RUBY-3800 Add test variant for the Atlas Secure Frontend Processor (SFP)#3080
Draft
comandeo-mongo wants to merge 3 commits into
Draft
RUBY-3800 Add test variant for the Atlas Secure Frontend Processor (SFP)#3080comandeo-mongo wants to merge 3 commits into
comandeo-mongo wants to merge 3 commits into
Conversation
Add SFP (monguard) connectivity tests that run against a preconfigured Atlas cluster proxied by a Secure Frontend Processor. The tests cover unauthenticated, SCRAM-SHA-256, and X.509 access, each authenticated case under baseline, compression, and Server API v1 variations, per the atlas-sfp-testing specification. Add a dedicated Evergreen "sfp" build variant with a test-sfp task that fetches credentials from the drivers/sfp secrets vault and runs the new spec/sfp suite.
The SFP proxy closes certless TLS handshakes on SFP_ATLAS_URI with "SSL_read: unexpected eof", while X.509 connections (which present a client certificate) succeed. Present the certificate at the TLS layer for the unauthenticated and SCRAM connections too, with the auth mechanism unchanged, to confirm whether the proxy requires mutual TLS for all connections. This is a diagnostic, not a final fix.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds connectivity tests for the Atlas Secure Frontend Processor (SFP, aka monguard), a proxy that sits in front of Atlas clusters. Test-only; no driver source changes. Implements the
atlas-sfp-testingspecification, mirroring the C driver reference (mongodb/mongo-c-driver#2330).The suite runs against a preconfigured Atlas SFP cluster and is driven by
SFP_ATLAS_*environment variables. It covers:Each run uses a unique
sfp_test_<ObjectId>collection that is dropped afterward.Files
Tests:
spec/sfp/sfp_spec.rb— the SFP test matrix (self-skips unlessSFP_TESTINGis set)Evergreen:
.evergreen/run-tests-sfp.sh— runner; sourcessecrets-export.shfrom thedrivers/sfpvault.evergreen/config/common.yml.erb—export SFP credentialsandrun SFP testsfunctions,test-sfptask.evergreen/config/standard.yml.erb—sfpbuild-variant matrix.evergreen/config.yml— regenerated viarake egTest plan
bundle exec rubocop spec/sfp/sfp_spec.rb— no offensesbundle exec rspec spec/sfpagainst the local cluster — 20 examples, 0 failures, 20 pending (correctly skipped without a live SFP cluster)rake egregeneratesconfig.yml; verified thetest-sfptask, both functions, and thesfpvariant are presentsfpEvergreen variant against the live cluster (requires thedrivers/sfpcredentials in CI)Jira
https://jira.mongodb.org/browse/RUBY-3800