bitnami/mongodb TLS cert generation (#3959)

* chanign * adding TLS settings * adding the ability to generate certs upon chart install for TLS usage * adding the ability to generate certs upon chart install for TLS usage. Changed version * adding the ability to generate certs upon chart install for TLS usage * removing white spaces * removing white spaces * adding the ability to generate certs upon chart install for TLS usage * making PR comment changes * making PR comment changes * making PR comment changes * making PR changes * adding tls to arbiter settings * adding tls settings to replicaset, arbiter and standalone instead of to the values-production and values yaml file * adding tls settings to replicaset, arbiter and standalone instead of to the values-production and values yaml file * adding TLS settings to replicaset, arbiter and standalone instead of to the values-production and values yaml file * made no changes * made no changes to bitnami/moodle * making modifications from reviewers comments * making modifications from reviewers comments * making modifications from reviewers comments * making changes from reviewers additional comments * making changes from reviewers additional comments * making changes from reviewers additional comments * adding reviewer changes * adding latest changes from reviewers additional comments Co-authored-by: Frank Pinto fmpinto <fmpinto@ip-10-114-23-236.evoforge.org> Co-authored-by: EC2 Default User <ec2-user@ip-172-31-48-60.ec2.internal>
2026-08-22 11:35:58 +10:00 · 2020-10-29 11:17:01 +01:00
parent 2ab95350dd
commit 97a6b8613a
10 changed files with 356 additions and 15 deletions
@@ -1,6 +1,6 @@
 apiVersion: v1
 name: mongodb
-version: 9.2.6
+version: 9.3.0
 appVersion: 4.4.1
 description: NoSQL document-oriented database that stores JSON-like documents with dynamic schemas, simplifying the integration of data in content-driven applications.
 keywords:
@@ -169,6 +169,15 @@ The following tables lists the configurable parameters of the MongoDB chart and
 | `extraEnvVars`                            | Extra environment variables to add to MongoDB pods                                                         | `[]`                                                    |
 | `extraEnvVarsCM`                          | Name of existing ConfigMap containing extra env vars                                                       | `nil`                                                   |
 | `extraEnvVarsSecret`                      | Name of existing Secret containing extra env vars (in case of sensitive data)                              | `nil`                                                   |
+| `tls.enabled`                             | Enable MongoDB TLS support between nodes in the cluster as well as between mongo clients and nodes         | `false`                                                 |
+| `tls.image.registry`                      | Init container TLS certs setup image registry (nginx)                                                      | `docker.io`
+             |                                                     
+| `tls.image.repository`                    | Init contianer TLS certs setup image name (nginx)                                                          | `bitnami/nginx`
+             | 
+| `tls.image.tag`                           | Init container TLS certs setup image tag (nginx)                                                           | `{TAG_NAME}`
+             | 
+| `tls.image.pullPolicy`                    | Init container TLS certs setup image pull policy (nginx)                                                   | `Always`
+             | 

 ### MongoDB statefulset parameters

@@ -504,6 +513,26 @@ As the image run as non-root by default, it is necessary to adjust the ownership

 As an alternative, this chart supports using an initContainer to change the ownership of the volume before mounting it in the final destination. You can enable this initContainer by setting `volumePermissions.enabled` to `true`.

+## Enabling SSL/TLS
+
+This container supports enabling SSL/TLS between nodes in the cluster, as well as between mongo clients and nodes, by setting the MONGODB_EXTRA_FLAGS and MONGODB_CLIENT_EXTRA_FLAGS environment variables, together with the correct MONGODB_ADVERTISED_HOSTNAME.
+To enable full TLS encryption set tls.enabled to true
+
+### Generating the self-signed cert via pre install helm hooks
+
+The secrets-ca.yaml utilizes the helm "pre-install" hook to ensure that the certs will only be generated on chart install. The genCA function will create a new self-signed x509 certificate authority, the genSignedCert function creates an object with a pair of items in it — the Cert and Key which we base64 encode and use in a yaml like object. With the genSignedCert function, we pass the CN, an empty IP list (the nil part), the validity and the CA created previously. 
+To hold the signed certificate created above, we can use a kubernetes Secret object and the initContainer sets up the rest.
+Using Helm’s hook annotations ensures that the certs will only be generated on chart install. This will prevent overriding the certs anytime we upgrade the chart’s released instance.
+
+### Accessing the cluster
+
+To access the cluster you will need to enable the initContainer which generates the MongoDB server/client pem needed to access the cluster. Please ensure that you include the $my_hostname section with your actual hostname and alternative hostnames section should contain the hostnames you want to allow access to the MongoDB replicaset. 
+Note: You will be generating self signed certs for the MongoDB deployment. With the initContainer it will generate a new MongoDB private key which will be used to create your own Certificate Authority (CA),the public  cert for the CA will be created, the Certificate Signing Requst will be created as well and signed using the private key of the CA previously created. Finally the PEM bundle will be created using the private key and public certficate. The process will be repeated for each node in the cluster. 
+
+### Starting the cluster
+
+After the certs have been generated and made available to the containers at the correct mount points, the mongod server will be started with TLS enabled. The options for the TLS mode will be (disabled|allowTLS|preferTLS|requireTLS). This value can be changed via the MONGODB_EXTRA_FLAGS field using the tlsMode. The client should now be able to connect to the TLS enabled cluster with the provided certs. 
+
 ## Troubleshooting

 Find more information about how to deal with common errors related to Bitnami’s Helm charts in [this troubleshooting guide](https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues).
@@ -1,6 +1,7 @@
 dependencies:
 - name: common
  repository: https://charts.bitnami.com/bitnami
-  version: 0.8.1
-digest: sha256:ad106a61ddcf8b78033635f756554bda2de59183ca30ef9b6642a392eb832c3a
-generated: "2020-10-12T00:00:59.94799946Z"
+  version: 0.9.0
+digest: sha256:ccf956b06766e5af946354f49211badc949847abf87d355c5d93224b45adf0bb
+generated: "2020-10-22T12:36:27.174429185-04:00"
+
@@ -43,6 +43,13 @@ Return the proper image name (for the init container auto-discovery image)
 {{ include "common.images.image" (dict "imageRoot" .Values.externalAccess.autoDiscovery.image "global" .Values.global) }}
 {{- end -}}

+{{/*
+Return the proper image name (for the TLS Certs image)
+*/}}
+{{- define "mongodb.tls.image" -}}
+{{ include "common.images.image" (dict "imageRoot" .Values.tls.image "global" .Values.global) }}
+{{- end -}}
+
 {{/*
 Return the proper Docker Image Registry Secret Names
 */}}
@@ -54,9 +54,64 @@ spec:
      {{- if .Values.arbiter.podSecurityContext.enabled }}
      securityContext: {{- omit .Values.arbiter.podSecurityContext "enabled" | toYaml | nindent 8 }}
      {{- end }}
-      {{- if .Values.arbiter.initContainers }}
-      initContainers: {{- include "common.tplvalues.render" (dict "value" .Values.arbiter.initContainers "context" $) | nindent 8 }}
-      {{- end }}
+      initContainers: 
+        {{- if .Values.arbiter.initContainers }}
+        {{- include "common.tplvalues.render" (dict "value" .Values.arbiter.initContainers "context" $) | nindent 8 }}
+        {{- end }}
+        {{- if and .Values.tls.enabled .Values.arbiter.enabled }}
+        - name: generate-client
+          image: {{ include "mongodb.tls.image" . }}
+          imagePullPolicy: {{ .Values.tls.image.pullPolicy | quote }}
+          env:
+            - name: MY_POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+          volumeMounts:
+          - name: certs-volume
+            mountPath: /certs/CAs
+          - name: certs
+            mountPath: /certs
+          command:
+            - sh
+            - "-c"
+            - |
+              /bin/bash <<'EOF'
+              my_hostname=$(hostname)
+              svc=$(echo -n "$my_hostname" | sed s/-[0-9]*$//)-headless
+
+              cp /certs/CAs/* /certs/
+
+              cat >/certs/openssl.cnf <<EOL
+              [req]
+              req_extensions = v3_req
+              distinguished_name = req_distinguished_name
+              [req_distinguished_name]
+              [ v3_req ]
+              basicConstraints = CA:FALSE
+              keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+              subjectAltName = @alt_names
+              [alt_names]
+              DNS.1 = $svc
+              DNS.2 = $my_hostname
+              DNS.3 = $my_hostname.$svc.$MY_POD_NAMESPACE.svc.cluster.local
+              DNS.4 = localhost
+              DNS.5 = 127.0.0.1
+              EOL
+ 
+              export RANDFILE=/certs/.rnd && openssl genrsa -out /certs/mongo.key 2048
+              #Create the client/server cert
+              openssl req -new -key /certs/mongo.key -out /certs/mongo.csr -subj "/C=US/O=My Organisations/OU=IT/CN=$my_hostname" -config /certs/openssl.cnf
+              #Signing the server cert with the CA cert and key
+              openssl x509 -req -in /certs/mongo.csr -CA /certs/mongodb-ca-cert -CAkey /certs/mongodb-ca-key -CAcreateserial -out /certs/mongo.crt -days 3650 -extensions v3_req -extfile /certs/openssl.cnf
+              rm /certs/mongo.csr
+              #Concatenate to a pem file for use as the client PEM file which can be used for both member and client authentication.
+              cat /certs/mongo.crt /certs/mongo.key > /certs/mongodb.pem
+              cd /certs/
+              shopt -s extglob
+              rm -rf !(mongodb-ca-cert|mongodb.pem|CAs|openssl.cnf)
+              EOF
+        {{- end }}
      containers:
        - name: mongodb-arbiter
          image: {{ include "mongodb.image" . }}
@@ -105,10 +160,18 @@ spec:
            {{- end }}
            - name: ALLOW_EMPTY_PASSWORD
              value: {{ ternary "no" "yes" .Values.auth.enabled | quote }}
+            {{- if and .Values.tls.enabled .Values.arbiter.enabled }}
+            - name: MONGODB_EXTRA_FLAGS
+              value: --tlsMode=requireTLS --tlsCertificateKeyFile=/certs/mongodb.pem --tlsCAFile=/certs/mongodb-ca-cert
+            {{- end }}
            {{- if .Values.arbiter.extraFlags }}
            - name: MONGODB_EXTRA_FLAGS
              value: {{ .Values.arbiter.extraFlags | join " " | quote }}
            {{- end }}
+            {{- if and .Values.tls.enabled  .Values.arbiter.enabled }}
+            - name: MONGODB_CLIENT_EXTRA_FLAGS
+              value: --tls --tlsCertificateKeyFile=/certs/mongodb.pem --tlsCAFile=/certs/mongodb-ca-cert
+            {{- end }}
            {{- if .Values.arbiter.extraEnvVars }}
            {{- include "common.tplvalues.render" (dict "value" .Values.arbiter.extraEnvVars "context" $) | nindent 12 }}
            {{- end }}
@@ -153,13 +216,17 @@ spec:
          {{- if .Values.arbiter.resources }}
          resources: {{- toYaml .Values.arbiter.resources | nindent 12 }}
          {{- end }}
-          {{- if or .Values.arbiter.configuration .Values.arbiter.existingConfigmap .Values.arbiter.extraVolumeMounts }}
+          {{- if or .Values.arbiter.configuration .Values.arbiter.existingConfigmap .Values.arbiter.extraVolumeMounts .Values.tls.enabled }}
          volumeMounts:
            {{- if or .Values.arbiter.configuration .Values.arbiter.existingConfigmap }}
            - name: config
              mountPath: /opt/bitnami/mongodb/conf/mongodb.conf
              subPath: mongodb.conf
            {{- end }}
+            {{- if and .Values.tls.enabled .Values.arbiter.enabled }}
+            - name: certs
+              mountPath: /certs
+            {{- end }}
            {{- if .Values.arbiter.extraVolumeMounts }}
            {{- toYaml .Values.arbiter.extraVolumeMounts | nindent 12 }}
            {{- end }}
@@ -167,13 +234,27 @@ spec:
        {{- if .Values.arbiter.sidecars }}
        {{- include "common.tplvalues.render" (dict "value" .Values.arbiter.sidecars "context" $) | nindent 8 }}
        {{- end }}
-      {{- if or .Values.arbiter.configuration .Values.arbiter.existingConfigmap .Values.arbiter.extraVolumes }}
+      {{- if or .Values.arbiter.configuration .Values.arbiter.existingConfigmap .Values.arbiter.extraVolumes .Values.tls.enabled }}
      volumes:
        {{- if or .Values.arbiter.configuration .Values.arbiter.existingConfigmap }}
        - name: config
          configMap:
            name: {{ include "mongodb.arbiter.configmapName" . }}
        {{- end }}
+        {{- if and .Values.tls.enabled .Values.arbiter.enabled }}
+        - name: certs
+          emptyDir: {}
+        - name: certs-volume
+          secret:
+            secretName: ca-clients
+            items:
+            - key: mongodb-ca-cert
+              path: mongodb-ca-cert
+              mode: 511
+            - key: mongodb-ca-key
+              path: mongodb-ca-key
+              mode: 511
+        {{- end }}
        {{- if .Values.arbiter.extraVolumes }}
        {{- toYaml .Values.arbiter.extraVolumes | nindent 8 }}
        {{- end }}
@@ -64,7 +64,7 @@ spec:
      {{- if .Values.podSecurityContext.enabled }}
      securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }}
      {{- end }}
-      {{- if or .Values.initContainers (and .Values.volumePermissions.enabled .Values.persistence.enabled) (and .Values.externalAccess.enabled .Values.externalAccess.autoDiscovery.enabled) }}
+      {{- if or .Values.initContainers (and .Values.volumePermissions.enabled .Values.persistence.enabled) (and .Values.externalAccess.enabled .Values.externalAccess.autoDiscovery.enabled) .Values.tls.enabled }}
      initContainers:
        {{- if .Values.initContainers }}
        {{- include "common.tplvalues.render" (dict "value" .Values.initContainers "context" $) | nindent 8 }}
@@ -94,6 +94,58 @@ spec:
            - name: datadir
              mountPath: {{ .Values.persistence.mountPath }}
        {{- end }}
+        {{- if .Values.tls.enabled }}
+        - name: generate-tls-certs
+          image: {{ include "mongodb.tls.image" . }} 
+          imagePullPolicy: {{ .Values.tls.image.pullPolicy | quote }}
+          env:
+            - name: MY_POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+          volumeMounts:
+          - name: certs-volume
+            mountPath: /certs/CAs
+          - name: certs
+            mountPath: /certs
+          command:
+            - sh
+            - "-c"
+            - |
+              /bin/bash <<'EOF'
+              my_hostname=$(hostname)
+              svc=$(echo -n "$my_hostname" | sed s/-[0-9]*$//)-headless
+              cp /certs/CAs/* /certs/
+              cat >/certs/openssl.cnf <<EOL
+              [req]
+              req_extensions = v3_req
+              distinguished_name = req_distinguished_name
+              [req_distinguished_name]
+              [ v3_req ]
+              basicConstraints = CA:FALSE
+              keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+              subjectAltName = @alt_names
+              [alt_names]
+              DNS.1 = $svc
+              DNS.2 = $my_hostname
+              DNS.3 = $my_hostname.$svc.$MY_POD_NAMESPACE.svc.cluster.local
+              DNS.4 = localhost
+              DNS.5 = 127.0.0.1
+              EOL
+
+              export RANDFILE=/certs/.rnd && openssl genrsa -out /certs/mongo.key 2048
+              #Create the client/server certificate
+              openssl req -new -key /certs/mongo.key -out /certs/mongo.csr -subj "/C=US/O=My Organisations/OU=IT/CN=$my_hostname" -config /certs/openssl.cnf
+              #Signing the server certificate with the CA cert and key
+              openssl x509 -req -in /certs/mongo.csr -CA /certs/mongodb-ca-cert -CAkey /certs/mongodb-ca-key -CAcreateserial -out /certs/mongo.crt -days 3650 -extensions v3_req -extfile /certs/openssl.cnf
+              rm /certs/mongo.csr
+              #Concatenate to a pem file for use as the client PEM file which can be used for both member and client authentication. 
+              cat /certs/mongo.crt /certs/mongo.key > /certs/mongodb.pem
+              cd /certs/
+              shopt -s extglob
+              rm -rf !(mongodb-ca-cert|mongodb.pem|CAs|openssl.cnf)
+              EOF
+        {{- end }}
        {{- if and .Values.externalAccess.enabled .Values.externalAccess.autoDiscovery.enabled (eq .Values.externalAccess.service.type "LoadBalancer") }}
        - name: auto-discovery
          image: {{ include "mongodb.externalAccess.autoDiscovery.image" . }}
@@ -196,10 +248,18 @@ spec:
              value: {{ ternary "yes" "no" .Values.enableIPv6 | quote }}
            - name: MONGODB_ENABLE_DIRECTORY_PER_DB
              value: {{ ternary "yes" "no" .Values.directoryPerDB | quote }}
+            {{- if .Values.tls.enabled }}
+            - name: MONGODB_EXTRA_FLAGS
+              value: --tlsMode=requireTLS --tlsCertificateKeyFile=/certs/mongodb.pem --tlsCAFile=/certs/mongodb-ca-cert
+            {{- end }}
            {{- if .Values.extraFlags }}
            - name: MONGODB_EXTRA_FLAGS
              value: {{ .Values.extraFlags | join " " | quote }}
            {{- end }}
+            {{- if .Values.tls.enabled }}
+            - name: MONGODB_CLIENT_EXTRA_FLAGS
+              value: --tls --tlsCertificateKeyFile=/certs/mongodb.pem --tlsCAFile=/certs/mongodb-ca-cert
+            {{- end }}
            {{- if .Values.extraEnvVars }}
            {{- include "common.tplvalues.render" (dict "value" .Values.extraEnvVars "context" $) | nindent 12 }}
            {{- end }}
@@ -221,8 +281,14 @@ spec:
          livenessProbe:
            exec:
              command:
-                - pgrep
-                - mongod
+                - mongo
+              {{- if .Values.tls.enabled }}
+                - --tls
+                - --tlsCertificateKeyFile=/certs/mongodb.pem
+                - --tlsCAFile=/certs/mongodb-ca-cert
+              {{- end }}
+                - --eval
+                - "db.adminCommand('ping')"
            initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }}
            periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
            timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }}
@@ -236,6 +302,11 @@ spec:
            exec:
              command:
                - mongo
+              {{- if .Values.tls.enabled }}
+                - --tls
+                - --tlsCertificateKeyFile=/certs/mongodb.pem
+                - --tlsCAFile=/certs/mongodb-ca-cert
+              {{- end }}
                - --eval
                - "db.adminCommand('ping')"
            initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
@@ -269,6 +340,10 @@ spec:
            - name: shared
              mountPath: /shared
            {{- end }}
+            {{- if .Values.tls.enabled }}
+            - name: certs
+              mountPath: /certs
+            {{- end }}
            {{- if .Values.extraVolumeMounts }}
            {{- toYaml .Values.extraVolumeMounts | nindent 12 }}
            {{- end }}
@@ -351,6 +426,20 @@ spec:
        {{- if .Values.extraVolumes }}
        {{- toYaml .Values.extraVolumes | nindent 8 }}
        {{- end }}
+        {{- if .Values.tls.enabled }}
+        - name: certs
+          emptyDir: {}
+        - name: certs-volume
+          secret:
+            secretName: ca-clients
+            items:
+            - key: mongodb-ca-cert
+              path: mongodb-ca-cert
+              mode: 511
+            - key: mongodb-ca-key
+              path: mongodb-ca-key
+              mode: 511
+        {{- end }}
  {{- if not .Values.persistence.enabled }}
        - name: datadir
          emptyDir: {}
@@ -0,0 +1,21 @@
+{{- if .Values.tls.enabled -}}
+{{- $cn := printf "%s.%s.svc.cluster.local" ( include "mongodb.fullname" . ) .Release.Namespace }}
+{{- $ca := genCA "myMongo-ca" 3650 -}}
+{{- $cert := genSignedCert $cn nil nil 3650 $ca -}}
+{{- $pem := printf "%s%s" $cert.Cert $cert.Key -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ca-clients
+  namespace: {{ template "mongodb.namespace" . }}
+  annotations:
+    "helm.sh/hook": "pre-install"
+  labels:
+   {{- include "common.labels.standard" . | nindent 4 }}
+    app.kubernetes.io/component: mongodb
+type: Opaque
+data:
+  mongodb-ca-cert: {{ b64enc $ca.Cert }}
+  mongodb-ca-key: {{ b64enc $ca.Key }}
+  client-pem: {{ b64enc $pem }}
+{{- end -}}
@@ -63,7 +63,7 @@ spec:
      {{- if .Values.podSecurityContext.enabled }}
      securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }}
      {{- end }}
-      {{- if or .Values.initContainers (and .Values.volumePermissions.enabled .Values.persistence.enabled) }}
+      {{- if or .Values.initContainers (and .Values.volumePermissions.enabled .Values.persistence.enabled) .Values.tls.enabled }}
      initContainers:
        {{- if .Values.initContainers }}
        {{- include "common.tplvalues.render" (dict "value" .Values.initContainers "context" $) | nindent 8 }}
@@ -93,6 +93,58 @@ spec:
            - name: datadir
              mountPath: {{ .Values.persistence.mountPath }}
        {{- end }}
+        {{- if .Values.tls.enabled }}
+        - name: generate-tls-certs
+          image: {{ include "mongodb.tls.image" . }}
+          imagePullPolicy: {{ .Values.tls.image.pullPolicy | quote }}
+          env:
+            - name: MY_POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+          volumeMounts:
+          - name: certs-volume
+            mountPath: /certs/CAs
+          - name: certs
+            mountPath: /certs
+          command:
+            - sh
+            - "-c"
+            - |
+              /bin/bash <<'EOF'
+              my_hostname=$(hostname)
+              svc=$(echo -n "$my_hostname" | sed s/-[0-9]*$//)-headless
+              cp /certs/CAs/* /certs/
+              cat >/certs/openssl.cnf <<EOL
+              [req]
+              req_extensions = v3_req
+              distinguished_name = req_distinguished_name
+              [req_distinguished_name]
+              [ v3_req ]
+              basicConstraints = CA:FALSE
+              keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+              subjectAltName = @alt_names
+              [alt_names]
+              DNS.1 = $svc
+              DNS.2 = $my_hostname
+              DNS.3 = $my_hostname.$svc.$MY_POD_NAMESPACE.svc.cluster.local
+              DNS.4 = localhost
+              DNS.5 = 127.0.0.1
+              EOL
+
+              export RANDFILE=/certs/.rnd && openssl genrsa -out /certs/mongo.key 2048
+              #Create the client/server cert
+              openssl req -new -key /certs/mongo.key -out /certs/mongo.csr -subj "/C=US/O=My Organisations/OU=IT/CN=$my_hostname" -config /certs/openssl.cnf
+              #Signing the server cert with the CA cert and key
+              openssl x509 -req -in /certs/mongo.csr -CA /certs/mongodb-ca-cert -CAkey /certs/mongodb-ca-key -CAcreateserial -out /certs/mongo.crt -days 3650 -extensions v3_req -extfile /certs/openssl.cnf
+              rm /certs/mongo.csr
+              #Concatenate to a pem file for use as the client PEM file which can be used for both member and client authentication.
+              cat /certs/mongo.crt /certs/mongo.key > /certs/mongodb.pem
+              cd /certs/
+              shopt -s extglob
+              rm -rf !(mongodb-ca-cert|mongodb.pem|CAs|openssl.cnf)
+              EOF
+        {{- end }}
      {{- end }}
      containers:
        - name: mongodb
@@ -142,10 +194,18 @@ spec:
              value: {{ ternary "yes" "no" .Values.enableIPv6 | quote }}
            - name: MONGODB_ENABLE_DIRECTORY_PER_DB
              value: {{ ternary "yes" "no" .Values.directoryPerDB | quote }}
+            {{- if .Values.tls.enabled }}
+            - name: MONGODB_EXTRA_FLAGS
+              value: --tlsMode=requireTLS --tlsCertificateKeyFile=/certs/mongodb.pem --tlsCAFile=/certs/mongodb-ca-cert
+            {{- end }}
            {{- if .Values.extraFlags }}
            - name: MONGODB_EXTRA_FLAGS
              value: {{ .Values.extraFlags | join " " | quote }}
            {{- end }}
+            {{- if .Values.tls.enabled }}
+            - name: MONGODB_CLIENT_EXTRA_FLAGS
+              value: --tls --tlsCertificateKeyFile=/certs/mongodb.pem --tlsCAFile=/certs/mongodb-ca-cert
+            {{- end }}
            {{- if .Values.extraEnvVars }}
            {{- include "common.tplvalues.render" (dict "value" .Values.extraEnvVars "context" $) | nindent 12 }}
            {{- end }}
@@ -167,8 +227,14 @@ spec:
          livenessProbe:
            exec:
              command:
-                - pgrep
-                - mongod
+                - mongo
+              {{- if .Values.tls.enabled }}
+                - --tls
+                - --tlsCertificateKeyFile=/certs/mongodb.pem
+                - --tlsCAFile=/certs/mongodb-ca-cert
+              {{- end }}
+                - --eval
+                - "db.adminCommand('ping')"
            initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }}
            periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
            timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }}
@@ -182,6 +248,11 @@ spec:
            exec:
              command:
                - mongo
+              {{- if .Values.tls.enabled }}
+                - --tls
+                - --tlsCertificateKeyFile=/certs/mongodb.pem
+                - --tlsCAFile=/certs/mongodb-ca-cert
+              {{- end }}
                - --eval
                - "db.adminCommand('ping')"
            initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
@@ -208,6 +279,10 @@ spec:
              mountPath: /opt/bitnami/mongodb/conf/mongodb.conf
              subPath: mongodb.conf
            {{- end }}
+            {{- if .Values.tls.enabled }}
+            - name: certs
+              mountPath: /certs
+            {{- end }}
            {{- if .Values.extraVolumeMounts }}
            {{- toYaml .Values.extraVolumeMounts | nindent 12 }}
            {{- end }}
@@ -282,6 +357,20 @@ spec:
        {{- if .Values.extraVolumes }}
        {{- toYaml .Values.extraVolumes | nindent 8 }}
        {{- end }}
+        {{- if .Values.tls.enabled }}
+        - name: certs
+          emptyDir: {}
+        - name: certs-volume
+          secret:
+            secretName: ca-clients
+            items:
+            - key: mongodb-ca-cert
+              path: mongodb-ca-cert
+              mode: 511
+            - key: mongodb-ca-key
+              path: mongodb-ca-key
+              mode: 511
+        {{- end }}
  {{- if not .Values.persistence.enabled }}
        - name: datadir
          emptyDir: {}
@@ -89,6 +89,18 @@ auth:
  ##
  # existingSecret: name-of-existing-secret

+tls:
+ ## Enable or disable MongoDB TLS Support 
+  enabled: false
+ ##
+ ## Bitnami Nginx image
+ ##
+  image:
+    registry: docker.io
+    repository: bitnami/nginx
+    tag: 1.19.3
+    pullPolicy: IfNotPresent
+
 ## Name of the replica set
 ## Ignored when mongodb.architecture=standalone
 ##
@@ -89,6 +89,18 @@ auth:
  ##
  # existingSecret: name-of-existing-secret

+tls:
+ ## Enable or disable MongoDB TLS Support
+  enabled: false
+ ##
+ ## Bitnami Nginx image
+ ##
+  image:
+    registry: docker.io
+    repository: bitnami/nginx
+    tag: 1.19.3
+    pullPolicy: IfNotPresent
+
 ## Name of the replica set
 ## Ignored when mongodb.architecture=standalone
 ##