svc.cluster.local:27017\", fromId: 1, term: 1, $replData: 1, $clusterTime: { clusterTime: Timestamp(1525288116, 1), signature: { hash: BinData(0, 259E9B3067A93809C76C1DC5B31CA15C0B2814DF), keyId: 6551044020938735618 } }, $db: \"admin\" }\r\n2018-05-02T19:13:24.353+0000 I ACCESS   [conn12] Unauthorized: not authorized on admin to execute command { replSetHeartbeat: \"rs0\", configVersion: 5, hbv: 1, from: \"mongod-2.mongodb-service.default.svc.cluster.local:27017\", fromId: 2, term: 1, $replData: 1, $clusterTime: { clusterTime: Timestamp(1525288116, 1), signature: { hash: BinData(0, 259E9B3067A93809C76C1DC5B31CA15C0B2814DF), keyId: 6551044020938735618 } }, $db: \"admin\" }\r\n2018-05-02T19:13:24.541+0000 I REPL_HB  [replexec-0] Error in heartbeat (requestId: 829) to mongod-2.mongodb-service.default.svc.cluster.local:27017, response status: Unauthorized: not authorized on admin to execute command { replSetHeartbeat: \"rs0\", configVersion: 5, hbv: 1, from: \"mongod-0.mongodb-service.default.svc.cluster.local:27017\", fromId: 0, term: 1, $replData: 1, $clusterTime: { clusterTime: Timestamp(1525288116, 1), signature: { hash: BinData(0, 259E9B3067A93809C76C1DC5B31CA15C0B2814DF), keyId: 6551044020938735618 } }, $db: \"admin\" }\r\n2018-05-02T19:13:24.625+0000 I REPL_HB  [replexec-2] Error in heartbeat (requestId: 831) to mongod-1.mongodb-service.default.svc.cluster.local:27017, response status: Unauthorized: not authorized on admin to execute command { replSetHeartbeat: \"rs0\", configVersion: 5, hbv: 1, from: \"mongod-0.mongodb-service.default.svc.cluster.local:27017\", fromId: 0, term: 1, $replData: 1, $clusterTime: { clusterTime: Timestamp(1525288116, 1), signature: { hash: BinData(0, 259E9B3067A93809C76C1DC5B31CA15C0B2814DF), keyId: 6551044020938735618 } }, $db: \"admin\" }\r\n```\r\n \r\n\r\nWhat I am doing wrong? I need to grant external access to this database, otherwise i would not care about authentication. Help would be very much appreciated "},"comment":{"url":"https://api.github.com/repos/cvallance/mongo-k8s-sidecar/issues/comments/391558462","html_url":"https://github.com/cvallance/mongo-k8s-sidecar/issues/82#issuecomment-391558462","issue_url":"https://api.github.com/repos/cvallance/mongo-k8s-sidecar/issues/82","id":391558462,"user":{"login":"supereagle","id":3390333,"avatar_url":"https://avatars1.githubusercontent.com/u/3390333?v=4","gravatar_id":"","url":"https://api.github.com/users/supereagle","html_url":"https://github.com/supereagle","followers_url":"https://api.github.com/users/supereagle/followers","following_url":"https://api.github.com/users/supereagle/following{/other_user}","gists_url":"https://api.github.com/users/supereagle/gists{/gist_id}","starred_url":"https://api.github.com/users/supereagle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/supereagle/subscriptions","organizations_url":"https://api.github.com/users/supereagle/orgs","repos_url":"https://api.github.com/users/supereagle/repos","events_url":"https://api.github.com/users/supereagle/events{/privacy}","received_events_url":"https://api.github.com/users/supereagle/received_events","type":"User","site_admin":false},"created_at":"2018-05-24T01:29:54Z","updated_at":"2018-05-24T01:29:54Z","author_association":"NONE","body":"> Strange thing I notice is that if I enable auth on the sidecar and not on mongod, the replicas are able to connect,\r\n\r\n@cescoferraro  I meet the same problem, how do you enable auth on the sidecar?"}}
{"actor":{"display_login":"supereagle"}}