Skip to content

fix(mongodb): surface per-user credentials to the tenant - #2860

Closed
Andrei Kvapil (kvaps) wants to merge 1 commit into
cozystack:mainfrom
kvaps:fix/mongodb-per-user-tenant-secrets
Closed

fix(mongodb): surface per-user credentials to the tenant#2860
Andrei Kvapil (kvaps) wants to merge 1 commit into
cozystack:mainfrom
kvaps:fix/mongodb-per-user-tenant-secrets

Conversation

@kvaps

@kvaps Andrei Kvapil (kvaps) commented Jun 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

What this PR does

MongoDB exposes each managed user's password as a separate
<release>-user-<user> secret, but the mongodb-rd cozyrd only included
the cluster <release>-credentials secret (the databaseAdmin pair) in
its secrets.include rules. As a result the lineage controller never
stamped internal.cozystack.io/tenantresource=true on the per-user
secrets, so a provisioned user's password was invisible to the tenant and
to anything reading the core.cozystack.io TenantSecret projection.

This labels each per-user secret apps.cozystack.io/user-secret=true and
adds a matching matchLabels include rule to the cozyrd — the same
pattern the bucket chart already uses for its per-user S3 credentials. A
username field is also added so the forwarded secret is self-describing
instead of relying on the secret-name suffix.

helm-unittest for the mongodb chart is green (94 tests).

Release note

fix(mongodb): expose per-user credentials as tenant secrets so a managed user's password is visible to the tenant

Related

Found while building the cozyportal managed-services integration, where per-user credentials are surfaced to the portal user:

  • aenix-org/cozyportal#867 — portal apiserver (credentials subresource)
  • aenix-org/cozyportal-ui#188 — console UI consuming the credentials

@kvaps @claude
fix(mongodb): surface per-user credentials to the tenant
51e9604 
The mongodb-rd cozyrd only included the cluster <release>-credentials
secret (the databaseAdmin pair), so the lineage controller never stamped
internal.cozystack.io/tenantresource=true on the per-user
<release>-user-<user> secrets. They stayed invisible to the tenant and to
any consumer reading the core.cozystack.io TenantSecret projection, so a
provisioned user's password could not be surfaced.

Label each per-user secret apps.cozystack.io/user-secret=true and add a
matching include rule to the cozyrd, mirroring the bucket chart. Also add
username to the secret so the credential is self-describing rather than
relying on the secret-name suffix.

Co-Authored-By: Claude <[email protected]>
Signed-off-by: Andrei Kvapil <[email protected]>
@github-actions github-actions Bot added area/uncategorized PR auto-labeler could not map title scope to a known area/*; please review size/S This PR changes 10-29 lines, ignoring generated files kind/bug Categorizes issue or PR as related to a bug labels Jun 9, 2026
@coderabbitai

coderabbitai Bot commented Jun 9, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 6de6ccc6-64a2-422a-ba97-466b50e92785

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@lexfrei Aleksei Sviridkin (lexfrei) added area/database Issues or PRs related to managed databases (postgres, mariadb, redis, etcd, kafka, clickhouse) and removed area/uncategorized PR auto-labeler could not map title scope to a known area/*; please review labels Jul 1, 2026
@myasnikovdaniil myasnikovdaniil mentioned this pull request Aug 14, 2026
Open
28 of 48 tasks
@github-actions

github-actions Bot commented Aug 31, 2026

Copy link
Copy Markdown

This PR has had no activity for 60 days and was marked lifecycle/stale.
It will be closed in 14 days unless commented or labelled lifecycle/frozen.

@github-actions github-actions Bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale label Aug 31, 2026
@github-actions

github-actions Bot commented Sep 14, 2026

Copy link
Copy Markdown

Closed because no activity followed the lifecycle/stale warning.
Reopen if the change is still wanted.

@github-actions github-actions Bot added the lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed label Sep 14, 2026
@github-actions github-actions Bot closed this Sep 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lllamnyp Timofei Larkin (lllamnyp) Awaiting requested review from lllamnyp lllamnyp will be requested when the pull request is marked ready for review lllamnyp is a code owner
@lexfrei Aleksei Sviridkin (lexfrei) Awaiting requested review from lexfrei lexfrei will be requested when the pull request is marked ready for review lexfrei is a code owner
@myasnikovdaniil myasnikovdaniil Awaiting requested review from myasnikovdaniil myasnikovdaniil will be requested when the pull request is marked ready for review myasnikovdaniil is a code owner
@IvanHunters IvanHunters Awaiting requested review from IvanHunters IvanHunters will be requested when the pull request is marked ready for review IvanHunters is a code owner
@matthieu-robin Matthieu ROBIN (matthieu-robin) Awaiting requested review from matthieu-robin matthieu-robin will be requested when the pull request is marked ready for review matthieu-robin is a code owner
@scooby87 scooby87 Awaiting requested review from scooby87 scooby87 will be requested when the pull request is marked ready for review scooby87 is a code owner

Assignees

No one assigned

Labels

area/database Issues or PRs related to managed databases (postgres, mariadb, redis, etcd, kafka, clickhouse) kind/bug Categorizes issue or PR as related to a bug lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale size/S This PR changes 10-29 lines, ignoring generated files

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@kvaps @lexfrei