LIB-876: Propagate custom users to shard replsets in sharded clusters#16
Merged
Merged
Conversation
Custom users created via spec.users are created through mongos, which stores them on the config server only. Individual shard replica sets have no knowledge of these users, so direct-to-shard connections (e.g. for clusterSuperAdmin) fail with auth errors. Fix: after reconciling users via mongos, iterate over each shard replset and call handleUsers() directly against each shard's primary. This mirrors how system users (users.go) are propagated across all replsets via mongoClientWithRole. Roles are not re-applied to shards — role definitions only exist at the cluster level (config server / mongos) and do not need to be replicated. Bumps version to 1.22.0-4.
- Pin setup-envtest to v0.23.1 matching our controller-runtime version (latest moved to v0.24.1 requiring Go 1.26, CI has 1.25.1) - Update deploy/operator.yaml and deploy/cw-operator.yaml image to perconalab/percona-server-mongodb-operator:main to match CI expectations from 'make manifests VERSION=main'
The @v0.23.1 tag doesn't contain the tools/setup-envtest package as a separate module. Using @release-0.23 branch which is compatible with Go 1.25.1 and contains the correct package structure.
…on change LIB-982 disabled encryption at rest by default for community MongoDB images. The test fixtures still contained --enableEncryption flags and encryption key volume mounts. Regenerated all 9 fixtures to match the current operator behavior.
…encryption change" This reverts commit ec2f49e.
Instead of creating all custom users on every shard, filter to only propagate clusterSuperAdmin which needs direct shard access for platform operations (compaction, backups, monitoring). Other custom users remain cluster-level only and are accessed through mongos.
stuartn
approved these changes
Jul 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix for LIB-876 — custom users (like
clusterSuperAdmin) cannot auth directly to shards in sharded clusters.Problem
Custom users defined in
spec.usersare created via mongos (cluster level), but individual shard nodes maintain their own local admin databases. Direct-to-shard connections fail with auth errors.Solution
After mongos user reconciliation, iterate each shard replset and call
handleUsers()directly against each shard's primary.Changes
pkg/controller/perconaservermongodb/custom_users.go: Add shard iteration looppkg/controller/perconaservermongodb/custom_users_test.go: New testTestReconcileCustomUsers_ShardedPropagationpkg/version/version.txt:1.22.0-3→1.22.0-4Testing
All tests pass ✅